@clawos-dev/clawd 0.2.584 → 0.2.586

package/dist/app-builder-plugin/mcp-server.cjs

@@ -21507,8 +21507,8 @@ var EnvPackageSchema = external_exports.object({
   // 两者都缺省即完全不约束。
   min: external_exports.string().optional(),
   /**
-   * 没有可执行、只是个包（引擎扩展这类：pi 底座里的 cliproxyapi 扩展）。构建器只断言它装上了（npm ls），不查 PATH 上有没有 `name` 这条命令。
-   * 只有引擎底座清单（cloud-host/engines/<e>/manifest.json）用得到；扫描器不产它。
+   * 没有可执行、只是个包（引擎扩展这类：pi 底座里的 cliproxyapi 扩展；apt 的字体包）。构建器只断言它装上了（npm 的问 npm ls，apt 的问 dpkg-query），
+   * 不查 PATH 上有没有 `name` 这条命令。用在底座清单（cloud-host/engines/<e>/manifest.json、provision/manifests/common.json）里。
    */
   library: external_exports.boolean().optional(),
   /**
@@ -21787,6 +21787,10 @@ var DeployPutSecretArgsSchema = external_exports.object({
   // 环境变量名 → 值。key 必须是该 secret 声明过的 env 之一，handler 校验。
   values: external_exports.record(external_exports.string(), external_exports.string())
 }).strict();
+var DeploySetEngineAuthArgsSchema = external_exports.object({
+  personaId: external_exports.string().min(1),
+  auth: external_exports.object({ baseUrl: external_exports.string(), apiKey: external_exports.string() }).strict().nullable()
+}).strict();
 var DeployRerunJobArgsSchema = external_exports.object({
   personaId: external_exports.string().min(1),
   /** GitHub 的 job databaseId。**是数字**——字符串会在拼命令时静默出错 */
@@ -24273,9 +24277,13 @@ var METHOD_DOCS = {
     args: DeployPatchArgsSchema
   },
   "deploy:putSecret": {
-    summary: "\u628A\u4E00\u6761\u51ED\u636E\u7684\u503C\u5199\u8FDB\u4ED3\u5E93\u7684 GitHub Secrets\uFF08GitHub REST\uFF0C\u503C\u7528\u4ED3\u5E93\u516C\u94A5\u5C01\u7BB1\u540E\u4E0A\u4F20\uFF09\u3002**\u8FD9\u662F\u503C\u552F\u4E00\u7684\u5165\u53E3**\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u503C\u3001\u672C\u673A\u4E0D\u843D\u76D8\u3002env \u540D\u5FC5\u987B\u662F scanId \u90A3\u6B21\u6E05\u5355\u91CC\u8BE5\u51ED\u636E\u58F0\u660E\u8FC7\u7684\uFF1Bowner-only",
+    summary: "\u628A\u4E00\u6761\u51ED\u636E\u7684\u503C\u5199\u8FDB\u4ED3\u5E93\u7684 GitHub Secrets\uFF08GitHub REST\uFF0C\u503C\u7528\u4ED3\u5E93\u516C\u94A5\u5C01\u7BB1\u540E\u4E0A\u4F20\uFF09\u3002**\u8FD9\u662F\u6E05\u5355\u51ED\u636E\u503C\u552F\u4E00\u7684\u5165\u53E3**\uFF08\u6A21\u578B\u8BA2\u9605\u8D70 deploy:setEngineAuth\uFF09\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u503C\u3001\u672C\u673A\u4E0D\u843D\u76D8\u3002env \u540D\u5FC5\u987B\u662F scanId \u90A3\u6B21\u6E05\u5355\u91CC\u8BE5\u51ED\u636E\u58F0\u660E\u8FC7\u7684\uFF1Bowner-only",
     args: DeployPutSecretArgsSchema
   },
+  "deploy:setEngineAuth": {
+    summary: "\u6A21\u578B\u8BA2\u9605\uFF08\u4E91\u4E0A\u8DD1\u8FD9\u4E2A persona \u82B1\u8C01\u7684\u6A21\u578B\u989D\u5EA6\uFF09\uFF1Aauth = { baseUrl, apiKey } \u5199\u8FDB\u4ED3\u5E93 GitHub Secrets \u7684 CLAWD_ENGINE_BASE_URL / CLAWD_ENGINE_API_KEY\uFF08\u5730\u5740\u89C4\u8303\u6210 \u2026/v1\uFF09\uFF0Cnull = \u5220\u8FD9\u4E24\u6761\u3001\u6539\u56DE\u5E73\u53F0\u9ED8\u8BA4\u3002\u4E0B\u6B21\u53D1\u5E03\u751F\u6548\u3002\u540C putSecret \u7684\u7EAA\u5F8B\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u503C\u3001\u672C\u673A\u4E0D\u843D\u76D8\uFF1B\u56DE deploy:get \u540C\u5F62\u7684\u72B6\u6001\uFF1Bowner-only\u3001human-only",
+    args: DeploySetEngineAuthArgsSchema
+  },
   "deploy:reportFinding": {
     summary: "\u626B\u63CF\u4E2D\u7684 butler \u9010\u6761\u4E0A\u62A5\u4E00\u4E2A\u53D1\u73B0\uFF08cli / secret / asset\uFF09\u3002**\u8FB9\u626B\u8FB9\u62A5**\uFF0C\u9875\u9762\u968F\u4E4B\u4E00\u70B9\u70B9\u586B\u5145\uFF1B\u540C (kind,name) \u91CD\u590D\u4E0A\u62A5\u5373\u8986\u76D6\u3002owner-only\u2014\u2014butler \u4F1A\u8BDD\u672C\u8EAB\u8DD1\u5728 owner \u6A21\u5F0F",
     args: DeployReportFindingArgsSchema

package/dist/cli.cjs

@@ -6020,6 +6020,8 @@ var init_environment_schemas = __esm({
       "jq",
       "rsync",
       "psql",
+      "chromium",
+      "fonts-wqy-microhei",
       "pnpm",
       "whiteboard-cli",
       "s",
@@ -6054,8 +6056,8 @@ var init_environment_schemas = __esm({
       // 两者都缺省即完全不约束。
       min: external_exports.string().optional(),
       /**
-       * 没有可执行、只是个包（引擎扩展这类：pi 底座里的 cliproxyapi 扩展）。构建器只断言它装上了（npm ls），不查 PATH 上有没有 `name` 这条命令。
-       * 只有引擎底座清单（cloud-host/engines/<e>/manifest.json）用得到；扫描器不产它。
+       * 没有可执行、只是个包（引擎扩展这类：pi 底座里的 cliproxyapi 扩展；apt 的字体包）。构建器只断言它装上了（npm 的问 npm ls，apt 的问 dpkg-query），
+       * 不查 PATH 上有没有 `name` 这条命令。用在底座清单（cloud-host/engines/<e>/manifest.json、provision/manifests/common.json）里。
        */
       library: external_exports.boolean().optional(),
       /**
@@ -6154,6 +6156,26 @@ var init_environment_schemas = __esm({
 });
 
 // ../protocol/src/deploy-schemas.ts
+function engineAuthState(secrets) {
+  if (!secrets) return void 0;
+  const has = (env) => secrets.some((p3) => p3.env === env && p3.setAt !== void 0);
+  const n2 = [ENGINE_AUTH_SECRETS.baseUrl, ENGINE_AUTH_SECRETS.apiKey].filter(has).length;
+  return n2 === 2 ? "own" : n2 === 0 ? "platform" : "partial";
+}
+function normalizeEngineBaseUrl(raw) {
+  const s2 = raw.trim();
+  let url;
+  try {
+    url = new URL(s2);
+  } catch {
+    throw new Error("\u8BA2\u9605\u5730\u5740\u8981\u4EE5 http:// \u6216 https:// \u5F00\u5934\uFF0C\u5F62\u5982 https://cpa.example.com");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:" || !url.hostname) {
+    throw new Error("\u8BA2\u9605\u5730\u5740\u8981\u4EE5 http:// \u6216 https:// \u5F00\u5934\uFF0C\u5F62\u5982 https://cpa.example.com");
+  }
+  const base = `${url.origin}${url.pathname}`.replace(/\/+$/, "");
+  return base.endsWith("/v1") ? base : `${base}/v1`;
+}
 function contentHeadOf(repo2, released) {
   return released && repo2.head === released.head ? released.contentHead : repo2.head;
 }
@@ -6168,7 +6190,7 @@ function cloudEngineOk(tool) {
 function repoSlug(url) {
   return url.trim().replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
 }
-var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
+var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, ENGINE_AUTH_SECRETS, ENGINE_AUTH_PARTIAL_BLOCKER, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeploySetEngineAuthArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
 var init_deploy_schemas = __esm({
   "../protocol/src/deploy-schemas.ts"() {
     "use strict";
@@ -6253,6 +6275,8 @@ var init_deploy_schemas = __esm({
       env: external_exports.string().min(1),
       setAt: external_exports.number().optional()
     }).strict();
+    ENGINE_AUTH_SECRETS = { baseUrl: "CLAWD_ENGINE_BASE_URL", apiKey: "CLAWD_ENGINE_API_KEY" };
+    ENGINE_AUTH_PARTIAL_BLOCKER = "\u6A21\u578B\u8BA2\u9605\u53EA\u5199\u8FDB\u53BB\u4E00\u534A\u2014\u2014\u91CD\u586B\u6216\u6539\u56DE\u5E73\u53F0\u9ED8\u8BA4";
     DEPLOY_STAGE_STATUSES = ["pending", "running", "done", "failed", "waiting", "skipped"];
     DeployStageStatusSchema = external_exports.enum(DEPLOY_STAGE_STATUSES);
     DEPLOY_STAGE_KEYS = ["build", "smoke", "deploy"];
@@ -6358,6 +6382,10 @@ var init_deploy_schemas = __esm({
       // 环境变量名 → 值。key 必须是该 secret 声明过的 env 之一，handler 校验。
       values: external_exports.record(external_exports.string(), external_exports.string())
     }).strict();
+    DeploySetEngineAuthArgsSchema = external_exports.object({
+      personaId: external_exports.string().min(1),
+      auth: external_exports.object({ baseUrl: external_exports.string(), apiKey: external_exports.string() }).strict().nullable()
+    }).strict();
     DeployRerunJobArgsSchema = external_exports.object({
       personaId: external_exports.string().min(1),
       /** GitHub 的 job databaseId。**是数字**——字符串会在拼命令时静默出错 */
@@ -9137,9 +9165,13 @@ var init_methods = __esm({
         args: DeployPatchArgsSchema
       },
       "deploy:putSecret": {
-        summary: "\u628A\u4E00\u6761\u51ED\u636E\u7684\u503C\u5199\u8FDB\u4ED3\u5E93\u7684 GitHub Secrets\uFF08GitHub REST\uFF0C\u503C\u7528\u4ED3\u5E93\u516C\u94A5\u5C01\u7BB1\u540E\u4E0A\u4F20\uFF09\u3002**\u8FD9\u662F\u503C\u552F\u4E00\u7684\u5165\u53E3**\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u503C\u3001\u672C\u673A\u4E0D\u843D\u76D8\u3002env \u540D\u5FC5\u987B\u662F scanId \u90A3\u6B21\u6E05\u5355\u91CC\u8BE5\u51ED\u636E\u58F0\u660E\u8FC7\u7684\uFF1Bowner-only",
+        summary: "\u628A\u4E00\u6761\u51ED\u636E\u7684\u503C\u5199\u8FDB\u4ED3\u5E93\u7684 GitHub Secrets\uFF08GitHub REST\uFF0C\u503C\u7528\u4ED3\u5E93\u516C\u94A5\u5C01\u7BB1\u540E\u4E0A\u4F20\uFF09\u3002**\u8FD9\u662F\u6E05\u5355\u51ED\u636E\u503C\u552F\u4E00\u7684\u5165\u53E3**\uFF08\u6A21\u578B\u8BA2\u9605\u8D70 deploy:setEngineAuth\uFF09\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u503C\u3001\u672C\u673A\u4E0D\u843D\u76D8\u3002env \u540D\u5FC5\u987B\u662F scanId \u90A3\u6B21\u6E05\u5355\u91CC\u8BE5\u51ED\u636E\u58F0\u660E\u8FC7\u7684\uFF1Bowner-only",
         args: DeployPutSecretArgsSchema
       },
+      "deploy:setEngineAuth": {
+        summary: "\u6A21\u578B\u8BA2\u9605\uFF08\u4E91\u4E0A\u8DD1\u8FD9\u4E2A persona \u82B1\u8C01\u7684\u6A21\u578B\u989D\u5EA6\uFF09\uFF1Aauth = { baseUrl, apiKey } \u5199\u8FDB\u4ED3\u5E93 GitHub Secrets \u7684 CLAWD_ENGINE_BASE_URL / CLAWD_ENGINE_API_KEY\uFF08\u5730\u5740\u89C4\u8303\u6210 \u2026/v1\uFF09\uFF0Cnull = \u5220\u8FD9\u4E24\u6761\u3001\u6539\u56DE\u5E73\u53F0\u9ED8\u8BA4\u3002\u4E0B\u6B21\u53D1\u5E03\u751F\u6548\u3002\u540C putSecret \u7684\u7EAA\u5F8B\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u503C\u3001\u672C\u673A\u4E0D\u843D\u76D8\uFF1B\u56DE deploy:get \u540C\u5F62\u7684\u72B6\u6001\uFF1Bowner-only\u3001human-only",
+        args: DeploySetEngineAuthArgsSchema
+      },
       "deploy:reportFinding": {
         summary: "\u626B\u63CF\u4E2D\u7684 butler \u9010\u6761\u4E0A\u62A5\u4E00\u4E2A\u53D1\u73B0\uFF08cli / secret / asset\uFF09\u3002**\u8FB9\u626B\u8FB9\u62A5**\uFF0C\u9875\u9762\u968F\u4E4B\u4E00\u70B9\u70B9\u586B\u5145\uFF1B\u540C (kind,name) \u91CD\u590D\u4E0A\u62A5\u5373\u8986\u76D6\u3002owner-only\u2014\u2014butler \u4F1A\u8BDD\u672C\u8EAB\u8DD1\u5728 owner \u6A21\u5F0F",
         args: DeployReportFindingArgsSchema
@@ -60865,6 +60897,11 @@ function createGithubApi(args) {
       const encrypted_value = await seal(pk.key, value);
       await must("PUT", `/repos/${slug}/actions/secrets/${encodeURIComponent(name)}`, `\u5199 ${name}`, { encrypted_value, key_id: pk.key_id });
     },
+    async deleteSecret(slug, name) {
+      const r2 = await request("DELETE", `/repos/${slug}/actions/secrets/${encodeURIComponent(name)}`);
+      if (r2.status === 404) return;
+      if (r2.status < 200 || r2.status >= 300) throw new GithubApiError(r2.status, explain(r2.status, `\u5220 ${name}`, r2.json));
+    },
     async listSecrets(slug) {
       const j2 = await must("GET", `/repos/${slug}/actions/secrets?per_page=100`, "\u67E5\u4ED3\u5E93 Secrets");
       const rows = Array.isArray(j2?.secrets) ? j2.secrets : [];
@@ -61430,6 +61467,15 @@ async function setSecret(exec, api, args) {
     throw new RepoError(err instanceof Error ? err.message : String(err));
   }
 }
+async function deleteSecret(exec, api, args) {
+  const info = await repoInfo(exec, args.dir);
+  if (!info) throw new RepoError("\u8FD8\u6CA1\u6709\u4ED3\u5E93\uFF0CSecrets \u6CA1\u5730\u65B9\u5220");
+  try {
+    await api.deleteSecret(repoSlug(info.url), args.env);
+  } catch (err) {
+    throw new RepoError(err instanceof Error ? err.message : String(err));
+  }
+}
 async function listSecrets(exec, api, dir) {
   const info = await repoInfo(exec, dir);
   if (!info) return [];
@@ -61849,6 +61895,36 @@ function buildDeployHandlers(deps) {
     secretsCache.delete(args.personaId);
     return view(args.personaId);
   };
+  const setEngineAuth = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const args = parseArgs2(DeploySetEngineAuthArgsSchema, frame, "deploy:setEngineAuth");
+    const dir = mustPersona(args.personaId);
+    let writes;
+    if (args.auth) {
+      let baseUrl;
+      try {
+        baseUrl = normalizeEngineBaseUrl(args.auth.baseUrl);
+      } catch (err) {
+        throw invalid(err instanceof Error ? err.message : String(err));
+      }
+      const apiKey = args.auth.apiKey.trim();
+      if (!apiKey) throw invalid("key \u4E0D\u80FD\u662F\u7A7A\u7684");
+      if (/[\s\p{Cc}]/u.test(apiKey)) throw invalid("key \u91CC\u4E0D\u80FD\u6709\u7A7A\u767D\u6216\u63A7\u5236\u5B57\u7B26\uFF08\u591A\u534A\u662F\u7C98\u8D34\u65F6\u5E26\u8FDB\u4E86\u6362\u884C\u6216\u7A7A\u683C\uFF09");
+      writes = [[ENGINE_AUTH_SECRETS.apiKey, apiKey], [ENGINE_AUTH_SECRETS.baseUrl, baseUrl]];
+    }
+    const { api } = await requireGithub();
+    try {
+      if (writes) {
+        await deleteSecret(deps.exec, api, { dir, env: ENGINE_AUTH_SECRETS.baseUrl });
+        for (const [env, value] of writes) await setSecret(deps.exec, api, { dir, env, value });
+      } else for (const env of [ENGINE_AUTH_SECRETS.apiKey, ENGINE_AUTH_SECRETS.baseUrl]) await deleteSecret(deps.exec, api, { dir, env });
+    } catch (err) {
+      throw toClawdError(err);
+    } finally {
+      secretsCache.delete(args.personaId);
+    }
+    return view(args.personaId);
+  };
   async function settlePackage(pkg) {
     const localVersion = await deps.probeLocalVersion(pkg);
     const { artifact: reported, ...rest } = pkg;
@@ -61992,14 +62068,16 @@ function buildDeployHandlers(deps) {
       throw invalid(repo2.dirty ? "\u6709\u672A\u63D0\u4EA4\u7684\u6539\u52A8\uFF0C\u6E05\u5355\u662F\u6539\u52A8\u524D\u626B\u7684\u2014\u2014\u91CD\u65B0\u626B\u63CF" : "\u8FD9\u6B21\u626B\u63CF\u5BF9\u5E94\u7684\u4E0D\u662F\u5F53\u524D\u8FD9\u4E00\u7248 persona\u2014\u2014\u91CD\u65B0\u626B\u63CF");
     }
     const blockers = [];
-    let present;
+    let secrets;
     try {
-      present = new Set((await cachedSecrets(personaId2, dir, api, true)).filter((p3) => p3.setAt).map((p3) => p3.env));
+      secrets = await cachedSecrets(personaId2, dir, api, true);
     } catch (err) {
       throw toClawdError(err);
     }
+    const present = new Set(secrets.filter((p3) => p3.setAt).map((p3) => p3.env));
     const missing = requiredEnvNames(entry.manifest).filter((e) => !present.has(e));
     if (missing.length > 0) blockers.push(`${missing.join(" / ")} \u8FD8\u6CA1\u586B`);
+    if (engineAuthState(secrets) === "partial") blockers.push(ENGINE_AUTH_PARTIAL_BLOCKER);
     for (const c2 of entry.manifest.connectors) blockers.push(...connectorBlockers(c2));
     for (const p3 of entry.manifest.packages) blockers.push(...packageBlockers(p3));
     if (!deps.personaEngine(personaId2)?.model) {
@@ -62075,6 +62153,7 @@ function buildDeployHandlers(deps) {
     "deploy:scan": scanHandler,
     "deploy:patch": patch,
     "deploy:putSecret": putSecret,
+    "deploy:setEngineAuth": setEngineAuth,
     "deploy:reportFinding": reportFinding,
     "deploy:finishScan": finishScan,
     "deploy:release": releaseHandler,
@@ -72021,6 +72100,7 @@ var METHOD_GRANT_MAP = {
   "deploy:scan": ADMIN_ANY,
   "deploy:patch": ADMIN_ANY,
   "deploy:putSecret": ADMIN_ANY,
+  "deploy:setEngineAuth": ADMIN_ANY,
   "deploy:reportFinding": ADMIN_ANY,
   "deploy:finishScan": ADMIN_ANY,
   "deploy:release": ADMIN_ANY,
@@ -72238,6 +72318,7 @@ var HUMAN_ONLY_METHODS = [
   "deploy:scan",
   "deploy:release",
   "deploy:putSecret",
+  "deploy:setEngineAuth",
   "deploy:rerunJob",
   "deploy:unpublish",
   "githubAuth:oauthStart",
@@ -72284,7 +72365,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.584".length > 0 ? "0.2.584" : "dev";
+var version = "0.2.586".length > 0 ? "0.2.586" : "dev";
 
 // src/cli-probe/probe.ts
 var fs80 = __toESM(require("fs"), 1);