@clawos-dev/clawd 0.2.581 → 0.2.582

package/dist/app-builder-plugin/mcp-server.cjs

@@ -21706,6 +21706,12 @@ var DeployRunSchema = external_exports.object({
   /** run 刚入队时可能一条都还没有 */
   jobs: external_exports.array(DeployJobSchema)
 }).strict();
+var DeployUnpublishRunSchema = external_exports.object({
+  runId: external_exports.number(),
+  status: DeployRunSchema.shape.status,
+  conclusion: external_exports.enum(["success", "failure"]).optional(),
+  htmlUrl: external_exports.string().min(1)
+}).strict();
 var DeployStateSchema = external_exports.object({
   personaId: external_exports.string().min(1),
   /** 本机 GitHub 身份（机器级，githubAuth:* 的同一份；上云页顶上那张卡用）。老 daemon 不给（可选只为兼容），UI 缺席时按未知处理 */
@@ -21722,12 +21728,23 @@ var DeployStateSchema = external_exports.object({
    * **缺席是常态**：没推过、没授权 GitHub、GitHub 查不到、仓库还没有 run，都不该让整页打不开——同 `secrets` 的处理。
    */
   run: DeployRunSchema.optional(),
+  /**
+   * 现在在不在线上 = gateway 的正式登记表里有没有它（`/healthz`，跟 persona 列表里云卡片同一个来源）。
+   * **缺席 = 查不到**（没登录飞书 / 连不上云上服务），不是「不在」——页面据此不给下线按钮，也不撤「线上」标。
+   * 不看 `releases`：发布过不等于还在线上（下线过、或者被人用脚本撤了）
+   */
+  online: external_exports.boolean().optional(),
+  /** 最新那次下线流水线。没下线过 / 没仓库 / 没 GitHub 身份 / 查不到都缺席 */
+  unpublish: DeployUnpublishRunSchema.optional(),
   /**
    * `.clawd/deploy-scan.json` 读不出来（坏 JSON / 不合形状）时的人话。有它 `scans` 为空。
    * 页面据此给一条能走的路（重新扫描会重建这个文件），而不是白屏。
    */
   historyError: external_exports.string().optional()
 }).strict();
+var DeployUnpublishResultSchema = external_exports.object({
+  before: external_exports.number().nullable()
+}).strict();
 var DeployReleaseResultSchema = external_exports.object({
   sha: external_exports.string().min(1),
   actionsUrl: external_exports.string().min(1)
@@ -24275,6 +24292,10 @@ var METHOD_DOCS = {
     summary: "\u539F\u6837\u91CD\u8DD1\u6700\u65B0\u90A3\u6761\u6D41\u6C34\u7EBF\u91CC\u5931\u8D25\u7684\u67D0\u4E00\u6BB5\uFF08GitHub REST rerun job\uFF09\u3002**\u540C\u4E00\u4E2A commit\u3001\u540C\u4E00\u4EFD\u8F93\u5165**\uFF0C\u4E0D\u4EA7\u751F\u65B0\u63D0\u4EA4\u2014\u2014\u6539\u4E86 persona \u5185\u5BB9\u8981 deploy:scan \u518D deploy:release\u3002jobId \u5FC5\u987B\u5C5E\u4E8E\u6700\u65B0\u90A3\u6761 run\uFF1Bowner-only",
     args: DeployRerunJobArgsSchema
   },
+  "deploy:unpublish": {
+    summary: "\u4E0B\u7EBF\uFF1A\u89E6\u53D1 persona \u4ED3\u5E93\u91CC\u7684 clawd-unpublish.yml\uFF08workflow_dispatch\uFF09\uFF0C\u7531\u6D41\u6C34\u7EBF\u5728 gateway \u64A4\u6389\u6B63\u5F0F\u767B\u8BB0\u2014\u2014\u522B\u4EBA\u770B\u4E0D\u5230\u3001\u7528\u4E0D\u4E86\uFF1B\u4ED3\u5E93 / \u955C\u50CF / \u672C\u673A\u4E0A\u4E91\u8BB0\u5F55\u90FD\u4E0D\u52A8\uFF0C\u91CD\u65B0\u53D1\u5E03\u5C31\u56DE\u6765\u3002\u6700\u540E\u4E00\u6B21\u53D1\u5E03\u7684 commit \u91CC\u6CA1\u6709\u8FD9\u4EFD workflow\uFF08\u65E7\u6A21\u677F\uFF09\u65F6\u62D2\uFF0C\u8981\u5148\u91CD\u65B0\u53D1\u5E03\u4E00\u6B21\u3002\u56DE { before }\uFF1A\u89E6\u53D1\u4E4B\u524D\u73B0\u67E5\u7684\u6700\u65B0\u4E0B\u7EBF run id\uFF08\u6CA1\u4E0B\u7EBF\u8FC7 = null\uFF09\uFF0C\u9875\u9762\u62FF\u5B83\u8BA4\u65B0 run\uFF1Bowner-only\u3001human-only",
+    args: DeployPersonaArgsSchema
+  },
   // ---- githubAuth:*（本机 GitHub 身份，机器级；spec 2026-09-15-github-auth-unify-design §4.3）----
   "githubAuth:get": {
     summary: "\u672C\u673A\u7684 GitHub \u8EAB\u4EFD\uFF1Aauthorized\uFF08@login\uFF0C\u6765\u81EA git \u51ED\u636E\u5B58\u50A8 / \u672C\u673A\u51ED\u636E\u8868\uFF09/ missing / invalid\uFF08GitHub \u4E0D\u8BA4\uFF09/ pending\uFF08\u7B49 GitHub \u8DF3\u56DE\u4E2D\u5FC3\uFF09\u3002\u8BBE\u7F6E\u9875\u300C\u8D26\u53F7\u300D\u3001\u4E0A\u4E91\u9875\u9876\u4E0A\u90A3\u5F20\u5361\u3001PR \u6536\u4EF6\u7BB1\u90FD\u770B\u5B83\uFF1Bpending \u671F\u9875\u9762\u6BCF 2 \u79D2\u8F6E\u8BE2\uFF0Cdaemon \u987A\u624B\u5411\u4E2D\u5FC3\u9886 token\u3002\u65E0\u53C2\u6570",
@@ -24850,6 +24871,10 @@ var PackageFindingSchema = EnvPackageSchema.omit({ localVersion: true, artifact:
 // src/deploy/templates.ts
 var CLAWOS_REPO = "ottin4ttc/clawos";
 var CLAWOS_REF = "release";
+var DEPLOY_WORKFLOW_FILE = "clawd-deploy.yml";
+var WORKFLOW_PATH = `.github/workflows/${DEPLOY_WORKFLOW_FILE}`;
+var UNPUBLISH_WORKFLOW_FILE = "clawd-unpublish.yml";
+var UNPUBLISH_WORKFLOW_PATH = `.github/workflows/${UNPUBLISH_WORKFLOW_FILE}`;
 var ACR_REGISTRY = "registry.cn-hangzhou.aliyuncs.com";
 var ACR_VPC_REGISTRY = "registry-vpc.cn-hangzhou.aliyuncs.com";
 var ACR_NAMESPACE = "ttc-prod";
@@ -24903,6 +24928,7 @@ var ACR_LOGIN_STEPS = [
 ];
 var IMAGE_LATEST = '"$REGISTRY/$ACR_NAMESPACE/${{ steps.plan.outputs.persona_id }}:latest"';
 var RESOLVE_LINE = `          IMAGE_REF=$(node clawos/cloud-host/pipeline/acr.mjs resolve --image ${IMAGE_LATEST} --vpc-registry "$VPC_REGISTRY")`;
+var CONCURRENCY_GROUP = "  group: persona-cloud-${{ github.repository }}";
 var L = [
   "name: clawd deploy",
   "",
@@ -24923,7 +24949,7 @@ var L = [
   "",
   "concurrency:",
   "  # \u540C\u4E00\u4E2A\u4ED3\u5E93\u7684\u53D1\u5E03\u6392\u961F\u8DD1\uFF0C\u4E0D\u53D6\u6D88\uFF1A\u4E0A\u4E00\u6B21\u53EF\u80FD\u5DF2\u7ECF\u5728\u767B\u8BB0\u6B63\u5F0F\u4E86",
-  "  group: persona-cloud-${{ github.repository }}",
+  CONCURRENCY_GROUP,
   "",
   "env:",
   `  REGISTRY: ${ACR_REGISTRY}`,
@@ -25059,6 +25085,44 @@ var L = [
   ""
 ];
 var WORKFLOW_TEMPLATE = L.join("\n");
+var U = [
+  "name: clawd unpublish",
+  "",
+  "# \u7531 clawd \u751F\u6210\u3001\u7531 clawd \u7EF4\u62A4\uFF1A\u6BCF\u6B21\u300C\u53D1\u5E03\u300D\u90FD\u4F1A\u7528\u5F53\u524D\u6A21\u677F\u91CD\u5199\u8FD9\u4EFD\u6587\u4EF6\u518D\u63D0\u4EA4\uFF0C\u624B\u6539\u4F1A\u88AB\u76D6\u6389\u3002",
+  "# \u4E0B\u7EBF\uFF1A\u5728 gateway \u64A4\u6389\u8FD9\u4E2A persona \u7684\u6B63\u5F0F\u767B\u8BB0\u2014\u2014\u522B\u4EBA\u770B\u4E0D\u5230\u3001\u7528\u4E0D\u4E86\uFF1B\u4ED3\u5E93\u548C\u955C\u50CF\u90FD\u4E0D\u52A8\uFF0C\u91CD\u65B0\u53D1\u5E03\u5C31\u56DE\u6765\u3002",
+  "# \u53EA\u7531 clawd \u4E0A\u4E91\u9875\u7684\u300C\u4E0B\u7EBF\u300D\u89E6\u53D1\uFF08workflow_dispatch\uFF09\uFF0C\u63A8\u4EE3\u7801\u4E0D\u8DD1\u3002\u6B63\u5728\u8DD1\u7684\u5BF9\u8BDD\u4E0D\u6253\u65AD\uFF0C\u8DD1\u5230\u7A7A\u95F2\u81EA\u5DF1\u9000\u3002",
+  "#",
+  "# \u8981\u7684\u7EC4\u7EC7\u7EA7 Secrets\uFF1ACLAWOS_READ_TOKEN\uFF08\u8BFB clawos \u4ED3\u5E93\uFF09\u3001CLAWD_GATEWAY_ADMIN_KEY\uFF1B\u7EC4\u7EC7\u7EA7 Variable\uFF1ACLAWD_GATEWAY_URL\u3002",
+  "",
+  "on:",
+  "  workflow_dispatch:",
+  "",
+  "concurrency:",
+  "  # \u4E0E\u53D1\u5E03\u540C\u4E00\u7EC4\uFF1A\u53D1\u5E03\u5728\u8DD1\u65F6\u70B9\u4E0B\u7EBF\uFF0C\u6392\u5728\u5B83\u540E\u9762\uFF1B\u540E\u70B9\u7684\u9876\u6389\u5148\u70B9\u7684",
+  CONCURRENCY_GROUP,
+  "",
+  "env:",
+  `  CLAWOS_REPO: ${CLAWOS_REPO}`,
+  `  CLAWOS_REF: ${CLAWOS_REF}`,
+  "",
+  "permissions:",
+  "  contents: read",
+  "",
+  "jobs:",
+  "  unpublish:",
+  "    name: unpublish",
+  "    runs-on: ubuntu-latest",
+  "    timeout-minutes: 10",
+  "    steps:",
+  ...CONTRACT_STEPS,
+  "      - name: \u64A4\u767B\u8BB0",
+  "        env:",
+  "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
+  "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
+  "        run: node clawos/cloud-host/pipeline/unregister.mjs --persona-id '${{ steps.plan.outputs.persona_id }}'",
+  ""
+];
+var UNPUBLISH_WORKFLOW_TEMPLATE = U.join("\n");
 
 // src/deploy/exec.ts
 var import_node_child_process2 = require("child_process");

package/dist/cli.cjs

@@ -6168,7 +6168,7 @@ function cloudEngineOk(tool) {
 function repoSlug(url) {
   return url.trim().replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
 }
-var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployStateSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
+var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
 var init_deploy_schemas = __esm({
   "../protocol/src/deploy-schemas.ts"() {
     "use strict";
@@ -6277,6 +6277,12 @@ var init_deploy_schemas = __esm({
       jobs: external_exports.array(DeployJobSchema)
     }).strict();
     CLOUD_ENGINES = ["codex", "pi"];
+    DeployUnpublishRunSchema = external_exports.object({
+      runId: external_exports.number(),
+      status: DeployRunSchema.shape.status,
+      conclusion: external_exports.enum(["success", "failure"]).optional(),
+      htmlUrl: external_exports.string().min(1)
+    }).strict();
     DeployStateSchema = external_exports.object({
       personaId: external_exports.string().min(1),
       /** 本机 GitHub 身份（机器级，githubAuth:* 的同一份；上云页顶上那张卡用）。老 daemon 不给（可选只为兼容），UI 缺席时按未知处理 */
@@ -6293,12 +6299,23 @@ var init_deploy_schemas = __esm({
        * **缺席是常态**：没推过、没授权 GitHub、GitHub 查不到、仓库还没有 run，都不该让整页打不开——同 `secrets` 的处理。
        */
       run: DeployRunSchema.optional(),
+      /**
+       * 现在在不在线上 = gateway 的正式登记表里有没有它（`/healthz`，跟 persona 列表里云卡片同一个来源）。
+       * **缺席 = 查不到**（没登录飞书 / 连不上云上服务），不是「不在」——页面据此不给下线按钮，也不撤「线上」标。
+       * 不看 `releases`：发布过不等于还在线上（下线过、或者被人用脚本撤了）
+       */
+      online: external_exports.boolean().optional(),
+      /** 最新那次下线流水线。没下线过 / 没仓库 / 没 GitHub 身份 / 查不到都缺席 */
+      unpublish: DeployUnpublishRunSchema.optional(),
       /**
        * `.clawd/deploy-scan.json` 读不出来（坏 JSON / 不合形状）时的人话。有它 `scans` 为空。
        * 页面据此给一条能走的路（重新扫描会重建这个文件），而不是白屏。
        */
       historyError: external_exports.string().optional()
     }).strict();
+    DeployUnpublishResultSchema = external_exports.object({
+      before: external_exports.number().nullable()
+    }).strict();
     DeployReleaseResultSchema = external_exports.object({
       sha: external_exports.string().min(1),
       actionsUrl: external_exports.string().min(1)
@@ -9139,6 +9156,10 @@ var init_methods = __esm({
         summary: "\u539F\u6837\u91CD\u8DD1\u6700\u65B0\u90A3\u6761\u6D41\u6C34\u7EBF\u91CC\u5931\u8D25\u7684\u67D0\u4E00\u6BB5\uFF08GitHub REST rerun job\uFF09\u3002**\u540C\u4E00\u4E2A commit\u3001\u540C\u4E00\u4EFD\u8F93\u5165**\uFF0C\u4E0D\u4EA7\u751F\u65B0\u63D0\u4EA4\u2014\u2014\u6539\u4E86 persona \u5185\u5BB9\u8981 deploy:scan \u518D deploy:release\u3002jobId \u5FC5\u987B\u5C5E\u4E8E\u6700\u65B0\u90A3\u6761 run\uFF1Bowner-only",
         args: DeployRerunJobArgsSchema
       },
+      "deploy:unpublish": {
+        summary: "\u4E0B\u7EBF\uFF1A\u89E6\u53D1 persona \u4ED3\u5E93\u91CC\u7684 clawd-unpublish.yml\uFF08workflow_dispatch\uFF09\uFF0C\u7531\u6D41\u6C34\u7EBF\u5728 gateway \u64A4\u6389\u6B63\u5F0F\u767B\u8BB0\u2014\u2014\u522B\u4EBA\u770B\u4E0D\u5230\u3001\u7528\u4E0D\u4E86\uFF1B\u4ED3\u5E93 / \u955C\u50CF / \u672C\u673A\u4E0A\u4E91\u8BB0\u5F55\u90FD\u4E0D\u52A8\uFF0C\u91CD\u65B0\u53D1\u5E03\u5C31\u56DE\u6765\u3002\u6700\u540E\u4E00\u6B21\u53D1\u5E03\u7684 commit \u91CC\u6CA1\u6709\u8FD9\u4EFD workflow\uFF08\u65E7\u6A21\u677F\uFF09\u65F6\u62D2\uFF0C\u8981\u5148\u91CD\u65B0\u53D1\u5E03\u4E00\u6B21\u3002\u56DE { before }\uFF1A\u89E6\u53D1\u4E4B\u524D\u73B0\u67E5\u7684\u6700\u65B0\u4E0B\u7EBF run id\uFF08\u6CA1\u4E0B\u7EBF\u8FC7 = null\uFF09\uFF0C\u9875\u9762\u62FF\u5B83\u8BA4\u65B0 run\uFF1Bowner-only\u3001human-only",
+        args: DeployPersonaArgsSchema
+      },
       // ---- githubAuth:*（本机 GitHub 身份，机器级；spec 2026-09-15-github-auth-unify-design §4.3）----
       "githubAuth:get": {
         summary: "\u672C\u673A\u7684 GitHub \u8EAB\u4EFD\uFF1Aauthorized\uFF08@login\uFF0C\u6765\u81EA git \u51ED\u636E\u5B58\u50A8 / \u672C\u673A\u51ED\u636E\u8868\uFF09/ missing / invalid\uFF08GitHub \u4E0D\u8BA4\uFF09/ pending\uFF08\u7B49 GitHub \u8DF3\u56DE\u4E2D\u5FC3\uFF09\u3002\u8BBE\u7F6E\u9875\u300C\u8D26\u53F7\u300D\u3001\u4E0A\u4E91\u9875\u9876\u4E0A\u90A3\u5F20\u5361\u3001PR \u6536\u4EF6\u7BB1\u90FD\u770B\u5B83\uFF1Bpending \u671F\u9875\u9762\u6BCF 2 \u79D2\u8F6E\u8BE2\uFF0Cdaemon \u987A\u624B\u5411\u4E2D\u5FC3\u9886 token\u3002\u65E0\u53C2\u6570",
@@ -56076,13 +56097,13 @@ async function A2(A4 = {}) {
   (function() {
   }).bind();
   var E3, i2, D3, F3, o2, w3, h2, S3, y3, k3, c2, M3 = function() {
-  }.bind(), U2 = false, G2 = false;
+  }.bind(), U3 = false, G2 = false;
   function J2() {
     var A5 = d2.buffer;
     h2 = new Int8Array(A5), o2 = new Int16Array(A5), g3.HEAPU8 = c2 = new Uint8Array(A5), new Uint16Array(A5), w3 = new Int32Array(A5), k3 = new Uint32Array(A5), S3 = new Float32Array(A5), y3 = new Float64Array(A5);
   }
   function Y2(A5) {
-    g3.onAbort?.(A5), M3(A5 = `Aborted(${A5})`), U2 = true, A5 += ". Build with -sASSERTIONS for more info.";
+    g3.onAbort?.(A5), M3(A5 = `Aborted(${A5})`), U3 = true, A5 += ". Build with -sASSERTIONS for more info.";
     var I4 = new WebAssembly.RuntimeError(A5);
     throw D3?.(I4), I4;
   }
@@ -56240,7 +56261,7 @@ async function A2(A4 = {}) {
     })(0, F3, C3)).instance));
   })(), (function() {
     function A5() {
-      g3.calledRun = true, U2 || (G2 = true, i2?.(g3), g3.onRuntimeInitialized?.(), (function() {
+      g3.calledRun = true, U3 || (G2 = true, i2?.(g3), g3.onRuntimeInitialized?.(), (function() {
         if (g3.postRun) for ("function" == typeof g3.postRun && (g3.postRun = [g3.postRun]); g3.postRun.length; ) H2(g3.postRun.shift());
         N2(K2);
       })());
@@ -59596,6 +59617,9 @@ function createGithubApi(args) {
     },
     async rerunJob(slug, jobId) {
       await must("POST", `/repos/${slug}/actions/jobs/${jobId}/rerun`, "\u91CD\u8DD1\u8FD9\u4E00\u6BB5");
+    },
+    async dispatchWorkflow(slug, file, ref) {
+      await must("POST", `/repos/${slug}/actions/workflows/${encodeURIComponent(file)}/dispatches`, "\u89E6\u53D1\u6D41\u6C34\u7EBF", { ref });
     }
   };
 }
@@ -59663,7 +59687,10 @@ async function storeGithubAuth(args) {
 init_protocol();
 var CLAWOS_REPO = "ottin4ttc/clawos";
 var CLAWOS_REF = "release";
-var WORKFLOW_PATH = ".github/workflows/clawd-deploy.yml";
+var DEPLOY_WORKFLOW_FILE = "clawd-deploy.yml";
+var WORKFLOW_PATH = `.github/workflows/${DEPLOY_WORKFLOW_FILE}`;
+var UNPUBLISH_WORKFLOW_FILE = "clawd-unpublish.yml";
+var UNPUBLISH_WORKFLOW_PATH = `.github/workflows/${UNPUBLISH_WORKFLOW_FILE}`;
 var DOCKERFILE_PATH = "Dockerfile";
 var DOCKERIGNORE_PATH = ".dockerignore";
 var ACR_REGISTRY = "registry.cn-hangzhou.aliyuncs.com";
@@ -59757,6 +59784,7 @@ var ACR_LOGIN_STEPS = [
 ];
 var IMAGE_LATEST = '"$REGISTRY/$ACR_NAMESPACE/${{ steps.plan.outputs.persona_id }}:latest"';
 var RESOLVE_LINE = `          IMAGE_REF=$(node clawos/cloud-host/pipeline/acr.mjs resolve --image ${IMAGE_LATEST} --vpc-registry "$VPC_REGISTRY")`;
+var CONCURRENCY_GROUP = "  group: persona-cloud-${{ github.repository }}";
 var L2 = [
   "name: clawd deploy",
   "",
@@ -59777,7 +59805,7 @@ var L2 = [
   "",
   "concurrency:",
   "  # \u540C\u4E00\u4E2A\u4ED3\u5E93\u7684\u53D1\u5E03\u6392\u961F\u8DD1\uFF0C\u4E0D\u53D6\u6D88\uFF1A\u4E0A\u4E00\u6B21\u53EF\u80FD\u5DF2\u7ECF\u5728\u767B\u8BB0\u6B63\u5F0F\u4E86",
-  "  group: persona-cloud-${{ github.repository }}",
+  CONCURRENCY_GROUP,
   "",
   "env:",
   `  REGISTRY: ${ACR_REGISTRY}`,
@@ -59913,6 +59941,44 @@ var L2 = [
   ""
 ];
 var WORKFLOW_TEMPLATE = L2.join("\n");
+var U2 = [
+  "name: clawd unpublish",
+  "",
+  "# \u7531 clawd \u751F\u6210\u3001\u7531 clawd \u7EF4\u62A4\uFF1A\u6BCF\u6B21\u300C\u53D1\u5E03\u300D\u90FD\u4F1A\u7528\u5F53\u524D\u6A21\u677F\u91CD\u5199\u8FD9\u4EFD\u6587\u4EF6\u518D\u63D0\u4EA4\uFF0C\u624B\u6539\u4F1A\u88AB\u76D6\u6389\u3002",
+  "# \u4E0B\u7EBF\uFF1A\u5728 gateway \u64A4\u6389\u8FD9\u4E2A persona \u7684\u6B63\u5F0F\u767B\u8BB0\u2014\u2014\u522B\u4EBA\u770B\u4E0D\u5230\u3001\u7528\u4E0D\u4E86\uFF1B\u4ED3\u5E93\u548C\u955C\u50CF\u90FD\u4E0D\u52A8\uFF0C\u91CD\u65B0\u53D1\u5E03\u5C31\u56DE\u6765\u3002",
+  "# \u53EA\u7531 clawd \u4E0A\u4E91\u9875\u7684\u300C\u4E0B\u7EBF\u300D\u89E6\u53D1\uFF08workflow_dispatch\uFF09\uFF0C\u63A8\u4EE3\u7801\u4E0D\u8DD1\u3002\u6B63\u5728\u8DD1\u7684\u5BF9\u8BDD\u4E0D\u6253\u65AD\uFF0C\u8DD1\u5230\u7A7A\u95F2\u81EA\u5DF1\u9000\u3002",
+  "#",
+  "# \u8981\u7684\u7EC4\u7EC7\u7EA7 Secrets\uFF1ACLAWOS_READ_TOKEN\uFF08\u8BFB clawos \u4ED3\u5E93\uFF09\u3001CLAWD_GATEWAY_ADMIN_KEY\uFF1B\u7EC4\u7EC7\u7EA7 Variable\uFF1ACLAWD_GATEWAY_URL\u3002",
+  "",
+  "on:",
+  "  workflow_dispatch:",
+  "",
+  "concurrency:",
+  "  # \u4E0E\u53D1\u5E03\u540C\u4E00\u7EC4\uFF1A\u53D1\u5E03\u5728\u8DD1\u65F6\u70B9\u4E0B\u7EBF\uFF0C\u6392\u5728\u5B83\u540E\u9762\uFF1B\u540E\u70B9\u7684\u9876\u6389\u5148\u70B9\u7684",
+  CONCURRENCY_GROUP,
+  "",
+  "env:",
+  `  CLAWOS_REPO: ${CLAWOS_REPO}`,
+  `  CLAWOS_REF: ${CLAWOS_REF}`,
+  "",
+  "permissions:",
+  "  contents: read",
+  "",
+  "jobs:",
+  "  unpublish:",
+  "    name: unpublish",
+  "    runs-on: ubuntu-latest",
+  "    timeout-minutes: 10",
+  "    steps:",
+  ...CONTRACT_STEPS,
+  "      - name: \u64A4\u767B\u8BB0",
+  "        env:",
+  "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
+  "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
+  "        run: node clawos/cloud-host/pipeline/unregister.mjs --persona-id '${{ steps.plan.outputs.persona_id }}'",
+  ""
+];
+var UNPUBLISH_WORKFLOW_TEMPLATE = U2.join("\n");
 
 // src/deploy/exec.ts
 var import_node_child_process9 = require("child_process");
@@ -60028,9 +60094,11 @@ async function writeGitignore(dir) {
   await import_promises6.default.writeFile(gi, mergeGitignore(existing));
 }
 async function writeWorkflow(dir) {
-  const wf = import_node_path36.default.join(dir, WORKFLOW_PATH);
-  await import_promises6.default.mkdir(import_node_path36.default.dirname(wf), { recursive: true });
-  await import_promises6.default.writeFile(wf, WORKFLOW_TEMPLATE);
+  for (const [rel, body] of [[WORKFLOW_PATH, WORKFLOW_TEMPLATE], [UNPUBLISH_WORKFLOW_PATH, UNPUBLISH_WORKFLOW_TEMPLATE]]) {
+    const wf = import_node_path36.default.join(dir, rel);
+    await import_promises6.default.mkdir(import_node_path36.default.dirname(wf), { recursive: true });
+    await import_promises6.default.writeFile(wf, body);
+  }
 }
 async function writeDockerfile(dir, personaId2) {
   await import_promises6.default.writeFile(import_node_path36.default.join(dir, DOCKERFILE_PATH), renderDockerfile(personaId2));
@@ -60109,6 +60177,10 @@ async function hasCommit(exec, dir, sha) {
   const r2 = await git(exec, dir, ["cat-file", "-e", `${sha}^{commit}`]);
   return !r2.spawnError && r2.code === 0;
 }
+async function fileInCommit(exec, dir, sha, rel) {
+  const r2 = await git(exec, dir, ["cat-file", "-e", `${sha}:${rel}`]);
+  return !r2.spawnError && r2.code === 0;
+}
 async function commitAll(exec, args) {
   await mustGit(exec, args.dir, ["add", "-A"], "\u6682\u5B58\u6587\u4EF6");
   const staged = await git(exec, args.dir, ["diff", "--cached", "--quiet"]);
@@ -60147,6 +60219,7 @@ var SCAN_BASE_LABEL = {
 
 // src/deploy/run-status.ts
 init_protocol();
+var runsOf = (slug, file, query) => `/repos/${slug}/actions/workflows/${encodeURIComponent(file)}/runs?${query}`;
 var pipelineJobKey = (name) => DEPLOY_STAGE_KEYS.find((k3) => name === k3 || name.startsWith(`${k3} `));
 function stageStatusOf(status, conclusion) {
   if (status === "queued" || status === "requested" || status === "pending") return "pending";
@@ -60188,7 +60261,7 @@ async function runByHead(api, slug, head) {
   return fetchRun(api, slug, `head_sha=${encodeURIComponent(head)}&per_page=1`);
 }
 async function fetchRun(api, slug, query) {
-  const listed = await api.getJson(`/repos/${slug}/actions/runs?${query}`);
+  const listed = await api.getJson(runsOf(slug, DEPLOY_WORKFLOW_FILE, query));
   const raw = listed?.workflow_runs?.[0];
   if (!raw || typeof raw.id !== "number" || typeof raw.head_sha !== "string" || typeof raw.html_url !== "string") {
     return void 0;
@@ -60210,6 +60283,21 @@ async function fetchRun(api, slug, query) {
     jobs: DEPLOY_STAGE_KEYS.map((k3) => byKey.get(k3)).filter((j2) => j2 !== void 0)
   };
 }
+async function latestUnpublish(api, slug) {
+  const listed = await api.getJson(runsOf(slug, UNPUBLISH_WORKFLOW_FILE, "per_page=1"));
+  const runs = listed?.workflow_runs;
+  if (!Array.isArray(runs)) return void 0;
+  const raw = runs[0];
+  if (!raw) return null;
+  if (typeof raw.id !== "number" || typeof raw.html_url !== "string") return void 0;
+  const status = runStatusOf(String(raw.status ?? ""));
+  return {
+    runId: raw.id,
+    status,
+    htmlUrl: raw.html_url,
+    ...status === "completed" ? { conclusion: raw.conclusion === "success" ? "success" : "failure" } : {}
+  };
+}
 async function rerunJob(api, slug, jobId) {
   await api.rerunJob(slug, jobId);
 }
@@ -60241,6 +60329,8 @@ function reconcileInterruptedScans(deps) {
 // src/handlers/deploy.ts
 var SECRETS_CACHE_MS = 2e4;
 var RUN_CACHE_MS = 4e3;
+var ONLINE_CACHE_MS = 2e4;
+var UNPUBLISH_NEEDS_REPUBLISH = "\u8FD9\u4E2A persona \u7684\u6D41\u6C34\u7EBF\u662F\u65E7\u7248\u7684\uFF0C\u5148\u91CD\u65B0\u626B\u63CF\u3001\u53D1\u5E03\u4E00\u6B21\u518D\u4E0B\u7EBF";
 function ensureOwner(ctx) {
   if (!ctx || ctx.principal.kind !== "owner") {
     throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "UNAUTHORIZED: deploy:* requires owner ctx");
@@ -60301,6 +60391,28 @@ function buildDeployHandlers(deps) {
     runCache.set(key, { at: deps.now(), run });
     return run;
   };
+  const unpublishCache = /* @__PURE__ */ new Map();
+  const cachedUnpublish = async (personaId2, api, slug) => {
+    const hit = unpublishCache.get(personaId2);
+    if (hit && deps.now() - hit.at < RUN_CACHE_MS) return hit.run;
+    const run = await latestUnpublish(api, slug) ?? void 0;
+    unpublishCache.set(personaId2, { at: deps.now(), run });
+    return run;
+  };
+  const onlineCache = /* @__PURE__ */ new Map();
+  const cachedOnline = async (personaId2, run, unpublish) => {
+    const stamp = `${run?.runId ?? "-"}:${run?.status ?? "-"}|${unpublish?.runId ?? "-"}:${unpublish?.status ?? "-"}`;
+    const hit = onlineCache.get(personaId2);
+    if (hit && hit.stamp === stamp && deps.now() - hit.at < ONLINE_CACHE_MS) return hit.online;
+    let online;
+    try {
+      online = await deps.cloudOnline(personaId2);
+    } catch {
+      online = void 0;
+    }
+    onlineCache.set(personaId2, { stamp, at: deps.now(), online });
+    return online;
+  };
   deps.githubIdentity.onChange(() => secretsCache.clear());
   async function requireGithub() {
     const auth = await deps.githubIdentity.refresh();
@@ -60337,6 +60449,7 @@ function buildDeployHandlers(deps) {
     const { scans } = file;
     let secrets;
     let run;
+    let unpublish;
     if (repo2 && api && github.status === "authorized") {
       try {
         secrets = await cachedSecrets(personaId2, dir, api);
@@ -60344,7 +60457,9 @@ function buildDeployHandlers(deps) {
         secrets = void 0;
       }
       run = await cachedRun(personaId2, api, repoSlug(repo2.url), releaseHead);
+      if (releaseHead === void 0) unpublish = await cachedUnpublish(personaId2, api, repoSlug(repo2.url));
     }
+    const online = releaseHead === void 0 && file.releases.length > 0 ? await cachedOnline(personaId2, run, unpublish) : void 0;
     return {
       personaId: personaId2,
       github,
@@ -60353,6 +60468,8 @@ function buildDeployHandlers(deps) {
       releases: file.releases,
       ...secrets ? { secrets } : {},
       ...run ? { run } : {},
+      ...online !== void 0 ? { online } : {},
+      ...unpublish ? { unpublish } : {},
       ...historyError ? { historyError } : {}
     };
   }
@@ -60657,6 +60774,27 @@ function buildDeployHandlers(deps) {
     }
     return view(personaId2);
   };
+  const unpublishHandler = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const { personaId: personaId2 } = parseArgs2(DeployPersonaArgsSchema, frame, "deploy:unpublish");
+    const dir = mustPersona(personaId2);
+    const repo2 = await repoInfo(deps.exec, dir);
+    if (!repo2) throw invalid("\u8FD9\u4E2A persona \u8FD8\u6CA1\u4E0A\u8FC7\u4E91");
+    const { api } = await requireGithub();
+    const last = (await readHistory(dir)).releases.at(-1);
+    if (!last || !await fileInCommit(deps.exec, dir, last.head, UNPUBLISH_WORKFLOW_PATH)) throw invalid(UNPUBLISH_NEEDS_REPUBLISH);
+    const slug = repoSlug(repo2.url);
+    const before = await latestUnpublish(api, slug);
+    if (before === void 0) throw invalid("\u67E5\u4E0D\u5230\u8FD9\u4E2A\u4ED3\u5E93\u4E0A\u7684\u4E0B\u7EBF\u6D41\u6C34\u7EBF\uFF08GitHub \u6CA1\u54CD\u5E94\uFF09\uFF0C\u7A0D\u540E\u518D\u70B9\u4E00\u6B21");
+    try {
+      await api.dispatchWorkflow(slug, UNPUBLISH_WORKFLOW_FILE, "main");
+    } catch (err) {
+      throw new ClawdError(ERROR_CODES.INTERNAL, err instanceof Error ? err.message : String(err));
+    }
+    unpublishCache.delete(personaId2);
+    onlineCache.delete(personaId2);
+    return { response: { type: "deploy:unpublish", before: before?.runId ?? null } };
+  };
   return {
     "deploy:get": get,
     "deploy:scan": scanHandler,
@@ -60665,7 +60803,8 @@ function buildDeployHandlers(deps) {
     "deploy:reportFinding": reportFinding,
     "deploy:finishScan": finishScan,
     "deploy:release": releaseHandler,
-    "deploy:rerunJob": rerunJobHandler
+    "deploy:rerunJob": rerunJobHandler,
+    "deploy:unpublish": unpublishHandler
   };
 }
 
@@ -63205,13 +63344,17 @@ var CloudGatewayClient = class {
     if (!apiKey) throw new CloudApiKeyRequiredError();
     return { apiKey, gatewayUrl };
   }
-  async listPersonas() {
+  /**
+   * `healthzTimeoutMs`：只给 /healthz 那一趟定上限，**问到地址之后才开始计**（上云页的线上状态用；design 2026-09-24-deploy-unpublish）。
+   * 中心那一跳（locate）有它自己的上限，不归这里管。不给 = 同以前，不设
+   */
+  async listPersonas(opts = {}) {
     const { gatewayUrl } = await this.locate();
-    return this.fetchDeployments(gatewayUrl);
+    return this.fetchDeployments(gatewayUrl, opts.healthzTimeoutMs ? AbortSignal.timeout(opts.healthzTimeoutMs) : void 0);
   }
   /** /healthz 的登记表 → official 行。gatewayUrl 由调用方定：listPersonas 从中心拿，personaConnectors 用 persona 文件里的 */
-  async fetchDeployments(gatewayUrl) {
-    const res = await this.fetchImpl(gatewayUrl + GATEWAY_ROUTES.healthz());
+  async fetchDeployments(gatewayUrl, signal) {
+    const res = await this.fetchImpl(gatewayUrl + GATEWAY_ROUTES.healthz(), ...signal ? [{ signal }] : []);
     if (!res.ok) throw new Error(`gateway /healthz \u56DE ${res.status}`);
     const body = await res.json();
     const rows = Array.isArray(body.deployments) ? body.deployments : [];
@@ -71686,6 +71829,7 @@ var METHOD_GRANT_MAP = {
   "deploy:finishScan": ADMIN_ANY,
   "deploy:release": ADMIN_ANY,
   "deploy:rerunJob": ADMIN_ANY,
+  "deploy:unpublish": ADMIN_ANY,
   // cloud:connectors:*（云 persona 卡片上的连接器；design 2026-09-11-mcp-connector）：
   // 拿本机登录凭证向中心代查 / 代填使用者本人的凭据，guest 一律够不着
   "cloud:connectors:list": ADMIN_ANY,
@@ -71899,6 +72043,7 @@ var HUMAN_ONLY_METHODS = [
   "deploy:release",
   "deploy:putSecret",
   "deploy:rerunJob",
+  "deploy:unpublish",
   "githubAuth:oauthStart",
   "githubAuth:authorize"
 ];
@@ -71943,7 +72088,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.581".length > 0 ? "0.2.581" : "dev";
+var version = "0.2.582".length > 0 ? "0.2.582" : "dev";
 
 // src/cli-probe/probe.ts
 var fs80 = __toESM(require("fs"), 1);
@@ -75626,6 +75771,13 @@ async function startDaemon(config) {
     org: PERSONA_REPO_ORG,
     now: () => Date.now(),
     warn: (msg, meta) => logger.warn(msg, meta),
+    // 在不在线上 = gateway 正式登记表里有没有它（design 2026-09-24-deploy-unpublish §3.3）：跟 persona 列表的云卡片同一个来源。
+    // 拉不到（没登录飞书 / gateway 不通 / healthz 5s 没回）→ undefined，页面不给下线按钮也不撤「线上」标。
+    // 失败上界：中心那一跳自带 15s，healthz 这一趟 5s——deploy:get 要保证页面打得开，gateway 接了连接不回时不能挂到 undici 默认的 300s
+    cloudOnline: (personaId2) => cloudGateway.listPersonas({ healthzTimeoutMs: 5e3 }).then(
+      (list) => list.some((p3) => p3.personaId === personaId2),
+      () => void 0
+    ),
     startScan: (personaId2, scanBase, scanId) => {
       const baseLines = scanBase.base ? [
         `\u672C\u6B21\u662F**${SCAN_BASE_LABEL[scanBase.kind]}**\uFF1A\u53EA\u770B\u8DDF\u7EBF\u4E0A\u6B63\u8DD1\u90A3\u7248\u7684\u5DEE\u522B\uFF0C`,