@clawos-dev/clawd 0.2.625 → 0.2.626

package/dist/app-builder-plugin/mcp-server.cjs

@@ -21714,7 +21714,8 @@ var DeploySecretPresenceSchema = external_exports.object({
 }).strict();
 var DEPLOY_STAGE_STATUSES = ["pending", "running", "done", "failed", "waiting", "skipped"];
 var DeployStageStatusSchema = external_exports.enum(DEPLOY_STAGE_STATUSES);
-var DEPLOY_STAGE_KEYS = ["build", "smoke", "deploy"];
+var DEPLOY_VERIFY_STAGE = "verify";
+var DEPLOY_STAGE_KEYS = ["build", "smoke", "deploy", DEPLOY_VERIFY_STAGE];
 var DeployStageKeySchema = external_exports.enum(DEPLOY_STAGE_KEYS);
 var DeployJobSchema = external_exports.object({
   key: DeployStageKeySchema,
@@ -24604,6 +24605,12 @@ var PackageFindingSchema = EnvPackageSchema.omit({ localVersion: true, artifact:
   artifact: external_exports.object({ url: external_exports.string().url(), bin: external_exports.string() }).strict().optional()
 });
 
+// src/feishu-auth/deploy-environments.ts
+var DEPLOY_TARGETS = {
+  integration: { api: "https://api-int.clawos.chat", gateway: "https://persona-int.clawos.chat" },
+  production: { api: "https://api.clawos.chat", gateway: "https://persona.clawos.chat" }
+};
+
 // src/deploy/release-workflow.ts
 function renderDeployWorkflow(config2) {
   const identity = [
@@ -24807,6 +24814,22 @@ function renderDeployWorkflow(config2) {
     ...download("${{ inputs.environment == 'production' && 'persona-candidate' || 'persona-smoked' }}"),
     ...contract,
     ...runtime("register"),
+    ...job(DEPLOY_VERIFY_STAGE),
+    "    needs: deploy",
+    "    if: inputs.environment != 'production'",
+    "    steps:",
+    ...download("persona-smoked"),
+    ...contract,
+    "      - name: Verify ordinary user conversation after deployment",
+    "        env:",
+    `          CLAWD_INT_API_URL: \${{ vars.CLAWD_INT_API_URL || '${DEPLOY_TARGETS.integration.api}' }}`,
+    "          CLAWD_INT_TEST_LOGIN_PASS: ${{ secrets.CLAWD_INT_TEST_LOGIN_PASS }}",
+    "        run: |",
+    "          node clawos/cloud-host/pipeline/persona-verify.mjs \\",
+    "            --file candidate-release.json \\",
+    "            --persona-id '${{ steps.plan.outputs.persona_id }}' \\",
+    "            --engine '${{ steps.plan.outputs.engine }}'",
+    "",
     ...upload("persona-verified-${{ github.run_attempt }}")
   ].join("\n");
 }

package/dist/cli.cjs

@@ -6260,7 +6260,7 @@ function cloudEngineOk(tool) {
 function repoSlug(url) {
   return url.trim().replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
 }
-var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DEPLOY_PROMOTION_PHASES, DeployPromotionSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, ENGINE_AUTH_SECRETS, ENGINE_AUTH_PARTIAL_BLOCKER, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployPatchResultSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployConfirmTestArgsSchema, DeployPromoteArgsSchema, DeployOpenTestArgsSchema, DeployEnvironmentArgsSchema, DeployConfirmTestResultSchema, DeployPromoteResultSchema, DeployOpenTestResultSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeploySetEngineAuthArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
+var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DEPLOY_PROMOTION_PHASES, DeployPromotionSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, ENGINE_AUTH_SECRETS, ENGINE_AUTH_PARTIAL_BLOCKER, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_VERIFY_STAGE, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployPatchResultSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployConfirmTestArgsSchema, DeployPromoteArgsSchema, DeployOpenTestArgsSchema, DeployEnvironmentArgsSchema, DeployConfirmTestResultSchema, DeployPromoteResultSchema, DeployOpenTestResultSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeploySetEngineAuthArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
 var init_deploy_schemas = __esm({
   "../protocol/src/deploy-schemas.ts"() {
     "use strict";
@@ -6350,7 +6350,8 @@ var init_deploy_schemas = __esm({
     ENGINE_AUTH_PARTIAL_BLOCKER = "\u6A21\u578B\u8BA2\u9605\u53EA\u5199\u8FDB\u53BB\u4E00\u534A\u2014\u2014\u91CD\u586B\u6216\u6539\u56DE\u5E73\u53F0\u9ED8\u8BA4";
     DEPLOY_STAGE_STATUSES = ["pending", "running", "done", "failed", "waiting", "skipped"];
     DeployStageStatusSchema = external_exports.enum(DEPLOY_STAGE_STATUSES);
-    DEPLOY_STAGE_KEYS = ["build", "smoke", "deploy"];
+    DEPLOY_VERIFY_STAGE = "verify";
+    DEPLOY_STAGE_KEYS = ["build", "smoke", "deploy", DEPLOY_VERIFY_STAGE];
     DeployStageKeySchema = external_exports.enum(DEPLOY_STAGE_KEYS);
     DeployJobSchema = external_exports.object({
       key: DeployStageKeySchema,
@@ -60940,6 +60941,7 @@ async function storeGithubAuth(args) {
 }
 
 // src/deploy/release-workflow.ts
+init_protocol();
 function renderDeployWorkflow(config) {
   const identity = [
     "      - name: Select pinned source identities",
@@ -61142,6 +61144,22 @@ function renderDeployWorkflow(config) {
     ...download("${{ inputs.environment == 'production' && 'persona-candidate' || 'persona-smoked' }}"),
     ...contract,
     ...runtime("register"),
+    ...job(DEPLOY_VERIFY_STAGE),
+    "    needs: deploy",
+    "    if: inputs.environment != 'production'",
+    "    steps:",
+    ...download("persona-smoked"),
+    ...contract,
+    "      - name: Verify ordinary user conversation after deployment",
+    "        env:",
+    `          CLAWD_INT_API_URL: \${{ vars.CLAWD_INT_API_URL || '${DEPLOY_TARGETS.integration.api}' }}`,
+    "          CLAWD_INT_TEST_LOGIN_PASS: ${{ secrets.CLAWD_INT_TEST_LOGIN_PASS }}",
+    "        run: |",
+    "          node clawos/cloud-host/pipeline/persona-verify.mjs \\",
+    "            --file candidate-release.json \\",
+    "            --persona-id '${{ steps.plan.outputs.persona_id }}' \\",
+    "            --engine '${{ steps.plan.outputs.engine }}'",
+    "",
     ...upload("persona-verified-${{ github.run_attempt }}")
   ].join("\n");
 }
@@ -61738,6 +61756,11 @@ async function readVerifiedRelease(api, slug, run) {
     endpoint: DEPLOY_TARGETS.integration.gateway
   }) };
 }
+function requireDialogueVerification(release2, run) {
+  if (!release2.verification.checks.includes("persona-dialogue") || !run.jobs.some((j2) => j2.key === DEPLOY_VERIFY_STAGE && j2.status === "done")) {
+    throw new Error("\u8FD9\u6B21\u53D1\u5E03\u8FD8\u6CA1\u6709\u901A\u8FC7\u81EA\u52A8\u5BF9\u8BDD\u9A8C\u8BC1\uFF0C\u8BF7\u91CD\u65B0\u626B\u63CF\u5E76\u53D1\u5E03\u6D4B\u8BD5\u73AF\u5883");
+  }
+}
 function integrationPersonaForRelease(cloud, release2, releaseId) {
   const cloudName = cloudPersonaIdOf("https://github.com/" + release2.repository);
   if (cloud.personaId !== cloudName || cloud.image !== release2.image) return void 0;
@@ -62652,6 +62675,9 @@ function buildDeployHandlers(deps) {
     }
     return view(personaId2);
   };
+  const configureTestIdentity = async (api, slug) => {
+    await api.putSecret(slug, "CLAWD_INT_TEST_LOGIN_PASS", await deps.testLoginPass(), "integration");
+  };
   const releaseHandler = async (frame, _client, ctx) => {
     ensureOwner(ctx);
     const { personaId: personaId2, scanId } = parseArgs2(DeployReleaseArgsSchema, frame, "deploy:release");
@@ -62667,6 +62693,7 @@ function buildDeployHandlers(deps) {
     const pending = file.releases.find((r2) => r2.environment === "integration" && r2.scanId === scanId && !r2.pushed);
     if (pending) {
       try {
+        await configureTestIdentity(api, repoSlug(repo2.url));
         await pushRelease(deps.exec, dir, auth, pending.head);
         await api.setDefaultBranch(repoSlug(repo2.url), "integration");
         await writeScanFile(dir, { ...file, releases: file.releases.map((r2) => r2.id === pending.id ? { ...r2, pushed: true } : r2) });
@@ -62676,7 +62703,10 @@ function buildDeployHandlers(deps) {
       }
     }
     const already = [...file.releases].reverse().find((r2) => r2.environment === "integration" && r2.scanId === scanId && r2.pushed && r2.head === repo2.head);
-    if (already && !repo2.dirty) return { response: { type: "deploy:release", sha: already.head, actionsUrl: "https://github.com/" + repoSlug(repo2.url) + "/actions" } };
+    if (already && !repo2.dirty) {
+      await configureTestIdentity(api, repoSlug(repo2.url));
+      return { response: { type: "deploy:release", sha: already.head, actionsUrl: "https://github.com/" + repoSlug(repo2.url) + "/actions" } };
+    }
     if (entry.status !== "done") throw invalid(entry.status === "scanning" ? "\u8FD9\u6B21\u626B\u63CF\u8FD8\u5728\u8DD1\uFF0C\u7B49\u5B83\u626B\u5B8C" : "\u8FD9\u6B21\u626B\u63CF\u6CA1\u8DD1\u5B8C\uFF0C\u6E05\u5355\u4E0D\u5B8C\u6574\u2014\u2014\u91CD\u65B0\u626B\u63CF");
     if (!isScanFresh(entry, repo2, file.releases.find((r2) => r2.head === repo2.head))) {
       throw invalid(repo2.dirty ? "\u6709\u672A\u63D0\u4EA4\u7684\u6539\u52A8\uFF0C\u6E05\u5355\u662F\u6539\u52A8\u524D\u626B\u7684\u2014\u2014\u91CD\u65B0\u626B\u63CF" : "\u8FD9\u6B21\u626B\u63CF\u5BF9\u5E94\u7684\u4E0D\u662F\u5F53\u524D\u8FD9\u4E00\u7248 persona\u2014\u2014\u91CD\u65B0\u626B\u63CF");
@@ -62698,6 +62728,7 @@ function buildDeployHandlers(deps) {
       blockers.push("\u8FD8\u6CA1\u9009\u6A21\u578B\uFF08\u5207\u5F15\u64CE\u65F6\u4F1A\u6E05\u7A7A\uFF09\u2014\u2014\u5728\u4E0A\u4E91\u9875\u300C\u5F15\u64CE\u4E0E\u6A21\u578B\u300D\u91CC\u9009\u4E00\u4E2A");
     }
     if (blockers.length > 0) throw invalid(`\u8FD8\u5DEE\uFF1A${blockers.join("\uFF1B")}`);
+    await configureTestIdentity(api, repoSlug(repo2.url));
     if (await deps.claimPublisher(cloudPersonaIdOf(repo2.url), "integration") === "taken") throw invalid("\u6D4B\u8BD5\u73AF\u5883\u91CC\u7684\u8FD9\u4E2A\u540D\u5B57\u5DF2\u7531\u522B\u4EBA\u53D1\u5E03");
     const releaseId = (0, import_node_crypto14.randomUUID)();
     try {
@@ -62734,6 +62765,7 @@ function buildDeployHandlers(deps) {
     }
     try {
       if (record4?.environment === "integration") {
+        await configureTestIdentity(api, slug);
         await writeScanFile(dir, { ...file, releases: file.releases.map((r2) => r2.id === record4.id ? { ...r2, confirmation: void 0, verified: void 0, artifactId: void 0 } : r2) });
       }
       await rerunJob(api, slug, jobId);
@@ -62770,7 +62802,7 @@ function buildDeployHandlers(deps) {
     const { type: _type, requestId: _requestId, ...args } = frame;
     return parseArgs2({ safeParse: schema.safeParse.bind(schema) }, args, String(frame.type));
   }
-  async function testedRelease(personaId2, releaseId, checkOnline = true) {
+  async function testedRelease(personaId2, releaseId, checkOnline = true, requireDialogue = false) {
     const dir = mustPersona(personaId2);
     const file = await readHistory(dir);
     const record4 = file.releases.find((r2) => r2.id === releaseId);
@@ -62781,6 +62813,13 @@ function buildDeployHandlers(deps) {
     const run = record4.runId ? await runById(api, repoSlug(repo2.url), record4.runId, "integration") : await findReleaseRun(api, repoSlug(repo2.url), { environment: "integration", head: record4.head });
     if (!run || run.headSha !== record4.head) throw invalid("\u6682\u65F6\u67E5\u4E0D\u5230\u672C\u6B21\u6D4B\u8BD5\u6D41\u6C34\u7EBF\uFF0C\u8BF7\u5237\u65B0");
     const { artifactId, release: verified } = await readVerifiedRelease(api, repoSlug(repo2.url), run);
+    if (requireDialogue) {
+      try {
+        requireDialogueVerification(verified, run);
+      } catch (e) {
+        throw invalid(e.message);
+      }
+    }
     if (checkOnline && (await deps.cloudState(cloudPersonaIdOf(repo2.url), "integration")).image !== verified.image) throw invalid("\u6D4B\u8BD5\u73AF\u5883\u7684\u7248\u672C\u5DF2\u7ECF\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u53D1\u5E03\u6D4B\u8BD5\u5E76\u786E\u8BA4");
     const changed = record4.runId !== run.runId || record4.runAttempt !== run.runAttempt || record4.verified?.verification.fingerprint !== verified.verification.fingerprint;
     const updated = { ...record4, artifactId, verified, runId: run.runId, runAttempt: run.runAttempt ?? 1, ...changed ? { confirmation: void 0 } : {} };
@@ -62813,7 +62852,7 @@ function buildDeployHandlers(deps) {
   const confirmTest = async (frame, _client, ctx) => {
     ensureOwner(ctx);
     const { personaId: personaId2, releaseId } = releaseArgs(frame, DeployConfirmTestArgsSchema);
-    const record4 = await testedRelease(personaId2, releaseId);
+    const record4 = await testedRelease(personaId2, releaseId, true, true);
     const confirmation = record4.confirmation ?? { fingerprint: record4.verified.verification.fingerprint, runId: record4.runId, runAttempt: record4.runAttempt, at: deps.now() };
     const dir = mustPersona(personaId2), file = await readHistory(dir);
     await writeScanFile(dir, { ...file, releases: file.releases.map((r2) => r2.id === releaseId ? { ...r2, confirmation } : r2) });
@@ -62829,8 +62868,7 @@ function buildDeployHandlers(deps) {
     const stored = file.releases.find((r2) => r2.id === releaseId);
     const snapshot = old?.verified ?? (stored?.confirmation?.fingerprint === stored?.verified?.verification.fingerprint ? stored?.verified : void 0);
     if (recovering && (!snapshot || !stored)) throw invalid("\u539F\u4E0A\u7EBF\u4EFB\u52A1\u7684\u5DF2\u6D4B\u5236\u54C1\u8BB0\u5F55\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u5148\u6838\u5B9E\u539F\u6D41\u6C34\u7EBF\uFF1B\u4E0D\u4F1A\u6539\u7528\u65B0\u7684\u6D4B\u8BD5\u7248\u672C");
-    const record4 = recovering ? { ...stored, verified: snapshot } : await testedRelease(personaId2, releaseId);
-    if (!recovering && (!record4.confirmation || record4.confirmation.fingerprint !== record4.verified.verification.fingerprint || record4.confirmation.runId !== record4.runId || record4.confirmation.runAttempt !== record4.runAttempt)) throw invalid("\u8BF7\u5148\u5728\u6D4B\u8BD5\u73AF\u5883\u8BD5\u7528\uFF0C\u5E76\u786E\u8BA4\u8FD9\u6B21\u6D4B\u8BD5\u901A\u8FC7");
+    const record4 = recovering ? { ...stored, verified: snapshot } : await testedRelease(personaId2, releaseId, true, true);
     const repo2 = await repoInfo(deps.exec, mustPersona(personaId2));
     if (!repo2) throw invalid("\u4ED3\u5E93\u4E0D\u5B58\u5728");
     if (await deps.claimPublisher(cloudPersonaIdOf(repo2.url), "production") === "taken") throw invalid("\u7EBF\u4E0A\u73AF\u5883\u91CC\u7684\u8FD9\u4E2A\u540D\u5B57\u5DF2\u7531\u522B\u4EBA\u53D1\u5E03");
@@ -73562,7 +73600,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.625".length > 0 ? "0.2.625" : "dev";
+var version = "0.2.626".length > 0 ? "0.2.626" : "dev";
 
 // src/cli-probe/probe.ts
 var fs84 = __toESM(require("fs"), 1);
@@ -77221,6 +77259,12 @@ async function startDaemon(config) {
       const persona = list.find((p3) => p3.personaId === personaId2);
       return { online: persona !== void 0, ...persona?.image ? { image: persona.image } : {} };
     },
+    testLoginPass: async () => {
+      const loginPass = requireEnvironmentIdentity(environmentStores, "integration").loginPass;
+      const credentials = await centralGetApiKey({ api: targetApi("integration"), loginPass });
+      if (!credentials.apiKey) await centralIssueApiKey({ api: targetApi("integration"), loginPass });
+      return loginPass;
+    },
     openTestPersona: async (_personaId, release2, releaseId) => {
       const loginPass = requireEnvironmentIdentity(environmentStores, "integration").loginPass;
       const credentials = await centralGetApiKey({ api: targetApi("integration"), loginPass });