@clawos-dev/clawd 0.2.514 → 0.2.516

package/dist/app-builder-plugin/mcp-server.cjs

@@ -6891,7 +6891,6 @@ var require_dist = __commonJS({
 var mcp_server_exports = {};
 __export(mcp_server_exports, {
   handleCreateProject: () => handleCreateProject,
-  handleListProjects: () => handleListProjects,
   handlePublish: () => handlePublish,
   handleRemoveProject: () => handleRemoveProject,
   readEnv: () => readEnv,
@@ -21112,6 +21111,163 @@ var StdioServerTransport = class {
   }
 };
 
+// src/app-builder-plugin/project-store.ts
+var import_node_fs = require("fs");
+var import_node_child_process = require("child_process");
+var import_node_path = require("path");
+var PROJECTS_DIR = "projects";
+var META_FILE = ".clawd-project.json";
+var SCAFFOLD_TIMEOUT_MS = 3e4;
+async function exists(p) {
+  try {
+    await import_node_fs.promises.stat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var PROJECT_NAME_RE = /^[a-z][a-z0-9-]{0,39}$/;
+var AppProjectMetadataSchema = external_exports.object({
+  name: external_exports.string().regex(PROJECT_NAME_RE, {
+    message: "kebab-case, \u5C0F\u5199\u5B57\u6BCD\u5F00\u5934\uFF0C\u53EA\u5141\u8BB8\u5C0F\u5199\u5B57\u6BCD / \u6570\u5B57 / -\uFF0C\u6700\u957F 40 \u5B57\u7B26"
+  }),
+  createdAt: external_exports.string().datetime(),
+  /** GitHub 仓库地址（ottin4ttc/<name>-<slug>）；skill 经 GitHub MCP 建仓后用 record-push.mjs 记。 */
+  repoUrl: external_exports.string().url().optional(),
+  /** 最近一次经 GitHub MCP push 出去的远端 commit sha（record-push.mjs 记）；本地 git 仓库的老项目没有。 */
+  pushedCommit: external_exports.string().min(1).optional(),
+  /** push 那一刻 collect-files.mjs 算的文件树哈希（record-push.mjs 记）；publish 拿它判「有没有没推的改动」。 */
+  pushedTreeHash: external_exports.string().min(1).optional(),
+  /** 最近一次发布成功的公网地址。 */
+  prodUrl: external_exports.string().url().optional(),
+  publishedAt: external_exports.string().datetime().optional(),
+  /** 发布那一刻对应的 commit：本地 git 仓库取 HEAD，否则取 pushedCommit；两样都没有时缺席。 */
+  publishedCommit: external_exports.string().min(1).optional()
+});
+var ProjectStore = class {
+  /** @param root projects 父目录，例如 `~/.clawd/users/<userId>/` */
+  constructor(root) {
+    this.root = root;
+  }
+  root;
+  metaPath(name) {
+    return (0, import_node_path.join)(this.projectsRoot(), name, META_FILE);
+  }
+  projectDir(name) {
+    return (0, import_node_path.join)(this.projectsRoot(), name);
+  }
+  projectsRoot() {
+    return (0, import_node_path.join)(this.root, PROJECTS_DIR);
+  }
+  async list() {
+    let entries;
+    try {
+      entries = await import_node_fs.promises.readdir(this.projectsRoot());
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      throw err;
+    }
+    const out = [];
+    for (const name of entries) {
+      const meta = await this.readMeta(name);
+      if (meta) out.push(meta);
+    }
+    return out.sort((a, b) => a.name.localeCompare(b.name));
+  }
+  async get(name) {
+    return this.readMeta(name);
+  }
+  async readMeta(name) {
+    try {
+      const raw = await import_node_fs.promises.readFile(this.metaPath(name), "utf8");
+      const parsed = AppProjectMetadataSchema.safeParse(JSON.parse(raw));
+      return parsed.success ? parsed.data : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  async create(name) {
+    const meta = { name, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
+    const validated = AppProjectMetadataSchema.safeParse(meta);
+    if (!validated.success) {
+      throw new Error(`invalid name "${name}": ${validated.error.message}`);
+    }
+    if (await exists(this.projectDir(name))) {
+      throw new Error(`project "${name}" already exists / \u5DF2\u5B58\u5728\uFF08\u76EE\u5F55 ${this.projectDir(name)} \u5DF2\u5728\uFF09`);
+    }
+    await import_node_fs.promises.mkdir(this.projectDir(name), { recursive: true });
+    await this.write(validated.data);
+    return validated.data;
+  }
+  /**
+   * 同步内联 scaffold：spawn `new-extension.sh <name> <模板源> <项目目录>` 等 exit。
+   * 必须在 `create()` 之后调（脚本要求目标目录已存在且只含 .clawd-project.json）。
+   * 失败抛错；上层（core.createProject）catch 后回滚。
+   */
+  async scaffold(name, templateSrcDir, scaffoldScriptPath, extraEnv) {
+    const destDir = this.projectDir(name);
+    return await new Promise((resolve, reject) => {
+      const child = (0, import_node_child_process.spawn)("bash", [scaffoldScriptPath, name, templateSrcDir, destDir], {
+        // extraEnv 排在 PATH **之前**：凭据表里若混进一条名叫 PATH 的条目，顶掉 PATH 会让
+        // 脚本以「命令找不到」的形态崩在离现场很远的地方。
+        env: { ...process.env, ...extraEnv ?? {}, PATH: process.env.PATH ?? "" },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      let stdout = "";
+      let stderr = "";
+      child.stdout.on("data", (d) => {
+        stdout += d.toString("utf8");
+      });
+      child.stderr.on("data", (d) => {
+        stderr += d.toString("utf8");
+      });
+      const timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        reject(new Error(`scaffold timeout (>${SCAFFOLD_TIMEOUT_MS}ms): ${scaffoldScriptPath} ${name}`));
+      }, SCAFFOLD_TIMEOUT_MS);
+      child.on("error", (err) => {
+        clearTimeout(timer);
+        reject(new Error(`scaffold spawn failed: ${err.message}`));
+      });
+      child.on("exit", (code, signal) => {
+        clearTimeout(timer);
+        if (code === 0) resolve({ stdout, stderr });
+        else reject(new Error(`scaffold exit ${code ?? signal}: ${stderr.slice(0, 500)}`));
+      });
+    });
+  }
+  async delete(name) {
+    await import_node_fs.promises.rm(this.projectDir(name), { recursive: true, force: true });
+  }
+  async setPublished(name, fields) {
+    return this.patch(name, fields);
+  }
+  /** 读全量 → 改几个字段 → 校验 → 整份写回。其他字段保持原样。 */
+  async patch(name, fields) {
+    const current = await this.readMeta(name);
+    if (!current) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
+    const validated = AppProjectMetadataSchema.safeParse({ ...current, ...fields });
+    if (!validated.success) {
+      throw new Error(`invalid metadata for "${name}": ${validated.error.message}`);
+    }
+    await this.write(validated.data);
+    return validated.data;
+  }
+  async write(meta) {
+    await import_node_fs.promises.writeFile(this.metaPath(meta.name), JSON.stringify(meta, null, 2) + "\n", "utf8");
+  }
+};
+
+// src/app-builder-plugin/core.ts
+var import_node_child_process3 = require("child_process");
+var import_node_fs3 = require("fs");
+var import_node_path5 = require("path");
+
+// src/deploy/repo.ts
+var import_node_child_process2 = require("child_process");
+var import_promises2 = __toESM(require("fs/promises"), 1);
+var import_node_path4 = __toESM(require("path"), 1);
+
 // ../protocol/src/attachment-schemas.ts
 var TOKEN_ROLES = ["owner"];
 var GROUP_FILE_SOURCES = ["agent", "owner", "user-upload"];
@@ -21138,7 +21294,7 @@ var AttachmentSignUrlArgs = external_exports.object({
   sessionId: external_exports.string().min(1),
   /** 相对 session.cwd 的路径；允许传绝对路径，daemon 端会归一化（必须在 cwd 内） */
   relPath: external_exports.string().min(1),
-  /** TTL 秒数；缺省 24h；null 走永久 URL（不带 exp 字段） */
+  /** TTL 秒数；缺省 / null = 永久 URL（不带 e 字段）；只有显式传秒数才限时 */
   ttlSeconds: external_exports.number().int().positive().nullable().optional(),
   /** 视图模式：缺省 'raw' 返 /files/... 裸文件 URL；'md-rendered' 返
    *  /share/md/... viewer URL（同一签名，daemon 端换前缀），外人浏览器打开就是
@@ -21523,7 +21679,6 @@ var DeployFinishScanArgsSchema = external_exports.object({
   personaId: external_exports.string().min(1),
   notes: external_exports.array(external_exports.string()).default([])
 }).strict();
-var PERSONA_REPO_ORG = "ottin4ttc";
 
 // ../protocol/src/contact-remote-access.ts
 var ContactSetRemoteAccessArgsSchema = external_exports.object({
@@ -24149,7 +24304,7 @@ var METHOD_DOCS = {
     summary: "\u62C9\u5F53\u524D pty \u5C4F\u5E55\u5168\u91CF\u5FEB\u7167\uFF08\u5207\u56DE\u4F1A\u8BDD / \u5237\u65B0\u65F6\u7528\uFF09\uFF0C\u8FD4\u56DE { data, atSeq, popupKind }\u3002body: { sessionId }\u3002**\u7F3A sessionId \u9759\u9ED8\u8FD4 ok:false\uFF1B\u975E tui / pty \u5DF2\u9000\u51FA\u8FD4 ok:true \u4F46 data=null, atSeq=0** \u2014\u2014 \u4E24\u8005\u90FD\u4E0D\u62A5\u9519\uFF0C\u8981\u5206\u6E05\u5F97\u770B ok\u3002\u53EA\u6709\u8D8A\u6743\u8BBF\u95EE\u8BE5\u4F1A\u8BDD\u624D\u629B\u9519"
   },
   "attachment.signUrl": {
-    summary: "\u7ED9\u5DF2\u5165\u7FA4**\u4E14\u975E stale** \u7684\u6587\u4EF6\u7B7E\u53D1 HMAC \u4E0B\u8F7D URL\uFF08\u8DE8\u8BBE\u5907\u53EF\u76F4\u63A5\u6253\u5F00\uFF09\u3002**\u9ED8\u8BA4 24h \u8FC7\u671F**\uFF1BttlSeconds \u663E\u5F0F\u4F20 null = \u6C38\u4E0D\u8FC7\u671F\u3002\u4E0D\u5728\u6E05\u5355\u91CC\u548C stale \u62A5\u540C\u4E00\u4E2A\u9519\uFF0C\u5206\u4E0D\u51FA\u662F\u54EA\u79CD",
+    summary: "\u7ED9\u5DF2\u5165\u7FA4**\u4E14\u975E stale** \u7684\u6587\u4EF6\u7B7E\u53D1 HMAC \u4E0B\u8F7D URL\uFF08\u8DE8\u8BBE\u5907\u53EF\u76F4\u63A5\u6253\u5F00\uFF09\u3002**\u9ED8\u8BA4\u6C38\u4E0D\u8FC7\u671F**\uFF1B\u7528\u6237\u8981\u9650\u65F6\u94FE\u63A5\u624D\u663E\u5F0F\u4F20 ttlSeconds\uFF08\u79D2\uFF09\u3002\u4E0D\u5728\u6E05\u5355\u91CC\u548C stale \u62A5\u540C\u4E00\u4E2A\u9519\uFF0C\u5206\u4E0D\u51FA\u662F\u54EA\u79CD",
     args: AttachmentSignUrlArgs
   },
   "attachment.groupAdd": {
@@ -24383,162 +24538,6 @@ var INNER_TAG_NAMES = "clawd-dispatch-task|clawd-dispatch-result|brief|detail|fi
 var INNER_TAG_ESCAPE_RE = new RegExp(`<(\\\\*)(/?)(${INNER_TAG_NAMES})\\b`, "g");
 var INNER_TAG_UNESCAPE_RE = new RegExp(`<\\\\(\\\\*)(/?)(${INNER_TAG_NAMES})\\b`, "g");
 
-// src/app-builder-plugin/project-store.ts
-var import_node_fs = require("fs");
-var import_node_child_process = require("child_process");
-var import_node_path = require("path");
-var PROJECTS_DIR = "projects";
-var META_FILE = ".clawd-project.json";
-var SCAFFOLD_TIMEOUT_MS = 3e4;
-async function exists(p) {
-  try {
-    await import_node_fs.promises.stat(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-var PROJECT_NAME_RE = /^[a-z][a-z0-9-]{0,39}$/;
-var AppProjectMetadataSchema = external_exports.object({
-  name: external_exports.string().regex(PROJECT_NAME_RE, {
-    message: "kebab-case, \u5C0F\u5199\u5B57\u6BCD\u5F00\u5934\uFF0C\u53EA\u5141\u8BB8\u5C0F\u5199\u5B57\u6BCD / \u6570\u5B57 / -\uFF0C\u6700\u957F 40 \u5B57\u7B26"
-  }),
-  createdAt: external_exports.string().datetime(),
-  /** createProject 建好的 GitHub 仓库地址（ottin4ttc/<name>-<slug>）。 */
-  repoUrl: external_exports.string().url().optional(),
-  /** 最近一次发布成功的公网地址。 */
-  prodUrl: external_exports.string().url().optional(),
-  publishedAt: external_exports.string().datetime().optional(),
-  /** 发布那一刻的 HEAD；项目不是 git 仓库（老项目）时缺席。 */
-  publishedCommit: external_exports.string().min(1).optional()
-});
-var ProjectStore = class {
-  /** @param root projects 父目录，例如 `~/.clawd/users/<userId>/` */
-  constructor(root) {
-    this.root = root;
-  }
-  root;
-  metaPath(name) {
-    return (0, import_node_path.join)(this.projectsRoot(), name, META_FILE);
-  }
-  projectDir(name) {
-    return (0, import_node_path.join)(this.projectsRoot(), name);
-  }
-  projectsRoot() {
-    return (0, import_node_path.join)(this.root, PROJECTS_DIR);
-  }
-  async list() {
-    let entries;
-    try {
-      entries = await import_node_fs.promises.readdir(this.projectsRoot());
-    } catch (err) {
-      if (err.code === "ENOENT") return [];
-      throw err;
-    }
-    const out = [];
-    for (const name of entries) {
-      const meta = await this.readMeta(name);
-      if (meta) out.push(meta);
-    }
-    return out.sort((a, b) => a.name.localeCompare(b.name));
-  }
-  async get(name) {
-    return this.readMeta(name);
-  }
-  async readMeta(name) {
-    try {
-      const raw = await import_node_fs.promises.readFile(this.metaPath(name), "utf8");
-      const parsed = AppProjectMetadataSchema.safeParse(JSON.parse(raw));
-      return parsed.success ? parsed.data : void 0;
-    } catch {
-      return void 0;
-    }
-  }
-  async create(name) {
-    const meta = { name, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
-    const validated = AppProjectMetadataSchema.safeParse(meta);
-    if (!validated.success) {
-      throw new Error(`invalid name "${name}": ${validated.error.message}`);
-    }
-    if (await exists(this.projectDir(name))) {
-      throw new Error(`project "${name}" already exists / \u5DF2\u5B58\u5728\uFF08\u76EE\u5F55 ${this.projectDir(name)} \u5DF2\u5728\uFF09`);
-    }
-    await import_node_fs.promises.mkdir(this.projectDir(name), { recursive: true });
-    await this.write(validated.data);
-    return validated.data;
-  }
-  /**
-   * 同步内联 scaffold：spawn `new-extension.sh <name> <模板源> <项目目录>` 等 exit。
-   * 必须在 `create()` 之后调（脚本要求目标目录已存在且只含 .clawd-project.json）。
-   * 失败抛错；上层（core.createProject）catch 后回滚。
-   */
-  async scaffold(name, templateSrcDir, scaffoldScriptPath, extraEnv) {
-    const destDir = this.projectDir(name);
-    return await new Promise((resolve, reject) => {
-      const child = (0, import_node_child_process.spawn)("bash", [scaffoldScriptPath, name, templateSrcDir, destDir], {
-        // extraEnv 排在 PATH **之前**：凭据表里若混进一条名叫 PATH 的条目，顶掉 PATH 会让
-        // 脚本以「命令找不到」的形态崩在离现场很远的地方。
-        env: { ...process.env, ...extraEnv ?? {}, PATH: process.env.PATH ?? "" },
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-      let stdout = "";
-      let stderr = "";
-      child.stdout.on("data", (d) => {
-        stdout += d.toString("utf8");
-      });
-      child.stderr.on("data", (d) => {
-        stderr += d.toString("utf8");
-      });
-      const timer = setTimeout(() => {
-        child.kill("SIGKILL");
-        reject(new Error(`scaffold timeout (>${SCAFFOLD_TIMEOUT_MS}ms): ${scaffoldScriptPath} ${name}`));
-      }, SCAFFOLD_TIMEOUT_MS);
-      child.on("error", (err) => {
-        clearTimeout(timer);
-        reject(new Error(`scaffold spawn failed: ${err.message}`));
-      });
-      child.on("exit", (code, signal) => {
-        clearTimeout(timer);
-        if (code === 0) resolve({ stdout, stderr });
-        else reject(new Error(`scaffold exit ${code ?? signal}: ${stderr.slice(0, 500)}`));
-      });
-    });
-  }
-  async delete(name) {
-    await import_node_fs.promises.rm(this.projectDir(name), { recursive: true, force: true });
-  }
-  async setRepoUrl(name, repoUrl) {
-    return this.patch(name, { repoUrl });
-  }
-  async setPublished(name, fields) {
-    return this.patch(name, fields);
-  }
-  /** 读全量 → 改几个字段 → 校验 → 整份写回。其他字段保持原样。 */
-  async patch(name, fields) {
-    const current = await this.readMeta(name);
-    if (!current) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
-    const validated = AppProjectMetadataSchema.safeParse({ ...current, ...fields });
-    if (!validated.success) {
-      throw new Error(`invalid metadata for "${name}": ${validated.error.message}`);
-    }
-    await this.write(validated.data);
-    return validated.data;
-  }
-  async write(meta) {
-    await import_node_fs.promises.writeFile(this.metaPath(meta.name), JSON.stringify(meta, null, 2) + "\n", "utf8");
-  }
-};
-
-// src/app-builder-plugin/core.ts
-var import_node_child_process3 = require("child_process");
-var import_node_fs3 = require("fs");
-var import_node_path5 = require("path");
-
-// src/deploy/repo.ts
-var import_node_child_process2 = require("child_process");
-var import_promises2 = __toESM(require("fs/promises"), 1);
-var import_node_path4 = __toESM(require("path"), 1);
-
 // src/deploy/deploy-file.ts
 var import_promises = __toESM(require("fs/promises"), 1);
 var import_node_path3 = __toESM(require("path"), 1);
@@ -24816,28 +24815,9 @@ var runCommand = (cmd, args, opts = {}) => new Promise((resolve) => {
     child.stdin.end(opts.stdin);
   }
 });
-var RepoError = class extends Error {
-};
-var tail = (s, n = 400) => s.trim().slice(-n);
 async function git(exec, dir, args, opts) {
   return exec("git", args, { cwd: dir, ...opts });
 }
-async function mustGit(exec, dir, args, what, opts) {
-  const r = await git(exec, dir, args, opts);
-  if (r.spawnError) throw new RepoError(`\u672C\u673A\u8DD1\u4E0D\u4E86 git\uFF1A${r.spawnError}`);
-  if (r.code !== 0) throw new RepoError(`${what}\u6CA1\u6210\uFF08git \u9000\u51FA\u7801 ${r.code}\uFF09\uFF1A${tail(r.stderr) || tail(r.stdout)}`);
-  return r.stdout.trim();
-}
-async function ghReady(exec) {
-  const r = await exec("gh", ["auth", "status"], { timeoutMs: 15e3 });
-  if (r.spawnError || r.code !== 0) {
-    return {
-      ok: false,
-      message: "\u672C\u673A\u8FD8\u6CA1\u6709 GitHub \u547D\u4EE4\u884C\u5DE5\u5177\uFF08gh\uFF09\uFF0C\u6216\u8005\u8FD8\u6CA1\u767B\u5F55\u3002\u5EFA\u4ED3\u5E93\u3001\u63A8\u9001\u3001\u5199 Secrets \u90FD\u9760\u5B83\uFF1A\n\n  brew install gh\n  gh auth login\n\n\u767B\u5F55\u7684\u8D26\u53F7\u8981\u662F\u7EC4\u7EC7\u7684\u6210\u5458\u3002\u5F04\u597D\u540E\u518D\u70B9\u4E00\u6B21\u3002"
-    };
-  }
-  return { ok: true };
-}
 async function isToplevel(exec, dir) {
   const r = await git(exec, dir, ["rev-parse", "--show-toplevel"]);
   if (r.spawnError || r.code !== 0) return false;
@@ -24853,56 +24833,6 @@ async function samePath(a, b) {
   };
   return await real(a) === await real(b);
 }
-async function repoInfo(exec, dir) {
-  if (!await isToplevel(exec, dir)) return void 0;
-  const origin = await git(exec, dir, ["remote", "get-url", "origin"]);
-  if (origin.spawnError || origin.code !== 0) return void 0;
-  const url = origin.stdout.trim();
-  const branch = (await git(exec, dir, ["rev-parse", "--abbrev-ref", "HEAD"])).stdout.trim() || "main";
-  const head = (await git(exec, dir, ["rev-parse", "HEAD"])).stdout.trim() || "(\u8FD8\u6CA1\u6709\u63D0\u4EA4)";
-  const status = await git(exec, dir, ["status", "--porcelain", "--", ".", `:(exclude)${DEPLOY_FILE_REL}`]);
-  const dirty = status.spawnError !== void 0 || status.code !== 0 || status.stdout.trim().length > 0;
-  const aheadRaw = await git(exec, dir, ["rev-list", "--count", "@{u}..HEAD"]);
-  const ahead = aheadRaw.code === 0 ? Number(aheadRaw.stdout.trim()) || 0 : 0;
-  return { url, branch, head, dirty, ahead };
-}
-async function identityArgs(exec, dir) {
-  const email2 = await git(exec, dir, ["config", "user.email"]);
-  const name = await git(exec, dir, ["config", "user.name"]);
-  const has = (r) => r.code === 0 && r.stdout.trim().length > 0;
-  if (has(email2) && has(name)) return [];
-  return ["-c", "user.name=clawd", "-c", "user.email=clawd@clawos.local"];
-}
-var RepoAlreadyExistsError = class extends RepoError {
-  constructor(slug) {
-    super(`\u7EC4\u7EC7\u91CC\u5DF2\u7ECF\u6709 https://github.com/${slug} \u4E86`);
-    this.slug = slug;
-  }
-  slug;
-};
-async function createOrgRepo(exec, args) {
-  const { dir, org, repoName, message } = args;
-  if (!await isToplevel(exec, dir)) {
-    await mustGit(exec, dir, ["init", "-b", "main"], "\u521D\u59CB\u5316\u4ED3\u5E93");
-  }
-  const identity = await identityArgs(exec, dir);
-  await mustGit(exec, dir, ["add", "-A"], "\u6682\u5B58\u6587\u4EF6");
-  await mustGit(exec, dir, [...identity, "commit", "--allow-empty", "-m", message], "\u9996\u6B21\u63D0\u4EA4");
-  const slug = `${org}/${repoName}`;
-  const r = await exec(
-    "gh",
-    ["repo", "create", slug, "--private", "--source", dir, "--remote", "origin", "--push"],
-    { cwd: dir, timeoutMs: 12e4 }
-  );
-  if (r.spawnError) throw new RepoError(`\u672C\u673A\u8DD1\u4E0D\u4E86 gh\uFF1A${r.spawnError}`);
-  if (r.code !== 0) {
-    const err = tail(r.stderr) || tail(r.stdout);
-    if (/already exists/i.test(err)) throw new RepoAlreadyExistsError(slug);
-    throw new RepoError(`\u5EFA\u4ED3\u5E93\u6CA1\u6210\uFF08gh repo create \u9000\u51FA\u7801 ${r.code}\uFF09\uFF1A${err}`);
-  }
-  const info = await repoInfo(exec, dir);
-  return { slug, url: info?.url ?? `https://github.com/${slug}` };
-}
 async function workTreeState(exec, dir) {
   if (!await isToplevel(exec, dir)) return { isRepo: false };
   const status = await git(exec, dir, ["status", "--porcelain"]);
@@ -24932,31 +24862,22 @@ function tailStderrLines(buf, n) {
 var errMsg = (err) => err instanceof Error ? err.message : String(err);
 async function createProject(args) {
   const { store, name, logger: logger2 } = args;
-  const exec = args.exec ?? runCommand;
-  const gh = await ghReady(exec);
-  if (!gh.ok) throw new Error(gh.message);
-  await store.create(name);
+  const project = await store.create(name);
   const dir = store.projectDir(name);
-  let repo2;
   try {
     const scaffold = await store.scaffold(name, args.templateSrcDir, args.scaffoldScript, args.extraEnv);
     logger2?.info("app-builder.scaffold.done", { name, stdout: scaffold.stdout.slice(0, 200) });
     const slug = await readSlug(dir);
     if (!slug) logger2?.warn("app-builder.create.no-slug", { name });
-    const repoName = slug ? `${name}-${slug}` : name;
-    repo2 = await createOrgRepo(exec, { dir, org: args.org, repoName, message: `clawd: \u65B0\u5EFA ${name}` });
-    const commit = await headCommit(exec, dir);
-    const project = await store.setRepoUrl(name, repo2.url);
-    logger2?.info("app-builder.create.done", { name, repoUrl: repo2.url, commit });
-    return { project, projectDir: dir, repoUrl: repo2.url, commit };
+    logger2?.info("app-builder.create.done", { name, slug });
+    return { project, projectDir: dir, slug };
   } catch (err) {
     const message = errMsg(err);
     logger2?.warn("app-builder.create.failed", { name, error: message });
     await store.delete(name).catch((e) => {
       logger2?.warn("app-builder.create.rollback-failed", { name, error: errMsg(e) });
     });
-    const orphan = repo2 ? `\uFF1BGitHub \u4ED3\u5E93 ${repo2.url} \u5DF2\u7ECF\u5EFA\u597D\u63A8\u4E0A\u53BB\u4E86\uFF0C\u672C\u5730\u56DE\u6EDA\u5220\u4E0D\u6389\u5B83\uFF0C\u91CD\u8BD5\u524D\u5148\u53BB GitHub \u5220\u6389` : "";
-    throw new Error(`createProject \u6CA1\u6210\uFF0C\u521A\u5EFA\u7684\u76EE\u5F55\u5DF2\u56DE\u6EDA\uFF1A${message}${orphan}`);
+    throw new Error(`createProject \u6CA1\u6210\uFF0C\u521A\u5EFA\u7684\u76EE\u5F55\u5DF2\u56DE\u6EDA\uFF1A${message}`);
   }
 }
 async function readSlug(projectDir) {
@@ -24969,23 +24890,41 @@ async function readSlug(projectDir) {
   const m = /^SLUG=([A-Za-z0-9]+)\s*$/m.exec(conf);
   return m ? m[1] : null;
 }
-async function headCommit(exec, dir) {
-  const r = await exec("git", ["rev-parse", "HEAD"], { cwd: dir });
-  return r.code === 0 ? r.stdout.trim() : "";
-}
 var PUBLISH_TIMEOUT_MS = 15 * 6e4;
+function skillCollectFilesScript(personaRoot) {
+  return (0, import_node_path5.join)(personaRoot, ".claude", "skills", "app-builder-projects", "scripts", "collect-files.mjs");
+}
 async function runPublish(args) {
   const { store, name, logger: logger2 } = args;
   const exec = args.exec ?? runCommand;
   const spawnFn = args.spawnImpl ?? import_node_child_process3.spawn;
   const timeoutMs = args.timeoutMs ?? PUBLISH_TIMEOUT_MS;
-  if (!await store.get(name)) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
+  const meta = await store.get(name);
+  if (!meta) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
   const dir = store.projectDir(name);
   const tree = await workTreeState(exec, dir);
   if (tree.isRepo && tree.dirty) {
     throw new Error("\u5DE5\u4F5C\u533A\u6709\u672A\u63D0\u4EA4\u7684\u6539\u52A8\uFF1A\u5148 commit + push \u518D\u53D1\u5E03\uFF0C\u7EBF\u4E0A\u5FC5\u987B\u5BF9\u5E94\u4ED3\u5E93\u91CC\u7684\u4E00\u4E2A commit");
   }
-  const head = tree.isRepo ? tree.head : null;
+  let head = tree.isRepo ? tree.head : null;
+  if (!tree.isRepo && meta.repoUrl) {
+    if (!meta.pushedCommit || !meta.pushedTreeHash) {
+      throw new Error("\u8FD9\u4E2A\u9879\u76EE\u8FD8\u6CA1\u8BB0\u5F55\u8FC7 push\uFF1A\u5148\u6309 app-builder-projects skill \u628A\u6587\u4EF6\u63A8\u5230\u4ED3\u5E93\u5E76\u8DD1 record-push.mjs\uFF0C\u518D\u53D1\u5E03");
+    }
+    const script = args.collectFilesScript ?? skillCollectFilesScript(args.personaRoot);
+    const r = await exec(process.execPath, [script, "--project", dir], { timeoutMs: 6e4 });
+    if (r.code !== 0) throw new Error(`\u7B97\u4E0D\u51FA\u5F53\u524D\u6587\u4EF6\u6811\u54C8\u5E0C\uFF08${script}\uFF09\uFF1A${r.stderr.trim() || r.spawnError || `exit ${r.code}`}`);
+    let treeHash;
+    try {
+      treeHash = JSON.parse(r.stdout).treeHash;
+    } catch {
+    }
+    if (!treeHash) throw new Error(`collect-files.mjs \u7684\u8F93\u51FA\u91CC\u6CA1\u6709 treeHash\uFF08${script}\uFF09`);
+    if (treeHash !== meta.pushedTreeHash) {
+      throw new Error("\u6709\u6539\u52A8\u8FD8\u6CA1\u63A8\u5230\u4ED3\u5E93\uFF1A\u5148\u6309 skill \u63A8\u4E00\u904D\uFF08collect-files.mjs \u2192 push_files \u2192 record-push.mjs\uFF09\u518D\u53D1\u5E03\uFF0C\u7EBF\u4E0A\u5FC5\u987B\u5BF9\u5E94\u4ED3\u5E93\u91CC\u7684\u4E00\u4E2A commit");
+    }
+    head = meta.pushedCommit;
+  }
   const logPath = (0, import_node_path5.join)(dir, ".publish.log");
   const log2 = (0, import_node_fs3.createWriteStream)(logPath, { flags: "w" });
   log2.on("error", () => {
@@ -25129,7 +25068,7 @@ var ENV_NAMES = {
   removeScript: "CLAWD_APP_BUILDER_REMOVE_SCRIPT"
 };
 function readEnv(env = process.env) {
-  const out = { repoOrg: env.CLAWD_APP_BUILDER_REPO_ORG || PERSONA_REPO_ORG };
+  const out = {};
   for (const [key, name] of Object.entries(ENV_NAMES)) {
     const v = env[name];
     if (v) out[key] = v;
@@ -25150,33 +25089,21 @@ async function handleCreateProject(input, ctx) {
       name: input.name,
       templateSrcDir: env.templateDir,
       scaffoldScript: env.scaffoldScript,
-      org: env.repoOrg,
-      ...ctx.exec ? { exec: ctx.exec } : {},
       logger
     });
-    log("createProject done", { name: input.name, projectDir: r.projectDir, repoUrl: r.repoUrl });
+    const repoName = r.slug ? `${r.project.name}-${r.slug}` : r.project.name;
+    log("createProject done", { name: input.name, projectDir: r.projectDir, slug: r.slug, repoName });
     return ok({
       name: r.project.name,
       projectDir: r.projectDir,
-      repoUrl: r.repoUrl,
-      commit: r.commit,
-      next: "cd \u8FDB projectDir \u88C5\u4F9D\u8D56\uFF08server/ \u4E0E web/ \u5404\u4E00\u5957 pnpm install\uFF09\uFF0C\u4E4B\u540E\u6BCF\u5B8C\u6210\u4E00\u6BB5\u5C31 commit + push"
+      slug: r.slug,
+      repoName,
+      next: `\u6309 app-builder-projects skill \u8D70\uFF1A\u7528 github MCP \u5EFA\u4ED3 ottin4ttc/${repoName} \u5E76\u628A collect-files.mjs \u6536\u7684\u6587\u4EF6 push_files \u4E0A\u53BB\uFF0C\u518D record-push.mjs \u8BB0\u8D26\uFF1B\u7136\u540E cd \u8FDB projectDir \u88C5\u4F9D\u8D56\uFF08server/ \u4E0E web/ \u5404\u4E00\u5957 pnpm install\uFF09`
     });
   } catch (err) {
     return fail(`createProject failed: ${errMsg2(err)}`);
   }
 }
-async function handleListProjects(ctx) {
-  const miss = missingEnv(ctx.env, ["root"]);
-  if (miss) return fail(`listProjects: ${miss}`);
-  try {
-    const store = new ProjectStore(ctx.env.root);
-    const projects = (await store.list()).map((p) => ({ ...p, projectDir: store.projectDir(p.name) }));
-    return ok({ projects });
-  } catch (err) {
-    return fail(`listProjects failed: ${errMsg2(err)}`);
-  }
-}
 async function handlePublish(input, ctx) {
   const miss = missingEnv(ctx.env, ["root", "publishScript", "personaRoot"]);
   if (miss) return fail(`publish: ${miss}`);
@@ -25233,26 +25160,17 @@ function registerTools(server, ctx) {
   server.registerTool(
     "createProject",
     {
-      title: "Create an app project (scaffold + git + GitHub repo)",
-      description: "Create a new app project in the current user workspace: scaffold the starter template, `git init` with a first commit, and create a private GitHub repo under the org and push to it. This is the ONLY way to create a project \u2014 never mkdir one yourself, and never trust a path suggested elsewhere. Returns { name, projectDir, repoUrl, commit }; projectDir is the absolute path you must cd into. Fails (and rolls back) if the name is taken, the scaffold fails, or gh is not installed / logged in.",
+      title: "Create an app project (local scaffold only)",
+      description: "Create a new app project in the current user workspace: mkdir + metadata, then scaffold the starter template (this also renders server/.env from the credentials only this process holds). This is the ONLY way to create a project \u2014 never mkdir one yourself, and never trust a path suggested elsewhere. Returns { name, projectDir, slug, repoName }; projectDir is the absolute path you must cd into, repoName (<name>-<slug>, slug baked into ext.conf) is the GitHub repo to create. Does NOT touch GitHub: create the repo and push through the github MCP as the app-builder-projects skill says. Fails (and rolls back) if the name is taken or the scaffold fails.",
       inputSchema: { name: external_exports.string().min(1).describe("project name given by the user (kebab-case)") }
     },
     async (input) => handleCreateProject(input, ctx)
   );
-  server.registerTool(
-    "listProjects",
-    {
-      title: "List app projects",
-      description: "List the projects in the current user workspace: name / projectDir / repoUrl / prodUrl / publishedAt / publishedCommit. Use it to find the directory of an existing app before changing it, or to check for a name clash before createProject. A project without repoUrl predates git support.",
-      inputSchema: {}
-    },
-    async () => handleListProjects(ctx)
-  );
   server.registerTool(
     "publish",
     {
       title: "Publish the project to the public internet",
-      description: "Run the publish pipeline (build \u2192 deploy to Aliyun FC \u2192 verify) and wait for it to finish. Returns the public URL (and the commit it corresponds to) on success; on failure returns the failed stage, the error tail and the path of the full log. Refuses to run with uncommitted changes \u2014 commit and push first. Never run publish.sh yourself: the credentials only exist in this tool's process.",
+      description: "Run the publish pipeline (build \u2192 deploy to Aliyun FC \u2192 verify) and wait for it to finish. Returns the public URL (and the commit it corresponds to) on success; on failure returns the failed stage, the error tail and the path of the full log. Refuses to run if the project has changes that were not pushed: for a local git repo that means a dirty work tree; for a github-MCP project it recomputes the file tree hash with collect-files.mjs and compares it with what record-push.mjs recorded. Push first, then publish. Never run publish.sh yourself: the credentials only exist in this tool's process.",
       inputSchema: { name: external_exports.string().min(1).describe("project name") }
     },
     async (input) => handlePublish(input, ctx)
@@ -25270,7 +25188,7 @@ function registerTools(server, ctx) {
 async function main() {
   const env = readEnv();
   log("boot", { pid: process.pid, root: env.root ?? "(unset)", personaRoot: env.personaRoot ?? "(unset)" });
-  const server = new McpServer({ name: "clawd-app-builder", version: "0.2.0" });
+  const server = new McpServer({ name: "clawd-app-builder", version: "0.3.0" });
   registerTools(server, { env });
   await server.connect(new StdioServerTransport());
 }
@@ -25285,7 +25203,6 @@ if (isMainModule) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   handleCreateProject,
-  handleListProjects,
   handlePublish,
   handleRemoveProject,
   readEnv,