@clawos-dev/clawd 0.2.517 → 0.2.518

package/dist/cli.cjs

@@ -5950,6 +5950,27 @@ var init_contact_handshake = __esm({
   }
 });
 
+// ../protocol/src/github-auth-schemas.ts
+var GithubAuthStatusSchema, GithubAuthAuthorizeArgsSchema, GithubAuthOauthStartArgsSchema;
+var init_github_auth_schemas = __esm({
+  "../protocol/src/github-auth-schemas.ts"() {
+    "use strict";
+    init_zod();
+    GithubAuthStatusSchema = external_exports.discriminatedUnion("status", [
+      external_exports.object({ status: external_exports.literal("authorized"), login: external_exports.string().min(1), source: external_exports.enum(["git", "file"]) }).strict(),
+      external_exports.object({ status: external_exports.literal("missing") }).strict(),
+      external_exports.object({ status: external_exports.literal("invalid"), message: external_exports.string().min(1) }).strict(),
+      external_exports.object({ status: external_exports.literal("pending"), authUrl: external_exports.string().url() }).strict()
+    ]);
+    GithubAuthAuthorizeArgsSchema = external_exports.object({
+      token: external_exports.string().min(1)
+    }).strict();
+    GithubAuthOauthStartArgsSchema = external_exports.object({
+      returnTo: external_exports.string().url().optional()
+    }).strict();
+  }
+});
+
 // ../protocol/src/environment-schemas.ts
 function connectorBlockers(c2) {
   if (!c2.credentialSource) return [`\u8FDE\u63A5\u5668 ${c2.name} \u8FD8\u6CA1\u9009\u7528\u8C01\u7684\u8D26\u53F7`];
@@ -6077,11 +6098,12 @@ function cloudEngineOk(tool) {
 function repoSlug(url) {
   return url.trim().replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
 }
-var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployRepoSchema, DeployGithubStatusSchema, DeploySecretPresenceSchema, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, DeployStateSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployStartArgsSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeployGithubAuthorizeArgsSchema, DeployGithubOauthStartArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
+var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployRepoSchema, DeploySecretPresenceSchema, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, DeployStateSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployStartArgsSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
 var init_deploy_schemas = __esm({
   "../protocol/src/deploy-schemas.ts"() {
     "use strict";
     init_zod();
+    init_github_auth_schemas();
     init_environment_schemas();
     DeployFileSchema = external_exports.object({
       version: external_exports.literal(1),
@@ -6148,12 +6170,6 @@ var init_deploy_schemas = __esm({
       /** 本地领先远端几个提交 */
       ahead: external_exports.number()
     }).strict();
-    DeployGithubStatusSchema = external_exports.discriminatedUnion("status", [
-      external_exports.object({ status: external_exports.literal("authorized"), login: external_exports.string().min(1), source: external_exports.enum(["git", "file"]) }).strict(),
-      external_exports.object({ status: external_exports.literal("missing") }).strict(),
-      external_exports.object({ status: external_exports.literal("invalid"), message: external_exports.string().min(1) }).strict(),
-      external_exports.object({ status: external_exports.literal("pending"), authUrl: external_exports.string().url() }).strict()
-    ]);
     DeploySecretPresenceSchema = external_exports.object({
       env: external_exports.string().min(1),
       setAt: external_exports.number().optional()
@@ -6183,8 +6199,8 @@ var init_deploy_schemas = __esm({
     }).strict();
     DeployStateSchema = external_exports.object({
       personaId: external_exports.string().min(1),
-      /** 本机 GitHub 身份。daemon 每次现算；老 daemon 不给（可选只为兼容），UI 缺席时按未知处理 */
-      github: DeployGithubStatusSchema.optional(),
+      /** 本机 GitHub 身份（机器级，githubAuth:* 的同一份；上云页顶上那张卡用）。老 daemon 不给（可选只为兼容），UI 缺席时按未知处理 */
+      github: GithubAuthStatusSchema.optional(),
       repo: DeployRepoSchema.optional(),
       file: DeployFileSchema.optional(),
       scan: DeployScanSchema.optional(),
@@ -6229,14 +6245,6 @@ var init_deploy_schemas = __esm({
       // 环境变量名 → 值。key 必须是该 secret 声明过的 env 之一，handler 校验。
       values: external_exports.record(external_exports.string(), external_exports.string())
     }).strict();
-    DeployGithubAuthorizeArgsSchema = external_exports.object({
-      personaId: external_exports.string().min(1),
-      token: external_exports.string().min(1)
-    }).strict();
-    DeployGithubOauthStartArgsSchema = external_exports.object({
-      personaId: external_exports.string().min(1),
-      returnTo: external_exports.string().url().optional()
-    }).strict();
     DeployRerunJobArgsSchema = external_exports.object({
       personaId: external_exports.string().min(1),
       /** GitHub 的 job databaseId。**是数字**——字符串会在拼命令时静默出错 */
@@ -8672,6 +8680,7 @@ var init_methods = __esm({
     init_attachment_schemas();
     init_contact_handshake();
     init_deploy_schemas();
+    init_github_auth_schemas();
     init_contact_remote_access();
     init_cloud_connector_schemas();
     init_contact();
@@ -8909,13 +8918,18 @@ var init_methods = __esm({
         summary: "\u539F\u6837\u91CD\u8DD1\u6700\u65B0\u90A3\u6761\u6D41\u6C34\u7EBF\u91CC\u5931\u8D25\u7684\u67D0\u4E00\u6BB5\uFF08GitHub REST rerun job\uFF09\u3002**\u540C\u4E00\u4E2A commit\u3001\u540C\u4E00\u4EFD\u8F93\u5165**\uFF0C\u4E0D\u4EA7\u751F\u65B0\u63D0\u4EA4\u2014\u2014\u6539\u4E86 persona \u5185\u5BB9\u6216\u51ED\u636E\u8981\u8D70 deploy:release\u3002jobId \u5FC5\u987B\u5C5E\u4E8E\u6700\u65B0\u90A3\u6761 run\uFF1Bowner-only",
         args: DeployRerunJobArgsSchema
       },
-      "deploy:githubAuthorize": {
-        summary: "\u628A\u7528\u6237\u7C98\u7684 GitHub token \u5B58\u6210\u672C\u673A git \u7684\u8EAB\u4EFD\uFF1A\u5148 GET /user \u9A8C\u8BC1\uFF0C\u518D git credential approve \u4EA4\u7ED9 git \u7684 helper \u5B58\uFF08git \u6CA1\u914D helper \u65F6\u9000\u5230\u672C\u673A\u51ED\u636E\u8868\uFF09\u3002\u4E0A\u4E91\u7684\u5EFA\u4ED3 / \u63A8\u9001 / \u5199 Secrets / \u67E5\u6D41\u6C34\u7EBF\u90FD\u7528\u5B83\u3002\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E token\uFF1Bowner-only",
-        args: DeployGithubAuthorizeArgsSchema
+      // ---- githubAuth:*（本机 GitHub 身份，机器级；spec 2026-09-15-github-auth-unify-design §4.3）----
+      "githubAuth:get": {
+        summary: "\u672C\u673A\u7684 GitHub \u8EAB\u4EFD\uFF1Aauthorized\uFF08@login\uFF0C\u6765\u81EA git \u51ED\u636E\u5B58\u50A8 / \u672C\u673A\u51ED\u636E\u8868\uFF09/ missing / invalid\uFF08GitHub \u4E0D\u8BA4\uFF09/ pending\uFF08\u7B49 GitHub \u8DF3\u56DE\u4E2D\u5FC3\uFF09\u3002\u8BBE\u7F6E\u9875\u300C\u8D26\u53F7\u300D\u3001\u4E0A\u4E91\u9875\u9876\u4E0A\u90A3\u5F20\u5361\u3001PR \u6536\u4EF6\u7BB1\u90FD\u770B\u5B83\uFF1Bpending \u671F\u9875\u9762\u6BCF 2 \u79D2\u8F6E\u8BE2\uFF0Cdaemon \u987A\u624B\u5411\u4E2D\u5FC3\u9886 token\u3002\u65E0\u53C2\u6570",
+        args: NO_ARGS
+      },
+      "githubAuth:oauthStart": {
+        summary: "\u8BBE\u7F6E\u9875\u300C\u5173\u8054 GitHub\u300D\uFF1Adaemon \u5E26\u672C\u673A\u767B\u5F55\u51ED\u8BC1\u5411\u4E2D\u5FC3\u8981\u4E00\u6761 GitHub OAuth \u6388\u6743\u94FE\u63A5\u5E76\u56DE\u5728\u72B6\u6001\uFF08pending\uFF09\u91CC\uFF0C\u9875\u9762\u6253\u5F00\u5B83\uFF1B\u7528\u6237\u5728 GitHub \u70B9\u540C\u610F\u540E\u56DE\u8DF3\u4E2D\u5FC3\uFF0C\u4E2D\u5FC3\u6362\u597D token \u5B58\u4E00\u4EFD\uFF0Cdaemon \u5728\u4E4B\u540E\u7684 githubAuth:get \u91CC\u9886\u56DE\u6765\u5B58\u8FDB\u672C\u673A git\u3002\u4E2D\u5FC3\u5DF2\u6709\u672C\u4EBA\u7684 token \u65F6\u4E0D\u8DF3 GitHub\uFF0C\u76F4\u63A5\u9886\uFF1B\u8981\u767B\u5F55\u98DE\u4E66\uFF1Bowner-only",
+        args: GithubAuthOauthStartArgsSchema
       },
-      "deploy:githubOauthStart": {
-        summary: "\u4E0A\u4E91\u9875\u300C\u7528 GitHub \u6388\u6743\u300D\uFF1Adaemon \u5E26\u672C\u673A\u767B\u5F55\u51ED\u8BC1\u5411\u4E2D\u5FC3\u8981\u4E00\u6761 GitHub OAuth \u6388\u6743\u94FE\u63A5\u5E76\u56DE\u5728 DeployState.github\uFF08pending\uFF09\u91CC\uFF0C\u9875\u9762\u6253\u5F00\u5B83\uFF1B\u7528\u6237\u5728 GitHub \u70B9\u540C\u610F\u540E\u56DE\u8DF3\u4E2D\u5FC3\uFF0C\u4E2D\u5FC3\u6362\u597D token \u5B58\u4E00\u4EFD\uFF0Cdaemon \u5728\u4E4B\u540E\u7684 deploy:get \u91CC\u9886\u56DE\u6765\u5B58\u8FDB\u672C\u673A git\u3002\u4E2D\u5FC3\u5DF2\u6709\u672C\u4EBA\u7684 token \u65F6\u4E0D\u8DF3 GitHub\uFF0C\u76F4\u63A5\u9886\uFF1B\u8981\u767B\u5F55\u98DE\u4E66\uFF1Bowner-only",
-        args: DeployGithubOauthStartArgsSchema
+      "githubAuth:authorize": {
+        summary: "\u628A\u7528\u6237\u7C98\u7684 GitHub token \u5B58\u6210\u672C\u673A\u8EAB\u4EFD\uFF08\u70B9\u94FE\u63A5\u8D70\u4E0D\u901A\u65F6\u7684\u9000\u8DEF\uFF09\uFF1A\u5148 GET /user \u9A8C\u8BC1\uFF0C\u518D git credential approve \u4EA4\u7ED9 git \u7684 helper \u5B58\uFF08git \u6CA1\u914D helper \u65F6\u9000\u5230\u672C\u673A\u51ED\u636E\u8868 secrets/github.env\uFF09\u3002\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E token\uFF1Bowner-only",
+        args: GithubAuthAuthorizeArgsSchema
       },
       // ---- cloud:connectors:*（云 persona 卡片上的连接器；design 2026-09-11-mcp-connector §3.8）----
       "cloud:connectors:list": {
@@ -9592,6 +9606,7 @@ var init_runtime = __esm({
     init_environment_schemas();
     init_cloud_connector_schemas();
     init_deploy_schemas();
+    init_github_auth_schemas();
     init_persona_schemas();
     init_persona_mode();
     init_attachment_schemas();
@@ -54810,19 +54825,25 @@ var DEFAULT_TIMEOUT_MS2 = 15e3;
 var MAX_BUFFER = 4 * 1024 * 1024;
 function createGhRunner(defaults) {
   const baseTimeoutMs = defaults?.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  const spawn14 = defaults?.execFile ?? import_node_child_process7.execFile;
   return {
     run(args, opts) {
+      const token = defaults?.token?.();
       return new Promise((resolve9, reject) => {
-        (0, import_node_child_process7.execFile)(
+        spawn14(
           "gh",
           args,
-          { timeout: opts?.timeoutMs ?? baseTimeoutMs, maxBuffer: MAX_BUFFER },
+          {
+            timeout: opts?.timeoutMs ?? baseTimeoutMs,
+            maxBuffer: MAX_BUFFER,
+            env: { ...process.env, ...token ? { GH_TOKEN: token } : {} }
+          },
           (err, stdout, stderr) => {
-            if (!err) return resolve9(stdout);
+            if (!err) return resolve9(String(stdout));
             if (err.code === "ENOENT") {
               return reject(new GhError("gh-missing", "GitHub CLI (gh) \u672A\u5B89\u88C5"));
             }
-            const detail = (stderr ?? "").trim();
+            const detail = String(stderr ?? "").trim();
             reject(new GhError("gh-error", detail !== "" ? detail : err.message, detail));
           }
         );
@@ -58949,8 +58970,8 @@ function createGithubApi(args) {
 }
 
 // src/deploy/github-auth.ts
-var DEPLOY_TOKEN_FILE = "github-deploy.env";
-var DEPLOY_TOKEN_VAR = "GITHUB_DEPLOY_TOKEN";
+var GITHUB_TOKEN_FILE = "github.env";
+var GITHUB_TOKEN_VAR = "GITHUB_TOKEN";
 var HOST = "github.com";
 var TIMEOUT_MS2 = 15e3;
 var record3 = (fields) => `${Object.entries(fields).map(([k3, v3]) => `${k3}=${v3}`).join("\n")}
@@ -59580,8 +59601,7 @@ var invalid = (msg) => new ClawdError(ERROR_CODES.VALIDATION_ERROR, `VALIDATION_
 function wrongEngine(tool) {
   return cloudEngineOk(tool) ? void 0 : `\u5F15\u64CE\u662F ${tool || "claude"}\uFF0C\u4E91\u4E0A\u53EA\u8DD1 Codex\u2014\u2014\u53BB persona \u8BBE\u7F6E\u91CC\u628A\u5F15\u64CE\u5207\u6210 Codex\uFF0C\u518D\u9009\u4E2A\u6A21\u578B`;
 }
-var NO_GITHUB_AUTH = "\u8FD8\u6CA1\u6388\u6743 GitHub\uFF1A\u5728\u4E0A\u4E91\u9875\u9762\u9876\u4E0A\u90A3\u5F20\u300CGitHub \u6388\u6743\u300D\u5361\u91CC\u70B9\u300C\u7528 GitHub \u6388\u6743\u300D";
-var OAUTH_PENDING_MS = 10 * 6e4;
+var NO_GITHUB_AUTH = "\u8FD8\u6CA1\u5173\u8054 GitHub\uFF1A\u5728\u8BBE\u7F6E \u2192 \u8D26\u53F7\uFF08\u6216\u4E0A\u4E91\u9875\u9876\u4E0A\u90A3\u5F20\u5361\uFF09\u91CC\u70B9\u300C\u5173\u8054 GitHub\u300D";
 function toClawdError(err) {
   if (err instanceof ClawdError) return err;
   if (err instanceof RepoError || err instanceof GithubApiError) return new ClawdError(ERROR_CODES.INTERNAL, err.message);
@@ -59597,62 +59617,11 @@ function buildDeployHandlers(deps) {
   const cacheMs = deps.secretsCacheMs ?? SECRETS_CACHE_MS;
   const secretsCache = /* @__PURE__ */ new Map();
   const runCache = /* @__PURE__ */ new Map();
-  const githubStatusCache = /* @__PURE__ */ new Map();
-  let pendingOauth = null;
-  let staleCenterToken;
-  async function adoptToken(token) {
-    await deps.github.store(token);
-    githubStatusCache.clear();
-    secretsCache.clear();
-    pendingOauth = null;
-  }
-  async function claimCenterToken() {
-    let got;
-    try {
-      got = await deps.github.oauth.token();
-    } catch {
-      return false;
-    }
-    if (!got || got.token === staleCenterToken) return false;
-    try {
-      await deps.github.api(got.token).whoami();
-    } catch (err) {
-      if (err instanceof GithubApiError && err.status === 401) staleCenterToken = got.token;
-      return false;
-    }
-    await adoptToken(got.token);
-    return true;
-  }
-  async function settlePendingOauth() {
-    if (!pendingOauth) return;
-    if (deps.now() > pendingOauth.expiresAt) {
-      pendingOauth = null;
-      return;
-    }
-    try {
-      await claimCenterToken();
-    } catch {
-      pendingOauth = null;
-    }
-  }
+  deps.githubIdentity.onChange(() => secretsCache.clear());
   async function requireGithub() {
-    const auth = await deps.github.resolve();
+    const auth = await deps.githubIdentity.refresh();
     if (!auth) throw new ClawdError(ERROR_CODES.INTERNAL, NO_GITHUB_AUTH);
-    return { auth, api: deps.github.api(auth.token) };
-  }
-  async function githubStatus(auth) {
-    if (!auth) return { status: "missing" };
-    const hit = githubStatusCache.get(auth.token);
-    if (hit && deps.now() - hit.at < cacheMs) return hit.status;
-    let status;
-    try {
-      const { login } = await deps.github.api(auth.token).whoami();
-      status = { status: "authorized", login, source: auth.source };
-    } catch (err) {
-      status = { status: "invalid", message: err instanceof Error ? err.message : String(err) };
-    }
-    githubStatusCache.set(auth.token, { at: deps.now(), status });
-    return status;
+    return { auth, api: deps.githubApi(auth.token) };
   }
   function mustPersona(personaId2) {
     if (!deps.hasPersona(personaId2)) {
@@ -59670,11 +59639,9 @@ function buildDeployHandlers(deps) {
   async function stateOf(personaId2) {
     const dir = deps.personaDir(personaId2);
     const repo2 = await repoInfo(deps.exec, dir);
-    await settlePendingOauth();
-    const auth = await deps.github.resolve();
-    const current = await githubStatus(auth);
-    const github = pendingOauth && current.status !== "authorized" ? { status: "pending", authUrl: pendingOauth.authUrl } : current;
-    const api = auth ? deps.github.api(auth.token) : void 0;
+    const github = await deps.githubIdentity.status();
+    const auth = deps.githubIdentity.cached();
+    const api = auth ? deps.githubApi(auth.token) : void 0;
     let file;
     let fileError;
     try {
@@ -59944,33 +59911,6 @@ function buildDeployHandlers(deps) {
     }
     return view(personaId2);
   };
-  const githubAuthorize = async (frame, _client, ctx) => {
-    ensureOwner(ctx);
-    const args = parseArgs2(DeployGithubAuthorizeArgsSchema, frame, "deploy:githubAuthorize");
-    mustPersona(args.personaId);
-    const token = args.token.trim();
-    try {
-      await deps.github.api(token).whoami();
-    } catch (err) {
-      throw invalid(`GitHub \u4E0D\u8BA4\u8FD9\u4E2A token\uFF1A${err instanceof Error ? err.message : String(err)}`);
-    }
-    await adoptToken(token);
-    return view(args.personaId);
-  };
-  const githubOauthStart = async (frame, _client, ctx) => {
-    ensureOwner(ctx);
-    const args = parseArgs2(DeployGithubOauthStartArgsSchema, frame, "deploy:githubOauthStart");
-    mustPersona(args.personaId);
-    const local = await deps.github.resolve();
-    if (!local && await claimCenterToken()) return view(args.personaId);
-    try {
-      staleCenterToken = (await deps.github.oauth.token())?.token;
-    } catch {
-    }
-    const { authUrl } = await deps.github.oauth.start(args.returnTo);
-    pendingOauth = { authUrl, expiresAt: deps.now() + OAUTH_PENDING_MS };
-    return view(args.personaId);
-  };
   return {
     "deploy:start": start,
     "deploy:get": get,
@@ -59979,9 +59919,156 @@ function buildDeployHandlers(deps) {
     "deploy:reportFinding": reportFinding,
     "deploy:finishScan": finishScan,
     "deploy:release": releaseHandler,
-    "deploy:rerunJob": rerunJobHandler,
-    "deploy:githubAuthorize": githubAuthorize,
-    "deploy:githubOauthStart": githubOauthStart
+    "deploy:rerunJob": rerunJobHandler
+  };
+}
+
+// src/github/identity.ts
+var GithubTokenRejected = class extends Error {
+};
+var STATUS_CACHE_MS = 2e4;
+var OAUTH_PENDING_MS = 10 * 6e4;
+function secretsWithGithubIdentity(secrets, auth) {
+  return auth ? { ...secrets, GITHUB_TOKEN: auth.token } : secrets;
+}
+function createGithubIdentity(deps) {
+  const cacheMs = deps.statusCacheMs ?? STATUS_CACHE_MS;
+  let auth;
+  let seq = 0;
+  const statusCache = /* @__PURE__ */ new Map();
+  let pendingOauth = null;
+  let staleCenterToken;
+  const listeners = /* @__PURE__ */ new Set();
+  async function refresh() {
+    const mine = ++seq;
+    const resolved = await deps.resolve();
+    if (mine === seq) auth = resolved;
+    return resolved;
+  }
+  async function whoami(a2) {
+    const hit = statusCache.get(a2.token);
+    if (hit && deps.now() - hit.at < cacheMs) return hit.status;
+    let status2;
+    try {
+      const { login } = await deps.api(a2.token).whoami();
+      status2 = { status: "authorized", login, source: a2.source };
+    } catch (err) {
+      status2 = { status: "invalid", message: err instanceof Error ? err.message : String(err) };
+    }
+    statusCache.set(a2.token, { at: deps.now(), status: status2 });
+    return status2;
+  }
+  async function adopt(token) {
+    auth = await deps.store(token);
+    seq++;
+    statusCache.clear();
+    pendingOauth = null;
+    for (const cb of listeners) cb();
+  }
+  async function claimCenterToken() {
+    let got;
+    try {
+      got = await deps.oauth.token();
+    } catch {
+      return false;
+    }
+    if (!got || got.token === staleCenterToken) return false;
+    try {
+      await deps.api(got.token).whoami();
+    } catch (err) {
+      if (err instanceof GithubApiError && err.status === 401) staleCenterToken = got.token;
+      return false;
+    }
+    await adopt(got.token);
+    return true;
+  }
+  async function settlePendingOauth() {
+    if (!pendingOauth) return;
+    if (deps.now() > pendingOauth.expiresAt) {
+      pendingOauth = null;
+      return;
+    }
+    try {
+      await claimCenterToken();
+    } catch (err) {
+      deps.logger?.warn("github.identity.claim-failed", { message: err instanceof Error ? err.message : String(err) });
+      pendingOauth = null;
+    }
+  }
+  async function status() {
+    await settlePendingOauth();
+    const a2 = await refresh();
+    const current = a2 ? await whoami(a2) : { status: "missing" };
+    return pendingOauth && current.status !== "authorized" ? { status: "pending", authUrl: pendingOauth.authUrl } : current;
+  }
+  return {
+    cached: () => auth,
+    refresh,
+    status,
+    adopt,
+    async authorize(raw) {
+      const token = raw.trim();
+      try {
+        await deps.api(token).whoami();
+      } catch (err) {
+        throw new GithubTokenRejected(`GitHub \u4E0D\u8BA4\u8FD9\u4E2A token\uFF1A${err instanceof Error ? err.message : String(err)}`);
+      }
+      await adopt(token);
+      return status();
+    },
+    /**
+     * 本机还没有身份时先问中心有没有本人现成的 token（换台机器授权过 / 上次跳回来了但 daemon 没轮到）：
+     * 有且 GitHub 认就直接领、不跳 GitHub。本机已有身份（能用的 = 用户要换一个；失效的 = 要重新授权，而中心那份就是这把死的）
+     * 一律跳 GitHub 重来。进 pending 之后每次 status() 顺手问一次中心领没领到。
+     */
+    async oauthStart(returnTo) {
+      const local = await refresh();
+      if (!local && await claimCenterToken()) return status();
+      try {
+        staleCenterToken = (await deps.oauth.token())?.token;
+      } catch {
+      }
+      const { authUrl } = await deps.oauth.start(returnTo);
+      pendingOauth = { authUrl, expiresAt: deps.now() + OAUTH_PENDING_MS };
+      return status();
+    },
+    onChange(cb) {
+      listeners.add(cb);
+      return () => {
+        listeners.delete(cb);
+      };
+    }
+  };
+}
+
+// src/handlers/github-auth.ts
+init_protocol();
+function ensureOwner2(ctx) {
+  if (!ctx || ctx.principal.kind !== "owner") {
+    throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "UNAUTHORIZED: githubAuth:* requires owner ctx");
+  }
+}
+function buildGithubAuthHandlers(deps) {
+  const get = async () => ({ response: await deps.identity.status() });
+  const oauthStart = async (frame, _client, ctx) => {
+    ensureOwner2(ctx);
+    const args = parseArgs2(GithubAuthOauthStartArgsSchema, frame, "githubAuth:oauthStart");
+    return { response: await deps.identity.oauthStart(args.returnTo) };
+  };
+  const authorize = async (frame, _client, ctx) => {
+    ensureOwner2(ctx);
+    const args = parseArgs2(GithubAuthAuthorizeArgsSchema, frame, "githubAuth:authorize");
+    try {
+      return { response: await deps.identity.authorize(args.token) };
+    } catch (err) {
+      if (err instanceof GithubTokenRejected) throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, `VALIDATION_ERROR: ${err.message}`);
+      throw err;
+    }
+  };
+  return {
+    "githubAuth:get": get,
+    "githubAuth:oauthStart": oauthStart,
+    "githubAuth:authorize": authorize
   };
 }
 
@@ -62208,23 +62295,23 @@ async function centralConnectorFill(opts) {
   });
   if (body.ok !== true) throw new CentralClientError("BAD_RESPONSE", "connectors/fields: server did not ack ok");
 }
-async function centralGithubDeployOauthStart(opts) {
-  const body = await centralRequest(opts, "/api/persona-cloud/github-deploy/oauth/start", {
+async function centralGithubAuthOauthStart(opts) {
+  const body = await centralRequest(opts, "/api/persona-cloud/github/oauth/start", {
     method: "POST",
     bearer: opts.ttcJwt,
     body: { provider: opts.provider, ...opts.returnTo ? { returnTo: opts.returnTo } : {} }
   });
-  if (typeof body.authUrl !== "string" || !body.authUrl) throw new CentralClientError("BAD_RESPONSE", "github-deploy/oauth/start: missing authUrl");
+  if (typeof body.authUrl !== "string" || !body.authUrl) throw new CentralClientError("BAD_RESPONSE", "github/oauth/start: missing authUrl");
   return { authUrl: body.authUrl };
 }
-async function centralGithubDeployToken(opts) {
-  const body = await centralRequest(opts, "/api/persona-cloud/github-deploy/oauth/token", {
+async function centralGithubAuthToken(opts) {
+  const body = await centralRequest(opts, "/api/persona-cloud/github/oauth/token", {
     method: "POST",
     bearer: opts.ttcJwt,
     body: { provider: opts.provider }
   });
   if (body.token === null || body.token === void 0) return void 0;
-  if (typeof body.token !== "string" || !body.token) throw new CentralClientError("BAD_RESPONSE", "github-deploy/oauth/token: malformed token");
+  if (typeof body.token !== "string" || !body.token) throw new CentralClientError("BAD_RESPONSE", "github/oauth/token: malformed token");
   return { token: body.token, login: typeof body.login === "string" ? body.login : "" };
 }
 
@@ -67767,7 +67854,7 @@ async function syncOrgMesh(deps) {
 
 // src/handlers/device.ts
 init_protocol();
-function ensureOwner2(ctx) {
+function ensureOwner3(ctx) {
   if (!ctx || ctx.principal.kind !== "owner") {
     throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "UNAUTHORIZED: device:* requires owner ctx");
   }
@@ -67862,14 +67949,14 @@ function createConnectToDevice(deps) {
 function buildDeviceHandlers(deps) {
   const connectToDevice = createConnectToDevice(deps);
   const list = async (_frame, _client, ctx) => {
-    ensureOwner2(ctx);
+    ensureOwner3(ctx);
     const devices = await deps.listDevices().catch(rethrowLoginExpired);
     return {
       response: { type: "device:list:ok", devices }
     };
   };
   const connect = async (frame, _client, ctx) => {
-    ensureOwner2(ctx);
+    ensureOwner3(ctx);
     const { type: _t2, requestId: _r2, ...rest } = frame;
     const args = DeviceConnectArgsSchema.parse(rest);
     const contact = await connectToDevice(args);
@@ -67884,7 +67971,7 @@ function buildDeviceHandlers(deps) {
     };
   };
   const connections = async (_frame, client, ctx) => {
-    ensureOwner2(ctx);
+    ensureOwner3(ctx);
     const entries = deps.listOwnerConnections();
     return {
       response: {
@@ -69609,7 +69696,7 @@ function upsertPeerContact(args) {
 }
 
 // src/handlers/contact.ts
-function ensureOwner3(ctx) {
+function ensureOwner4(ctx) {
   if (!ctx || ctx.principal.kind !== "owner") {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
@@ -69619,7 +69706,7 @@ function ensureOwner3(ctx) {
 }
 function buildContactHandlers(deps) {
   const list = async (_frame, _client, ctx) => {
-    ensureOwner3(ctx);
+    ensureOwner4(ctx);
     return {
       response: {
         type: "contact:list:ok",
@@ -69628,7 +69715,7 @@ function buildContactHandlers(deps) {
     };
   };
   const pin = async (frame, _client, ctx) => {
-    ensureOwner3(ctx);
+    ensureOwner4(ctx);
     const args = parseArgs2(ContactPinArgsSchema, frame, "contact:pin");
     const pinnedAt = args.pinned ? deps.now() : null;
     const hit = deps.store.setPin(args.deviceId, pinnedAt);
@@ -69652,7 +69739,7 @@ function buildContactHandlers(deps) {
     };
   };
   const setNote = async (frame, _client, ctx) => {
-    ensureOwner3(ctx);
+    ensureOwner4(ctx);
     const args = parseArgs2(ContactSetNoteArgsSchema, frame, "contact:setNote");
     const hit = deps.store.setNote(args.deviceId, args.note);
     if (!hit) {
@@ -69675,13 +69762,13 @@ function buildContactHandlers(deps) {
     };
   };
   const orgPeers = async (_frame, _client, ctx) => {
-    ensureOwner3(ctx);
+    ensureOwner4(ctx);
     return {
       response: { type: "org:peers:ok", peers: getCachedOrgPeers() }
     };
   };
   const remove = async (frame, _client, ctx) => {
-    ensureOwner3(ctx);
+    ensureOwner4(ctx);
     const args = parseArgs2(ContactRemoveArgsSchema, frame, "contact:remove");
     deps.store.removeByDeviceId(args.deviceId);
     deps.broadcast({
@@ -69755,7 +69842,7 @@ function buildContactHandlers(deps) {
 
 // src/handlers/contact-remote-access.ts
 init_protocol();
-function ensureOwner4(ctx) {
+function ensureOwner5(ctx) {
   if (!ctx || ctx.principal.kind !== "owner") {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
@@ -69765,7 +69852,7 @@ function ensureOwner4(ctx) {
 }
 function buildContactRemoteAccessHandlers(deps) {
   const setRemoteAccess = async (frame, _client, ctx) => {
-    ensureOwner4(ctx);
+    ensureOwner5(ctx);
     const args = parseArgs2(ContactSetRemoteAccessArgsSchema, frame, "contact:setRemoteAccess");
     const hit = deps.store.setRemoteAccess(args.deviceId, {
       remoteAccessAllowed: args.remoteAccessAllowed
@@ -69925,7 +70012,7 @@ function buildFeishuAuthHandlers(deps) {
 
 // src/handlers/cloud-connectors.ts
 init_protocol();
-function ensureOwner5(ctx) {
+function ensureOwner6(ctx) {
   if (!ctx || ctx.principal.kind !== "owner") {
     throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "UNAUTHORIZED: cloud:connectors:* requires owner ctx");
   }
@@ -69945,7 +70032,7 @@ function buildCloudConnectorsHandlers(deps) {
     return { gatewayPersonaId: persona.cloud.personaId, connectors: all.filter((c2) => c2.credentialSource === "personal") };
   }
   const list = async (frame, _client, ctx) => {
-    ensureOwner5(ctx);
+    ensureOwner6(ctx);
     const { personaId: personaId2 } = parseArgs2(CloudConnectorsListArgsSchema, frame, "cloud:connectors:list");
     const { gatewayPersonaId, connectors } = await personalConnectors(personaId2);
     if (connectors.length === 0) return { response: { type: "cloud:connectors:list:ok", connectors: [] } };
@@ -69956,7 +70043,7 @@ function buildCloudConnectorsHandlers(deps) {
     return { response: { type: "cloud:connectors:list:ok", connectors: parsed.data.connectors } };
   };
   const fill = async (frame, _client, ctx) => {
-    ensureOwner5(ctx);
+    ensureOwner6(ctx);
     const args = parseArgs2(CloudConnectorFillArgsSchema, frame, "cloud:connectors:fill");
     const { connectors } = await personalConnectors(args.personaId);
     const connector = connectors.find((c2) => c2.name === args.name);
@@ -70027,8 +70114,6 @@ var METHOD_GRANT_MAP = {
   "deploy:finishScan": ADMIN_ANY,
   "deploy:release": ADMIN_ANY,
   "deploy:rerunJob": ADMIN_ANY,
-  "deploy:githubAuthorize": ADMIN_ANY,
-  "deploy:githubOauthStart": ADMIN_ANY,
   // cloud:connectors:*（云 persona 卡片上的连接器；design 2026-09-11-mcp-connector）：
   // 拿本机登录凭证向中心代查 / 代填使用者本人的凭据，guest 一律够不着
   "cloud:connectors:list": ADMIN_ANY,
@@ -70117,7 +70202,11 @@ var METHOD_GRANT_MAP = {
   "project:create": ADMIN_ANY,
   "project:patch": ADMIN_ANY,
   "project:reveal": ADMIN_ANY,
-  // github:*（PR 收件箱，spec 2026-08-11）：走 owner 本机 gh 凭据，owner-only 一刀切
+  // githubAuth:*（本机 GitHub 身份，机器级；spec 2026-09-15-github-auth-unify）：关联 / 粘 token 只认人手，guest 够不着
+  "githubAuth:get": ADMIN_ANY,
+  "githubAuth:oauthStart": ADMIN_ANY,
+  "githubAuth:authorize": ADMIN_ANY,
+  // github:*（PR 收件箱，spec 2026-08-11）：凭据是 githubAuth 那份身份（GH_TOKEN），owner-only 一刀切
   "github:status": ADMIN_ANY,
   "github:prList": ADMIN_ANY,
   "github:prDetail": ADMIN_ANY,
@@ -70229,8 +70318,8 @@ var HUMAN_ONLY_METHODS = [
   "deploy:release",
   "deploy:putSecret",
   "deploy:rerunJob",
-  "deploy:githubAuthorize",
-  "deploy:githubOauthStart"
+  "githubAuth:oauthStart",
+  "githubAuth:authorize"
 ];
 var HUMAN_ONLY = new Set(HUMAN_ONLY_METHODS);
 function isHumanOnlyDenied(method, transport) {
@@ -70273,7 +70362,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.517".length > 0 ? "0.2.517" : "dev";
+var version = "0.2.518".length > 0 ? "0.2.518" : "dev";
 
 // src/cli-probe/probe.ts
 var fs77 = __toESM(require("fs"), 1);
@@ -71830,9 +71919,8 @@ function parsePrDetailResponse(json, repoRef) {
 }
 
 // src/handlers/github.ts
-var HOSTNAME = "github.com";
 function buildGithubHandlers(deps) {
-  const { gh } = deps;
+  const { gh, identity } = deps;
   return {
     "github:status": async () => {
       try {
@@ -71843,13 +71931,9 @@ function buildGithubHandlers(deps) {
         }
         throw err;
       }
-      try {
-        await gh.run(["auth", "status", "--active", "--hostname", HOSTNAME]);
-      } catch {
-        return { response: { installed: true, authenticated: false } };
-      }
-      const login = (await gh.run(["api", "user", "--jq", ".login"])).trim();
-      const response = { installed: true, authenticated: true, login };
+      const st2 = await identity.status();
+      if (st2.status !== "authorized") return { response: { installed: true, authenticated: false } };
+      const response = { installed: true, authenticated: true, login: st2.login };
       return { response };
     },
     "github:prList": async (frame) => {
@@ -71937,7 +72021,7 @@ function buildGithubHandlers(deps) {
 
 // src/handlers/visitor.ts
 init_protocol();
-function ensureOwner6(ctx) {
+function ensureOwner7(ctx) {
   if (!ctx || ctx.principal.kind !== "owner") {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
@@ -71947,7 +72031,7 @@ function ensureOwner6(ctx) {
 }
 function buildVisitorHandlers(deps) {
   const list = async (_frame, _client, ctx) => {
-    ensureOwner6(ctx);
+    ensureOwner7(ctx);
     return {
       response: {
         type: "visitor:list",
@@ -72265,7 +72349,7 @@ function buildMethodHandlers(deps) {
       ownerIdProvider: deps.shiftOwnerIdProvider,
       now: () => Date.now()
     }),
-    ...buildGithubHandlers({ gh: deps.ghRunner }),
+    ...buildGithubHandlers({ gh: deps.ghRunner, identity: deps.githubIdentity }),
     ...buildVisitorHandlers({ visitorStore: deps.visitorStore })
   };
   handlers["meta:methods"] = buildMetaMethodsHandler({
@@ -73084,13 +73168,46 @@ async function startDaemon(config) {
   const secretsBundleRoot = findSecretsBundleRoot(logger);
   const localSecretsDir = import_node_path79.default.join(config.dataDir, LOCAL_SECRETS_DIRNAME);
   const readSecrets = () => readSecretTable({ bundleRoot: secretsBundleRoot, overrideDir: localSecretsDir, logger });
+  const githubIdentity = createGithubIdentity({
+    resolve: () => resolveGithubAuth({ exec: runCommand, fileToken: () => readSecrets()[GITHUB_TOKEN_VAR] }),
+    store: (token) => storeGithubAuth({
+      exec: runCommand,
+      token,
+      writeFileToken: (t2) => {
+        upsertEnvFileVar(import_node_path79.default.join(localSecretsDir, GITHUB_TOKEN_FILE), GITHUB_TOKEN_VAR, t2);
+        logger.warn("github.identity.token-in-file", { reason: "git \u6CA1\u914D credential helper\uFF0Ctoken \u843D\u672C\u673A\u51ED\u636E\u8868", file: GITHUB_TOKEN_FILE });
+      }
+    }),
+    api: (token) => createGithubApi({ token }),
+    oauth: {
+      start: async (returnTo) => {
+        const r2 = ownerIdentityStore.read();
+        if (!r2) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "FEISHU_LOGIN_REQUIRED: \u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u5173\u8054 GitHub \u8981\u7ECF\u4E2D\u5FC3\uFF1B\u5148\u767B\u5F55\uFF0C\u6216\u5728\u5361\u7247\u4E0A\u624B\u52A8\u7C98 token");
+        try {
+          return await centralGithubAuthOauthStart({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ttcJwt: r2.ttcToken, provider: r2.identity.provider, ...returnTo ? { returnTo } : {} });
+        } catch (err) {
+          throw new ClawdError(ERROR_CODES.INTERNAL, `\u5411\u4E2D\u5FC3\u8981 GitHub \u6388\u6743\u94FE\u63A5\u6CA1\u6210\uFF1A${err instanceof Error ? err.message : String(err)}`);
+        }
+      },
+      token: async () => {
+        const r2 = ownerIdentityStore.read();
+        if (!r2) return void 0;
+        return centralGithubAuthToken({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ttcJwt: r2.ttcToken, provider: r2.identity.provider });
+      }
+    },
+    now: () => Date.now(),
+    logger
+  });
+  void githubIdentity.refresh();
   let refreshAppBuilderMcpConfig;
   const resolvePersonaMcpConfig = (personaId2) => {
     refreshAppBuilderMcpConfig?.(personaId2);
+    const secrets = secretsWithGithubIdentity(readSecrets(), githubIdentity.cached());
+    void githubIdentity.refresh();
     return renderPersonaMcpSecrets({
       personaId: personaId2,
       personaDir: import_node_path79.default.join(config.dataDir, "personas", personaId2),
-      secrets: readSecrets(),
+      secrets,
       outDir: import_node_path79.default.join(config.dataDir, "persona-mcp"),
       logger
     });
@@ -73928,8 +74045,9 @@ async function startDaemon(config) {
       // daemon 稳定身份），跟我们 ShiftStore boot 时用的 provider 一致。
       shiftStore,
       shiftOwnerIdProvider: () => ownerPrincipalId,
-      // PR 收件箱：github:* handler spawn 本机 gh CLI（凭据复用 gh 登录态）
-      ghRunner: createGhRunner(),
+      // PR 收件箱：github:* handler spawn 本机 gh CLI，凭据是 clawd 的 GitHub 身份（GH_TOKEN），没有才是 gh 自己的登录态
+      ghRunner: createGhRunner({ token: () => githubIdentity.cached()?.token }),
+      githubIdentity,
       // persona web 分享：visitor:list owner RPC 读访客名单（同 exchange upsert 的实例）
       visitorStore
     })
@@ -74044,38 +74162,8 @@ async function startDaemon(config) {
       return p3 ? { ...p3.tool ? { tool: p3.tool } : {}, ...p3.model ? { model: p3.model } : {} } : void 0;
     },
     exec: runCommand,
-    // GitHub 的身份 = 本机 git 的身份（spec 2026-09-14-persona-deploy-github-api §3.1）：先问 git 的凭据存储，
-    // 没有退到本机凭据表里上云专用的那条（GITHUB_DEPLOY_TOKEN，与 app-builder 的 GITHUB_TOKEN 刻意不同名）；
-    // 授权时先交给 git 存，git 没配 helper 才写 <dataDir>/secrets/github-deploy.env。顺序 / 退路的规则在 github-auth.ts，有测试
-    github: {
-      resolve: () => resolveGithubAuth({ exec: runCommand, fileToken: () => readSecrets()[DEPLOY_TOKEN_VAR] }),
-      store: (token) => storeGithubAuth({
-        exec: runCommand,
-        token,
-        writeFileToken: (t2) => {
-          upsertEnvFileVar(import_node_path79.default.join(localSecretsDir, DEPLOY_TOKEN_FILE), DEPLOY_TOKEN_VAR, t2);
-          logger.warn("deploy.github.token-in-file", { reason: "git \u6CA1\u914D credential helper\uFF0Ctoken \u843D\u672C\u673A\u51ED\u636E\u8868", file: DEPLOY_TOKEN_FILE });
-        }
-      }),
-      api: (token) => createGithubApi({ token }),
-      // 点链接的 OAuth 经中心（spec §8）：登录凭证只在 daemon 内部传给中心，与 cloudConnectors 同一条纪律
-      oauth: {
-        start: async (returnTo) => {
-          const r2 = ownerIdentityStore.read();
-          if (!r2) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "FEISHU_LOGIN_REQUIRED: \u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u7528 GitHub \u6388\u6743\u8981\u7ECF\u4E2D\u5FC3\uFF1B\u5148\u767B\u5F55\uFF0C\u6216\u5728\u5361\u7247\u4E0A\u624B\u52A8\u7C98 token");
-          try {
-            return await centralGithubDeployOauthStart({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ttcJwt: r2.ttcToken, provider: r2.identity.provider, ...returnTo ? { returnTo } : {} });
-          } catch (err) {
-            throw new ClawdError(ERROR_CODES.INTERNAL, `\u5411\u4E2D\u5FC3\u8981 GitHub \u6388\u6743\u94FE\u63A5\u6CA1\u6210\uFF1A${err instanceof Error ? err.message : String(err)}`);
-          }
-        },
-        token: async () => {
-          const r2 = ownerIdentityStore.read();
-          if (!r2) return void 0;
-          return centralGithubDeployToken({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ttcJwt: r2.ttcToken, provider: r2.identity.provider });
-        }
-      }
-    },
+    githubIdentity,
+    githubApi: (token) => createGithubApi({ token }),
     org: PERSONA_REPO_ORG,
     now: () => Date.now(),
     startScan: (personaId2, scanBase) => {
@@ -74122,6 +74210,7 @@ async function startDaemon(config) {
     }
   });
   Object.assign(handlers, deployHandlers);
+  Object.assign(handlers, buildGithubAuthHandlers({ identity: githubIdentity }));
   const shiftSpawnFn = createShiftSpawnFn({ sessionManager: manager });
   const shiftScheduler = createShiftScheduler({
     store: shiftStore,