@clawos-dev/clawd 0.2.583 → 0.2.585

package/dist/app-builder-plugin/mcp-server.cjs

@@ -21787,6 +21787,10 @@ var DeployPutSecretArgsSchema = external_exports.object({
   // 环境变量名 → 值。key 必须是该 secret 声明过的 env 之一，handler 校验。
   values: external_exports.record(external_exports.string(), external_exports.string())
 }).strict();
+var DeploySetEngineAuthArgsSchema = external_exports.object({
+  personaId: external_exports.string().min(1),
+  auth: external_exports.object({ baseUrl: external_exports.string(), apiKey: external_exports.string() }).strict().nullable()
+}).strict();
 var DeployRerunJobArgsSchema = external_exports.object({
   personaId: external_exports.string().min(1),
   /** GitHub 的 job databaseId。**是数字**——字符串会在拼命令时静默出错 */
@@ -24273,9 +24277,13 @@ var METHOD_DOCS = {
     args: DeployPatchArgsSchema
   },
   "deploy:putSecret": {
-    summary: "\u628A\u4E00\u6761\u51ED\u636E\u7684\u503C\u5199\u8FDB\u4ED3\u5E93\u7684 GitHub Secrets\uFF08GitHub REST\uFF0C\u503C\u7528\u4ED3\u5E93\u516C\u94A5\u5C01\u7BB1\u540E\u4E0A\u4F20\uFF09\u3002**\u8FD9\u662F\u503C\u552F\u4E00\u7684\u5165\u53E3**\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u503C\u3001\u672C\u673A\u4E0D\u843D\u76D8\u3002env \u540D\u5FC5\u987B\u662F scanId \u90A3\u6B21\u6E05\u5355\u91CC\u8BE5\u51ED\u636E\u58F0\u660E\u8FC7\u7684\uFF1Bowner-only",
+    summary: "\u628A\u4E00\u6761\u51ED\u636E\u7684\u503C\u5199\u8FDB\u4ED3\u5E93\u7684 GitHub Secrets\uFF08GitHub REST\uFF0C\u503C\u7528\u4ED3\u5E93\u516C\u94A5\u5C01\u7BB1\u540E\u4E0A\u4F20\uFF09\u3002**\u8FD9\u662F\u6E05\u5355\u51ED\u636E\u503C\u552F\u4E00\u7684\u5165\u53E3**\uFF08\u6A21\u578B\u8BA2\u9605\u8D70 deploy:setEngineAuth\uFF09\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u503C\u3001\u672C\u673A\u4E0D\u843D\u76D8\u3002env \u540D\u5FC5\u987B\u662F scanId \u90A3\u6B21\u6E05\u5355\u91CC\u8BE5\u51ED\u636E\u58F0\u660E\u8FC7\u7684\uFF1Bowner-only",
     args: DeployPutSecretArgsSchema
   },
+  "deploy:setEngineAuth": {
+    summary: "\u6A21\u578B\u8BA2\u9605\uFF08\u4E91\u4E0A\u8DD1\u8FD9\u4E2A persona \u82B1\u8C01\u7684\u6A21\u578B\u989D\u5EA6\uFF09\uFF1Aauth = { baseUrl, apiKey } \u5199\u8FDB\u4ED3\u5E93 GitHub Secrets \u7684 CLAWD_ENGINE_BASE_URL / CLAWD_ENGINE_API_KEY\uFF08\u5730\u5740\u89C4\u8303\u6210 \u2026/v1\uFF09\uFF0Cnull = \u5220\u8FD9\u4E24\u6761\u3001\u6539\u56DE\u5E73\u53F0\u9ED8\u8BA4\u3002\u4E0B\u6B21\u53D1\u5E03\u751F\u6548\u3002\u540C putSecret \u7684\u7EAA\u5F8B\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u503C\u3001\u672C\u673A\u4E0D\u843D\u76D8\uFF1B\u56DE deploy:get \u540C\u5F62\u7684\u72B6\u6001\uFF1Bowner-only\u3001human-only",
+    args: DeploySetEngineAuthArgsSchema
+  },
   "deploy:reportFinding": {
     summary: "\u626B\u63CF\u4E2D\u7684 butler \u9010\u6761\u4E0A\u62A5\u4E00\u4E2A\u53D1\u73B0\uFF08cli / secret / asset\uFF09\u3002**\u8FB9\u626B\u8FB9\u62A5**\uFF0C\u9875\u9762\u968F\u4E4B\u4E00\u70B9\u70B9\u586B\u5145\uFF1B\u540C (kind,name) \u91CD\u590D\u4E0A\u62A5\u5373\u8986\u76D6\u3002owner-only\u2014\u2014butler \u4F1A\u8BDD\u672C\u8EAB\u8DD1\u5728 owner \u6A21\u5F0F",
     args: DeployReportFindingArgsSchema

package/dist/cli.cjs

@@ -6154,6 +6154,26 @@ var init_environment_schemas = __esm({
 });
 
 // ../protocol/src/deploy-schemas.ts
+function engineAuthState(secrets) {
+  if (!secrets) return void 0;
+  const has = (env) => secrets.some((p3) => p3.env === env && p3.setAt !== void 0);
+  const n2 = [ENGINE_AUTH_SECRETS.baseUrl, ENGINE_AUTH_SECRETS.apiKey].filter(has).length;
+  return n2 === 2 ? "own" : n2 === 0 ? "platform" : "partial";
+}
+function normalizeEngineBaseUrl(raw) {
+  const s2 = raw.trim();
+  let url;
+  try {
+    url = new URL(s2);
+  } catch {
+    throw new Error("\u8BA2\u9605\u5730\u5740\u8981\u4EE5 http:// \u6216 https:// \u5F00\u5934\uFF0C\u5F62\u5982 https://cpa.example.com");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:" || !url.hostname) {
+    throw new Error("\u8BA2\u9605\u5730\u5740\u8981\u4EE5 http:// \u6216 https:// \u5F00\u5934\uFF0C\u5F62\u5982 https://cpa.example.com");
+  }
+  const base = `${url.origin}${url.pathname}`.replace(/\/+$/, "");
+  return base.endsWith("/v1") ? base : `${base}/v1`;
+}
 function contentHeadOf(repo2, released) {
   return released && repo2.head === released.head ? released.contentHead : repo2.head;
 }
@@ -6168,7 +6188,7 @@ function cloudEngineOk(tool) {
 function repoSlug(url) {
   return url.trim().replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
 }
-var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
+var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, ENGINE_AUTH_SECRETS, ENGINE_AUTH_PARTIAL_BLOCKER, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeploySetEngineAuthArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
 var init_deploy_schemas = __esm({
   "../protocol/src/deploy-schemas.ts"() {
     "use strict";
@@ -6253,6 +6273,8 @@ var init_deploy_schemas = __esm({
       env: external_exports.string().min(1),
       setAt: external_exports.number().optional()
     }).strict();
+    ENGINE_AUTH_SECRETS = { baseUrl: "CLAWD_ENGINE_BASE_URL", apiKey: "CLAWD_ENGINE_API_KEY" };
+    ENGINE_AUTH_PARTIAL_BLOCKER = "\u6A21\u578B\u8BA2\u9605\u53EA\u5199\u8FDB\u53BB\u4E00\u534A\u2014\u2014\u91CD\u586B\u6216\u6539\u56DE\u5E73\u53F0\u9ED8\u8BA4";
     DEPLOY_STAGE_STATUSES = ["pending", "running", "done", "failed", "waiting", "skipped"];
     DeployStageStatusSchema = external_exports.enum(DEPLOY_STAGE_STATUSES);
     DEPLOY_STAGE_KEYS = ["build", "smoke", "deploy"];
@@ -6358,6 +6380,10 @@ var init_deploy_schemas = __esm({
       // 环境变量名 → 值。key 必须是该 secret 声明过的 env 之一，handler 校验。
       values: external_exports.record(external_exports.string(), external_exports.string())
     }).strict();
+    DeploySetEngineAuthArgsSchema = external_exports.object({
+      personaId: external_exports.string().min(1),
+      auth: external_exports.object({ baseUrl: external_exports.string(), apiKey: external_exports.string() }).strict().nullable()
+    }).strict();
     DeployRerunJobArgsSchema = external_exports.object({
       personaId: external_exports.string().min(1),
       /** GitHub 的 job databaseId。**是数字**——字符串会在拼命令时静默出错 */
@@ -9137,9 +9163,13 @@ var init_methods = __esm({
         args: DeployPatchArgsSchema
       },
       "deploy:putSecret": {
-        summary: "\u628A\u4E00\u6761\u51ED\u636E\u7684\u503C\u5199\u8FDB\u4ED3\u5E93\u7684 GitHub Secrets\uFF08GitHub REST\uFF0C\u503C\u7528\u4ED3\u5E93\u516C\u94A5\u5C01\u7BB1\u540E\u4E0A\u4F20\uFF09\u3002**\u8FD9\u662F\u503C\u552F\u4E00\u7684\u5165\u53E3**\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u503C\u3001\u672C\u673A\u4E0D\u843D\u76D8\u3002env \u540D\u5FC5\u987B\u662F scanId \u90A3\u6B21\u6E05\u5355\u91CC\u8BE5\u51ED\u636E\u58F0\u660E\u8FC7\u7684\uFF1Bowner-only",
+        summary: "\u628A\u4E00\u6761\u51ED\u636E\u7684\u503C\u5199\u8FDB\u4ED3\u5E93\u7684 GitHub Secrets\uFF08GitHub REST\uFF0C\u503C\u7528\u4ED3\u5E93\u516C\u94A5\u5C01\u7BB1\u540E\u4E0A\u4F20\uFF09\u3002**\u8FD9\u662F\u6E05\u5355\u51ED\u636E\u503C\u552F\u4E00\u7684\u5165\u53E3**\uFF08\u6A21\u578B\u8BA2\u9605\u8D70 deploy:setEngineAuth\uFF09\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u503C\u3001\u672C\u673A\u4E0D\u843D\u76D8\u3002env \u540D\u5FC5\u987B\u662F scanId \u90A3\u6B21\u6E05\u5355\u91CC\u8BE5\u51ED\u636E\u58F0\u660E\u8FC7\u7684\uFF1Bowner-only",
         args: DeployPutSecretArgsSchema
       },
+      "deploy:setEngineAuth": {
+        summary: "\u6A21\u578B\u8BA2\u9605\uFF08\u4E91\u4E0A\u8DD1\u8FD9\u4E2A persona \u82B1\u8C01\u7684\u6A21\u578B\u989D\u5EA6\uFF09\uFF1Aauth = { baseUrl, apiKey } \u5199\u8FDB\u4ED3\u5E93 GitHub Secrets \u7684 CLAWD_ENGINE_BASE_URL / CLAWD_ENGINE_API_KEY\uFF08\u5730\u5740\u89C4\u8303\u6210 \u2026/v1\uFF09\uFF0Cnull = \u5220\u8FD9\u4E24\u6761\u3001\u6539\u56DE\u5E73\u53F0\u9ED8\u8BA4\u3002\u4E0B\u6B21\u53D1\u5E03\u751F\u6548\u3002\u540C putSecret \u7684\u7EAA\u5F8B\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u503C\u3001\u672C\u673A\u4E0D\u843D\u76D8\uFF1B\u56DE deploy:get \u540C\u5F62\u7684\u72B6\u6001\uFF1Bowner-only\u3001human-only",
+        args: DeploySetEngineAuthArgsSchema
+      },
       "deploy:reportFinding": {
         summary: "\u626B\u63CF\u4E2D\u7684 butler \u9010\u6761\u4E0A\u62A5\u4E00\u4E2A\u53D1\u73B0\uFF08cli / secret / asset\uFF09\u3002**\u8FB9\u626B\u8FB9\u62A5**\uFF0C\u9875\u9762\u968F\u4E4B\u4E00\u70B9\u70B9\u586B\u5145\uFF1B\u540C (kind,name) \u91CD\u590D\u4E0A\u62A5\u5373\u8986\u76D6\u3002owner-only\u2014\u2014butler \u4F1A\u8BDD\u672C\u8EAB\u8DD1\u5728 owner \u6A21\u5F0F",
         args: DeployReportFindingArgsSchema
@@ -53313,6 +53343,23 @@ function stringValue(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
 
+// src/tools/first-byte.ts
+var VISIBLE = /* @__PURE__ */ new Set(["thinking", "tool_call", "text"]);
+function createFirstByteClock(now = Date.now) {
+  let at3 = null;
+  return {
+    reset() {
+      at3 = null;
+    },
+    see(events) {
+      if (at3 === null && events.some((e) => VISIBLE.has(e.kind))) at3 = now();
+    },
+    afterFirstByteMs() {
+      return at3 === null ? void 0 : Math.max(0, Math.round(now() - at3));
+    }
+  };
+}
+
 // src/tools/codex-app-server-params.ts
 function resolveApprovalPolicy(ctx) {
   if (ctx.personaMode === "owner" || ctx.personaMode === "guest") return "never";
@@ -53448,6 +53495,7 @@ function driveCodexThread(opts) {
   let threadId = ctx.toolSessionId;
   let turnId;
   let turnOpen = false;
+  const firstByte = createFirstByteClock(opts.now);
   const approvalIds = /* @__PURE__ */ new Map();
   const subagents = new CodexSubagentTracker();
   const effort = ctx.effort;
@@ -53479,10 +53527,13 @@ function driveCodexThread(opts) {
         ...subagents.handleParentNotification(method, params),
         ...translateNotification(method, params)
       ] : [];
-      if (events.length) sink.pushEvents(events);
+      if (events.length) {
+        if (turnOpen) firstByte.see(events);
+        sink.pushEvents(events);
+      }
       if (route === "foreground" && method === "turn/completed") {
         turnOpen = false;
-        opts.onTurnCompleted?.(turnOutcomeOf(params));
+        opts.onTurnCompleted?.(turnOutcomeOf(params), firstByte.afterFirstByteMs());
       }
     },
     onServerRequest: (id, method, params) => {
@@ -53531,6 +53582,7 @@ function driveCodexThread(opts) {
           const opened = !turnOpen;
           if (opened) {
             turnOpen = true;
+            firstByte.reset();
             opts.onTurnStarting?.();
           }
           void client.request("turn/start", {
@@ -53547,7 +53599,7 @@ function driveCodexThread(opts) {
             ]);
             if (!opened) return;
             turnOpen = false;
-            opts.onTurnCompleted?.("failure");
+            opts.onTurnCompleted?.("failure", firstByte.afterFirstByteMs());
           });
         }
       });
@@ -60843,6 +60895,11 @@ function createGithubApi(args) {
       const encrypted_value = await seal(pk.key, value);
       await must("PUT", `/repos/${slug}/actions/secrets/${encodeURIComponent(name)}`, `\u5199 ${name}`, { encrypted_value, key_id: pk.key_id });
     },
+    async deleteSecret(slug, name) {
+      const r2 = await request("DELETE", `/repos/${slug}/actions/secrets/${encodeURIComponent(name)}`);
+      if (r2.status === 404) return;
+      if (r2.status < 200 || r2.status >= 300) throw new GithubApiError(r2.status, explain(r2.status, `\u5220 ${name}`, r2.json));
+    },
     async listSecrets(slug) {
       const j2 = await must("GET", `/repos/${slug}/actions/secrets?per_page=100`, "\u67E5\u4ED3\u5E93 Secrets");
       const rows = Array.isArray(j2?.secrets) ? j2.secrets : [];
@@ -61408,6 +61465,15 @@ async function setSecret(exec, api, args) {
     throw new RepoError(err instanceof Error ? err.message : String(err));
   }
 }
+async function deleteSecret(exec, api, args) {
+  const info = await repoInfo(exec, args.dir);
+  if (!info) throw new RepoError("\u8FD8\u6CA1\u6709\u4ED3\u5E93\uFF0CSecrets \u6CA1\u5730\u65B9\u5220");
+  try {
+    await api.deleteSecret(repoSlug(info.url), args.env);
+  } catch (err) {
+    throw new RepoError(err instanceof Error ? err.message : String(err));
+  }
+}
 async function listSecrets(exec, api, dir) {
   const info = await repoInfo(exec, dir);
   if (!info) return [];
@@ -61827,6 +61893,36 @@ function buildDeployHandlers(deps) {
     secretsCache.delete(args.personaId);
     return view(args.personaId);
   };
+  const setEngineAuth = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const args = parseArgs2(DeploySetEngineAuthArgsSchema, frame, "deploy:setEngineAuth");
+    const dir = mustPersona(args.personaId);
+    let writes;
+    if (args.auth) {
+      let baseUrl;
+      try {
+        baseUrl = normalizeEngineBaseUrl(args.auth.baseUrl);
+      } catch (err) {
+        throw invalid(err instanceof Error ? err.message : String(err));
+      }
+      const apiKey = args.auth.apiKey.trim();
+      if (!apiKey) throw invalid("key \u4E0D\u80FD\u662F\u7A7A\u7684");
+      if (/[\s\p{Cc}]/u.test(apiKey)) throw invalid("key \u91CC\u4E0D\u80FD\u6709\u7A7A\u767D\u6216\u63A7\u5236\u5B57\u7B26\uFF08\u591A\u534A\u662F\u7C98\u8D34\u65F6\u5E26\u8FDB\u4E86\u6362\u884C\u6216\u7A7A\u683C\uFF09");
+      writes = [[ENGINE_AUTH_SECRETS.apiKey, apiKey], [ENGINE_AUTH_SECRETS.baseUrl, baseUrl]];
+    }
+    const { api } = await requireGithub();
+    try {
+      if (writes) {
+        await deleteSecret(deps.exec, api, { dir, env: ENGINE_AUTH_SECRETS.baseUrl });
+        for (const [env, value] of writes) await setSecret(deps.exec, api, { dir, env, value });
+      } else for (const env of [ENGINE_AUTH_SECRETS.apiKey, ENGINE_AUTH_SECRETS.baseUrl]) await deleteSecret(deps.exec, api, { dir, env });
+    } catch (err) {
+      throw toClawdError(err);
+    } finally {
+      secretsCache.delete(args.personaId);
+    }
+    return view(args.personaId);
+  };
   async function settlePackage(pkg) {
     const localVersion = await deps.probeLocalVersion(pkg);
     const { artifact: reported, ...rest } = pkg;
@@ -61970,14 +62066,16 @@ function buildDeployHandlers(deps) {
       throw invalid(repo2.dirty ? "\u6709\u672A\u63D0\u4EA4\u7684\u6539\u52A8\uFF0C\u6E05\u5355\u662F\u6539\u52A8\u524D\u626B\u7684\u2014\u2014\u91CD\u65B0\u626B\u63CF" : "\u8FD9\u6B21\u626B\u63CF\u5BF9\u5E94\u7684\u4E0D\u662F\u5F53\u524D\u8FD9\u4E00\u7248 persona\u2014\u2014\u91CD\u65B0\u626B\u63CF");
     }
     const blockers = [];
-    let present;
+    let secrets;
     try {
-      present = new Set((await cachedSecrets(personaId2, dir, api, true)).filter((p3) => p3.setAt).map((p3) => p3.env));
+      secrets = await cachedSecrets(personaId2, dir, api, true);
     } catch (err) {
       throw toClawdError(err);
     }
+    const present = new Set(secrets.filter((p3) => p3.setAt).map((p3) => p3.env));
     const missing = requiredEnvNames(entry.manifest).filter((e) => !present.has(e));
     if (missing.length > 0) blockers.push(`${missing.join(" / ")} \u8FD8\u6CA1\u586B`);
+    if (engineAuthState(secrets) === "partial") blockers.push(ENGINE_AUTH_PARTIAL_BLOCKER);
     for (const c2 of entry.manifest.connectors) blockers.push(...connectorBlockers(c2));
     for (const p3 of entry.manifest.packages) blockers.push(...packageBlockers(p3));
     if (!deps.personaEngine(personaId2)?.model) {
@@ -62053,6 +62151,7 @@ function buildDeployHandlers(deps) {
     "deploy:scan": scanHandler,
     "deploy:patch": patch,
     "deploy:putSecret": putSecret,
+    "deploy:setEngineAuth": setEngineAuth,
     "deploy:reportFinding": reportFinding,
     "deploy:finishScan": finishScan,
     "deploy:release": releaseHandler,
@@ -64007,7 +64106,7 @@ function openHttpLineStream(opts) {
     if (closed || !sessionId) return;
     const url = gatewayUrl + GATEWAY_ROUTES.sessionMirror(personaId2, sessionId);
     try {
-      const res = await fetchImpl(url, { method: "POST", headers, body: turn ? JSON.stringify({ turn: { outcome: turn.outcome } }) : "" });
+      const res = await fetchImpl(url, { method: "POST", headers, body: turn ? JSON.stringify({ turn: { outcome: turn.outcome, ...turn.afterFirstByteMs !== void 0 ? { afterFirstByteMs: turn.afterFirstByteMs } : {} } }) : "" });
       if (!res.ok) logger?.warn("cloud session mirror failed", { status: res.status });
     } catch (e) {
       if (!closed) logger?.warn("cloud session mirror error", { message: e.message });
@@ -64226,7 +64325,9 @@ function createCloudCodexSession(ctx, sink, deps) {
     kill: () => stream.close(),
     // 云 persona 运行看板（design 2026-09-23-cloud-persona-metrics §3.7）：提问那一行带「一轮开始」头，轮末镜像顺带报这一轮的结果
     onTurnStarting: () => channel?.markNextLineTurnStart(),
-    onTurnCompleted: (outcome) => void channel?.mirror({ outcome })
+    // 轮末镜像带上这一轮的结果与首字节（design 2026-09-23-cloud-persona-metrics §3.7）
+    onTurnCompleted: (outcome, afterFirstByteMs) => void channel?.mirror({ outcome, ...afterFirstByteMs !== void 0 ? { afterFirstByteMs } : {} }),
+    now: deps.now
   });
   if (!personaId2) {
     queueMicrotask(() => {
@@ -64563,6 +64664,7 @@ function drivePiSession(opts) {
   let turnErrored = false;
   let turnInterrupted = false;
   let turnOpen = false;
+  const firstByte = createFirstByteClock(opts.now);
   let handshakeFailed = false;
   let exited = false;
   const finish = (code) => {
@@ -64574,7 +64676,7 @@ function drivePiSession(opts) {
     sink.pushEvents([{ kind: "error", message }, { kind: "turn_end", reason: "completed" }]);
     if (!opened) return;
     turnOpen = false;
-    opts.onTurnCompleted?.("failure");
+    opts.onTurnCompleted?.("failure", firstByte.afterFirstByteMs());
   };
   const handleUiRequest = (ev) => {
     const method = str2(ev.method);
@@ -64601,14 +64703,17 @@ function drivePiSession(opts) {
         return;
       }
       const events = translatePiEvent(ev, st2);
-      if (events.length) sink.pushEvents(events);
+      if (events.length) {
+        if (turnOpen) firstByte.see(events);
+        sink.pushEvents(events);
+      }
       for (const e of events) {
         if (e.kind === "error") turnErrored = true;
         if (e.kind === "turn_end" && e.reason === "interrupted") turnInterrupted = true;
       }
       if (ev.type === "agent_settled") {
         turnOpen = false;
-        opts.onTurnCompleted?.(turnInterrupted ? "interrupted" : turnErrored ? "failure" : "success");
+        opts.onTurnCompleted?.(turnInterrupted ? "interrupted" : turnErrored ? "failure" : "success", firstByte.afterFirstByteMs());
       }
     },
     onClose: () => finish(opts.exitCodeOnClose?.() ?? null)
@@ -64644,6 +64749,7 @@ function drivePiSession(opts) {
         opened = !turnOpen;
         if (opened) {
           turnOpen = true;
+          firstByte.reset();
           opts.onTurnStarting?.();
         }
         const r2 = await client.request({
@@ -64949,7 +65055,9 @@ function createCloudPiSession(ctx, sink, deps) {
     kill: () => stream.close(),
     // 云 persona 运行看板（design 2026-09-23-cloud-persona-metrics §3.7）：提问那一行带「一轮开始」头，轮末镜像顺带报这一轮的结果
     onTurnStarting: () => channel?.markNextLineTurnStart(),
-    onTurnCompleted: (outcome) => void channel?.mirror({ outcome })
+    // 轮末镜像带上这一轮的结果与首字节（design 2026-09-23-cloud-persona-metrics §3.7）
+    onTurnCompleted: (outcome, afterFirstByteMs) => void channel?.mirror({ outcome, ...afterFirstByteMs !== void 0 ? { afterFirstByteMs } : {} }),
+    now: deps.now
   });
   if (!personaId2) {
     queueMicrotask(() => {
@@ -71990,6 +72098,7 @@ var METHOD_GRANT_MAP = {
   "deploy:scan": ADMIN_ANY,
   "deploy:patch": ADMIN_ANY,
   "deploy:putSecret": ADMIN_ANY,
+  "deploy:setEngineAuth": ADMIN_ANY,
   "deploy:reportFinding": ADMIN_ANY,
   "deploy:finishScan": ADMIN_ANY,
   "deploy:release": ADMIN_ANY,
@@ -72207,6 +72316,7 @@ var HUMAN_ONLY_METHODS = [
   "deploy:scan",
   "deploy:release",
   "deploy:putSecret",
+  "deploy:setEngineAuth",
   "deploy:rerunJob",
   "deploy:unpublish",
   "githubAuth:oauthStart",
@@ -72253,7 +72363,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.583".length > 0 ? "0.2.583" : "dev";
+var version = "0.2.585".length > 0 ? "0.2.585" : "dev";
 
 // src/cli-probe/probe.ts
 var fs80 = __toESM(require("fs"), 1);