@clawos-dev/clawd 0.2.622 → 0.2.624

package/dist/app-builder-plugin/mcp-server.cjs

@@ -21593,6 +21593,46 @@ var EnvEvidenceSchema = external_exports.object({
   quote: external_exports.string().min(1)
 });
 
+// ../protocol/src/release-schemas.ts
+var DEPLOY_ENVIRONMENTS = ["integration", "production"];
+var DeployEnvironmentSchema = external_exports.enum(DEPLOY_ENVIRONMENTS);
+var ImageDigestSchema = external_exports.string().regex(/^[a-z0-9.-]+(?::[0-9]+)?\/[a-z0-9._/-]+@sha256:[a-f0-9]{64}$/);
+var SourceCommitSchema = external_exports.string().regex(/^[a-f0-9]{40}$/);
+var IntegrationEndpointSchema = external_exports.string().refine((value) => {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash && url.pathname === "/" && /(^|[.-])int([.-]|$)/.test(url.hostname);
+  } catch {
+    return false;
+  }
+}, "\u6D4B\u8BD5\u9A8C\u8BC1\u5730\u5740\u5FC5\u987B\u660E\u786E\u6307\u5411 int HTTPS \u73AF\u5883");
+var VerificationSchema = external_exports.object({
+  status: external_exports.literal("passed"),
+  fingerprint: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  checks: external_exports.array(external_exports.string().regex(/^[a-z0-9-]+$/)),
+  endpoint: IntegrationEndpointSchema,
+  verifiedAt: external_exports.string().refine((s) => Number.isFinite(Date.parse(s)))
+}).strict();
+var VerifiedPersonaReleaseSchema = external_exports.object({
+  version: external_exports.literal(1),
+  environment: external_exports.literal("integration"),
+  component: external_exports.literal("persona"),
+  image: ImageDigestSchema,
+  commit: SourceCommitSchema,
+  baseImage: ImageDigestSchema,
+  pipelineCommit: SourceCommitSchema,
+  repository: external_exports.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/),
+  verification: VerificationSchema.refine((v) => v.checks.includes("persona-smoke"))
+}).strict();
+var VerifiedBaseReleaseSchema = external_exports.object({
+  version: external_exports.literal(1),
+  environment: external_exports.literal("integration"),
+  component: external_exports.literal("base"),
+  image: ImageDigestSchema,
+  commit: SourceCommitSchema,
+  verification: VerificationSchema.refine((v) => v.checks.includes("base-smoke"))
+}).strict();
+
 // ../protocol/src/deploy-schemas.ts
 var DeployFileSchema = external_exports.object({
   version: external_exports.literal(1),
@@ -21621,15 +21661,44 @@ var DeployScanSchema = external_exports.object({
   error: external_exports.string().optional()
 }).strict();
 var DeployReleasedSchema = external_exports.object({
+  /** Legacy wire records can omit these; file migration always materializes them. */
+  id: external_exports.string().min(1).optional(),
+  environment: DeployEnvironmentSchema.optional(),
+  legacy: external_exports.boolean().optional(),
   head: external_exports.string().min(1),
   contentHead: external_exports.string().min(1),
   scanId: external_exports.string().min(1),
-  at: external_exports.number()
+  at: external_exports.number(),
+  pushed: external_exports.boolean().optional(),
+  runId: external_exports.number().int().positive().optional(),
+  runAttempt: external_exports.number().int().positive().optional(),
+  artifactId: external_exports.number().int().positive().optional(),
+  verified: VerifiedPersonaReleaseSchema.optional(),
+  confirmation: external_exports.object({
+    fingerprint: external_exports.string().regex(/^[a-f0-9]{64}$/),
+    runId: external_exports.number().int().positive(),
+    runAttempt: external_exports.number().int().positive(),
+    at: external_exports.number()
+  }).strict().optional()
+}).strict();
+var DEPLOY_PROMOTION_PHASES = ["prepared", "main-pushed", "dispatching", "dispatched", "completed", "failed"];
+var DeployPromotionSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  releaseId: external_exports.string().min(1),
+  at: external_exports.number(),
+  /** Artifact fixed when the user authorizes this action; int reruns cannot replace it. */
+  verified: VerifiedPersonaReleaseSchema.optional(),
+  phase: external_exports.enum(DEPLOY_PROMOTION_PHASES),
+  expectedMain: external_exports.string().optional(),
+  runId: external_exports.number().int().positive().optional(),
+  runAttempt: external_exports.number().int().positive().optional(),
+  error: external_exports.string().optional()
 }).strict();
 var DeployScanFileSchema = external_exports.object({
-  version: external_exports.literal(3),
+  version: external_exports.literal(4),
   scans: external_exports.array(DeployScanSchema),
-  releases: external_exports.array(DeployReleasedSchema)
+  releases: external_exports.array(DeployReleasedSchema),
+  promotions: external_exports.array(DeployPromotionSchema).default([])
 }).strict();
 var DeployRepoSchema = external_exports.object({
   url: external_exports.string().min(1),
@@ -21663,7 +21732,13 @@ var DeployRunSchema = external_exports.object({
   status: external_exports.enum(["queued", "running", "completed"]),
   htmlUrl: external_exports.string().min(1),
   /** run 刚入队时可能一条都还没有 */
-  jobs: external_exports.array(DeployJobSchema)
+  jobs: external_exports.array(DeployJobSchema),
+  environment: DeployEnvironmentSchema.optional(),
+  branch: external_exports.string().optional(),
+  event: external_exports.string().optional(),
+  runAttempt: external_exports.number().int().positive().optional(),
+  conclusion: external_exports.enum(["success", "failure"]).optional(),
+  promotionId: external_exports.string().optional()
 }).strict();
 var DeployUnpublishRunSchema = external_exports.object({
   runId: external_exports.number(),
@@ -21678,6 +21753,23 @@ var DeployStateSchema = external_exports.object({
   repo: DeployRepoSchema.optional(),
   scans: external_exports.array(DeployScanSchema).default([]),
   releases: external_exports.array(DeployReleasedSchema).default([]),
+  promotions: external_exports.array(DeployPromotionSchema).optional(),
+  targets: external_exports.object({
+    integration: external_exports.object({
+      run: DeployRunSchema.optional(),
+      secrets: external_exports.array(DeploySecretPresenceSchema).optional(),
+      online: external_exports.boolean().optional(),
+      image: ImageDigestSchema.optional(),
+      unpublish: DeployUnpublishRunSchema.optional()
+    }).strict().optional(),
+    production: external_exports.object({
+      run: DeployRunSchema.optional(),
+      secrets: external_exports.array(DeploySecretPresenceSchema).optional(),
+      online: external_exports.boolean().optional(),
+      image: ImageDigestSchema.optional(),
+      unpublish: DeployUnpublishRunSchema.optional()
+    }).strict().optional()
+  }).strict().optional(),
   /** 没仓库时缺席（查不了） */
   secrets: external_exports.array(DeploySecretPresenceSchema).optional(),
   /**
@@ -21704,13 +21796,16 @@ var DeployUnpublishResultSchema = external_exports.object({
 var DeployPatchResultSchema = DeployStateSchema.pick({ scans: true });
 var DeployReleaseResultSchema = external_exports.object({
   sha: external_exports.string().min(1),
-  actionsUrl: external_exports.string().min(1)
+  actionsUrl: external_exports.string().min(1),
+  releaseId: external_exports.string().optional()
 }).strict();
 var DeployPersonaArgsSchema = external_exports.object({
   personaId: external_exports.string().min(1)
 }).strict();
 var DeployGetArgsSchema = DeployPersonaArgsSchema.extend({
-  releaseHead: external_exports.string().min(1).optional()
+  releaseHead: external_exports.string().min(1).optional(),
+  releaseId: external_exports.string().min(1).optional(),
+  environment: DeployEnvironmentSchema.optional()
 }).strict();
 var DeployScanArgsSchema = DeployPersonaArgsSchema.extend({
   scanBase: ScanBaseKindSchema.optional()
@@ -21718,6 +21813,13 @@ var DeployScanArgsSchema = DeployPersonaArgsSchema.extend({
 var DeployReleaseArgsSchema = DeployPersonaArgsSchema.extend({
   scanId: external_exports.string().min(1)
 }).strict();
+var DeployConfirmTestArgsSchema = DeployPersonaArgsSchema.extend({ releaseId: external_exports.string().min(1) }).strict();
+var DeployPromoteArgsSchema = DeployConfirmTestArgsSchema;
+var DeployOpenTestArgsSchema = DeployConfirmTestArgsSchema;
+var DeployEnvironmentArgsSchema = DeployPersonaArgsSchema.extend({ environment: DeployEnvironmentSchema.default("production") }).strict();
+var DeployConfirmTestResultSchema = external_exports.object({ confirmation: DeployReleasedSchema.shape.confirmation.unwrap() }).strict();
+var DeployPromoteResultSchema = external_exports.object({ promotion: DeployPromotionSchema }).strict();
+var DeployOpenTestResultSchema = external_exports.object({ personaId: external_exports.string().min(1), expectedImage: ImageDigestSchema }).strict();
 var DeployPatchArgsSchema = external_exports.object({
   personaId: external_exports.string().min(1),
   scanId: external_exports.string().min(1),
@@ -21733,6 +21835,7 @@ var DeployPatchArgsSchema = external_exports.object({
 }).strict();
 var DeployPutSecretArgsSchema = external_exports.object({
   personaId: external_exports.string().min(1),
+  environment: DeployEnvironmentSchema.default("production"),
   /** 按哪次扫描的清单校验凭据名 / env 名。值本身是仓库级的（GitHub Secrets），跟扫描无关 */
   scanId: external_exports.string().min(1),
   name: external_exports.string().min(1),
@@ -21741,6 +21844,7 @@ var DeployPutSecretArgsSchema = external_exports.object({
 }).strict();
 var DeploySetEngineAuthArgsSchema = external_exports.object({
   personaId: external_exports.string().min(1),
+  environment: DeployEnvironmentSchema.default("production"),
   channelId: external_exports.string().min(1).optional(),
   auth: external_exports.object({ baseUrl: external_exports.string(), apiKey: external_exports.string() }).strict().nullable().optional()
 }).strict().refine((data) => data.channelId !== void 0 || data.auth !== void 0, {
@@ -21748,6 +21852,8 @@ var DeploySetEngineAuthArgsSchema = external_exports.object({
 });
 var DeployRerunJobArgsSchema = external_exports.object({
   personaId: external_exports.string().min(1),
+  environment: DeployEnvironmentSchema.default("production"),
+  releaseId: external_exports.string().optional(),
   jobId: external_exports.number()
 }).strict();
 var DeployReportFindingArgsSchema = external_exports.object({
@@ -21769,6 +21875,99 @@ var DeployFinishScanArgsSchema = external_exports.object({
   notes: external_exports.array(external_exports.string()).default([])
 }).strict();
 
+// ../protocol/src/feishu-auth.ts
+var AuthEnvironmentArgsSchema = external_exports.object({ environment: DeployEnvironmentSchema.default("production") }).strict();
+var DeviceEntrySchema = external_exports.object({
+  /**
+   * 设备标识（决策 #15：daemon 本地生成的 dev-<uuid>，与人的身份 unionId 无关）。
+   * 中心 server clawd_devices 注册表仅作服务发现（url 下发 + 目录），不在安全路径上。
+   */
+  deviceId: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  url: external_exports.string().min(1)
+});
+var DeviceListResponseSchema = external_exports.object({
+  type: external_exports.literal("device:list:ok"),
+  devices: external_exports.array(DeviceEntrySchema)
+});
+var DeviceConnectArgsSchema = external_exports.object({
+  deviceId: external_exports.string().min(1),
+  /**
+   * 目标设备的 ws/tunnel 地址（可选）：
+   *   - 公开目录点击：带 url（device:list 已下发，省一次 server 查询）
+   *   - 凭 deviceId 连接：缺省 url → daemon exchange 时由中心 server 下发该设备上报的 url
+   *   - 注册表不在安全路径上：知道对方 url 时显式传入即可连接（不依赖中心 server 服务发现）
+   */
+  url: external_exports.string().min(1).optional(),
+  /** Optional display name; otherwise populate it from the handshake acknowledgement. */
+  name: external_exports.string().optional()
+});
+var DeviceConnectResponseSchema = external_exports.object({
+  type: external_exports.literal("device:connect:ok"),
+  deviceId: external_exports.string(),
+  name: external_exports.string(),
+  url: external_exports.string()
+});
+var FeishuIdentitySchema = external_exports.object({
+  /** 归属人 id（决策 #16：TTC unique_id，取代飞书 union_id；跨登录方式稳定） */
+  ownerId: external_exports.string().min(1),
+  /** 身份来源：'ttc'（飞书/手机/邮箱登入 TTC）| 'google' | ...（决策 #16，拓展用） */
+  provider: external_exports.string().min(1),
+  displayName: external_exports.string().min(1),
+  /** TTC user_info 接口 data.avatar_url，可缺省 */
+  avatarUrl: external_exports.string().optional(),
+  /** TTC user_info 接口 data.union_id（飞书 union_id；dataclaw 可信入口 X-User-UnionId 用），可缺省 */
+  unionId: external_exports.string().optional()
+});
+var AuthLoginStartResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:login:start:ok"),
+  environment: DeployEnvironmentSchema.optional(),
+  authUrl: external_exports.string().min(1),
+  /** 防 CSRF 的一次性 nonce；回调时 daemon 校验 */
+  state: external_exports.string().min(1)
+});
+var AuthGetIdentityResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:getIdentity:ok"),
+  /** null = 未登录 */
+  identity: FeishuIdentitySchema.nullable(),
+  /** Stable device identifier independent of login, used for the shareable device link. */
+  deviceId: external_exports.string().min(1)
+});
+var AuthLogoutResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:logout:ok")
+});
+var GatewayUrl = external_exports.string().nullable();
+var AuthApiKeyGetResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:apiKey:get:ok"),
+  /** null = 还没发过。**发过就能一直看到** —— 中心存的是明文，设置页据此展示 */
+  apiKey: external_exports.string().nullable(),
+  /** ISO 时间；apiKey 为 null 时同为 null */
+  createdAt: external_exports.string().nullable(),
+  gatewayUrl: GatewayUrl
+});
+var AuthApiKeyRegenerateResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:apiKey:regenerate:ok"),
+  /** 新发的那把。**旧的当场失效** —— 一人一把，按 union_id 覆盖 */
+  apiKey: external_exports.string().min(1),
+  createdAt: external_exports.string().min(1),
+  gatewayUrl: GatewayUrl
+});
+var AuthApiKeyRevokeResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:apiKey:revoke:ok"),
+  /** 之前有没有那把——没发过也算成功（幂等） */
+  revoked: external_exports.boolean()
+});
+var AuthLoginDoneEventSchema = external_exports.object({
+  type: external_exports.literal("auth:login:done"),
+  environment: DeployEnvironmentSchema.optional(),
+  identity: FeishuIdentitySchema
+});
+var AuthLoginFailedEventSchema = external_exports.object({
+  type: external_exports.literal("auth:login:failed"),
+  environment: DeployEnvironmentSchema.optional(),
+  reason: external_exports.string()
+});
+
 // ../protocol/src/contact-remote-access.ts
 var ContactSetRemoteAccessArgsSchema = external_exports.object({
   deviceId: external_exports.string().min(1),
@@ -21886,95 +22085,6 @@ var ContactPinnedFrameSchema = external_exports.object({
   pinnedAt: external_exports.number().int().nullable()
 }).strict();
 
-// ../protocol/src/feishu-auth.ts
-var DeviceEntrySchema = external_exports.object({
-  /**
-   * 设备标识（决策 #15：daemon 本地生成的 dev-<uuid>，与人的身份 unionId 无关）。
-   * 中心 server clawd_devices 注册表仅作服务发现（url 下发 + 目录），不在安全路径上。
-   */
-  deviceId: external_exports.string().min(1),
-  name: external_exports.string().min(1),
-  url: external_exports.string().min(1)
-});
-var DeviceListResponseSchema = external_exports.object({
-  type: external_exports.literal("device:list:ok"),
-  devices: external_exports.array(DeviceEntrySchema)
-});
-var DeviceConnectArgsSchema = external_exports.object({
-  deviceId: external_exports.string().min(1),
-  /**
-   * 目标设备的 ws/tunnel 地址（可选）：
-   *   - 公开目录点击：带 url（device:list 已下发，省一次 server 查询）
-   *   - 凭 deviceId 连接：缺省 url → daemon exchange 时由中心 server 下发该设备上报的 url
-   *   - 注册表不在安全路径上：知道对方 url 时显式传入即可连接（不依赖中心 server 服务发现）
-   */
-  url: external_exports.string().min(1).optional(),
-  /** Optional display name; otherwise populate it from the handshake acknowledgement. */
-  name: external_exports.string().optional()
-});
-var DeviceConnectResponseSchema = external_exports.object({
-  type: external_exports.literal("device:connect:ok"),
-  deviceId: external_exports.string(),
-  name: external_exports.string(),
-  url: external_exports.string()
-});
-var FeishuIdentitySchema = external_exports.object({
-  /** 归属人 id（决策 #16：TTC unique_id，取代飞书 union_id；跨登录方式稳定） */
-  ownerId: external_exports.string().min(1),
-  /** 身份来源：'ttc'（飞书/手机/邮箱登入 TTC）| 'google' | ...（决策 #16，拓展用） */
-  provider: external_exports.string().min(1),
-  displayName: external_exports.string().min(1),
-  /** TTC user_info 接口 data.avatar_url，可缺省 */
-  avatarUrl: external_exports.string().optional(),
-  /** TTC user_info 接口 data.union_id（飞书 union_id；dataclaw 可信入口 X-User-UnionId 用），可缺省 */
-  unionId: external_exports.string().optional()
-});
-var AuthLoginStartResponseSchema = external_exports.object({
-  type: external_exports.literal("auth:login:start:ok"),
-  authUrl: external_exports.string().min(1),
-  /** 防 CSRF 的一次性 nonce；回调时 daemon 校验 */
-  state: external_exports.string().min(1)
-});
-var AuthGetIdentityResponseSchema = external_exports.object({
-  type: external_exports.literal("auth:getIdentity:ok"),
-  /** null = 未登录 */
-  identity: FeishuIdentitySchema.nullable(),
-  /** Stable device identifier independent of login, used for the shareable device link. */
-  deviceId: external_exports.string().min(1)
-});
-var AuthLogoutResponseSchema = external_exports.object({
-  type: external_exports.literal("auth:logout:ok")
-});
-var GatewayUrl = external_exports.string().nullable();
-var AuthApiKeyGetResponseSchema = external_exports.object({
-  type: external_exports.literal("auth:apiKey:get:ok"),
-  /** null = 还没发过。**发过就能一直看到** —— 中心存的是明文，设置页据此展示 */
-  apiKey: external_exports.string().nullable(),
-  /** ISO 时间；apiKey 为 null 时同为 null */
-  createdAt: external_exports.string().nullable(),
-  gatewayUrl: GatewayUrl
-});
-var AuthApiKeyRegenerateResponseSchema = external_exports.object({
-  type: external_exports.literal("auth:apiKey:regenerate:ok"),
-  /** 新发的那把。**旧的当场失效** —— 一人一把，按 union_id 覆盖 */
-  apiKey: external_exports.string().min(1),
-  createdAt: external_exports.string().min(1),
-  gatewayUrl: GatewayUrl
-});
-var AuthApiKeyRevokeResponseSchema = external_exports.object({
-  type: external_exports.literal("auth:apiKey:revoke:ok"),
-  /** 之前有没有那把——没发过也算成功（幂等） */
-  revoked: external_exports.boolean()
-});
-var AuthLoginDoneEventSchema = external_exports.object({
-  type: external_exports.literal("auth:login:done"),
-  identity: FeishuIdentitySchema
-});
-var AuthLoginFailedEventSchema = external_exports.object({
-  type: external_exports.literal("auth:login:failed"),
-  reason: external_exports.string()
-});
-
 // ../protocol/src/dispatch.ts
 var DispatchOutcomeSchema = external_exports.discriminatedUnion("kind", [
   external_exports.object({
@@ -22778,7 +22888,14 @@ var PersonaFileSchema = external_exports.object({
   createdAt: external_exports.number(),
   updatedAt: external_exports.number(),
   /** Registry-only cloud entry, with no local persona directory. Local key adds -cloud; gateway paths use cloud.personaId and the registered engine determines the cloud tool id. */
-  cloud: external_exports.object({ gatewayUrl: external_exports.string().min(1), personaId: external_exports.string().min(1), publishedByMe: external_exports.boolean().optional() }).strict().optional()
+  cloud: external_exports.object({
+    gatewayUrl: external_exports.string().min(1),
+    personaId: external_exports.string().min(1),
+    publishedByMe: external_exports.boolean().optional(),
+    environment: DeployEnvironmentSchema.optional(),
+    expectedImage: ImageDigestSchema.optional(),
+    testReleaseId: external_exports.string().optional()
+  }).strict().optional()
 }).strict();
 var PersonaSkillSummarySchema = external_exports.object({
   // 目录名作为 skill name（对齐 CC：frontmatter `name:` 仅作 displayName 用）
@@ -23012,6 +23129,9 @@ var AllowRuleSchema = external_exports.object({
   createdAt: external_exports.string().min(1).optional()
 });
 var SessionFileSchema = external_exports.object({
+  cloudEnvironment: DeployEnvironmentSchema.optional(),
+  cloudExpectedImage: ImageDigestSchema.optional(),
+  testReleaseId: external_exports.string().optional(),
   sessionId: external_exports.string().min(1),
   /** New gateway execution identity after session:new; defaults to sessionId for the first execution. */
   cloudExecutionId: external_exports.string().min(1).optional(),
@@ -23888,9 +24008,21 @@ var METHOD_DOCS = {
     summary: "\u539F\u6837\u91CD\u8DD1\u6700\u65B0\u90A3\u6761\u6D41\u6C34\u7EBF\u91CC\u5931\u8D25\u7684\u67D0\u4E00\u6BB5\uFF08GitHub REST rerun job\uFF09\u3002**\u540C\u4E00\u4E2A commit\u3001\u540C\u4E00\u4EFD\u8F93\u5165**\uFF0C\u4E0D\u4EA7\u751F\u65B0\u63D0\u4EA4\u2014\u2014\u6539\u4E86 persona \u5185\u5BB9\u8981 deploy:scan \u518D deploy:release\u3002jobId \u5FC5\u987B\u5C5E\u4E8E\u6700\u65B0\u90A3\u6761 run\uFF1Bowner-only",
     args: DeployRerunJobArgsSchema
   },
+  "deploy:confirmTest": {
+    summary: "\u786E\u8BA4\u6240\u9009\u6D4B\u8BD5\u7248\u901A\u8FC7\u5B9E\u9645\u8BD5\u7528\uFF1B\u6309\u5DF2\u4FDD\u5B58\u5236\u54C1\u548C\u6D4B\u8BD5\u767B\u8BB0\u6821\u9A8C\uFF0Cowner-only\u3001human-only",
+    args: DeployConfirmTestArgsSchema
+  },
+  "deploy:promote": {
+    summary: "\u5C06\u5DF2\u786E\u8BA4\u6D4B\u8BD5\u7248\u7684\u63D0\u4EA4\u63A8\u8FDB main \u5E76\u4E0A\u7EBF\u76F8\u540C\u955C\u50CF\uFF1B\u6062\u590D\u4E2D\u65AD\u7684\u540C\u4E00\u6B21\u664B\u7EA7\uFF0Cowner-only\u3001human-only",
+    args: DeployPromoteArgsSchema
+  },
+  "deploy:openTest": {
+    summary: "\u51C6\u5907\u5F53\u524D\u6D4B\u8BD5\u7248\u7684\u4E91 Persona \u4F1A\u8BDD\u5165\u53E3\uFF0C\u9501\u5B9A\u73AF\u5883\u548C\u5DF2\u6D4B\u955C\u50CF\uFF0Cowner-only\u3001human-only",
+    args: DeployOpenTestArgsSchema
+  },
   "deploy:unpublish": {
     summary: "\u4E0B\u7EBF\uFF1A\u89E6\u53D1 persona \u4ED3\u5E93\u91CC\u7684 clawd-unpublish.yml\uFF08workflow_dispatch\uFF09\uFF0C\u7531\u6D41\u6C34\u7EBF\u5728 gateway \u64A4\u6389\u6B63\u5F0F\u767B\u8BB0\u2014\u2014\u522B\u4EBA\u770B\u4E0D\u5230\u3001\u7528\u4E0D\u4E86\uFF1B\u4ED3\u5E93 / \u955C\u50CF / \u672C\u673A\u4E0A\u4E91\u8BB0\u5F55\u90FD\u4E0D\u52A8\uFF0C\u91CD\u65B0\u53D1\u5E03\u5C31\u56DE\u6765\u3002\u6700\u540E\u4E00\u6B21\u53D1\u5E03\u7684 commit \u91CC\u6CA1\u6709\u8FD9\u4EFD workflow\uFF08\u65E7\u6A21\u677F\uFF09\u65F6\u62D2\uFF0C\u8981\u5148\u91CD\u65B0\u53D1\u5E03\u4E00\u6B21\u3002\u56DE { before }\uFF1A\u89E6\u53D1\u4E4B\u524D\u73B0\u67E5\u7684\u6700\u65B0\u4E0B\u7EBF run id\uFF08\u6CA1\u4E0B\u7EBF\u8FC7 = null\uFF09\uFF0C\u9875\u9762\u62FF\u5B83\u8BA4\u65B0 run\uFF1Bowner-only\u3001human-only",
-    args: DeployPersonaArgsSchema
+    args: DeployEnvironmentArgsSchema
   },
   "githubAuth:get": {
     summary: "\u672C\u673A\u7684 GitHub \u8EAB\u4EFD\uFF1Aauthorized\uFF08@login\uFF0C\u6765\u81EA git \u51ED\u636E\u5B58\u50A8 / \u672C\u673A\u51ED\u636E\u8868\uFF09/ missing / invalid\uFF08GitHub \u4E0D\u8BA4\uFF09/ pending\uFF08\u7B49 GitHub \u8DF3\u56DE\u4E2D\u5FC3\uFF09\u3002\u8BBE\u7F6E\u9875\u300C\u8D26\u53F7\u300D\u3001\u4E0A\u4E91\u9875\u9876\u4E0A\u90A3\u5F20\u5361\u3001PR \u6536\u4EF6\u7BB1\u90FD\u770B\u5B83\uFF1Bpending \u671F\u9875\u9762\u6BCF 2 \u79D2\u8F6E\u8BE2\uFF0Cdaemon \u987A\u624B\u5411\u4E2D\u5FC3\u9886 token\u3002\u65E0\u53C2\u6570",
@@ -24312,7 +24444,7 @@ var METHOD_DOCS = {
   },
   "auth:login:start": {
     summary: "\u8D77\u98DE\u4E66\u767B\u5F55\u6D41\u7A0B\uFF1A\u751F\u6210 state \u5E76\u8FD4\u56DE\u6388\u6743 URL\uFF0C\u56DE\u8C03\u8D70 HTTP /auth/callback \u843D\u76D8\u3002owner-only",
-    args: NO_ARGS
+    args: AuthEnvironmentArgsSchema
   },
   "auth:getIdentity": {
     summary: "\u53D6\u672C\u673A owner \u7684\u98DE\u4E66\u8EAB\u4EFD\uFF08ownerId / provider / displayName / unionId\uFF09+ **\u672C\u673A deviceId**\uFF08\u8BBE\u5907\u5C5E\u6027\uFF0C\u4E0E\u767B\u5F55\u6001\u65E0\u5173\uFF1Bdevice:connect / contact:* / inbox:* \u7684\u4E3B\u952E\u90FD\u662F\u5B83\uFF09\uFF1B\u7EDD\u4E0D\u8FD4\u56DE\u767B\u5F55\u7968",
@@ -24324,15 +24456,15 @@ var METHOD_DOCS = {
   },
   "auth:apiKey:get": {
     summary: "\u8BFB\u56DE\u81EA\u5DF1\u90A3\u628A\u4E91 persona \u8C03\u7528 key\uFF08\u6CA1\u53D1\u8FC7 \u2192 apiKey:null\uFF09\u3002daemon \u62FF\u672C\u673A\u767B\u5F55\u51ED\u8BC1\u5411\u4E2D\u5FC3\u4EE3\u53D6\uFF0C\u51ED\u8BC1\u4E0D\u51FA ws\u3002owner-only",
-    args: NO_ARGS
+    args: AuthEnvironmentArgsSchema
   },
   "auth:apiKey:regenerate": {
     summary: "\u6362\u4E00\u628A\u65B0\u7684\u4E91 persona \u8C03\u7528 key\uFF0C**\u65E7\u7684\u5F53\u573A\u5931\u6548**\uFF08\u4E00\u4EBA\u4E00\u628A\uFF0C\u4E2D\u5FC3\u6309 union_id \u8986\u76D6\uFF09\u3002owner-only",
-    args: NO_ARGS
+    args: AuthEnvironmentArgsSchema
   },
   "auth:apiKey:revoke": {
     summary: "\u64A4\u9500\u81EA\u5DF1\u7684\u4E91 persona \u8C03\u7528 key\uFF1A\u4E2D\u5FC3\u5220\u6389\u90A3\u4E00\u884C\u3001**\u4E0D\u53D1\u65B0\u7684**\u3002gateway \u53EA\u5728\u5F00\u4F1A\u8BDD\u548C\u6BCF\u6B21\u4E0A\u884C\u65F6\u9A8C key\uFF0C\u6240\u4EE5\u5F00\u7740\u7684\u4E91\u4F1A\u8BDD\u4E0B\u4E00\u6761\u6D88\u606F\u624D\u53D1\u4E0D\u51FA\u53BB\u3001\u6B63\u5728\u8DD1\u7684\u90A3\u4E00\u8F6E\u4F1A\u8DD1\u5B8C\u3002\u6CA1\u53D1\u8FC7\u4E5F\u56DE ok\uFF08revoked:false\uFF09\u3002owner-only",
-    args: NO_ARGS
+    args: AuthEnvironmentArgsSchema
   },
   "device:list": {
     summary: "\u5217\u51FA\u516C\u5171\u8BBE\u5907\u76EE\u5F55\u91CC\u53EF\u8FDE\u63A5\u7684\u8BBE\u5907\uFF08daemon \u4EE3\u7406\u4E2D\u5FC3 server\uFF09\u3002owner-only",
@@ -24467,10 +24599,242 @@ var DEPLOY_FILE = import_node_path3.default.join(".clawd", "deploy.json");
 var SCAN_FILE = import_node_path3.default.join(".clawd", "deploy-scan.json");
 var z1 = DeployScanSchema.omit({ id: true, manifest: true }).extend({ releasedHead: DeployScanSchema.shape.head }).strict();
 var z2 = external_exports.object({ version: external_exports.literal(2), scans: external_exports.array(DeployScanSchema), released: DeployReleasedSchema.optional() }).strict();
+var z3 = external_exports.object({ version: external_exports.literal(3), scans: external_exports.array(DeployScanSchema), releases: external_exports.array(DeployReleasedSchema) }).strict();
 var PackageFindingSchema = EnvPackageSchema.omit({ localVersion: true, artifact: true, aptMissing: true, aptVersion: true }).extend({
   artifact: external_exports.object({ url: external_exports.string().url(), bin: external_exports.string() }).strict().optional()
 });
 
+// src/deploy/release-workflow.ts
+function renderDeployWorkflow(config2) {
+  const identity = [
+    "      - name: Select pinned source identities",
+    "        env:",
+    "          RELEASE_JSON: ${{ inputs.release_json }}",
+    "        run: |",
+    "          node --input-type=module <<'NODE'",
+    '          import fs from "node:fs"',
+    '          const file = "candidate-release.json"',
+    '          const r = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, "utf8")) : process.env.RELEASE_JSON ? JSON.parse(process.env.RELEASE_JSON) : undefined',
+    '          if (r && (!/^[a-f0-9]{40}$/.test(r.commit) || !/^[a-f0-9]{40}$/.test(r.pipelineCommit) || r.repository !== process.env.GITHUB_REPOSITORY)) throw new Error("invalid Persona release identity")',
+    '          if (process.env.DEPLOY_ENVIRONMENT === "production" && (!r || process.env.GITHUB_REF_NAME !== "main" || process.env.GITHUB_SHA !== r.commit)) throw new Error("production main must equal tested commit")',
+    '          fs.appendFileSync(process.env.GITHUB_ENV, "SOURCE_COMMIT=" + (r?.commit ?? process.env.GITHUB_SHA) + "\\nPIPELINE_COMMIT=" + (r?.pipelineCommit ?? process.env.CLAWOS_REF) + "\\n")',
+    "          NODE",
+    ""
+  ];
+  const contract = [
+    ...identity,
+    "      - name: Checkout persona",
+    "        uses: actions/checkout@v4",
+    "        with:",
+    "          path: persona",
+    "          ref: ${{ env.SOURCE_COMMIT }}",
+    "          sparse-checkout: .clawd",
+    "",
+    "      - name: Checkout pinned pipeline",
+    "        uses: actions/checkout@v4",
+    "        with:",
+    "          repository: ${{ env.CLAWOS_REPO }}",
+    "          ref: ${{ env.PIPELINE_COMMIT }}",
+    "          token: ${{ secrets.CLAWOS_READ_TOKEN }}",
+    "          path: clawos",
+    "          sparse-checkout: |",
+    "            cloud-host/pipeline",
+    "            cloud-host/k8s",
+    "",
+    "      - name: \u8BFB\u90E8\u7F72\u6587\u4EF6",
+    "        id: plan",
+    "        run: |",
+    "          node clawos/cloud-host/pipeline/deploy-file.mjs \\",
+    "            --persona-dir persona \\",
+    "            --repo-name '${{ github.event.repository.name }}' \\",
+    '            --sha "$SOURCE_COMMIT" >> "$GITHUB_OUTPUT"',
+    "",
+    "      - name: Bind pipeline source",
+    '        run: echo "PIPELINE_COMMIT=$(git -C clawos rev-parse HEAD)" >> "$GITHUB_ENV"',
+    "",
+    "      - name: Select integration credentials",
+    "        if: inputs.environment != 'production'",
+    "        env:",
+    "          CLAWD_INT_GATEWAY_URL: ${{ vars.CLAWD_INT_GATEWAY_URL }}",
+    "          CLAWD_INT_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_INT_GATEWAY_ADMIN_KEY }}",
+    "          CLAWD_INT_PERSONA_SECRETS_JSON: ${{ toJSON(secrets) }}",
+    "          CLAWD_ENV_NAMES: ${{ steps.plan.outputs.env_names }}",
+    "        run: node clawos/cloud-host/pipeline/persona-candidate.mjs env",
+    "",
+    "      - name: Select production credentials",
+    "        if: inputs.environment == 'production'",
+    "        env:",
+    "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
+    "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
+    "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
+    "        run: node clawos/cloud-host/pipeline/persona-candidate.mjs env",
+    "",
+    "      - name: Check required credentials",
+    "        env:",
+    "          CLAWD_ENV_NAMES: ${{ steps.plan.outputs.env_names }}",
+    "        run: node clawos/cloud-host/pipeline/check-secrets.mjs",
+    ""
+  ];
+  const download = (name) => [
+    "      - uses: actions/download-artifact@v4",
+    "        with:",
+    `          name: ${name}`,
+    ""
+  ];
+  const upload = (name) => [
+    "      - uses: actions/upload-artifact@v4",
+    ...name.startsWith("persona-verified") ? ["        if: inputs.environment != 'production'"] : [],
+    "        with:",
+    `          name: ${name}`,
+    "          path: candidate-release.json",
+    "          overwrite: true",
+    ""
+  ];
+  const runtime = (script) => [
+    `      - name: ${script === "smoke" ? "Run real int smoke" : "Register the verified image"}`,
+    "        env:",
+    "          CLAWD_ENV_NAMES: ${{ steps.plan.outputs.env_names }}",
+    "        run: |",
+    `          IMAGE_REF=$(node clawos/cloud-host/pipeline/release.mjs validate --file candidate-release.json --component persona${script === "register" ? " --production" : ""})`,
+    ...script === "register" ? ["          node clawos/cloud-host/pipeline/persona-candidate.mjs check-source"] : [],
+    `          node clawos/cloud-host/pipeline/${script}.mjs \\`,
+    '            --image "$IMAGE_REF" \\',
+    "            --persona-id '${{ steps.plan.outputs.persona_id }}' \\",
+    "            --model '${{ steps.plan.outputs.model }}' \\",
+    "            --effort '${{ steps.plan.outputs.effort }}' \\",
+    "            --size '${{ steps.plan.outputs.size }}' \\",
+    "            --task-concurrency '${{ steps.plan.outputs.task_concurrency }}' \\",
+    "            --engine '${{ steps.plan.outputs.engine }}' \\",
+    "            --connectors '${{ steps.plan.outputs.connectors }}' \\",
+    "            --run-number '${{ github.run_number }}'",
+    ""
+  ];
+  const job = (name) => [
+    `  ${name}:`,
+    `    name: ${name}`,
+    "    runs-on: ubuntu-latest",
+    "    environment: ${{ inputs.environment || 'integration' }}",
+    "    timeout-minutes: 40"
+  ];
+  return [
+    "name: clawd deploy",
+    "run-name: ${{ inputs.environment == 'production' && format('persona-production-{0}', inputs.promotion_id) || 'persona-integration' }}",
+    "# \u7531 clawd \u751F\u6210\u3001\u7531 clawd \u7EF4\u62A4\u3002push \u6784\u5EFA int \u5019\u9009\uFF1Bproduction \u624B\u52A8\u664B\u7EA7\u5DF2\u9A8C\u6536\u5236\u54C1\u3002",
+    "on:",
+    "  push:",
+    "    branches: [integration]",
+    "  workflow_dispatch:",
+    "    inputs:",
+    "      environment:",
+    "        type: choice",
+    "        options: [integration, production]",
+    "        default: integration",
+    "      promotion_id:",
+    "        type: string",
+    "        required: false",
+    "      release_json:",
+    "        description: Verified Persona release JSON for production promotion",
+    "        type: string",
+    "        required: false",
+    "",
+    "concurrency:",
+    "  group: persona-cloud-${{ github.repository }}",
+    "  queue: max",
+    "  cancel-in-progress: false",
+    "",
+    "env:",
+    `  REGISTRY: ${config2.registry}`,
+    `  VPC_REGISTRY: ${config2.vpcRegistry}`,
+    `  ACR_NAMESPACE: ${config2.namespace}`,
+    `  CLAWOS_REPO: ${config2.repository}`,
+    "  CLAWOS_REF: ${{ vars.CLAWD_PIPELINE_REF || '" + config2.ref + "' }}",
+    "  DEPLOY_ENVIRONMENT: ${{ inputs.environment || 'integration' }}",
+    "",
+    "permissions:",
+    "  contents: read",
+    "",
+    "jobs:",
+    ...job("build"),
+    "    steps:",
+    ...contract,
+    "      - name: Dockerfile matches Persona directory",
+    "        if: inputs.environment != 'production'",
+    "        run: |",
+    "          test -f persona/Dockerfile",
+    "          grep -qF '/clawd/personas/${{ steps.plan.outputs.persona_id }}/' persona/Dockerfile",
+    "",
+    "      - name: Install aliyun CLI",
+    "        if: inputs.environment != 'production'",
+    "        env:",
+    "          GH_TOKEN: ${{ github.token }}",
+    "        run: |",
+    "          TAGNAME=$(gh release view --repo aliyun/aliyun-cli --json tagName -q .tagName)",
+    '          VER=$(printf %s "$TAGNAME" | sed s/^v//)',
+    '          curl -fsSL -o /tmp/aliyun-cli.tgz "https://github.com/aliyun/aliyun-cli/releases/download/$TAGNAME/aliyun-cli-linux-$VER-amd64.tgz"',
+    "          sudo tar -xzf /tmp/aliyun-cli.tgz -C /usr/local/bin",
+    "",
+    "      - name: Login to ACR",
+    "        if: inputs.environment != 'production'",
+    "        uses: aliyun/acr-login@v1",
+    "        with:",
+    "          login-server: ${{ env.REGISTRY }}",
+    "          username: ${{ secrets.ALI_DOCKER_USERNAME }}",
+    "          password: ${{ secrets.ALI_DOCKER_PASSWORD }}",
+    "",
+    "      - name: Select candidate or promote without rebuilding",
+    "        env:",
+    "          ALIBABA_CLOUD_ACCESS_KEY_ID: ${{ secrets.ALI_ACS_ACCESS_KEY_ID }}",
+    "          ALIBABA_CLOUD_ACCESS_KEY_SECRET: ${{ secrets.ALI_ACS_ACCESS_KEY_SECRET }}",
+    "          RELEASE_JSON: ${{ inputs.release_json }}",
+    "        run: node clawos/cloud-host/pipeline/persona-candidate.mjs",
+    "",
+    ...upload("persona-candidate"),
+    ...job("smoke"),
+    "    needs: build",
+    "    if: inputs.environment != 'production'",
+    "    steps:",
+    ...download("persona-candidate"),
+    ...contract,
+    ...runtime("smoke"),
+    "      - name: Attest successful int runtime smoke",
+    '        run: node clawos/cloud-host/pipeline/release.mjs attest --file candidate-release.json --endpoint "$CLAWD_GATEWAY_URL" --checks persona-smoke --out candidate-release.json',
+    "",
+    ...upload("persona-smoked"),
+    ...job("deploy"),
+    "    needs: [build, smoke]",
+    "    if: always() && needs.build.result == 'success' && (needs.smoke.result == 'success' || needs.smoke.result == 'skipped')",
+    "    steps:",
+    ...download("${{ inputs.environment == 'production' && 'persona-candidate' || 'persona-smoked' }}"),
+    ...contract,
+    ...runtime("register"),
+    ...upload("persona-verified-${{ github.run_attempt }}")
+  ].join("\n");
+}
+
+// src/deploy/templates.ts
+var import_node_crypto2 = require("crypto");
+
+// src/deploy/default-base-release.json
+var default_base_release_default = {
+  version: 1,
+  environment: "integration",
+  component: "base",
+  image: "registry-vpc.cn-hangzhou.aliyuncs.com/ttc-prod/clawd-persona-base@sha256:9a0952c6bc94a6595374da7db125b5089b476d0bd88f280bd981757d9f572c22",
+  commit: "8dfab2c57781e9f9600e3f99a79adcfbef455f2e",
+  verification: {
+    status: "passed",
+    fingerprint: "d7b03abb9d2bf3a4d7f6f88ac43a2d33d6ec7a7c94ae816f7dae11d67d338194",
+    checks: [
+      "base-smoke",
+      "codex-smoke",
+      "pi-smoke",
+      "workspace-persistence"
+    ],
+    endpoint: "https://persona-int.clawos.chat",
+    verifiedAt: "2026-10-08T09:34:53.131Z"
+  }
+};
+
 // src/deploy/templates.ts
 var CLAWOS_REPO = "ottin4ttc/clawos";
 var CLAWOS_REF = "release";
@@ -24481,7 +24845,17 @@ var UNPUBLISH_WORKFLOW_PATH = `.github/workflows/${UNPUBLISH_WORKFLOW_FILE}`;
 var ACR_REGISTRY = "registry.cn-hangzhou.aliyuncs.com";
 var ACR_VPC_REGISTRY = "registry-vpc.cn-hangzhou.aliyuncs.com";
 var ACR_NAMESPACE = "ttc-prod";
-var BASE_IMAGE = `${ACR_REGISTRY}/${ACR_NAMESPACE}/clawd-persona-base:release`;
+var acceptedBase = VerifiedBaseReleaseSchema.parse(default_base_release_default);
+var baseFingerprint = (0, import_node_crypto2.createHash)("sha256").update(JSON.stringify({
+  component: acceptedBase.component,
+  image: acceptedBase.image,
+  commit: acceptedBase.commit,
+  baseImage: null,
+  pipelineCommit: null,
+  repository: null
+})).digest("hex");
+if (baseFingerprint !== acceptedBase.verification.fingerprint) throw new Error("\u5E73\u53F0\u9ED8\u8BA4\u5E95\u5EA7\u4E0E\u5DF2\u9A8C\u6536\u5236\u54C1\u4E0D\u4E00\u81F4");
+var BASE_IMAGE = acceptedBase.image.replace(`${ACR_VPC_REGISTRY}/`, `${ACR_REGISTRY}/`);
 var DOCKERIGNORE_TEMPLATE = [
   "# \u7531 clawd \u751F\u6210\u3001\u7531 clawd \u7EF4\u62A4\uFF08\u540C Dockerfile\uFF09\u3002",
   ".git",
@@ -24520,170 +24894,8 @@ var CONTRACT_STEPS = [
   "",
   ...PLAN_STEP
 ];
-var ACR_LOGIN_STEPS = [
-  "      - name: Login to ACR\uFF08\u89E3\u6790\u955C\u50CF digest \u8981 docker \u51ED\u636E\uFF09",
-  "        uses: aliyun/acr-login@v1",
-  "        with:",
-  "          login-server: ${{ env.REGISTRY }}",
-  '          username: "${{ secrets.ALI_DOCKER_USERNAME }}"',
-  '          password: "${{ secrets.ALI_DOCKER_PASSWORD }}"',
-  ""
-];
-var IMAGE_LATEST = '"$REGISTRY/$ACR_NAMESPACE/${{ steps.plan.outputs.persona_id }}:latest"';
-var RESOLVE_LINE = `          IMAGE_REF=$(node clawos/cloud-host/pipeline/acr.mjs resolve --image ${IMAGE_LATEST} --vpc-registry "$VPC_REGISTRY")`;
 var CONCURRENCY_GROUP = "  group: persona-cloud-${{ github.repository }}";
-var L = [
-  "name: clawd deploy",
-  "",
-  "# \u7531 clawd \u751F\u6210\u3001\u7531 clawd \u7EF4\u62A4\uFF1A\u6BCF\u6B21\u300C\u53D1\u5E03\u300D\u90FD\u4F1A\u7528\u5F53\u524D\u6A21\u677F\u91CD\u5199\u8FD9\u4EFD\u6587\u4EF6\u518D\u63D0\u4EA4\uFF0C\u624B\u6539\u4F1A\u88AB\u76D6\u6389\u3002",
-  "# \u4E09\u6BB5\uFF1Abuild \u8BA9 ACR \u4ECE\u8FD9\u4E2A\u4ED3\u5E93\u6784 persona \u955C\u50CF\uFF08Dockerfile \u4E5F\u662F clawd \u5199\u7684\uFF09\u2192 smoke \u5728\u96C6\u7FA4\u4E0A\u771F\u8D77\u4E00\u6B21 \u2192 deploy \u5728 gateway \u767B\u8BB0\u6210\u6B63\u5F0F\u3002",
-  "# \u955C\u50CF\u4E0D\u5728 runner \u4E0A\u6784\u3001\u4E5F\u4E0D\u4ECE runner \u63A8\uFF1AACR \u4E2A\u4EBA\u7248\u4ED3\u5E93 ttc-prod/<persona_id> \u6302\u7740\u8FD9\u4E2A GitHub \u4ED3\u5E93\u5F53\u4EE3\u7801\u6E90\uFF08\u9996\u6B21\u53D1\u5E03\u65F6\u81EA\u5EFA\uFF09\uFF0C",
-  "# build \u6BB5\u53EA\u662F\u300C\u89E6\u53D1 \u2192 \u7B49\u5B83\u6784\u51FA\u672C\u6B21 commit\u300D\uFF1Bsmoke / deploy \u5404\u81EA\u628A :latest \u89E3\u6790\u6210 digest \u518D\u7528\u3002\u6D41\u6C34\u7EBF\u811A\u672C\u5728 ottin4ttc/clawos \u4ED3\u5E93\u91CC\u3002",
-  "#",
-  "# \u8981\u7684\u7EC4\u7EC7\u7EA7 Secrets\uFF1AALI_ACS_ACCESS_KEY_ID / ALI_ACS_ACCESS_KEY_SECRET\uFF08ACR OpenAPI\uFF1A\u5EFA\u4ED3\u5E93 / \u89E6\u53D1 / \u67E5\u6784\u5EFA\u8BB0\u5F55\uFF09\u3001",
-  "# ALI_DOCKER_USERNAME / ALI_DOCKER_PASSWORD\uFF08\u89E3\u6790\u955C\u50CF digest\uFF09\u3001CLAWOS_READ_TOKEN\uFF08\u8BFB clawos \u4ED3\u5E93\uFF09\u3001CLAWD_GATEWAY_ADMIN_KEY\uFF1B",
-  "# \u7EC4\u7EC7\u7EA7 Variable\uFF1ACLAWD_GATEWAY_URL\u3002",
-  "# \u4ED3\u5E93\u7EA7\u540C\u540D\u914D\u7F6E\u4F1A\u76D6\u8FC7\u7EC4\u7EC7\u7EA7\u2014\u2014\u67D0\u4E2A persona \u8981\u6307\u5230\u53E6\u4E00\u53F0 gateway\uFF0C\u5728\u81EA\u5DF1\u4ED3\u5E93\u91CC\u914D\u5373\u53EF\u3002",
-  "",
-  "on:",
-  "  push:",
-  "    branches: [main]",
-  "  workflow_dispatch:",
-  "",
-  "concurrency:",
-  "  # \u540C\u4E00\u4E2A\u4ED3\u5E93\u7684\u53D1\u5E03\u6392\u961F\u8DD1\uFF0C\u4E0D\u53D6\u6D88\uFF1A\u4E0A\u4E00\u6B21\u53EF\u80FD\u5DF2\u7ECF\u5728\u767B\u8BB0\u6B63\u5F0F\u4E86",
-  CONCURRENCY_GROUP,
-  "",
-  "env:",
-  `  REGISTRY: ${ACR_REGISTRY}`,
-  `  VPC_REGISTRY: ${ACR_VPC_REGISTRY}`,
-  `  ACR_NAMESPACE: ${ACR_NAMESPACE}`,
-  `  CLAWOS_REPO: ${CLAWOS_REPO}`,
-  `  CLAWOS_REF: ${CLAWOS_REF}`,
-  "",
-  "permissions:",
-  "  contents: read",
-  "",
-  "jobs:",
-  "  build:",
-  // jobs API 只返 name 不返 key，故 name 必须用段 key。
-  "    name: build",
-  "    runs-on: ubuntu-latest",
-  // ACR 账号内串行构建，需给其他镜像排队留时间。
-  "    timeout-minutes: 40",
-  "    steps:",
-  ...CONTRACT_STEPS,
-  "      - name: \u51ED\u636E\u9F50\u4E0D\u9F50\uFF08\u7F3A\u54EA\u51E0\u4E2A\u540D\u5B57\u4E00\u6B21\u5217\u5168\uFF09",
-  "        env:",
-  "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
-  "          CLAWD_ENV_NAMES: ${{ steps.plan.outputs.env_names }}",
-  "        run: node clawos/cloud-host/pipeline/check-secrets.mjs",
-  "",
-  "      - name: Dockerfile \u5728\u3001\u4E14\u62F7\u5230\u7684\u662F\u8FD9\u4E2A persona \u7684\u76EE\u5F55",
-  "        # Dockerfile \u7531 clawd \u53D1\u5E03\u65F6\u5199\uFF08\u540C\u8FD9\u4EFD workflow\uFF09\uFF0CACR \u6309\u5B83\u6784\u3002\u76EE\u5F55\u540D\u90A3\u4E00\u6BB5\u8981\u4E0E deploy-file \u7B97\u51FA\u7684 persona_id \u4E00\u81F4\uFF1A",
-  "        # \u4E24\u8FB9\u5404\u6709\u4E00\u4EFD\u540C\u6837\u7684\u540D\u5B57\u6E05\u6D17\uFF0C\u8FD9\u91CC\u662F\u5B83\u4EEC\u552F\u4E00\u7684\u4EA4\u6C47\u70B9\u3002",
-  "        run: |",
-  "          test -f persona/Dockerfile \\",
-  '            || { echo "\u2717 \u4ED3\u5E93\u91CC\u6CA1\u6709 Dockerfile\uFF1A\u8FD9\u6B21\u63A8\u9001\u4E0D\u662F clawd \u53D1\u5E03\u7684\uFF08\u6216 clawd \u592A\u65E7\uFF09\uFF1B\u56DE clawd \u7684\u4E0A\u4E91\u9875\u9762\u91CD\u65B0\u53D1\u5E03" >&2; exit 1; }',
-  "          grep -qF '/clawd/personas/${{ steps.plan.outputs.persona_id }}/' persona/Dockerfile \\",
-  '            || { echo "\u2717 Dockerfile \u62F7\u5230\u7684\u76EE\u5F55\u4E0D\u662F /clawd/personas/${{ steps.plan.outputs.persona_id }}/" >&2; exit 1; }',
-  "",
-  "      - name: \u88C5 aliyun CLI\uFF08ACR OpenAPI\uFF1A\u5EFA\u4ED3\u5E93 / \u89E6\u53D1 / \u67E5\u6784\u5EFA\u8BB0\u5F55\uFF09",
-  "        env:",
-  "          GH_TOKEN: ${{ github.token }}",
-  "        run: |",
-  "          TAGNAME=$(gh release view --repo aliyun/aliyun-cli --json tagName -q .tagName)",
-  // 不用 ${TAGNAME#v} 这种带花括号的展开：这份模板里 `${` 只许出现在 GitHub 表达式里（spec 守着）
-  '          VER=$(printf %s "$TAGNAME" | sed s/^v//)',
-  '          curl -fsSL -o /tmp/aliyun-cli.tgz "https://github.com/aliyun/aliyun-cli/releases/download/$TAGNAME/aliyun-cli-linux-$VER-amd64.tgz"',
-  "          sudo tar -xzf /tmp/aliyun-cli.tgz -C /usr/local/bin",
-  "          aliyun version",
-  "",
-  "      - name: \u8BA9 ACR \u4ECE\u672C\u4ED3\u5E93\u6784\uFF08\u9996\u6B21\u53D1\u5E03\u5148\u5EFA ACR \u4ED3\u5E93\u4E0E\u89C4\u5219\uFF1B\u7B49\u5B83\u6784\u51FA\u672C\u6B21 commit\uFF09",
-  "        # ACR \u6784\u7684\u662F main \u5F53\u524D\u7684 tip\u3001\u4E0D\u662F github.sha\uFF1Atip \u5DF2\u7ECF\u4E0D\u662F\u672C\u6B21 commit \u65F6\u76F4\u63A5\u7EA2\uFF0C\u8BA9\u66F4\u65B0\u7684\u90A3\u6B21 run \u53BB\u6784\u3001\u53BB\u767B\u8BB0\u3002",
-  "        # \u81EA\u52A8\u6784\u5EFA\u5173\u7740\uFF1A\u53EA\u6709\u8FD9\u91CC\u89E6\u53D1\u3001webhook \u4E0D\u6784\uFF0C\u300C\u6784 \u2192 \u5192\u70DF \u2192 \u767B\u8BB0\u300D\u624D\u662F\u4E00\u6761\u6709\u5E8F\u7684\u94FE\u3002",
-  "        # \u6784\u51FA\u7684\u662F\u54EA\u4E2A commit \u7531 acr.mjs wait \u6309\u6784\u5EFA\u8BB0\u5F55 + \u65E5\u5FD7\u91CC\u7684 commit \u6838\uFF0C\u4E0D\u770B\u955C\u50CF\u7684\u65F6\u95F4\uFF08\u7F13\u5B58\u547D\u4E2D\u65F6\u90A3\u662F\u8001\u7684\uFF09\u3002",
-  "        env:",
-  "          ALIBABA_CLOUD_ACCESS_KEY_ID: ${{ secrets.ALI_ACS_ACCESS_KEY_ID }}",
-  "          ALIBABA_CLOUD_ACCESS_KEY_SECRET: ${{ secrets.ALI_ACS_ACCESS_KEY_SECRET }}",
-  "        run: |",
-  // pipefail 让 ls-remote 失败正确传播，避免被 cut 的成功状态掩盖。
-  "          set -eo pipefail",
-  '          REPO="$ACR_NAMESPACE/${{ steps.plan.outputs.persona_id }}"',
-  '          node clawos/cloud-host/pipeline/acr.mjs ensure-repo --repo "$REPO" \\',
-  "            --source '${{ github.repository }}' --location / --dockerfile Dockerfile --branch main --tag latest \\",
-  "            --summary 'clawd persona ${{ github.event.repository.name }}'",
-  "          TIP=$(git -C persona ls-remote origin refs/heads/main | cut -f1)",
-  `          [ "$TIP" = '\${{ github.sha }}' ] \\`,
-  '            || { echo "\u2717 main \u5DF2\u7ECF\u63A8\u8FDB\u5230 $TIP\uFF0C\u672C\u6B21 ${{ github.sha }} \u4E0D\u518D\u6784\uFF1B\u7B49\u65B0\u7684\u90A3\u6B21 run" >&2; exit 1; }',
-  '          node clawos/cloud-host/pipeline/acr.mjs trigger --repo "$REPO" --tag latest',
-  `          node clawos/cloud-host/pipeline/acr.mjs wait --repo "$REPO" --tag latest --commit '\${{ github.sha }}' --timeout-sec 1800`,
-  "",
-  ...ACR_LOGIN_STEPS,
-  "      - name: \u955C\u50CF = \u672C\u6B21 commit \u6784\u51FA\u7684\u90A3\u4EFD\uFF08digest\uFF1B\u53EA\u6253\u65E5\u5FD7\uFF0Csmoke / deploy \u5404\u81EA\u518D\u89E3\u6790\u4E00\u6B21\uFF09",
-  `        run: node clawos/cloud-host/pipeline/acr.mjs resolve --image ${IMAGE_LATEST} --vpc-registry "$VPC_REGISTRY"`,
-  "",
-  "  smoke:",
-  "    name: smoke",
-  "    needs: build",
-  "    runs-on: ubuntu-latest",
-  "    timeout-minutes: 20",
-  "    steps:",
-  ...CONTRACT_STEPS,
-  ...ACR_LOGIN_STEPS,
-  "      - name: \u4E34\u65F6\u767B\u8BB0 \u2192 \u8D77\u4E00\u6B21 Pod \u2192 \u64A4\u9500",
-  "        # \u767B\u8BB0\u6B63\u5F0F\u53EA\u662F\u5F80 gateway \u5199\u4E00\u884C\uFF0Cgateway \u4E0D\u78B0\u955C\u50CF\uFF1B\u96C6\u7FA4\u62C9\u955C\u50CF\u53D1\u751F\u5728\u7B2C\u4E00\u4E2A\u4EFB\u52A1\u5230\u6765\u65F6\u3002",
-  "        # \u6CA1\u6709\u8FD9\u4E00\u6B65\uFF0C\u6D41\u6C34\u7EBF\u7EFF\u4E86\u53EA\u4EE3\u8868\u300C\u767B\u8BB0\u4E86\u300D\u3002\u955C\u50CF\u7528 digest\uFF08\u96C6\u7FA4 Job \u662F IfNotPresent\uFF0C\u79FB\u52A8 tag \u4F1A\u4E00\u76F4\u8DD1\u65E7\u7684\uFF09\u3002",
-  // smoke 与正式发布用同份模型/档位/连接器；deploy-file.mjs 拒绝单引号/换行等危险值，方可单引号拼参。
-  "        env:",
-  "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
-  "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
-  "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
-  "          CLAWD_ENV_NAMES: ${{ steps.plan.outputs.env_names }}",
-  "        run: |",
-  "          set -e",
-  RESOLVE_LINE,
-  "          node clawos/cloud-host/pipeline/smoke.mjs \\",
-  '            --image "$IMAGE_REF" \\',
-  "            --persona-id '${{ steps.plan.outputs.persona_id }}' \\",
-  "            --model '${{ steps.plan.outputs.model }}' \\",
-  "            --effort '${{ steps.plan.outputs.effort }}' \\",
-  "            --size '${{ steps.plan.outputs.size }}' \\",
-  "            --task-concurrency '${{ steps.plan.outputs.task_concurrency }}' \\",
-  "            --engine '${{ steps.plan.outputs.engine }}' \\",
-  "            --connectors '${{ steps.plan.outputs.connectors }}' \\",
-  "            --run-number '${{ github.run_number }}'",
-  "",
-  "  deploy:",
-  "    name: deploy",
-  "    needs: [build, smoke]",
-  "    runs-on: ubuntu-latest",
-  "    # \u4ED3\u5E93\u914D\u4E86 production \u73AF\u5883\u7684\u300C\u987B\u5BA1\u6838\u4EBA\u6279\u51C6\u300D\uFF0Cjob \u5C31\u505C\u5728\u8FD9\u91CC\u7B49\u4EBA\u70B9\uFF1B\u6CA1\u914D\u5C31\u76F4\u63A5\u8FC7\u3002",
-  "    environment: production",
-  "    steps:",
-  ...CONTRACT_STEPS,
-  ...ACR_LOGIN_STEPS,
-  "      - name: \u767B\u8BB0\u6B63\u5F0F",
-  "        env:",
-  "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
-  "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
-  "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
-  "          CLAWD_ENV_NAMES: ${{ steps.plan.outputs.env_names }}",
-  "        run: |",
-  "          set -e",
-  RESOLVE_LINE,
-  "          node clawos/cloud-host/pipeline/register.mjs \\",
-  '            --image "$IMAGE_REF" \\',
-  "            --persona-id '${{ steps.plan.outputs.persona_id }}' \\",
-  "            --model '${{ steps.plan.outputs.model }}' \\",
-  "            --effort '${{ steps.plan.outputs.effort }}' \\",
-  "            --size '${{ steps.plan.outputs.size }}' \\",
-  "            --task-concurrency '${{ steps.plan.outputs.task_concurrency }}' \\",
-  "            --engine '${{ steps.plan.outputs.engine }}' \\",
-  "            --connectors '${{ steps.plan.outputs.connectors }}'",
-  ""
-];
-var WORKFLOW_TEMPLATE = L.join("\n");
+var WORKFLOW_TEMPLATE = renderDeployWorkflow({ registry: ACR_REGISTRY, vpcRegistry: ACR_VPC_REGISTRY, namespace: ACR_NAMESPACE, repository: CLAWOS_REPO, ref: CLAWOS_REF });
 var U = [
   "name: clawd unpublish",
   "",
@@ -24695,10 +24907,17 @@ var U = [
   "",
   "on:",
   "  workflow_dispatch:",
+  "    inputs:",
+  "      environment:",
+  "        type: choice",
+  "        options: [integration, production]",
+  "        default: production",
   "",
   "concurrency:",
-  "  # \u4E0E\u53D1\u5E03\u540C\u4E00\u7EC4\uFF1A\u53D1\u5E03\u5728\u8DD1\u65F6\u70B9\u4E0B\u7EBF\uFF0C\u6392\u5728\u5B83\u540E\u9762\uFF1B\u540E\u70B9\u7684\u9876\u6389\u5148\u70B9\u7684",
+  "  # \u4E0E\u53D1\u5E03\u540C\u4E00\u7EC4\u4E32\u884C\u7B49\u5F85\uFF0C\u65B0\u7684\u4EFB\u52A1\u4E0D\u4F1A\u66FF\u6362\u7B49\u5F85\u4E2D\u7684\u4EFB\u52A1",
   CONCURRENCY_GROUP,
+  "  queue: max",
+  "  cancel-in-progress: false",
   "",
   "env:",
   `  CLAWOS_REPO: ${CLAWOS_REPO}`,
@@ -24711,14 +24930,23 @@ var U = [
   "  unpublish:",
   "    name: unpublish",
   "    runs-on: ubuntu-latest",
+  "    environment: ${{ inputs.environment || 'integration' }}",
   "    timeout-minutes: 10",
   "    steps:",
   ...CONTRACT_STEPS,
-  "      - name: \u64A4\u767B\u8BB0",
+  "      - name: \u64A4 production \u767B\u8BB0",
+  "        if: inputs.environment == 'production'",
   "        env:",
   "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
   "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
   "        run: node clawos/cloud-host/pipeline/unregister.mjs --persona-id '${{ steps.plan.outputs.persona_id }}'",
+  "      - name: \u64A4 int \u767B\u8BB0",
+  "        if: inputs.environment != 'production'",
+  "        env:",
+  "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_INT_GATEWAY_URL }}",
+  "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_INT_GATEWAY_ADMIN_KEY }}",
+  "        run: node clawos/cloud-host/pipeline/unregister.mjs --persona-id '${{ steps.plan.outputs.persona_id }}'",
+  "",
   ""
 ];
 var UNPUBLISH_WORKFLOW_TEMPLATE = U.join("\n");