@clawos-dev/clawd 0.2.511 → 0.2.513

package/dist/app-builder-plugin/mcp-server.cjs

@@ -3227,8 +3227,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path) {
-      let input = path;
+    function removeDotSegments(path4) {
+      let input = path4;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3480,8 +3480,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path && path !== "/" ? path : void 0;
+        const [path4, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path4 && path4 !== "/" ? path4 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -4453,13 +4453,13 @@ var require_core = __commonJS({
     }, warn() {
     }, error() {
     } };
-    function getLogger(logger) {
-      if (logger === false)
+    function getLogger(logger2) {
+      if (logger2 === false)
         return noLogs;
-      if (logger === void 0)
+      if (logger2 === void 0)
         return console;
-      if (logger.log && logger.warn && logger.error)
-        return logger;
+      if (logger2.log && logger2.warn && logger2.error)
+        return logger2;
       throw new Error("logger must implement log, warn and error methods");
     }
     var KEYWORD_NAME = /^[a-z_$][a-z0-9_$:-]*$/i;
@@ -6874,12 +6874,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs3, exportName) {
+    function addFormats(ajv, list, fs7, exportName) {
       var _a;
       var _b;
       (_a = (_b = ajv.opts.code).formats) !== null && _a !== void 0 ? _a : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs3[f]);
+        ajv.addFormat(f, fs7[f]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -6894,15 +6894,11 @@ __export(mcp_server_exports, {
   handleListProjects: () => handleListProjects,
   handlePublish: () => handlePublish,
   handleRemoveProject: () => handleRemoveProject,
-  handleReportStage: () => handleReportStage,
-  handleSetProdUrl: () => handleSetProdUrl,
-  handleStartDevServer: () => handleStartDevServer,
-  handleUpdateProjectPort: () => handleUpdateProjectPort,
   readEnv: () => readEnv,
   registerTools: () => registerTools
 });
 module.exports = __toCommonJS(mcp_server_exports);
-var import_node_fs3 = __toESM(require("fs"), 1);
+var import_node_fs4 = __toESM(require("fs"), 1);
 
 // ../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -7382,8 +7378,8 @@ function getErrorMap() {
 
 // ../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path, errorMaps, issueData } = params;
-  const fullPath = [...path, ...issueData.path || []];
+  const { data, path: path4, errorMaps, issueData } = params;
+  const fullPath = [...path4, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -7499,11 +7495,11 @@ var errorUtil;
 
 // ../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path, key) {
+  constructor(parent, value, path4, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path;
+    this._path = path4;
     this._key = key;
   }
   get path() {
@@ -11140,10 +11136,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path) {
-  if (!path)
+function getElementAtPath(obj, path4) {
+  if (!path4)
     return obj;
-  return path.reduce((acc, key) => acc?.[key], obj);
+  return path4.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11463,11 +11459,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path, issues) {
+function prefixIssues(path4, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path);
+    iss.path.unshift(path4);
     return iss;
   });
 }
@@ -21116,11 +21112,6 @@ var StdioServerTransport = class {
   }
 };
 
-// src/app-builder-plugin/project-store.ts
-var import_node_fs = require("fs");
-var import_node_child_process = require("child_process");
-var import_node_path = require("path");
-
 // ../protocol/src/attachment-schemas.ts
 var TOKEN_ROLES = ["owner"];
 var GROUP_FILE_SOURCES = ["agent", "owner", "user-upload"];
@@ -21532,6 +21523,7 @@ var DeployFinishScanArgsSchema = external_exports.object({
   personaId: external_exports.string().min(1),
   notes: external_exports.array(external_exports.string()).default([])
 }).strict();
+var PERSONA_REPO_ORG = "ottin4ttc";
 
 // ../protocol/src/contact-remote-access.ts
 var ContactSetRemoteAccessArgsSchema = external_exports.object({
@@ -22919,10 +22911,6 @@ var SessionFileSchema = external_exports.object({
    * 本机资源指针——mirror 上与 ownerPersonaId 同地点 strip（#750 防线）。
    */
   projectPath: external_exports.string().min(1).optional(),
-  // app-builder Project 反向索引（spec: superpowers/specs/2026-06-01-app-builder-project-picker-design.md）。
-  // 当此 session 绑定到某个 build 中的 project 时填写；name 与 projects/<name>/ 子目录同名，
-  // 受 projectNameSchema regex 约束。daemon session:resume 时校验该目录存在，不存在则拒。
-  appBuilderProject: external_exports.string().regex(/^[a-z][a-z0-9-]{0,39}$/).optional(),
   // listener-mode sub-session 的原始 chatId（owner-mode 不写；listener-scope 强制写入）。
   // 派生 sessionId 是单向 hash `${personaId}-${tokenHash12}-${chatHash8}`，必须保留原始 chatId
   // 才能让 alice 重连同一 sub-session（持久化在 alice localStorage 之外，由 daemon push 同步）。
@@ -23257,10 +23245,6 @@ var SessionCreateArgs = external_exports.object({
   // owner-mode persona session：传此字段时 daemon 自行派生 cwd 和启动参数，
   // 且按 ownerPersonaId 做 idempotent dedupe（每 persona 永远只有一个 owner session）
   ownerPersonaId: external_exports.string().min(1).optional(),
-  // 单栏默认 refactor (spec 2026-06-02)：appBuilderProject 字段已从 SessionCreateArgs 砍掉。
-  // 绑定路径收敛到 appBuilder:createProject —— 先创建空 session（仅传 ownerPersonaId=persona-app-builder），
-  // 后通过 createProject RPC 创建 project 并 daemon 内部 mutate 写入 appBuilderProject。
-  // SessionFile schema 仍保留该字段供 daemon 内部 mutate（manager.update 内部调用通道）。
   /**
    * 新建会话选择的 project（spec 2026-08-17-projects-sidebar §4.2）：
    * - 单独出现：daemon 以它为 cwd（等价传 cwd）
@@ -23347,9 +23331,6 @@ var SessionUpdateArgs = external_exports.object({
     // 从所有 sidebar 消费者视野消失（App.visibleSessions / buildSessionTree），用户看不见
     // 也删不掉，再被 sweepEphemeralOnStartup 静默删除——数据丢失级别的口子。
     ephemeral: external_exports.literal(false).optional()
-    // 注意：appBuilderProject 字段已从 patch 中砍掉（spec 2026-06-02-app-builder-single-pane-default-design）。
-    // 绑定单向不可变 —— 由 appBuilder:createProject 在 daemon 内部一次写入；UI / assistant 不再
-    // 通过 sessionUpdate 修改这个字段。SessionFile 仍保留 appBuilderProject 字段供 daemon 内部 mutate。
   })
 });
 var QueuedMessage = external_exports.object({
@@ -23696,189 +23677,6 @@ var InfoResponseSchema = external_exports.object({
    *  探测见 daemon/src/cli-probe/probe.ts。旧 daemon 不发 → undefined。 */
   globalCliVersion: external_exports.string().nullable().optional()
 });
-var PROJECT_PORT_MIN = 6173;
-var PROJECT_PORT_MAX = 6272;
-var projectNameRegex = /^[a-z][a-z0-9-]{0,39}$/;
-var DEFAULT_DEV_COMMAND = "cd server && pnpm dev";
-var ProjectMetadataSchema = external_exports.object({
-  name: external_exports.string().regex(projectNameRegex, {
-    message: "kebab-case, \u5C0F\u5199\u5B57\u6BCD\u5F00\u5934\uFF0C\u53EA\u5141\u8BB8\u5C0F\u5199\u5B57\u6BCD / \u6570\u5B57 / -\uFF0C\u6700\u957F 40 \u5B57\u7B26"
-  }),
-  port: external_exports.number().int().min(PROJECT_PORT_MIN).max(PROJECT_PORT_MAX),
-  createdAt: external_exports.string().datetime(),
-  /** dev server 启动命令（shell 字符串）；占位符 $CLAWD_PREVIEW_PORT 替换 + env 注入 */
-  devCommand: external_exports.string().min(1),
-  /**
-   * 发布上线后的公网 URL（spec 2026-06-02-app-builder-single-pane-default-design §5.6.1）。
-   * assistant 跑完 publish.sh 后调 appBuilder:setProdUrl 写入；UI 读这个字段切预览栏到线上 URL，
-   * 取代旧 `<builder-preview url=... label="prod" />` marker 机制。
-   * 老 project 元数据无此字段（optional 兼容）。
-   */
-  prodUrl: external_exports.string().url().optional(),
-  /**
-   * dev server 就绪 stdout regex（spec 2026-06-02-app-builder-explicit-dev-server-control §2）。
-   * supervisor spawn 后会监听子进程 stdout，命中此 regex 视为 dev server 真 ready；
-   * 仅当 await ready 后才把 stage 切到 'running'，避免 cold start race 导致 iframe 502。
-   * optional：缺省时 supervisor 用默认 /Local:\s+https?:\/\//（vite "Local: http://..." 输出）。
-   * 老板换非 vite 技术栈（Next.js "Ready in"、webpack "Compiled" 等）时自定义这个字段。
-   */
-  readyPattern: external_exports.string().optional(),
-  /**
-   * 发布上线脚手架化 (spec 2026-06-03-app-builder-publish-scaffold-design §5.1.4)：
-   * in-flight 发布 job 的元数据。仅承载"in-flight"或"中断残骸"两种状态：
-   *   - daemon spawn publish.sh + 收到第一个 ::stage::build marker 时写入
-   *   - 每次 stage 切换更新 stage 字段
-   *   - 成功 / 正常失败 / 用户 dismiss 时立即清掉
-   *   - 只有 daemon 崩才会留残骸（子进程随 daemon 一起死）
-   * status 字段在 ProjectWithStatus 派生而不在这里 —— 本 schema 是落盘形态，
-   * "in-flight vs interrupted" 区分由 daemon 响应时实时拼 registry 状态得出。
-   */
-  publishJob: external_exports.object({
-    jobId: external_exports.string().min(1),
-    stage: external_exports.enum(["build", "deploy", "verify"]),
-    startedAt: external_exports.number().int().nonnegative()
-  }).optional()
-});
-var PROJECT_STAGE_VALUES = [
-  "install-pending",
-  // createProject 刚返回，scaffold 已完成（daemon 同步内联跑），等 assistant pnpm install
-  "installing",
-  // assistant pnpm install 中
-  "starting-dev-server",
-  // startDevServer 已调，supervisor spawn 子进程中（await ready 期间也在此 stage）
-  "running",
-  // dev server 跑起来了（supervisor stdout 命中 readyPattern + 端口已监听）
-  "stopped",
-  // 用户显式点"收起预览"停掉 / daemon 重启后默认；UI 渲染折叠条 + "展开预览"按钮
-  "failed"
-  // 某个阶段失败（stageReason 字段携带原因，含 dev server cold start timeout）
-];
-var ProjectStageSchema = external_exports.enum(PROJECT_STAGE_VALUES);
-var ProjectWithStatusSchema = ProjectMetadataSchema.extend({
-  isRunning: external_exports.boolean(),
-  boundSessionId: external_exports.string().nullable(),
-  /**
-   * 单栏 refactor stage fix (spec 2026-06-02 §5.6.2)：daemon 内存维护的当前 stage。
-   * UI 据此切 PreviewPane spinner / iframe / error。
-   * optional 兼容启动后 daemon 还没有 stage 记录的 fresh project（按 isRunning 推断兜底）。
-   */
-  stage: ProjectStageSchema.optional(),
-  /** stage='failed' 时携带失败原因 */
-  stageReason: external_exports.string().optional(),
-  /**
-   * 发布上线脚手架化 (spec 2026-06-03-app-builder-publish-scaffold-design §5.1.3)：
-   * ProjectMetadata.publishJob 的 status 派生版。daemon 响应时按以下规则实时拼装：
-   *   - 落盘字段存在 + PublishJobRegistry 有匹配 jobId → 'in-flight'
-   *   - 落盘字段存在 + Registry 无匹配（jobId 对不上或 entry 缺失）→ 'interrupted'（daemon 崩残骸）
-   *   - 落盘字段不存在 → undefined（字段省略）
-   * UI 用 status 决定 PreviewPane 渲染分支（in-flight 三段 checklist / interrupted 恢复条）。
-   */
-  publishJob: external_exports.object({
-    jobId: external_exports.string().min(1),
-    stage: external_exports.enum(["build", "deploy", "verify"]),
-    startedAt: external_exports.number().int().nonnegative(),
-    status: external_exports.enum(["in-flight", "interrupted"])
-  }).optional()
-});
-var ListProjectsArgsSchema = external_exports.object({}).strict();
-var ListProjectsResultSchema = external_exports.object({
-  projects: external_exports.array(ProjectWithStatusSchema)
-}).strict();
-var GetProjectArgsSchema = external_exports.object({
-  sessionId: external_exports.string().min(1)
-}).strict();
-var GetProjectResultSchema = external_exports.object({
-  /** session 未绑 project / project 不存在时为 null（UI 走单栏 / 折叠） */
-  project: ProjectWithStatusSchema.nullable()
-}).strict();
-var CreateProjectArgsSchema = external_exports.object({
-  /** 必填：caller session，daemon 自动绑过去（spec 2026-06-02 §3 invariant 1 Session ↔ 1 Project） */
-  sessionId: external_exports.string().min(1),
-  // .min(1)：改造前手写校验是 `!f.name` 明确拒空串；空 name 会让 projectDir('')
-  // 落到 projects 根目录，scaffold 往根上铺模板。
-  name: external_exports.string().min(1)
-}).strict();
-var CreateProjectResultSchema = external_exports.object({
-  project: ProjectMetadataSchema
-}).strict();
-var DeleteProjectArgsSchema = external_exports.object({
-  name: external_exports.string()
-}).strict();
-var DeleteProjectResultSchema = external_exports.object({}).strict();
-var UpdateProjectPortArgsSchema = external_exports.object({
-  name: external_exports.string(),
-  newPort: external_exports.number().int()
-}).strict();
-var UpdateProjectPortResultSchema = external_exports.object({
-  project: ProjectMetadataSchema
-}).strict();
-var SetProdUrlArgsSchema = external_exports.object({
-  name: external_exports.string().regex(projectNameRegex),
-  url: external_exports.string().url()
-}).strict();
-var SetProdUrlResultSchema = external_exports.object({
-  project: ProjectMetadataSchema
-}).strict();
-var StartDevServerArgsSchema = external_exports.object({
-  sessionId: external_exports.string().min(1),
-  force: external_exports.boolean().optional()
-}).strict();
-var StartDevServerResultSchema = external_exports.object({
-  project: ProjectMetadataSchema
-}).strict();
-var ASSISTANT_REPORTABLE_STAGES = [
-  "installing",
-  "failed"
-];
-var ReportStageArgsSchema = external_exports.object({
-  sessionId: external_exports.string().min(1),
-  stage: external_exports.enum(ASSISTANT_REPORTABLE_STAGES),
-  /** stage='failed' 时必填的原因（一句话），其它 stage optional */
-  reason: external_exports.string().optional()
-}).strict();
-var ReportStageResultSchema = external_exports.object({
-  ok: external_exports.literal(true)
-}).strict();
-var StopDevServerArgsSchema = external_exports.object({
-  sessionId: external_exports.string().min(1)
-}).strict();
-var StopDevServerResultSchema = external_exports.object({
-  ok: external_exports.literal(true)
-}).strict();
-var AppBuilderProjectUpdatedEventSchema = external_exports.object({
-  type: external_exports.literal("appBuilder:project-updated"),
-  project: ProjectWithStatusSchema,
-  stage: ProjectStageSchema,
-  /** stage='failed' 时的失败原因 */
-  stageReason: external_exports.string().optional()
-}).strict();
-var PublishArgsSchema = external_exports.object({
-  name: external_exports.string().regex(projectNameRegex)
-});
-var PublishResultSchema = external_exports.object({
-  jobId: external_exports.string().min(1),
-  status: external_exports.enum(["started", "already-publishing"])
-}).strict();
-var DismissPublishJobArgsSchema = external_exports.object({
-  name: external_exports.string().regex(projectNameRegex)
-});
-var DismissPublishJobResultSchema = external_exports.object({
-  ok: external_exports.literal(true)
-}).strict();
-var AppBuilderPublishProgressEventSchema = external_exports.object({
-  type: external_exports.literal("appBuilder:publish-progress"),
-  name: external_exports.string().regex(projectNameRegex),
-  jobId: external_exports.string().min(1),
-  stage: external_exports.enum(["build", "deploy", "verify"]),
-  status: external_exports.enum(["started", "completed"])
-}).strict();
-var AppBuilderPublishFailedEventSchema = external_exports.object({
-  type: external_exports.literal("appBuilder:publish-failed"),
-  name: external_exports.string().regex(projectNameRegex),
-  jobId: external_exports.string().min(1),
-  stage: external_exports.enum(["build", "deploy", "verify", "unknown"]),
-  errorSummary: external_exports.string()
-}).strict();
 
 // ../protocol/src/methods.ts
 var NO_ARGS = external_exports.object({});
@@ -23914,7 +23712,7 @@ var METHOD_DOCS = {
     args: SessionUpdateArgs
   },
   "session:delete": {
-    summary: "\u5220\u4F1A\u8BDD\uFF1A\u505C\u8FDB\u7A0B + \u5220 SessionFile\uFF0C\u5E76\u8054\u52A8\u6E05\u7406\u7ED1\u5B9A\u7684 app-builder project",
+    summary: "\u5220\u4F1A\u8BDD\uFF1A\u505C\u8FDB\u7A0B + \u5220 SessionFile",
     args: SessionIdArgs
   },
   "session:send": {
@@ -24505,50 +24303,6 @@ var METHOD_DOCS = {
   "device:connections": {
     summary: '\u5217\u51FA\u672C daemon \u5F53\u524D\u6240\u6709 owner WS \u8FDE\u63A5\uFF08\u672C\u673A UI / \u624B\u673A / \u7B2C\u4E8C\u53F0\u684C\u9762\uFF09+ \u5404\u81EA clientInfo\u3002owner-only\uFF1Bguest \u8FDE\u63A5\u4E0D\u5728\u5217\uFF08\u4E0D\u662F"\u6211\u7684\u8BBE\u5907"\u4E14\u4E0D\u5411 UI \u6CC4\u9732 guest \u4FE1\u606F\uFF09',
     args: NO_ARGS
-  },
-  "appBuilder:listProjects": {
-    summary: "\u5217\u51FA app-builder project\uFF08\u542B dev server \u72B6\u6001\uFF09",
-    args: ListProjectsArgsSchema
-  },
-  "appBuilder:getProject": {
-    summary: "\u6309 sessionId \u53D6\u5355\u4E2A\u7ED1\u5B9A\u7684 project\uFF08\u542B status\uFF09",
-    args: GetProjectArgsSchema
-  },
-  "appBuilder:createProject": {
-    summary: "\u7ED9\u4F1A\u8BDD\u7ED1\u5B9A\u65B0 project\uFF1A\u6821\u9A8C\u540D + \u4ECE PROJECT_PORT_MIN..MAX \u6BB5\uFF08\u5F53\u524D 6173-6272\uFF09\u5206\u914D\u672A\u5360\u7528\u7AEF\u53E3\uFF08\u8DE8 user \u5168\u5C40\u552F\u4E00\uFF0C\u6C60\u6EE1\u62A5\u9519\uFF09+ \u5EFA\u76EE\u5F55\u5199\u5143\u6570\u636E + **\u540C\u6B65 scaffold**\uFF08spawn \u811A\u672C\u628A nestjs-react \u6A21\u677F\u62F7\u8FDB\u53BB\uFF1B\u5931\u8D25\u4F1A\u5220\u6389\u521A\u5EFA\u7684\u76EE\u5F55\u518D\u629B INTERNAL\uFF0C\u4E0D\u7559\u534A\u6210\u54C1\uFF09\u3002**\u88C5\u4F9D\u8D56\u548C\u8D77 dev server \u90FD\u4E0D\u5728\u8FD9\u91CC**\uFF1A\u843D\u5730 stage=install-pending\uFF0C\u8C03\u7528\u65B9\u81EA\u5DF1 pnpm install + appBuilder:reportStage + appBuilder:startDevServer",
-    args: CreateProjectArgsSchema
-  },
-  "appBuilder:deleteProject": {
-    summary: "\u505C dev server + \u5220 project \u76EE\u5F55\uFF08\u7ED1\u5B9A\u7684\u4F1A\u8BDD\u4E0D\u5728\u8FD9\u91CC\u5220\uFF09",
-    args: DeleteProjectArgsSchema
-  },
-  "appBuilder:updateProjectPort": {
-    summary: "\u6539 dev server \u7AEF\u53E3\uFF08\u6821\u9A8C\u5728 PROJECT_PORT_MIN..MAX \u6BB5\u5185\u3001\u5F53\u524D 6173-6272\uFF1B**\u649E\u8F66\u53EA\u67E5\u8C03\u7528\u65B9\u81EA\u5DF1\u540D\u4E0B\u7684 project**\uFF0C\u4E0D\u50CF createProject \u90A3\u6837\u8DE8 user \u67E5\uFF09\uFF1A\u505C\u65E7\u7AEF\u53E3 dev server + \u6539 .clawd-project.json + \u7F6E stage=stopped\u3002**\u4E0D\u81EA\u52A8\u62C9\u8D77\u65B0\u7AEF\u53E3\u7684 dev server**\u2014\u2014\u8981\u8D77\u5F97\u518D\u8C03 appBuilder:startDevServer\uFF08\u90A3\u6761\u624D\u8D70 readiness probe\uFF09",
-    args: UpdateProjectPortArgsSchema
-  },
-  "appBuilder:setProdUrl": {
-    summary: "\u53D1\u5E03\u4E0A\u7EBF\u540E\u56DE\u586B\u7EBF\u4E0A\u5730\u5740\u5230 .clawd-project.json",
-    args: SetProdUrlArgsSchema
-  },
-  "appBuilder:startDevServer": {
-    summary: "scaffold + \u4F9D\u8D56\u5B89\u88C5\u5B8C\u6210\u540E\u663E\u5F0F\u62C9\u8D77 dev server\uFF08createProject \u4E0D\u518D\u81EA\u52A8\u8D77\uFF09",
-    args: StartDevServerArgsSchema
-  },
-  "appBuilder:reportStage": {
-    summary: "\u4E0A\u62A5\u811A\u624B\u67B6\u9636\u6BB5\uFF08scaffolding / installing / failed \u7B49\uFF09\uFF0Cdaemon \u5E7F\u64AD\u5E27\u8BA9 UI \u5207 PreviewPane",
-    args: ReportStageArgsSchema
-  },
-  "appBuilder:stopDevServer": {
-    summary: "\u6536\u8D77\u9884\u89C8\uFF1A\u505C\u6389 dev server\uFF08\u5BF9\u79F0 startDevServer\uFF09",
-    args: StopDevServerArgsSchema
-  },
-  "appBuilder:publish": {
-    summary: "\u53D1\u5E03\u4E0A\u7EBF\uFF1A\u4E32\u884C\u5316 spawn publish.sh \u5E76\u5E7F\u64AD\u9636\u6BB5\u8FDB\u5EA6\u5E27\uFF1B\u540C project \u5DF2\u6709 in-flight job \u65F6\u8FD4\u56DE already-publishing",
-    args: PublishArgsSchema
-  },
-  "appBuilder:dismissPublishJob": {
-    summary: "\u53D6\u6D88 in-flight publish\uFF08SIGTERM \u5B50\u8FDB\u7A0B\uFF09\u6216\u6E05\u6389 daemon \u5D29\u6E83\u7559\u4E0B\u7684\u6B8B\u9AB8 publishJob \u5B57\u6BB5",
-    args: DismissPublishJobArgsSchema
   }
 };
 var METHOD_NAMES = Object.keys(METHOD_DOCS);
@@ -24630,37 +24384,43 @@ var INNER_TAG_ESCAPE_RE = new RegExp(`<(\\\\*)(/?)(${INNER_TAG_NAMES})\\b`, "g")
 var INNER_TAG_UNESCAPE_RE = new RegExp(`<\\\\(\\\\*)(/?)(${INNER_TAG_NAMES})\\b`, "g");
 
 // src/app-builder-plugin/project-store.ts
+var import_node_fs = require("fs");
+var import_node_child_process = require("child_process");
+var import_node_path = require("path");
 var PROJECTS_DIR = "projects";
 var META_FILE = ".clawd-project.json";
 var SCAFFOLD_TIMEOUT_MS = 3e4;
-var metaWriteQueues = /* @__PURE__ */ new Map();
-function serializeMetaWrite(metaPath, op) {
-  const prev = metaWriteQueues.get(metaPath) ?? Promise.resolve();
-  const next = prev.then(op, op);
-  const settled = next.then(
-    () => void 0,
-    () => void 0
-  );
-  metaWriteQueues.set(metaPath, settled);
-  void settled.then(() => {
-    if (metaWriteQueues.get(metaPath) === settled) metaWriteQueues.delete(metaPath);
-  });
-  return next;
+async function exists(p) {
+  try {
+    await import_node_fs.promises.stat(p);
+    return true;
+  } catch {
+    return false;
+  }
 }
+var PROJECT_NAME_RE = /^[a-z][a-z0-9-]{0,39}$/;
+var AppProjectMetadataSchema = external_exports.object({
+  name: external_exports.string().regex(PROJECT_NAME_RE, {
+    message: "kebab-case, \u5C0F\u5199\u5B57\u6BCD\u5F00\u5934\uFF0C\u53EA\u5141\u8BB8\u5C0F\u5199\u5B57\u6BCD / \u6570\u5B57 / -\uFF0C\u6700\u957F 40 \u5B57\u7B26"
+  }),
+  createdAt: external_exports.string().datetime(),
+  /** createProject 建好的 GitHub 仓库地址（ottin4ttc/<name>-<slug>）。 */
+  repoUrl: external_exports.string().url().optional(),
+  /** 最近一次发布成功的公网地址。 */
+  prodUrl: external_exports.string().url().optional(),
+  publishedAt: external_exports.string().datetime().optional(),
+  /** 发布那一刻的 HEAD；项目不是 git 仓库（老项目）时缺席。 */
+  publishedCommit: external_exports.string().min(1).optional()
+});
 var ProjectStore = class {
-  /** @param root projects 父目录，例如 `~/.clawd/users/<userId>/`（v2 per-user） */
+  /** @param root projects 父目录，例如 `~/.clawd/users/<userId>/` */
   constructor(root) {
     this.root = root;
   }
   root;
-  serializeWrite(name, op) {
-    return serializeMetaWrite(this.metaPath(name), op);
-  }
-  /** projects/<name>/.clawd-project.json 路径 */
   metaPath(name) {
     return (0, import_node_path.join)(this.projectsRoot(), name, META_FILE);
   }
-  /** projects/<name>/ 目录路径（cwd 用） */
   projectDir(name) {
     return (0, import_node_path.join)(this.projectsRoot(), name);
   }
@@ -24677,73 +24437,40 @@ var ProjectStore = class {
     }
     const out = [];
     for (const name of entries) {
-      try {
-        const raw = await import_node_fs.promises.readFile(this.metaPath(name), "utf8");
-        const json = JSON.parse(raw);
-        let migrated = false;
-        if (typeof json.devCommand !== "string" || json.devCommand.length === 0) {
-          json.devCommand = DEFAULT_DEV_COMMAND;
-          migrated = true;
-        }
-        const parsed = ProjectMetadataSchema.safeParse(json);
-        if (parsed.success) {
-          out.push(parsed.data);
-          if (migrated) {
-            void import_node_fs.promises.writeFile(this.metaPath(name), JSON.stringify(parsed.data, null, 2) + "\n", "utf8").catch(() => {
-            });
-          }
-        }
-      } catch {
-      }
+      const meta = await this.readMeta(name);
+      if (meta) out.push(meta);
     }
     return out.sort((a, b) => a.name.localeCompare(b.name));
   }
-  /**
-   * @param reservedPorts 其它 user 已占端口（v2 per-user：端口必须全局唯一，所有 user 的
-   *   dev server 同机跑；per-user store 各自只 list 自己，靠 handler 收集全局端口传进来，
-   *   否则不同 user 的首个项目都从 PROJECT_PORT_MIN 起 → 全撞 6173）。
-   */
-  async create(name, reservedPorts) {
-    const existing = await this.list();
-    if (existing.some((p) => p.name === name)) {
-      throw new Error(`project "${name}" already exists / \u5DF2\u5B58\u5728`);
-    }
-    const usedPorts = new Set(existing.map((p) => p.port));
-    if (reservedPorts) for (const p of reservedPorts) usedPorts.add(p);
-    let port = -1;
-    for (let p = PROJECT_PORT_MIN; p <= PROJECT_PORT_MAX; p++) {
-      if (!usedPorts.has(p)) {
-        port = p;
-        break;
-      }
-    }
-    if (port < 0) {
-      throw new Error(
-        `port pool exhausted / \u7AEF\u53E3\u6C60\u5DF2\u6EE1\uFF08${PROJECT_PORT_MIN}-${PROJECT_PORT_MAX}\uFF09\uFF0C\u5148\u5220\u4E00\u4E2A project \u91CA\u653E\u7AEF\u53E3`
-      );
+  async get(name) {
+    return this.readMeta(name);
+  }
+  async readMeta(name) {
+    try {
+      const raw = await import_node_fs.promises.readFile(this.metaPath(name), "utf8");
+      const parsed = AppProjectMetadataSchema.safeParse(JSON.parse(raw));
+      return parsed.success ? parsed.data : void 0;
+    } catch {
+      return void 0;
     }
-    const meta = {
-      name,
-      port,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      devCommand: DEFAULT_DEV_COMMAND
-    };
-    const validated = ProjectMetadataSchema.safeParse(meta);
+  }
+  async create(name) {
+    const meta = { name, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
+    const validated = AppProjectMetadataSchema.safeParse(meta);
     if (!validated.success) {
       throw new Error(`invalid name "${name}": ${validated.error.message}`);
     }
-    const dir = this.projectDir(name);
-    await import_node_fs.promises.mkdir(dir, { recursive: true });
-    await import_node_fs.promises.writeFile(this.metaPath(name), JSON.stringify(meta, null, 2) + "\n", "utf8");
-    return meta;
+    if (await exists(this.projectDir(name))) {
+      throw new Error(`project "${name}" already exists / \u5DF2\u5B58\u5728\uFF08\u76EE\u5F55 ${this.projectDir(name)} \u5DF2\u5728\uFF09`);
+    }
+    await import_node_fs.promises.mkdir(this.projectDir(name), { recursive: true });
+    await this.write(validated.data);
+    return validated.data;
   }
   /**
-   * 同步内联 scaffold：spawn `extension-kit/scripts/new-extension.sh <name>` 等 exit。
-   * 必须在 `create()` 之后调（脚本期望 projects/<name>/.clawd-project.json 已就位 = picker 模式）。
-   * 失败抛错；上层（handler）应当 catch 后回滚（删 dir + 不 mutate session）。
-   *
-   * spec 2026-06-02 §5.6.3：scaffold 对 assistant 不可见，避免 assistant 被诱导去"读 example
-   * 代码再参考"。assistant 进 project 时目录已是完整模板，直接 pnpm install 即可。
+   * 同步内联 scaffold：spawn `new-extension.sh <name> <模板源> <项目目录>` 等 exit。
+   * 必须在 `create()` 之后调（脚本要求目标目录已存在且只含 .clawd-project.json）。
+   * 失败抛错；上层（core.createProject）catch 后回滚。
    */
   async scaffold(name, templateSrcDir, scaffoldScriptPath, extraEnv) {
     const destDir = this.projectDir(name);
@@ -24778,151 +24505,415 @@ var ProjectStore = class {
     });
   }
   async delete(name) {
-    const dir = this.projectDir(name);
-    await import_node_fs.promises.rm(dir, { recursive: true, force: true });
-  }
-  async updatePort(name, newPort) {
-    if (newPort < PROJECT_PORT_MIN || newPort > PROJECT_PORT_MAX) {
-      throw new Error(
-        `port range invalid: must be ${PROJECT_PORT_MIN}-${PROJECT_PORT_MAX}, got ${newPort}`
-      );
-    }
-    return await this.serializeWrite(name, async () => {
-      const list = await this.list();
-      const target = list.find((p) => p.name === name);
-      if (!target) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
-      const conflict = list.find((p) => p.name !== name && p.port === newPort);
-      if (conflict) {
-        throw new Error(`port ${newPort} already used / \u5DF2\u88AB project "${conflict.name}" \u5360\u7528`);
-      }
-      const updated = { ...target, port: newPort };
-      await import_node_fs.promises.writeFile(this.metaPath(name), JSON.stringify(updated, null, 2) + "\n", "utf8");
-      return updated;
-    });
+    await import_node_fs.promises.rm(this.projectDir(name), { recursive: true, force: true });
   }
-  /**
-   * 单栏 refactor (spec 2026-06-02 §5.6.1)：发布上线后写公网 URL 到 .clawd-project.json.prodUrl。
-   * UI 通过 listProjects 读到 prodUrl 后切预览栏到线上 URL，取代旧 prod marker 机制。
-   * 重复调用幂等（覆盖旧 URL）。url 由 ProjectMetadataSchema 校验 url() 格式。
-   */
-  async setProdUrl(name, url) {
-    return await this.serializeWrite(name, async () => {
-      const list = await this.list();
-      const target = list.find((p) => p.name === name);
-      if (!target) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
-      const updated = { ...target, prodUrl: url };
-      const validated = ProjectMetadataSchema.safeParse(updated);
-      if (!validated.success) {
-        throw new Error(`invalid prodUrl "${url}": ${validated.error.message}`);
-      }
-      await import_node_fs.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
-      return validated.data;
-    });
+  async setRepoUrl(name, repoUrl) {
+    return this.patch(name, { repoUrl });
   }
-  /**
-   * 发布上线脚手架化 (spec 2026-06-03-app-builder-publish-scaffold-design §5.1.4)：
-   * 写 publishJob 字段到 .clawd-project.json。仅承载 in-flight 状态 ——
-   *   - daemon 收到第一个 ::stage::build marker 时写入
-   *   - 每次 stage 切换更新 stage 字段（jobId / startedAt 不变）
-   *   - 成功 / 失败 / dismiss 时调 clearPublishJob 清掉
-   *   - 只有 daemon 崩才会留残骸
-   * 写入时保留所有其他字段（prodUrl 等不受影响）。
-   */
-  async setPublishJob(name, job) {
-    return await this.serializeWrite(name, async () => {
-      const list = await this.list();
-      const target = list.find((p) => p.name === name);
-      if (!target) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
-      const updated = { ...target, publishJob: job };
-      const validated = ProjectMetadataSchema.safeParse(updated);
-      if (!validated.success) {
-        throw new Error(`invalid publishJob: ${validated.error.message}`);
-      }
-      await import_node_fs.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
-      return validated.data;
-    });
+  async setPublished(name, fields) {
+    return this.patch(name, fields);
   }
-  /** 清掉 .clawd-project.json.publishJob 字段。其他字段保持原样。 */
-  async clearPublishJob(name) {
-    return await this.serializeWrite(name, async () => {
-      const list = await this.list();
-      const target = list.find((p) => p.name === name);
-      if (!target) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
-      if (!target.publishJob) return target;
-      const { publishJob: _drop, ...rest } = target;
-      void _drop;
-      const validated = ProjectMetadataSchema.safeParse(rest);
-      if (!validated.success) {
-        throw new Error(`failed to clear publishJob: ${validated.error.message}`);
-      }
-      await import_node_fs.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
-      return validated.data;
-    });
+  /** 读全量 → 改几个字段 → 校验 → 整份写回。其他字段保持原样。 */
+  async patch(name, fields) {
+    const current = await this.readMeta(name);
+    if (!current) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
+    const validated = AppProjectMetadataSchema.safeParse({ ...current, ...fields });
+    if (!validated.success) {
+      throw new Error(`invalid metadata for "${name}": ${validated.error.message}`);
+    }
+    await this.write(validated.data);
+    return validated.data;
+  }
+  async write(meta) {
+    await import_node_fs.promises.writeFile(this.metaPath(meta.name), JSON.stringify(meta, null, 2) + "\n", "utf8");
   }
 };
 
 // src/app-builder-plugin/core.ts
 var import_node_child_process3 = require("child_process");
+var import_node_fs3 = require("fs");
+var import_node_path5 = require("path");
+
+// src/deploy/repo.ts
+var import_node_child_process2 = require("child_process");
+var import_promises2 = __toESM(require("fs/promises"), 1);
+var import_node_path4 = __toESM(require("path"), 1);
+
+// src/deploy/deploy-file.ts
+var import_promises = __toESM(require("fs/promises"), 1);
+var import_node_path3 = __toESM(require("path"), 1);
+
+// src/deploy/connectors.ts
+var import_node_fs2 = __toESM(require("fs"), 1);
+var import_node_path2 = __toESM(require("path"), 1);
+
+// src/deploy/redact.ts
+var KNOWN_SECRET_SHAPES = [
+  /LTAI[A-Za-z0-9]{6,}/,
+  /eyJ[A-Za-z0-9_-]{10,}/,
+  /sk-[A-Za-z0-9_-]{16,}/,
+  /gh[pousr]_[A-Za-z0-9]{20,}/,
+  /AKIA[A-Z0-9]{12,}/
+];
+var BARE_SECRET = new RegExp(KNOWN_SECRET_SHAPES.map((re) => re.source).join("|"), "g");
+
+// src/deploy/connectors.ts
+var CliConnectorFindingSchema = external_exports.object({
+  name: ConnectorNameSchema,
+  fields: external_exports.array(ConnectorFieldSchema).default([])
+});
+
+// src/deploy/deploy-file.ts
+var DEPLOY_FILE = import_node_path3.default.join(".clawd", "deploy.json");
+var SCAN_FILE = import_node_path3.default.join(".clawd", "deploy-scan.json");
+
+// src/deploy/templates.ts
+var CLAWOS_REPO = "ottin4ttc/clawos";
+var CLAWOS_REF = "release";
+var L = [
+  "name: clawd deploy",
+  "",
+  "# \u7531 clawd \u751F\u6210\u3001\u7531 clawd \u7EF4\u62A4\uFF1A\u6BCF\u6B21\u300C\u53D1\u5E03\u300D\u90FD\u4F1A\u7528\u5F53\u524D\u6A21\u677F\u91CD\u5199\u8FD9\u4EFD\u6587\u4EF6\u518D\u63D0\u4EA4\uFF0C\u624B\u6539\u4F1A\u88AB\u76D6\u6389\u3002",
+  "# \u4E09\u6BB5\uFF1Abuild \u6784 persona \u5C42\u955C\u50CF\u63A8 ACR \u2192 smoke \u5728\u96C6\u7FA4\u4E0A\u771F\u8D77\u4E00\u6B21 \u2192 deploy \u5728 gateway \u767B\u8BB0\u6210\u6B63\u5F0F\u3002",
+  "# \u6784\u5EFA\u5668 / \u6D41\u6C34\u7EBF\u811A\u672C / \u968F\u884C\u8D44\u4EA7\u5728 ottin4ttc/clawos \u4ED3\u5E93\u91CC\uFF0C\u8FD9\u91CC checkout \u4E00\u4EFD\u6765\u7528\u3002",
+  "#",
+  "# \u8981\u7684\u7EC4\u7EC7\u7EA7 Secrets\uFF1AALI_DOCKER_USERNAME / ALI_DOCKER_PASSWORD\uFF08\u63A8 ACR\uFF09\u3001CLAWOS_READ_TOKEN",
+  "#\uFF08\u8BFB clawos \u4ED3\u5E93\uFF09\u3001CLAWD_GATEWAY_ADMIN_KEY\uFF1B\u7EC4\u7EC7\u7EA7 Variable\uFF1ACLAWD_GATEWAY_URL\u3002",
+  "# \u4ED3\u5E93\u7EA7\u540C\u540D\u914D\u7F6E\u4F1A\u76D6\u8FC7\u7EC4\u7EC7\u7EA7\u2014\u2014\u67D0\u4E2A persona \u8981\u6307\u5230\u53E6\u4E00\u53F0 gateway\uFF0C\u5728\u81EA\u5DF1\u4ED3\u5E93\u91CC\u914D\u5373\u53EF\u3002",
+  "",
+  "on:",
+  "  push:",
+  "    branches: [main]",
+  "  workflow_dispatch:",
+  "",
+  "concurrency:",
+  "  # \u540C\u4E00\u4E2A\u4ED3\u5E93\u7684\u53D1\u5E03\u6392\u961F\u8DD1\uFF0C\u4E0D\u53D6\u6D88\uFF1A\u4E0A\u4E00\u6B21\u53EF\u80FD\u5DF2\u7ECF\u5728\u767B\u8BB0\u6B63\u5F0F\u4E86",
+  "  group: persona-cloud-${{ github.repository }}",
+  "",
+  "env:",
+  "  REGISTRY: registry.cn-hangzhou.aliyuncs.com",
+  "  VPC_REGISTRY: registry-vpc.cn-hangzhou.aliyuncs.com",
+  "  IMAGE_NAME: ttc-prod/clawd-persona-cloud",
+  `  CLAWOS_REPO: ${CLAWOS_REPO}`,
+  `  CLAWOS_REF: ${CLAWOS_REF}`,
+  "",
+  "permissions:",
+  "  contents: read",
+  "",
+  "jobs:",
+  "  build:",
+  // name 就是段 key：daemon 按 jobs API 回的 name 认段（那接口不返回 job 的 key）。
+  // 中文说明归 clawd 的上云页面，这里保持机器好认。
+  "    name: build",
+  "    runs-on: ubuntu-latest",
+  "    timeout-minutes: 30",
+  "    outputs:",
+  "      tag: ${{ steps.plan.outputs.tag }}",
+  "      image: ${{ steps.plan.outputs.image }}",
+  "      persona_id: ${{ steps.plan.outputs.persona_id }}",
+  "      env_names: ${{ steps.plan.outputs.env_names }}",
+  // 云上跑哪个模型 = 发布这一刻 persona 配的（build 段从仓库里的 .clawd/persona.json 读）。
+  // smoke 与 deploy 都要：smoke 得用正式那份模型探活，否则验的不是将要上线的东西。
+  "      model: ${{ steps.plan.outputs.model }}",
+  "      effort: ${{ steps.plan.outputs.effort }}",
+  // 装了哪些连接器（JSON 数组）。gateway 按它决定要不要为任务签工牌、把授权链接拼进 prompt
+  //（design 2026-09-09-cloud-connector-credentials）。名字形状在 deploy-file.mjs 卡死成 [a-z0-9-]，
+  // 所以下面单引号包住直接拼进命令行是安全的。
+  "      connectors: ${{ steps.plan.outputs.connectors }}",
+  "    steps:",
+  "      - name: Checkout persona",
+  "        uses: actions/checkout@v4",
+  "        with:",
+  "          path: persona",
+  "",
+  "      - name: Checkout clawos\uFF08\u6784\u5EFA\u5668 / \u6D41\u6C34\u7EBF\u811A\u672C / \u968F\u884C\u8D44\u4EA7\uFF09",
+  "        uses: actions/checkout@v4",
+  "        with:",
+  "          repository: ${{ env.CLAWOS_REPO }}",
+  "          ref: ${{ env.CLAWOS_REF }}",
+  "          token: ${{ secrets.CLAWOS_READ_TOKEN }}",
+  "          path: clawos",
+  "",
+  "      - name: \u8BFB\u90E8\u7F72\u6587\u4EF6",
+  "        id: plan",
+  "        run: |",
+  "          node clawos/cloud-host/pipeline/deploy-file.mjs \\",
+  "            --persona-dir persona \\",
+  "            --repo-name '${{ github.event.repository.name }}' \\",
+  "            --sha '${{ github.sha }}' \\",
+  '            --image-repo "$VPC_REGISTRY/$IMAGE_NAME" \\',
+  '            --assets clawos/cloud-host/provision/manifests/assets.json >> "$GITHUB_OUTPUT"',
+  "",
+  "      - name: \u51ED\u636E\u9F50\u4E0D\u9F50\uFF08\u7F3A\u54EA\u51E0\u4E2A\u540D\u5B57\u4E00\u6B21\u5217\u5168\uFF09",
+  "        env:",
+  "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
+  "          CLAWD_ENV_NAMES: ${{ steps.plan.outputs.env_names }}",
+  "        run: node clawos/cloud-host/pipeline/check-secrets.mjs",
+  "",
+  "      - uses: pnpm/action-setup@v4",
+  "        if: steps.plan.outputs.asset_builds != ''",
+  "        with:",
+  "          version: 10",
+  "",
+  "      - uses: actions/setup-node@v4",
+  "        if: steps.plan.outputs.asset_builds != ''",
+  "        with:",
+  "          node-version: 20",
+  "          cache: pnpm",
+  "          cache-dependency-path: clawos/clawd/pnpm-lock.yaml",
+  "",
+  "      - name: \u6784\u968F\u884C\u8D44\u4EA7\uFF08\u6E05\u5355\u91CC\u70B9\u8FC7\u540D\u3001\u4E14\u662F\u4ED3\u5E93\u6784\u5EFA\u4EA7\u7269\u7684\u90A3\u4E9B\uFF09",
+  "        # \u547D\u4EE4\u6765\u81EA assets.json\uFF0C\u5B83\u81EA\u5DF1\u5E26\u88C5\u4F9D\u8D56\u90A3\u4E00\u6B65\u3002< /dev/null\uFF1A\u522B\u8BA9\u67D0\u6761\u547D\u4EE4\u628A here-string \u91CC\u5269\u4E0B\u7684\u884C\u5F53 stdin \u5403\u6389",
+  "        if: steps.plan.outputs.asset_builds != ''",
+  "        working-directory: clawos",
+  "        run: |",
+  "          set -e",
+  "          while IFS= read -r cmd; do",
+  '            [ -n "$cmd" ] || continue',
+  '            echo "$ $cmd"',
+  '            bash -c "$cmd" < /dev/null',
+  "          done <<< '${{ steps.plan.outputs.asset_builds }}'",
+  "",
+  "      - name: Login to ACR",
+  "        uses: aliyun/acr-login@v1",
+  "        with:",
+  "          login-server: ${{ env.REGISTRY }}",
+  '          username: "${{ secrets.ALI_DOCKER_USERNAME }}"',
+  '          password: "${{ secrets.ALI_DOCKER_PASSWORD }}"',
+  "",
+  "      - name: \u6784 persona \u5C42",
+  "        # \u6784\u5EFA\u5668\u6574\u76EE\u5F55\u62F7\uFF0C`.git` \u4E0D\u662F\u4EBA\u683C\uFF0C\u5148\u5220\u3002\u5E95\u5EA7\u7528 :base \u79FB\u52A8 tag\u2014\u2014runner \u6BCF\u6B21\u90FD\u662F\u5E72\u51C0\u673A\u5668\u3001",
+  "        # \u5FC5\u7136\u62C9\u6700\u65B0\uFF1Bpersona \u5C42\u81EA\u5DF1\u7684 tag \u5E26 commit sha\u3001\u4E0D\u53EF\u53D8\uFF0C\u96C6\u7FA4\u6309\u5B83\u62C9\u6CA1\u6709\u6B67\u4E49\u3002",
+  "        run: |",
+  "          rm -rf persona/.git",
+  "          node clawos/cloud-host/provision/build-image.mjs \\",
+  "            --manifest persona/.clawd/deploy.json \\",
+  '            --from "$REGISTRY/$IMAGE_NAME:base" \\',
+  "            --persona-dir persona \\",
+  // persona 在镜像里落 /clawd/personas/<id>/（与本机同构），id 是 gateway 登记的名字；同 smoke / register 用的那个输出
+  "            --persona-id '${{ steps.plan.outputs.persona_id }}' \\",
+  '            --tag "$REGISTRY/$IMAGE_NAME:${{ steps.plan.outputs.tag }}"',
+  "",
+  "      - name: \u955C\u50CF\u65AD\u8A00\uFF08\u6E05\u5355\u91CC\u7684 CLI \u90FD\u5728\u3001bundle \u91CC persona \u5728\uFF09",
+  "        # /opt/versions.sh \u6BCF\u884C\u90FD\u4EE5 `|| echo` \u6536\u5C3E\u3001\u6C38\u8FDC exit 0\uFF0C\u53EA\u80FD\u9A8C\u8F93\u51FA\uFF1A\u6BB5\u6570\u8981\u7B49\u4E8E\u6E05\u5355\u91CC\u7684",
+  "        # CLI \u6570\uFF0C\u6BCF\u6BB5\u4E0B\u9762\u8981\u6709\u7248\u672C\u53F7\u3002\u955C\u50CF ENTRYPOINT \u662F sh -c\uFF0C\u547D\u4EE4\u8981\u4F5C\u4E3A\u4E00\u4E2A\u5B57\u7B26\u4E32\u4F20\u3002",
+  "        run: |",
+  '          IMG="$REGISTRY/$IMAGE_NAME:${{ steps.plan.outputs.tag }}"',
+  `          OUT=$(docker run --rm "$IMG" '/opt/versions.sh')`,
+  '          echo "$OUT"',
+  `          WANT=$(node -e 'const m=JSON.parse(require("fs").readFileSync("persona/.clawd/deploy.json","utf8"));console.log(((m.manifest??m).clis??[]).length)')`,
+  `          echo "$OUT" | awk -v want="$WANT" '`,
+  '            /^--- / { name=$2; if ((getline v) <= 0) v=""; n++',
+  '                      if (v !~ /[0-9]+\\.[0-9]+/) { printf "  \u2717 %s \u6CA1\u62A5\u51FA\u7248\u672C\u53F7\uFF1A%s\\n", name, v > "/dev/stderr"; bad++ } }',
+  '            END { if (n != want) { printf "  \u2717 \u955C\u50CF\u91CC\u53EA\u6709 %d \u4E2A CLI \u6BB5\uFF0C\u6E05\u5355\u8981\u6C42 %d \u4E2A\\n", n, want > "/dev/stderr"; bad++ }',
+  "                  exit bad ? 1 : 0 }'",
+  '          echo "  \u2713 $WANT \u4E2A CLI \u90FD\u5728\u4E14\u62A5\u5F97\u51FA\u7248\u672C"',
+  `          docker run --rm "$IMG" 'test -d /clawd/personas/\${{ steps.plan.outputs.persona_id }}' \\`,
+  '            || { echo "  \u2717 /clawd/personas/${{ steps.plan.outputs.persona_id }} \u4E0D\u5728" >&2; exit 1; }',
+  '          echo "  \u2713 persona \u76EE\u5F55\u5728"',
+  "",
+  "      - name: Push to ACR",
+  '        run: docker push "$REGISTRY/$IMAGE_NAME:${{ steps.plan.outputs.tag }}"',
+  "",
+  "  smoke:",
+  "    name: smoke",
+  "    needs: build",
+  "    runs-on: ubuntu-latest",
+  "    timeout-minutes: 20",
+  "    steps:",
+  "      - name: Checkout clawos\uFF08\u53EA\u8981\u6D41\u6C34\u7EBF\u811A\u672C\uFF09",
+  "        uses: actions/checkout@v4",
+  "        with:",
+  "          repository: ${{ env.CLAWOS_REPO }}",
+  "          ref: ${{ env.CLAWOS_REF }}",
+  "          token: ${{ secrets.CLAWOS_READ_TOKEN }}",
+  "          path: clawos",
+  "          sparse-checkout: cloud-host/pipeline",
+  "",
+  "      - name: \u4E34\u65F6\u767B\u8BB0 \u2192 \u8D77\u4E00\u6B21 Pod \u2192 \u64A4\u9500",
+  "        # \u767B\u8BB0\u6B63\u5F0F\u53EA\u662F\u5F80 gateway \u5199\u4E00\u884C\uFF0Cgateway \u4E0D\u78B0\u955C\u50CF\uFF1B\u96C6\u7FA4\u62C9\u955C\u50CF\u53D1\u751F\u5728\u7B2C\u4E00\u4E2A\u4EFB\u52A1\u5230\u6765\u65F6\u3002",
+  "        # \u6CA1\u6709\u8FD9\u4E00\u6B65\uFF0C\u6D41\u6C34\u7EBF\u7EFF\u4E86\u53EA\u4EE3\u8868\u300C\u767B\u8BB0\u4E86\u300D\u3002",
+  "        env:",
+  "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
+  "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
+  "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
+  "          CLAWD_ENV_NAMES: ${{ needs.build.outputs.env_names }}",
+  "        run: |",
+  "          node clawos/cloud-host/pipeline/smoke.mjs \\",
+  "            --image '${{ needs.build.outputs.image }}' \\",
+  "            --persona-id '${{ needs.build.outputs.persona_id }}' \\",
+  "            --model '${{ needs.build.outputs.model }}' \\",
+  "            --effort '${{ needs.build.outputs.effort }}' \\",
+  "            --connectors '${{ needs.build.outputs.connectors }}' \\",
+  "            --run-number '${{ github.run_number }}'",
+  "",
+  "  deploy:",
+  "    name: deploy",
+  "    needs: [build, smoke]",
+  "    runs-on: ubuntu-latest",
+  "    # \u4ED3\u5E93\u914D\u4E86 production \u73AF\u5883\u7684\u300C\u987B\u5BA1\u6838\u4EBA\u6279\u51C6\u300D\uFF0Cjob \u5C31\u505C\u5728\u8FD9\u91CC\u7B49\u4EBA\u70B9\uFF1B\u6CA1\u914D\u5C31\u76F4\u63A5\u8FC7\u3002",
+  "    environment: production",
+  "    steps:",
+  "      - name: Checkout clawos\uFF08\u53EA\u8981\u6D41\u6C34\u7EBF\u811A\u672C\uFF09",
+  "        uses: actions/checkout@v4",
+  "        with:",
+  "          repository: ${{ env.CLAWOS_REPO }}",
+  "          ref: ${{ env.CLAWOS_REF }}",
+  "          token: ${{ secrets.CLAWOS_READ_TOKEN }}",
+  "          path: clawos",
+  "          sparse-checkout: cloud-host/pipeline",
+  "",
+  "      - name: \u767B\u8BB0\u6B63\u5F0F",
+  "        env:",
+  "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
+  "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
+  "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
+  "          CLAWD_ENV_NAMES: ${{ needs.build.outputs.env_names }}",
+  "        run: |",
+  "          node clawos/cloud-host/pipeline/register.mjs \\",
+  "            --image '${{ needs.build.outputs.image }}' \\",
+  "            --persona-id '${{ needs.build.outputs.persona_id }}' \\",
+  "            --model '${{ needs.build.outputs.model }}' \\",
+  "            --effort '${{ needs.build.outputs.effort }}' \\",
+  "            --connectors '${{ needs.build.outputs.connectors }}'",
+  ""
+];
+var WORKFLOW_TEMPLATE = L.join("\n");
 
-// src/app-builder-plugin/publish-registry.ts
-var import_node_crypto = require("crypto");
-var PublishJobRegistry = class {
-  jobs = /* @__PURE__ */ new Map();
-  has(name) {
-    return this.jobs.has(name);
-  }
-  get(name) {
-    return this.jobs.get(name);
-  }
-  /**
-   * args.jobId 仅用于测试注入；生产代码不传，registry 自己生成。
-   * args.now 仅用于测试注入；生产代码不传，用 Date.now()。
-   */
-  create(args) {
-    if (this.jobs.has(args.name)) {
-      throw new Error(`already publishing: ${args.name}`);
-    }
-    const jobId = args.jobId ?? `job-${(0, import_node_crypto.randomUUID)()}`;
-    this.jobs.set(args.name, {
-      jobId,
-      name: args.name,
-      stage: "build",
-      sessionId: args.sessionId,
-      childProc: args.childProc,
-      dismissed: false,
-      sawAnyStage: false,
-      startedAt: args.now ?? Date.now()
+// src/deploy/repo.ts
+var DEPLOY_FILE_REL = DEPLOY_FILE.split(import_node_path4.default.sep).join("/");
+var DEFAULT_TIMEOUT_MS = 6e4;
+var runCommand = (cmd, args, opts = {}) => new Promise((resolve) => {
+  const child = (0, import_node_child_process2.spawn)(cmd, args, {
+    cwd: opts.cwd,
+    stdio: [opts.stdin === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
+  });
+  let stdout = "";
+  let stderr = "";
+  child.stdout?.on("data", (d) => {
+    stdout += d.toString("utf8");
+  });
+  child.stderr?.on("data", (d) => {
+    stderr += d.toString("utf8");
+  });
+  const timer = setTimeout(() => {
+    child.kill("SIGKILL");
+    stderr += `
+[clawd] \u8D85\u65F6\uFF08>${Math.round((opts.timeoutMs ?? DEFAULT_TIMEOUT_MS) / 1e3)}s\uFF09\uFF0C\u5DF2\u7ECF\u628A\u5B83\u6390\u4E86
+`;
+  }, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  child.on("error", (err) => {
+    clearTimeout(timer);
+    resolve({ code: null, stdout, stderr, spawnError: err.message });
+  });
+  child.on("close", (code) => {
+    clearTimeout(timer);
+    resolve({ code, stdout, stderr });
+  });
+  if (opts.stdin !== void 0 && child.stdin) {
+    child.stdin.on("error", () => {
     });
-    return jobId;
-  }
-  updateStage(name, stage) {
-    const job = this.jobs.get(name);
-    if (!job) return;
-    job.stage = stage;
-    job.sawAnyStage = true;
-  }
-  markDismissed(name) {
-    const job = this.jobs.get(name);
-    if (!job) return;
-    job.dismissed = true;
+    child.stdin.end(opts.stdin);
   }
-  remove(name) {
-    const job = this.jobs.get(name);
-    if (!job) return void 0;
-    this.jobs.delete(name);
-    return { sessionId: job.sessionId };
+});
+var RepoError = class extends Error {
+};
+var tail = (s, n = 400) => s.trim().slice(-n);
+async function git(exec, dir, args, opts) {
+  return exec("git", args, { cwd: dir, ...opts });
+}
+async function mustGit(exec, dir, args, what, opts) {
+  const r = await git(exec, dir, args, opts);
+  if (r.spawnError) throw new RepoError(`\u672C\u673A\u8DD1\u4E0D\u4E86 git\uFF1A${r.spawnError}`);
+  if (r.code !== 0) throw new RepoError(`${what}\u6CA1\u6210\uFF08git \u9000\u51FA\u7801 ${r.code}\uFF09\uFF1A${tail(r.stderr) || tail(r.stdout)}`);
+  return r.stdout.trim();
+}
+async function ghReady(exec) {
+  const r = await exec("gh", ["auth", "status"], { timeoutMs: 15e3 });
+  if (r.spawnError || r.code !== 0) {
+    return {
+      ok: false,
+      message: "\u672C\u673A\u8FD8\u6CA1\u6709 GitHub \u547D\u4EE4\u884C\u5DE5\u5177\uFF08gh\uFF09\uFF0C\u6216\u8005\u8FD8\u6CA1\u767B\u5F55\u3002\u5EFA\u4ED3\u5E93\u3001\u63A8\u9001\u3001\u5199 Secrets \u90FD\u9760\u5B83\uFF1A\n\n  brew install gh\n  gh auth login\n\n\u767B\u5F55\u7684\u8D26\u53F7\u8981\u662F\u7EC4\u7EC7\u7684\u6210\u5458\u3002\u5F04\u597D\u540E\u518D\u70B9\u4E00\u6B21\u3002"
+    };
   }
+  return { ok: true };
+}
+async function isToplevel(exec, dir) {
+  const r = await git(exec, dir, ["rev-parse", "--show-toplevel"]);
+  if (r.spawnError || r.code !== 0) return false;
+  return samePath(dir, r.stdout.trim());
+}
+async function samePath(a, b) {
+  const real = async (x) => {
+    try {
+      return await import_promises2.default.realpath(x);
+    } catch {
+      return import_node_path4.default.resolve(x);
+    }
+  };
+  return await real(a) === await real(b);
+}
+async function repoInfo(exec, dir) {
+  if (!await isToplevel(exec, dir)) return void 0;
+  const origin = await git(exec, dir, ["remote", "get-url", "origin"]);
+  if (origin.spawnError || origin.code !== 0) return void 0;
+  const url = origin.stdout.trim();
+  const branch = (await git(exec, dir, ["rev-parse", "--abbrev-ref", "HEAD"])).stdout.trim() || "main";
+  const head = (await git(exec, dir, ["rev-parse", "HEAD"])).stdout.trim() || "(\u8FD8\u6CA1\u6709\u63D0\u4EA4)";
+  const status = await git(exec, dir, ["status", "--porcelain", "--", ".", `:(exclude)${DEPLOY_FILE_REL}`]);
+  const dirty = status.spawnError !== void 0 || status.code !== 0 || status.stdout.trim().length > 0;
+  const aheadRaw = await git(exec, dir, ["rev-list", "--count", "@{u}..HEAD"]);
+  const ahead = aheadRaw.code === 0 ? Number(aheadRaw.stdout.trim()) || 0 : 0;
+  return { url, branch, head, dirty, ahead };
+}
+async function identityArgs(exec, dir) {
+  const email2 = await git(exec, dir, ["config", "user.email"]);
+  const name = await git(exec, dir, ["config", "user.name"]);
+  const has = (r) => r.code === 0 && r.stdout.trim().length > 0;
+  if (has(email2) && has(name)) return [];
+  return ["-c", "user.name=clawd", "-c", "user.email=clawd@clawos.local"];
+}
+var RepoAlreadyExistsError = class extends RepoError {
+  constructor(slug) {
+    super(`\u7EC4\u7EC7\u91CC\u5DF2\u7ECF\u6709 https://github.com/${slug} \u4E86`);
+    this.slug = slug;
+  }
+  slug;
 };
-
-// src/app-builder-plugin/publish-job-runner.ts
-var import_node_child_process2 = require("child_process");
-var import_node_fs2 = require("fs");
-var import_node_path2 = require("path");
+async function createOrgRepo(exec, args) {
+  const { dir, org, repoName, message } = args;
+  if (!await isToplevel(exec, dir)) {
+    await mustGit(exec, dir, ["init", "-b", "main"], "\u521D\u59CB\u5316\u4ED3\u5E93");
+  }
+  const identity = await identityArgs(exec, dir);
+  await mustGit(exec, dir, ["add", "-A"], "\u6682\u5B58\u6587\u4EF6");
+  await mustGit(exec, dir, [...identity, "commit", "--allow-empty", "-m", message], "\u9996\u6B21\u63D0\u4EA4");
+  const slug = `${org}/${repoName}`;
+  const r = await exec(
+    "gh",
+    ["repo", "create", slug, "--private", "--source", dir, "--remote", "origin", "--push"],
+    { cwd: dir, timeoutMs: 12e4 }
+  );
+  if (r.spawnError) throw new RepoError(`\u672C\u673A\u8DD1\u4E0D\u4E86 gh\uFF1A${r.spawnError}`);
+  if (r.code !== 0) {
+    const err = tail(r.stderr) || tail(r.stdout);
+    if (/already exists/i.test(err)) throw new RepoAlreadyExistsError(slug);
+    throw new RepoError(`\u5EFA\u4ED3\u5E93\u6CA1\u6210\uFF08gh repo create \u9000\u51FA\u7801 ${r.code}\uFF09\uFF1A${err}`);
+  }
+  const info = await repoInfo(exec, dir);
+  return { slug, url: info?.url ?? `https://github.com/${slug}` };
+}
+async function workTreeState(exec, dir) {
+  if (!await isToplevel(exec, dir)) return { isRepo: false };
+  const status = await git(exec, dir, ["status", "--porcelain"]);
+  const dirty = status.spawnError !== void 0 || status.code !== 0 || status.stdout.trim().length > 0;
+  const head = await git(exec, dir, ["rev-parse", "HEAD"]);
+  return { isRepo: true, dirty, head: head.code === 0 ? head.stdout.trim() || null : null };
+}
 
 // src/app-builder-plugin/publish-stage-parser.ts
 var STAGE_RE = /^\s*::stage::(build|deploy|verify)\s*$/;
 var PROD_URL_RE = /^\s*::prod-url::(\S+)\s*$/;
-var URL_RE = /\bhttps?:\/\/[^\s]+/;
 function parsePublishLine(line) {
   const stageMatch = STAGE_RE.exec(line);
   if (stageMatch) return { kind: "stage", stage: stageMatch[1] };
@@ -24930,10 +24921,6 @@ function parsePublishLine(line) {
   if (urlMatch) return { kind: "prod-url", url: urlMatch[1] };
   return null;
 }
-function extractProdUrl(text) {
-  const m = URL_RE.exec(text);
-  return m ? m[0] : null;
-}
 function tailStderrLines(buf, n) {
   if (!buf) return "";
   const lines = buf.split("\n");
@@ -24941,347 +24928,148 @@ function tailStderrLines(buf, n) {
   return lines.slice(lines.length - n).join("\n");
 }
 
-// src/app-builder-plugin/publish-job-runner.ts
-async function startPublishJob(deps, args) {
-  const { registry: registry2, projectDir } = deps;
-  const spawn2 = deps.spawnImpl ?? import_node_child_process2.spawn;
-  if (registry2.has(args.name)) {
-    return { jobId: registry2.get(args.name).jobId, status: "already-publishing" };
-  }
-  const projDir = projectDir(args.name);
-  const logPath = (0, import_node_path2.join)(projDir, ".publish.log");
-  let logStream = null;
+// src/app-builder-plugin/core.ts
+var errMsg = (err) => err instanceof Error ? err.message : String(err);
+async function createProject(args) {
+  const { store, name, logger: logger2 } = args;
+  const exec = args.exec ?? runCommand;
+  const gh = await ghReady(exec);
+  if (!gh.ok) throw new Error(gh.message);
+  await store.create(name);
+  const dir = store.projectDir(name);
+  let repo2;
   try {
-    logStream = (0, import_node_fs2.createWriteStream)(logPath, { flags: "w" });
-  } catch {
-    logStream = null;
-  }
-  const child = spawn2("bash", [args.scriptPath, projDir, args.personaRoot ?? ""], {
-    cwd: projDir,
-    // 宿主给的 env 覆盖在 process.env 之上：daemon 进程本身没有这些变量（它们只在这一个
-    // 子进程里活着）。云上宿主不传 extraEnv，凭据本来就在容器 env 里。
-    // PATH 排在最后（与 ProjectStore.scaffold 同款）：extraEnv 里若混进一条名叫 PATH 的条目，
-    // 顶掉 PATH 会让脚本以「命令找不到」的形态崩在离现场很远的地方。
-    env: { ...process.env, ...args.extraEnv ?? {}, PATH: process.env.PATH ?? "" },
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  const jobId = registry2.create({
-    name: args.name,
-    sessionId: args.sessionId,
-    childProc: child
-  });
-  deps.logger?.info("app-builder.publish.spawned", {
-    name: args.name,
-    jobId,
-    pid: child.pid ?? null,
-    scriptPath: args.scriptPath,
-    logPath
-  });
-  child.on("error", (err) => {
-    deps.logger?.warn("app-builder.publish.spawn-error", {
-      name: args.name,
-      jobId,
-      error: err instanceof Error ? err.message : String(err)
-    });
-    void handleExit(deps, {
-      name: args.name,
-      jobId,
-      code: null,
-      signal: null,
-      urlCandidate: null,
-      stderrTail: err instanceof Error ? err.message : String(err),
-      logPath
-    });
-  });
-  let urlFromMarker = null;
-  let urlFallback = null;
-  let stdoutBuf = "";
-  child.stdout?.on("data", (chunk) => {
-    if (logStream) logStream.write(chunk);
-    stdoutBuf += chunk.toString();
-    let nlIdx;
-    while ((nlIdx = stdoutBuf.indexOf("\n")) >= 0) {
-      const line = stdoutBuf.slice(0, nlIdx);
-      stdoutBuf = stdoutBuf.slice(nlIdx + 1);
-      handleStdoutLine(deps, args.name, jobId, line);
-      const parsedForUrl = parsePublishLine(line);
-      if (parsedForUrl?.kind === "prod-url") urlFromMarker = parsedForUrl.url;
-      const url = extractProdUrl(line);
-      if (url && !urlFallback) urlFallback = url;
-    }
-  });
-  let stderrBuf = "";
-  child.stderr?.on("data", (chunk) => {
-    if (logStream) logStream.write(chunk);
-    stderrBuf += chunk.toString();
-  });
-  child.on("exit", (code, signal) => {
-    if (logStream) logStream.end();
-    const urlCandidate = urlFromMarker ?? urlFallback;
-    deps.logger?.info("app-builder.publish.child-exit", {
-      name: args.name,
-      jobId,
-      code,
-      signal,
-      hadUrl: !!urlCandidate,
-      urlSource: urlFromMarker ? "marker" : urlFallback ? "fallback" : "none",
-      stderrBytes: stderrBuf.length
-    });
-    void handleExit(deps, {
-      name: args.name,
-      jobId,
-      code,
-      signal,
-      urlCandidate,
-      stderrTail: tailStderrLines(stderrBuf, 20),
-      logPath
-    });
-  });
-  return { jobId, status: "started" };
-}
-function handleStdoutLine(deps, name, jobId, line) {
-  const parsed = parsePublishLine(line);
-  if (parsed?.kind !== "stage") return;
-  advanceStage(deps, name, jobId, parsed.stage);
-}
-function advanceStage(deps, name, jobId, next) {
-  const job = deps.registry.get(name);
-  if (!job) return;
-  const prev = job.stage;
-  const wasFirstStage = !job.sawAnyStage;
-  deps.logger?.info("app-builder.publish.stage-advance", {
-    name,
-    jobId,
-    prev: wasFirstStage ? null : prev,
-    next,
-    firstStage: wasFirstStage
-  });
-  if (wasFirstStage) {
-    deps.registry.updateStage(name, next);
-    void deps.setPublishJob(name, {
-      jobId,
-      stage: next,
-      startedAt: job.startedAt
-    });
-    deps.broadcast({
-      type: "appBuilder:publish-progress",
-      name,
-      jobId,
-      stage: next,
-      status: "started"
+    const scaffold = await store.scaffold(name, args.templateSrcDir, args.scaffoldScript, args.extraEnv);
+    logger2?.info("app-builder.scaffold.done", { name, stdout: scaffold.stdout.slice(0, 200) });
+    const slug = await readSlug(dir);
+    if (!slug) logger2?.warn("app-builder.create.no-slug", { name });
+    const repoName = slug ? `${name}-${slug}` : name;
+    repo2 = await createOrgRepo(exec, { dir, org: args.org, repoName, message: `clawd: \u65B0\u5EFA ${name}` });
+    const commit = await headCommit(exec, dir);
+    const project = await store.setRepoUrl(name, repo2.url);
+    logger2?.info("app-builder.create.done", { name, repoUrl: repo2.url, commit });
+    return { project, projectDir: dir, repoUrl: repo2.url, commit };
+  } catch (err) {
+    const message = errMsg(err);
+    logger2?.warn("app-builder.create.failed", { name, error: message });
+    await store.delete(name).catch((e) => {
+      logger2?.warn("app-builder.create.rollback-failed", { name, error: errMsg(e) });
     });
-    return;
+    const orphan = repo2 ? `\uFF1BGitHub \u4ED3\u5E93 ${repo2.url} \u5DF2\u7ECF\u5EFA\u597D\u63A8\u4E0A\u53BB\u4E86\uFF0C\u672C\u5730\u56DE\u6EDA\u5220\u4E0D\u6389\u5B83\uFF0C\u91CD\u8BD5\u524D\u5148\u53BB GitHub \u5220\u6389` : "";
+    throw new Error(`createProject \u6CA1\u6210\uFF0C\u521A\u5EFA\u7684\u76EE\u5F55\u5DF2\u56DE\u6EDA\uFF1A${message}${orphan}`);
   }
-  if (prev === next) {
-    return;
-  }
-  deps.broadcast({
-    type: "appBuilder:publish-progress",
-    name,
-    jobId,
-    stage: prev,
-    status: "completed"
-  });
-  deps.registry.updateStage(name, next);
-  void deps.setPublishJob(name, {
-    jobId,
-    stage: next,
-    startedAt: job.startedAt
-  });
-  deps.broadcast({
-    type: "appBuilder:publish-progress",
-    name,
-    jobId,
-    stage: next,
-    status: "started"
-  });
 }
-async function handleExit(deps, args) {
-  const job = deps.registry.get(args.name);
-  if (args.signal === "SIGTERM" && job?.dismissed) {
-    try {
-      await deps.clearPublishJob(args.name);
-    } catch (err) {
-      console.error("[publish] clearPublishJob failed (dismissed branch)", err);
-    }
-    deps.registry.remove(args.name);
-    deps.onSettled?.({ kind: "dismissed" });
-    return;
-  }
-  if (args.code === 0 && args.urlCandidate) {
-    if (job?.sawAnyStage) {
-      deps.broadcast({
-        type: "appBuilder:publish-progress",
-        name: args.name,
-        jobId: args.jobId,
-        stage: job.stage,
-        status: "completed"
-      });
-    }
-    try {
-      await deps.setProdUrl(args.name, args.urlCandidate);
-    } catch (err) {
-      console.error("[publish] setProdUrl failed; falling through to failure branch", err);
-      await emitFailure(deps, args, "\u8C03 setProdUrl \u5931\u8D25\uFF1A" + (err instanceof Error ? err.message : String(err)));
-      return;
-    }
-    try {
-      await deps.clearPublishJob(args.name);
-    } catch (err) {
-      console.error("[publish] clearPublishJob failed (success branch)", err);
-    }
-    deps.registry.remove(args.name);
-    deps.onSettled?.({ kind: "published", url: args.urlCandidate });
-    return;
+async function readSlug(projectDir) {
+  let conf;
+  try {
+    conf = await import_node_fs3.promises.readFile((0, import_node_path5.join)(projectDir, "ext.conf"), "utf8");
+  } catch {
+    return null;
   }
-  await emitFailure(deps, args, buildErrorSummary(args));
+  const m = /^SLUG=([A-Za-z0-9]+)\s*$/m.exec(conf);
+  return m ? m[1] : null;
+}
+async function headCommit(exec, dir) {
+  const r = await exec("git", ["rev-parse", "HEAD"], { cwd: dir });
+  return r.code === 0 ? r.stdout.trim() : "";
 }
-async function emitFailure(deps, args, errorSummary) {
-  const job = deps.registry.get(args.name);
-  const failStage = job?.sawAnyStage ? job.stage : "unknown";
-  deps.logger?.warn("app-builder.publish.failed", {
-    name: args.name,
-    jobId: args.jobId,
-    stage: failStage,
-    errorSummary: errorSummary.slice(0, 500)
+var PUBLISH_TIMEOUT_MS = 15 * 6e4;
+async function runPublish(args) {
+  const { store, name, logger: logger2 } = args;
+  const exec = args.exec ?? runCommand;
+  const spawnFn = args.spawnImpl ?? import_node_child_process3.spawn;
+  const timeoutMs = args.timeoutMs ?? PUBLISH_TIMEOUT_MS;
+  if (!await store.get(name)) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
+  const dir = store.projectDir(name);
+  const tree = await workTreeState(exec, dir);
+  if (tree.isRepo && tree.dirty) {
+    throw new Error("\u5DE5\u4F5C\u533A\u6709\u672A\u63D0\u4EA4\u7684\u6539\u52A8\uFF1A\u5148 commit + push \u518D\u53D1\u5E03\uFF0C\u7EBF\u4E0A\u5FC5\u987B\u5BF9\u5E94\u4ED3\u5E93\u91CC\u7684\u4E00\u4E2A commit");
+  }
+  const head = tree.isRepo ? tree.head : null;
+  const logPath = (0, import_node_path5.join)(dir, ".publish.log");
+  const log2 = (0, import_node_fs3.createWriteStream)(logPath, { flags: "w" });
+  log2.on("error", () => {
   });
-  try {
-    await deps.clearPublishJob(args.name);
-  } catch (err) {
-    deps.logger?.warn("app-builder.publish.clear-field-failed", {
-      name: args.name,
-      jobId: args.jobId,
-      error: err instanceof Error ? err.message : String(err)
+  logger2?.info("app-builder.publish.start", { name, scriptPath: args.scriptPath, head });
+  return await new Promise((resolve, reject) => {
+    const child = spawnFn("bash", [args.scriptPath, dir, args.personaRoot], {
+      cwd: dir,
+      // 凭据就在本进程 env 里（宿主交进来的），照单全给脚本
+      env: process.env,
+      stdio: ["ignore", "pipe", "pipe"]
     });
-  }
-  const removed = deps.registry.remove(args.name);
-  deps.broadcast({
-    type: "appBuilder:publish-failed",
-    name: args.name,
-    jobId: args.jobId,
-    stage: failStage,
-    errorSummary
-  });
-  if (removed) {
-    const msg = formatFailureMessage(failStage, errorSummary, args.logPath);
-    try {
-      await deps.injectUserText(removed.sessionId, msg);
-      deps.logger?.info("app-builder.publish.failure-injected-to-chat", {
-        name: args.name,
-        jobId: args.jobId,
-        sessionId: removed.sessionId
-      });
-    } catch (err) {
-      deps.logger?.warn("app-builder.publish.inject-user-text-failed", {
-        name: args.name,
-        jobId: args.jobId,
-        sessionId: removed.sessionId,
-        error: err instanceof Error ? err.message : String(err)
-      });
-    }
-  } else {
-    deps.logger?.warn("app-builder.publish.no-registry-entry-on-failure", {
-      name: args.name,
-      jobId: args.jobId
+    let stdout = "";
+    let stderr = "";
+    let partial2 = "";
+    let stage = "unknown";
+    let prodUrl = null;
+    let timedOut = false;
+    const feed = (line) => {
+      const p = parsePublishLine(line);
+      if (p?.kind === "stage") stage = p.stage;
+      else if (p?.kind === "prod-url") prodUrl = p.url;
+    };
+    child.stdout?.on("data", (d) => {
+      const s = d.toString("utf8");
+      stdout += s;
+      log2.write(s);
+      partial2 += s;
+      const lines = partial2.split("\n");
+      partial2 = lines.pop() ?? "";
+      for (const l of lines) feed(l);
     });
-  }
-  deps.onSettled?.({ kind: "failed", stage: failStage, errorSummary });
-}
-function buildErrorSummary(args) {
-  if (args.signal) {
-    return `publish.sh \u88AB\u4E2D\u65AD\uFF08signal: ${args.signal}\uFF09`;
-  }
-  if (args.code === 0 && !args.urlCandidate) {
-    return "publish.sh \u6210\u529F\u9000\u51FA\u4F46\u672A\u8F93\u51FA\u516C\u7F51 URL";
-  }
-  return args.stderrTail || `publish.sh \u5F02\u5E38\u9000\u51FA\uFF08exit code: ${args.code}\uFF09`;
-}
-function formatFailureMessage(stage, errorSummary, logPath) {
-  return `\u53D1\u5E03\u5931\u8D25\uFF1A[${stage}] \u9636\u6BB5
-${errorSummary}
-
-\u5B8C\u6574\u65E5\u5FD7\uFF1A${logPath}
-\u8BF7\u4F60\u63A5\u7BA1\u5B8C\u6210\u672C\u6B21\u53D1\u5E03\uFF1A\u5148\u6839\u636E\u65E5\u5FD7\u4FEE\u590D\u95EE\u9898\uFF0C\u7136\u540E\u91CD\u8DD1 publish.sh \u76F4\u5230\u4E0A\u7EBF\u6210\u529F\uFF0C\u6700\u540E\u7528 appBuilder.setProdUrl \u5199\u5165\u516C\u7F51 URL\u3002`;
-}
-
-// src/app-builder-plugin/core.ts
-function createPublishService() {
-  const registry2 = new PublishJobRegistry();
-  return {
-    inFlightJobId(name) {
-      return registry2.get(name)?.jobId ?? null;
-    },
-    async start(args) {
-      const { store, hooks, logger } = args;
-      const changed = async (name) => {
-        await hooks?.onProjectChanged?.(name);
-      };
-      return await startPublishJob(
-        {
-          registry: registry2,
-          setPublishJob: async (name, job) => {
-            await store.setPublishJob(name, job);
-            await changed(name);
-          },
-          clearPublishJob: async (name) => {
-            await store.clearPublishJob(name);
-            await changed(name);
-          },
-          setProdUrl: async (name, url) => {
-            await store.setProdUrl(name, url);
-            await changed(name);
-          },
-          broadcast: (frame) => hooks?.broadcast?.(frame),
-          injectUserText: async (sessionId, text) => {
-            await hooks?.injectUserText?.(sessionId, text);
-          },
-          projectDir: (name) => store.projectDir(name),
-          ...hooks?.onSettled ? { onSettled: hooks.onSettled } : {},
-          ...logger ? { logger } : {}
-        },
-        {
-          name: args.name,
-          sessionId: args.sessionId,
-          scriptPath: args.scriptPath,
-          personaRoot: args.personaRoot,
-          ...args.extraEnv ? { extraEnv: args.extraEnv } : {}
+    child.stderr?.on("data", (d) => {
+      const s = d.toString("utf8");
+      stderr += s;
+      log2.write(s);
+    });
+    const timeoutSummary = `publish.sh \u8D85\u8FC7 ${Math.round(timeoutMs / 6e4)} \u5206\u949F\u6CA1\u7ED3\u675F\uFF0C\u5DF2\u7ECF\u628A\u5B83\u6390\u4E86`;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+      log2.end();
+      logger2?.warn("app-builder.publish.timeout", { name, stage });
+      resolve({ ok: false, stage, errorSummary: timeoutSummary, logPath });
+    }, timeoutMs);
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      log2.end();
+      reject(new Error(`publish spawn failed: ${err.message}`));
+    });
+    child.on("close", (code, signal) => {
+      clearTimeout(timer);
+      if (timedOut) return;
+      if (partial2) feed(partial2);
+      log2.end();
+      void (async () => {
+        if (code === 0 && prodUrl) {
+          const publishedAt = (/* @__PURE__ */ new Date()).toISOString();
+          try {
+            await store.setPublished(name, {
+              prodUrl,
+              publishedAt,
+              ...head ? { publishedCommit: head } : {}
+            });
+          } catch (err) {
+            reject(new Error(`\u53D1\u5E03\u6210\u529F\u4F46\u5199\u56DE\u5143\u6570\u636E\u5931\u8D25\uFF1A${errMsg(err)}`));
+            return;
+          }
+          logger2?.info("app-builder.publish.done", { name, prodUrl, head });
+          resolve({ ok: true, prodUrl, commit: head, publishedAt, logPath });
+          return;
         }
-      );
-    },
-    dismiss(name) {
-      const job = registry2.get(name);
-      if (!job) return false;
-      registry2.markDismissed(name);
-      job.childProc.kill("SIGTERM");
-      return true;
-    }
-  };
-}
-async function createProjectOnDisk(args) {
-  const { store, name, templateSrcDir, scaffoldScript, logger } = args;
-  const project = await store.create(name, args.reservedPorts);
-  try {
-    const result = await store.scaffold(name, templateSrcDir, scaffoldScript, args.extraEnv);
-    logger?.info("app-builder.scaffold.done", { name, stdout: result.stdout.slice(0, 200) });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    logger?.warn("app-builder.scaffold.failed", { name, error: message });
-    await store.delete(name).catch((delErr) => {
-      logger?.warn("app-builder.scaffold.rollback-failed", {
-        name,
-        error: delErr instanceof Error ? delErr.message : String(delErr)
-      });
+        const errorSummary = code === 0 ? "\u811A\u672C\u9000\u51FA 0 \u4F46\u6CA1\u6709\u8F93\u51FA ::prod-url:: \u6807\u8BB0\uFF0C\u62FF\u4E0D\u5230\u516C\u7F51\u5730\u5740" : tailStderrLines(stderr, 20) || tailStderrLines(stdout, 20) || `exit ${code ?? signal}`;
+        logger2?.warn("app-builder.publish.failed", { name, stage, code, signal, timedOut });
+        resolve({ ok: false, stage, errorSummary, logPath });
+      })();
     });
-    throw new Error(`scaffold failed: ${message}`);
-  }
-  return { project, projectDir: store.projectDir(name) };
+  });
 }
 var REMOVE_TIMEOUT_MS = 10 * 6e4;
 async function runRemoveExtension(args) {
   const spawnFn = args.spawnImpl ?? import_node_child_process3.spawn;
   return await new Promise((resolve, reject) => {
     const child = spawnFn("bash", [args.script, args.projectDir, args.personaRoot], {
-      // 凭据在 process.env 里（gateway → MCP server 的 per-server env → 本进程）
       env: process.env,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -25301,7 +25089,7 @@ async function runRemoveExtension(args) {
       clearTimeout(timer);
       reject(new Error(`remove-extension spawn failed: ${err.message}`));
     });
-    child.on("exit", (code) => {
+    child.on("close", (code) => {
       clearTimeout(timer);
       args.logger?.info("app-builder.remove.exit", { projectDir: args.projectDir, code });
       resolve({ code, stdout, stderr });
@@ -25316,7 +25104,7 @@ function log(msg, info) {
 `;
   if (LOG_PATH) {
     try {
-      import_node_fs3.default.appendFileSync(LOG_PATH, line);
+      import_node_fs4.default.appendFileSync(LOG_PATH, line);
       return;
     } catch {
     }
@@ -25326,282 +25114,145 @@ function log(msg, info) {
   } catch {
   }
 }
+var logger = { info: log, warn: log };
 var ok = (payload) => ({
-  content: [{ type: "text", text: typeof payload === "string" ? payload : JSON.stringify(payload) }]
+  content: [{ type: "text", text: typeof payload === "string" ? payload : JSON.stringify(payload, null, 2) }]
 });
 var fail = (text) => ({ content: [{ type: "text", text }], isError: true });
+var errMsg2 = (err) => err instanceof Error ? err.message : String(err);
+var ENV_NAMES = {
+  root: "CLAWD_APP_BUILDER_ROOT",
+  personaRoot: "CLAWD_APP_BUILDER_PERSONA_ROOT",
+  templateDir: "CLAWD_APP_BUILDER_TEMPLATE_DIR",
+  scaffoldScript: "CLAWD_APP_BUILDER_SCAFFOLD_SCRIPT",
+  publishScript: "CLAWD_APP_BUILDER_PUBLISH_SCRIPT",
+  removeScript: "CLAWD_APP_BUILDER_REMOVE_SCRIPT"
+};
 function readEnv(env = process.env) {
-  return {
-    ...env.CLAWD_DAEMON_URL ? { daemonUrl: env.CLAWD_DAEMON_URL } : {},
-    ...env.CLAWD_DAEMON_TOKEN ? { daemonToken: env.CLAWD_DAEMON_TOKEN } : {},
-    ...env.CLAWD_SESSION_ID ? { sessionId: env.CLAWD_SESSION_ID } : {},
-    ...env.CLAWD_PERSONA_ID ? { personaId: env.CLAWD_PERSONA_ID } : {},
-    root: env.CLAWD_APP_BUILDER_ROOT || process.cwd(),
-    ...env.CLAWD_APP_BUILDER_TEMPLATE_DIR ? { templateDir: env.CLAWD_APP_BUILDER_TEMPLATE_DIR } : {},
-    ...env.CLAWD_APP_BUILDER_SCAFFOLD_SCRIPT ? { scaffoldScript: env.CLAWD_APP_BUILDER_SCAFFOLD_SCRIPT } : {},
-    ...env.CLAWD_APP_BUILDER_PUBLISH_SCRIPT ? { publishScript: env.CLAWD_APP_BUILDER_PUBLISH_SCRIPT } : {},
-    ...env.CLAWD_APP_BUILDER_PERSONA_ROOT ? { personaRoot: env.CLAWD_APP_BUILDER_PERSONA_ROOT } : {},
-    ...env.CLAWD_APP_BUILDER_REMOVE_SCRIPT ? { removeScript: env.CLAWD_APP_BUILDER_REMOVE_SCRIPT } : {}
-  };
-}
-function hasDaemon(env) {
-  return Boolean(env.daemonUrl && env.daemonToken);
-}
-async function callDaemon(ctx, method, args) {
-  const env = ctx.env;
-  if (!hasDaemon(env)) return fail(`${method}: no daemon`);
-  const f = ctx.fetch ?? fetch;
-  const url = `${env.daemonUrl}/rpc/${method}`;
-  log("daemon call", { method });
-  let res;
-  try {
-    res = await f(url, {
-      method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${env.daemonToken}` },
-      body: JSON.stringify({ ...env.sessionId ? { sessionId: env.sessionId } : {}, ...args })
-    });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    log("daemon call threw", { method, msg });
-    return fail(`${method} transport failed (is the daemon up?): ${msg}`);
-  }
-  let json;
-  try {
-    json = await res.json();
-  } catch {
-    log("daemon call non-JSON", { method, status: res.status });
-    return fail(`${method} returned non-JSON (HTTP ${res.status})`);
-  }
-  if (json.ok === false) {
-    log("daemon call rpc error", { method, error: json.error });
-    return fail(`${method} failed: ${json.error}: ${json.message}`);
+  const out = { repoOrg: env.CLAWD_APP_BUILDER_REPO_ORG || PERSONA_REPO_ORG };
+  for (const [key, name] of Object.entries(ENV_NAMES)) {
+    const v = env[name];
+    if (v) out[key] = v;
   }
-  log("daemon call ok", { method });
-  return ok(json.result);
+  return out;
 }
-function storeOf(env) {
-  return new ProjectStore(env.root);
+function missingEnv(env, keys) {
+  const missing = keys.filter((k) => !env[k]).map((k) => ENV_NAMES[k]);
+  return missing.length ? `env not set: ${missing.join(", ")}` : null;
 }
 async function handleCreateProject(input, ctx) {
-  if (hasDaemon(ctx.env)) return callDaemon(ctx, "appBuilder:createProject", { name: input.name });
-  const { templateDir, scaffoldScript } = ctx.env;
-  if (!templateDir || !scaffoldScript) {
-    return fail(
-      "createProject: no daemon, and CLAWD_APP_BUILDER_TEMPLATE_DIR / CLAWD_APP_BUILDER_SCAFFOLD_SCRIPT are not set; cannot scaffold."
-    );
-  }
+  const miss = missingEnv(ctx.env, ["root", "templateDir", "scaffoldScript"]);
+  if (miss) return fail(`createProject: ${miss}`);
+  const env = ctx.env;
   try {
-    const created = await createProjectOnDisk({
-      store: storeOf(ctx.env),
+    const r = await createProject({
+      store: new ProjectStore(env.root),
       name: input.name,
-      templateSrcDir: templateDir,
-      scaffoldScript,
-      logger: { info: (m, i) => log(m, i), warn: (m, i) => log(m, i) }
+      templateSrcDir: env.templateDir,
+      scaffoldScript: env.scaffoldScript,
+      org: env.repoOrg,
+      ...ctx.exec ? { exec: ctx.exec } : {},
+      logger
+    });
+    log("createProject done", { name: input.name, projectDir: r.projectDir, repoUrl: r.repoUrl });
+    return ok({
+      name: r.project.name,
+      projectDir: r.projectDir,
+      repoUrl: r.repoUrl,
+      commit: r.commit,
+      next: "cd \u8FDB projectDir \u88C5\u4F9D\u8D56\uFF08server/ \u4E0E web/ \u5404\u4E00\u5957 pnpm install\uFF09\uFF0C\u4E4B\u540E\u6BCF\u5B8C\u6210\u4E00\u6BB5\u5C31 commit + push"
     });
-    log("createProject done (no daemon)", { name: input.name, projectDir: created.projectDir });
-    return ok(created);
   } catch (err) {
-    return fail(`createProject failed: ${err instanceof Error ? err.message : String(err)}`);
+    return fail(`createProject failed: ${errMsg2(err)}`);
   }
 }
 async function handleListProjects(ctx) {
-  if (hasDaemon(ctx.env)) return callDaemon(ctx, "appBuilder:listProjects", {});
+  const miss = missingEnv(ctx.env, ["root"]);
+  if (miss) return fail(`listProjects: ${miss}`);
   try {
-    return ok({ projects: await storeOf(ctx.env).list() });
+    const store = new ProjectStore(ctx.env.root);
+    const projects = (await store.list()).map((p) => ({ ...p, projectDir: store.projectDir(p.name) }));
+    return ok({ projects });
   } catch (err) {
-    return fail(`listProjects failed: ${err instanceof Error ? err.message : String(err)}`);
-  }
-}
-async function handleReportStage(input, ctx) {
-  if (hasDaemon(ctx.env)) {
-    return callDaemon(ctx, "appBuilder:reportStage", {
-      stage: input.stage,
-      ...input.reason !== void 0 ? { reason: input.reason } : {}
-    });
-  }
-  log("reportStage skipped (no daemon)", { stage: input.stage });
-  return ok({ ok: true, skipped: "no daemon; stage reporting is a local-UI concern" });
-}
-async function handleStartDevServer(input, ctx) {
-  if (hasDaemon(ctx.env)) {
-    return callDaemon(ctx, "appBuilder:startDevServer", {
-      ...input.force !== void 0 ? { force: input.force } : {}
-    });
+    return fail(`listProjects failed: ${errMsg2(err)}`);
   }
-  return fail(
-    "startDevServer is a local-only capability (daemon dev server supervisor + port pool); it is not available in this environment."
-  );
 }
-async function handleUpdateProjectPort(input, ctx) {
-  if (hasDaemon(ctx.env)) {
-    return callDaemon(ctx, "appBuilder:updateProjectPort", {
+async function handlePublish(input, ctx) {
+  const miss = missingEnv(ctx.env, ["root", "publishScript", "personaRoot"]);
+  if (miss) return fail(`publish: ${miss}`);
+  const env = ctx.env;
+  try {
+    const r = await runPublish({
+      store: new ProjectStore(env.root),
       name: input.name,
-      newPort: input.newPort
+      scriptPath: env.publishScript,
+      personaRoot: env.personaRoot,
+      ...ctx.exec ? { exec: ctx.exec } : {},
+      ...ctx.spawnImpl ? { spawnImpl: ctx.spawnImpl } : {},
+      logger
     });
-  }
-  return fail(
-    "updateProjectPort is a local-only capability (dev server port pool); it is not available in this environment."
-  );
-}
-async function handleSetProdUrl(input, ctx) {
-  if (hasDaemon(ctx.env)) {
-    return callDaemon(ctx, "appBuilder:setProdUrl", { name: input.name, url: input.url });
-  }
-  try {
-    return ok({ project: await storeOf(ctx.env).setProdUrl(input.name, input.url) });
-  } catch (err) {
-    return fail(`setProdUrl failed: ${err instanceof Error ? err.message : String(err)}`);
-  }
-}
-async function handlePublish(input, ctx) {
-  if (hasDaemon(ctx.env)) return callDaemon(ctx, "appBuilder:publish", { name: input.name });
-  const { publishScript, personaRoot } = ctx.env;
-  if (!publishScript) {
-    return fail("publish: no daemon, and CLAWD_APP_BUILDER_PUBLISH_SCRIPT is not set.");
-  }
-  const service = ctx.publishService ?? createPublishService();
-  const store = storeOf(ctx.env);
-  let settle = () => {
-  };
-  const done = new Promise((resolve) => {
-    settle = resolve;
-  });
-  const publishStore = {
-    setPublishJob: (name, job) => store.setPublishJob(name, job),
-    clearPublishJob: (name) => store.clearPublishJob(name),
-    setProdUrl: (name, url) => store.setProdUrl(name, url),
-    projectDir: (name) => store.projectDir(name)
-  };
-  const started = await service.start({
-    name: input.name,
-    sessionId: ctx.env.sessionId ?? "",
-    scriptPath: publishScript,
-    personaRoot: personaRoot ?? "",
-    store: publishStore,
-    hooks: {
-      broadcast: (frame) => log("publish frame", frame),
-      onSettled: (outcome) => {
-        log("publish settled", outcome);
-        if (outcome.kind === "published") {
-          settle(ok({ status: "published", name: input.name, prodUrl: outcome.url }));
-        } else if (outcome.kind === "failed") {
-          settle(fail(`\u53D1\u5E03\u5931\u8D25\uFF1A[${outcome.stage}] \u9636\u6BB5
-${outcome.errorSummary}`));
-        } else {
-          settle(fail("publish was dismissed before it finished"));
-        }
-      }
-    },
-    logger: {
-      info: (m, i) => log(m, i),
-      warn: (m, i) => log(m, i)
+    if (r.ok) {
+      return ok({ status: "published", name: input.name, prodUrl: r.prodUrl, commit: r.commit, publishedAt: r.publishedAt });
     }
-  });
-  if (started.status === "already-publishing") {
-    return ok({ status: "already-publishing", jobId: started.jobId });
+    return fail(`\u53D1\u5E03\u5931\u8D25\uFF1A[${r.stage}] \u9636\u6BB5
+${r.errorSummary}
+
+\u5B8C\u6574\u65E5\u5FD7\uFF1A${r.logPath}`);
+  } catch (err) {
+    return fail(`publish failed: ${errMsg2(err)}`);
   }
-  return await done;
 }
 async function handleRemoveProject(input, ctx) {
-  if (hasDaemon(ctx.env)) {
-    return fail(
-      'removeProject is cloud-only. On this host run the script yourself:\n  bash "$HOME/.clawd/deploy-kit/scripts/remove-extension.sh" <projectDir> <personaRoot>'
-    );
-  }
-  const { removeScript, personaRoot } = ctx.env;
-  if (!removeScript) {
-    return fail("removeProject: no daemon, and CLAWD_APP_BUILDER_REMOVE_SCRIPT is not set.");
-  }
-  const store = storeOf(ctx.env);
+  const miss = missingEnv(ctx.env, ["root", "removeScript", "personaRoot"]);
+  if (miss) return fail(`removeProject: ${miss}`);
+  const env = ctx.env;
+  const store = new ProjectStore(env.root);
   try {
-    const projectDir = store.projectDir(input.name);
+    if (!await store.get(input.name)) return fail(`removeProject: project "${input.name}" not found / \u4E0D\u5B58\u5728`);
     const r = await runRemoveExtension({
-      script: removeScript,
-      projectDir,
-      personaRoot: personaRoot ?? "",
-      logger: { info: (m, i) => log(m, i), warn: (m, i) => log(m, i) }
+      script: env.removeScript,
+      projectDir: store.projectDir(input.name),
+      personaRoot: env.personaRoot,
+      ...ctx.spawnImpl ? { spawnImpl: ctx.spawnImpl } : {},
+      logger
     });
     const text = `exit=${r.code}
 --- stdout ---
 ${r.stdout}
 --- stderr ---
 ${r.stderr}`;
-    return r.code === 0 ? ok(text) : fail(text);
+    if (r.code !== 0) return fail(text);
+    await store.delete(input.name);
+    return ok(`${text}
+\u672C\u5730\u76EE\u5F55\u5DF2\u5220\u9664\uFF1BGitHub \u4ED3\u5E93\u4FDD\u7559\uFF0C\u8981\u5220\u81EA\u5DF1\u53BB GitHub \u5F52\u6863\u3002`);
   } catch (err) {
-    return fail(`removeProject failed: ${err instanceof Error ? err.message : String(err)}`);
+    return fail(`removeProject failed: ${errMsg2(err)}`);
   }
 }
 function registerTools(server, ctx) {
   server.registerTool(
     "createProject",
     {
-      title: "Create and scaffold an app-builder project",
-      description: "Create a new app-builder project: allocate its directory + .clawd-project.json and scaffold the starter template into it. This is the ONLY way to create a project \u2014 never mkdir one yourself, and never trust a path suggested elsewhere. Returns { project, projectDir }; projectDir is the absolute path you must cd into. Fails if the name is already taken.",
-      inputSchema: { name: external_exports.string().min(1).describe("project name given by the user") }
+      title: "Create an app project (scaffold + git + GitHub repo)",
+      description: "Create a new app project in the current user workspace: scaffold the starter template, `git init` with a first commit, and create a private GitHub repo under the org and push to it. This is the ONLY way to create a project \u2014 never mkdir one yourself, and never trust a path suggested elsewhere. Returns { name, projectDir, repoUrl, commit }; projectDir is the absolute path you must cd into. Fails (and rolls back) if the name is taken, the scaffold fails, or gh is not installed / logged in.",
+      inputSchema: { name: external_exports.string().min(1).describe("project name given by the user (kebab-case)") }
     },
     async (input) => handleCreateProject(input, ctx)
   );
   server.registerTool(
     "listProjects",
     {
-      title: "List app-builder projects",
-      description: "List the app-builder projects visible to this session (name / port / stage / prodUrl). Use it to check for a name clash before createProject, or to re-find a project path you forgot.",
+      title: "List app projects",
+      description: "List the projects in the current user workspace: name / projectDir / repoUrl / prodUrl / publishedAt / publishedCommit. Use it to find the directory of an existing app before changing it, or to check for a name clash before createProject. A project without repoUrl predates git support.",
       inputSchema: {}
     },
     async () => handleListProjects(ctx)
   );
-  server.registerTool(
-    "reportStage",
-    {
-      title: "Report scaffolding stage",
-      description: 'Report the current stage of the project so the UI preview pane can follow along. Only "installing" and "failed" are reportable by the assistant; the rest are set by the host. Pass reason when failing. Silently skipped in environments with no UI.',
-      inputSchema: {
-        stage: external_exports.string().describe('"installing" or "failed"'),
-        reason: external_exports.string().optional().describe('one-line cause, required when stage is "failed"')
-      }
-    },
-    async (input) => handleReportStage(input, ctx)
-  );
-  server.registerTool(
-    "startDevServer",
-    {
-      title: "Start the project dev server",
-      description: "Start the dev server for this session project after dependencies are installed. Idempotent: a running server is left alone unless force is true. Local-only capability \u2014 unavailable when there is no host daemon.",
-      inputSchema: {
-        force: external_exports.boolean().optional().describe("stop and respawn even if it is already running")
-      }
-    },
-    async (input) => handleStartDevServer(input, ctx)
-  );
-  server.registerTool(
-    "updateProjectPort",
-    {
-      title: "Change the dev server port of a project",
-      description: "Change which local port this project's dev server listens on. Normally the user does this from the project settings menu \u2014 only call it when they ask you to. Local-only capability.",
-      inputSchema: {
-        name: external_exports.string().min(1).describe("project name"),
-        newPort: external_exports.number().int().describe("new port, must be inside the app-builder port range")
-      }
-    },
-    async (input) => handleUpdateProjectPort(input, ctx)
-  );
-  server.registerTool(
-    "setProdUrl",
-    {
-      title: "Record the public URL of a published project",
-      description: "Write the public URL of a successfully published project into its .clawd-project.json so the preview switches to the live site. Call it after a publish that you drove by hand.",
-      inputSchema: {
-        name: external_exports.string().min(1).describe("project name"),
-        url: external_exports.string().url().describe("public https URL")
-      }
-    },
-    async (input) => handleSetProdUrl(input, ctx)
-  );
   server.registerTool(
     "publish",
     {
       title: "Publish the project to the public internet",
-      description: "Run the publish pipeline (build \u2192 deploy \u2192 verify) for the project. With a host daemon this hands the job to it (progress shows up in the UI, and a failure comes back to you as a chat message); without one the pipeline runs here and this call returns only when it finishes, with the public URL or the failure log tail.",
+      description: "Run the publish pipeline (build \u2192 deploy to Aliyun FC \u2192 verify) and wait for it to finish. Returns the public URL (and the commit it corresponds to) on success; on failure returns the failed stage, the error tail and the path of the full log. Refuses to run with uncommitted changes \u2014 commit and push first. Never run publish.sh yourself: the credentials only exist in this tool's process.",
       inputSchema: { name: external_exports.string().min(1).describe("project name") }
     },
     async (input) => handlePublish(input, ctx)
@@ -25609,8 +25260,8 @@ function registerTools(server, ctx) {
   server.registerTool(
     "removeProject",
     {
-      title: "Tear down a published project",
-      description: "Tear down everything a published project created (FC function / trigger / custom domain, plus the DROP statements for its Supabase tables). Cloud-only: on a host with a local daemon this returns the shell command to run yourself instead. Returns the script output verbatim \u2014 read it, it may ask you to run a few DROPs through the supabase MCP to finish the job.",
+      title: "Tear down a project",
+      description: "Tear down everything a published project created (FC function / trigger / custom domain, plus the DROP statements for its Supabase tables) and then delete the local project directory. The GitHub repo is kept. Returns the script output verbatim \u2014 read it, it may ask you to run a few DROPs through the supabase MCP. Confirm with the user before calling.",
       inputSchema: { name: external_exports.string().min(1).describe("project name") }
     },
     async (input) => handleRemoveProject(input, ctx)
@@ -25618,13 +25269,8 @@ function registerTools(server, ctx) {
 }
 async function main() {
   const env = readEnv();
-  log("boot", {
-    pid: process.pid,
-    mode: hasDaemon(env) ? "daemon" : "standalone",
-    personaId: env.personaId ?? "(none)",
-    root: env.root
-  });
-  const server = new McpServer({ name: "clawd-app-builder", version: "0.1.0" });
+  log("boot", { pid: process.pid, root: env.root ?? "(unset)", personaRoot: env.personaRoot ?? "(unset)" });
+  const server = new McpServer({ name: "clawd-app-builder", version: "0.2.0" });
   registerTools(server, { env });
   await server.connect(new StdioServerTransport());
 }
@@ -25642,10 +25288,6 @@ if (isMainModule) {
   handleListProjects,
   handlePublish,
   handleRemoveProject,
-  handleReportStage,
-  handleSetProdUrl,
-  handleStartDevServer,
-  handleUpdateProjectPort,
   readEnv,
   registerTools
 });