@clawos-dev/clawd 0.2.625 → 0.2.627

package/README.md

@@ -1,109 +1,40 @@
 # @clawos-dev/clawd
 
-独立 clawd daemon —— Claude Code（以及未来的 Codex 等）会话服务，对外暴露 WebSocket 协议。
+Clawd daemon CLI：管理 Claude Code、Codex、pi 会话，通过 WebSocket 与 HTTP RPC 提供会话、persona、权限、历史和远程接入能力。
 
 ## 安装与启动
 
-推荐用 `npx`，每次自动拉最新版（无需全局安装）：
-
 ```bash
-npx @clawos-dev/clawd@latest                          # 默认 ws://127.0.0.1:18790
-npx @clawos-dev/clawd@latest --port 28790             # 自定义端口
-npx @clawos-dev/clawd@latest --data-dir /path/to/data # 覆盖默认 ~/.clawd
-npx @clawos-dev/clawd@latest --tunnel                 # 远程：起 frp tunnel + first-message token 鉴权
+npx @clawos-dev/clawd@latest
+npx @clawos-dev/clawd@latest --port 28790
+npx @clawos-dev/clawd@latest --data-dir /path/to/data
+npx @clawos-dev/clawd@latest --tunnel
 ```
 
-也可以 `npm i -g @clawos-dev/clawd` 后直接 `clawd …`。
-
-启动成功 stdout 会打印 `Ready: ws://127.0.0.1:18790`，运行时元数据（`{url, pid, authToken?, tunnelUrl?, ...}`）写入 `~/.clawd/state.json`（0600 权限）。
-
-> **本机模式无鉴权**：监听 `127.0.0.1`，所有连接直接放行；`--tunnel` 模式强制开启 first-message token 鉴权。
+也可全局安装后运行 `clawd`。默认监听 `127.0.0.1:18790`，数据目录为 `~/.clawd`；参数与配置的当前定义见 [config.ts](./src/config.ts)。完整参数用 `clawd --help` 查看。
 
-## CLI 参数
+常用选项：`--port`、`--data-dir`、`--config`、`--log-level`、`--tunnel`、`--clawos-api`、`--auth-token`、`--no-log-shipping`。环境变量由 `resolveConfig` 解析，不根据旧示例猜测支持范围。
 
-| Flag | 默认 | 说明 |
-|---|---|---|
-| `--port <n>` | `18790` | WebSocket 监听端口 |
-| `--data-dir <path>` | `~/.clawd` | 数据目录 |
-| `--config <path>` | `<data-dir>/config.json` | 配置文件（存在则加载） |
-| `--log-level <level>` | `info` | `debug` / `info` / `warn` / `error` |
-| `--tunnel` | `false` | 启用 frp tunnel 把本地端口暴露到公网 |
-| `--clawos-api <url>` | `https://api.clawos.chat` | tunnel register 接口 base url |
-| `--auth-token <s>` | 自动生成 | 指定 daemon auth token；缺省时 tunnel 模式从 `~/.clawd/auth.json` 复用，不存在则生成 32 字节 base64url |
-| `--help` / `-h` | — | 显示帮助 |
-| `--version` / `-v` | — | 显示版本 |
+## 鉴权与远程接入
 
-### 环境变量（高级）
+- **WebSocket**：无 tunnel 时 loopback 连接可豁免首帧鉴权；启用 tunnel 后 loopback 也要求鉴权。需要鉴权的客户端发送 `{"type":"auth","token":"<token>"}` 并等待 `auth:ok` 后再发送业务帧。凭据决定 owner / guest 身份与权限，不由客户端自报身份。
+- **HTTP RPC**：无论是否启用 tunnel 都使用已解析的 Bearer token。WebSocket 的本机豁免不适用于 HTTP。
+- `--tunnel` 注册公网隧道并启动 frpc，使手机和授权的远端客户端能连接本机 daemon。连接串包含凭据，只交给授权客户端，不贴入诊断报告。
 
-| Var | 说明 |
-|---|---|
-| `CLAWD_FRPC_BIN` | 自带 frpc 二进制路径（缺省时按需下载到 `~/.clawd/bin/frpc`） |
-| `CLAWD_NO_TUNNEL_PERSIST` | `=1` 启动时不复用 `~/.clawd/tunnel.json`（dev only；`NODE_ENV=development` 自动开启） |
-| `CLAWD_TUNNEL` | `=1` 等价于 `--tunnel` |
-| `CLAWOS_API` | 等价于 `--clawos-api` |
-| `CLAWD_AUTH_TOKEN` | 等价于 `--auth-token` |
+本地 owner token、中心登录票 loginPass、云 gateway API key 各自有不同用途；当前边界见 [identity](../doc/glossary/identity.md) 和 [peer-mesh](../doc/glossary/peer-mesh.md)。
 
-## Tunnel 模式
-
-零参数即可启用：
-
-```bash
-clawd --tunnel
-```
-
-启动后 stdout 会输出一段 banner，包含 tunnel URL 与一键连接串：
-
-```
-══════════════════════════════════════════════════════
-  Tunnel:      wss://abcd1234.tunnel.clawos.chat
-  Connect:     wss://abcd1234.tunnel.clawos.chat#token=kF3p...
-  Frpc config: ~/.clawd/frpc.toml
-  Frpc log:    ~/.clawd/frpc.log
-══════════════════════════════════════════════════════
-```
+## 查询状态与排障
 
-把 `Connect:` 整行复制到客户端的"远程连接"输入框即可，客户端会从 fragment 拆出 token。同样的内容也会落盘到 `~/.clawd/connect.txt`（0600）方便事后查阅。
+persona / 会话 / 联系人 / 任务 / tunnel 的实际状态先通过 `clawd-rpc` 的 `list` + `call` 查询。会话列表走 `session:list`；历史读取用 `history:read` 并加 `slim:true`。不要按旧目录示例拼路径，也不直接读取 `auth.json` 或含 connectToken 的联系人记录。
 
-要换 register base url：`--clawos-api https://example.com`。
+默认日志在 `~/.clawd/log/`，daemon 主日志为 `clawd.log`。远端和云 persona 状态不能由本机文件判断；按 [日志排障手册](../doc/debug-with-logs.md) 查对应时间窗与 owner。
 
-启用后 daemon 会：
+## 开发入口
 
-1. 调 `POST <clawos-api>/api/tunnel/register` 拿 frps 凭证
-2. 缓存到 `~/.clawd/tunnel.json`（0600，TTL 7 天，下次启动复用）
-3. 按 OS/arch 下载 frpc 到 `~/.clawd/bin/frpc`（仅首次）
-4. 写 `~/.clawd/frpc.toml` 并 spawn frpc 子进程
-5. 把 `tunnelUrl` 写进 `~/.clawd/state.json`
-
-退出时 SIGTERM frpc 子进程，5 秒后 SIGKILL。
-
-## Auth: first-message handshake
-
-启用 tunnel 时，daemon 强制要求 first-message auth：
-
-- 客户端连上后 5 秒内必须发送 `{"type":"auth","token":"<token>"}`
-- 通过 → daemon 回 `{"type":"auth:ok"}`
-- 失败 / 超时 / 越权 → close code 1008
-
-token 来源（任选其一）：
-- 启动 banner 里 `Connect:` 整行（带 `#token=`），客户端一次粘贴即可
-- 单独从 `Auth Token:` 行复制
-- `~/.clawd/state.json` 的 `authToken` 字段（0600，仅本机用户可读）
-
-非 tunnel 模式下，`127.0.0.1` / `::1` 来源连接默认豁免 auth；`--tunnel` 模式所有连接都要 auth。
-
-## 目录结构
-
-```
-~/.clawd/
-├── config.json                # 可选配置文件
-├── state.json                 # 运行时发现文件（启动写，退出删）
-├── auth.json                  # tunnel auth token 持久化
-├── tunnel.json                # frps 凭证缓存
-├── connect.txt                # tunnel 连接串
-├── frpc.toml / frpc.log       # frpc 子进程配置 / 日志
-├── clawd.log                  # daemon 运行日志
-└── sessions/default/*.json    # 会话持久化
-```
+- 工作规范：[CLAUDE.md](./CLAUDE.md)与[workspace 规范](../CLAUDE.md)。
+- wire 字段与 schema：[protocol/src/](../protocol/src/)；说明见 [wire-protocol](../doc/glossary/wire-protocol.md)。
+- 模块边界和当前术语：[glossary](../doc/glossary/README.md)。
+- 运行时持久化布局：[disk-layout](../doc/glossary/disk-layout.md)，它是实现说明，不是状态查询接口。
 
 ## License
 

package/dist/app-builder-plugin/mcp-server.cjs

@@ -21714,7 +21714,8 @@ var DeploySecretPresenceSchema = external_exports.object({
 }).strict();
 var DEPLOY_STAGE_STATUSES = ["pending", "running", "done", "failed", "waiting", "skipped"];
 var DeployStageStatusSchema = external_exports.enum(DEPLOY_STAGE_STATUSES);
-var DEPLOY_STAGE_KEYS = ["build", "smoke", "deploy"];
+var DEPLOY_VERIFY_STAGE = "verify";
+var DEPLOY_STAGE_KEYS = ["build", "smoke", "deploy", DEPLOY_VERIFY_STAGE];
 var DeployStageKeySchema = external_exports.enum(DEPLOY_STAGE_KEYS);
 var DeployJobSchema = external_exports.object({
   key: DeployStageKeySchema,
@@ -24604,6 +24605,12 @@ var PackageFindingSchema = EnvPackageSchema.omit({ localVersion: true, artifact:
   artifact: external_exports.object({ url: external_exports.string().url(), bin: external_exports.string() }).strict().optional()
 });
 
+// src/feishu-auth/deploy-environments.ts
+var DEPLOY_TARGETS = {
+  integration: { api: "https://api-int.clawos.chat", gateway: "https://persona-int.clawos.chat" },
+  production: { api: "https://api.clawos.chat", gateway: "https://persona.clawos.chat" }
+};
+
 // src/deploy/release-workflow.ts
 function renderDeployWorkflow(config2) {
   const identity = [
@@ -24807,6 +24814,22 @@ function renderDeployWorkflow(config2) {
     ...download("${{ inputs.environment == 'production' && 'persona-candidate' || 'persona-smoked' }}"),
     ...contract,
     ...runtime("register"),
+    ...job(DEPLOY_VERIFY_STAGE),
+    "    needs: deploy",
+    "    if: inputs.environment != 'production'",
+    "    steps:",
+    ...download("persona-smoked"),
+    ...contract,
+    "      - name: Verify ordinary user conversation after deployment",
+    "        env:",
+    `          CLAWD_INT_API_URL: \${{ vars.CLAWD_INT_API_URL || '${DEPLOY_TARGETS.integration.api}' }}`,
+    "          CLAWD_INT_TEST_LOGIN_PASS: ${{ secrets.CLAWD_INT_TEST_LOGIN_PASS }}",
+    "        run: |",
+    "          node clawos/cloud-host/pipeline/persona-verify.mjs \\",
+    "            --file candidate-release.json \\",
+    "            --persona-id '${{ steps.plan.outputs.persona_id }}' \\",
+    "            --engine '${{ steps.plan.outputs.engine }}'",
+    "",
     ...upload("persona-verified-${{ github.run_attempt }}")
   ].join("\n");
 }

package/dist/cli.cjs

@@ -6260,7 +6260,7 @@ function cloudEngineOk(tool) {
 function repoSlug(url) {
   return url.trim().replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
 }
-var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DEPLOY_PROMOTION_PHASES, DeployPromotionSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, ENGINE_AUTH_SECRETS, ENGINE_AUTH_PARTIAL_BLOCKER, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployPatchResultSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployConfirmTestArgsSchema, DeployPromoteArgsSchema, DeployOpenTestArgsSchema, DeployEnvironmentArgsSchema, DeployConfirmTestResultSchema, DeployPromoteResultSchema, DeployOpenTestResultSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeploySetEngineAuthArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
+var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DEPLOY_PROMOTION_PHASES, DeployPromotionSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, ENGINE_AUTH_SECRETS, ENGINE_AUTH_PARTIAL_BLOCKER, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_VERIFY_STAGE, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployPatchResultSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployConfirmTestArgsSchema, DeployPromoteArgsSchema, DeployOpenTestArgsSchema, DeployEnvironmentArgsSchema, DeployConfirmTestResultSchema, DeployPromoteResultSchema, DeployOpenTestResultSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeploySetEngineAuthArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
 var init_deploy_schemas = __esm({
   "../protocol/src/deploy-schemas.ts"() {
     "use strict";
@@ -6350,7 +6350,8 @@ var init_deploy_schemas = __esm({
     ENGINE_AUTH_PARTIAL_BLOCKER = "\u6A21\u578B\u8BA2\u9605\u53EA\u5199\u8FDB\u53BB\u4E00\u534A\u2014\u2014\u91CD\u586B\u6216\u6539\u56DE\u5E73\u53F0\u9ED8\u8BA4";
     DEPLOY_STAGE_STATUSES = ["pending", "running", "done", "failed", "waiting", "skipped"];
     DeployStageStatusSchema = external_exports.enum(DEPLOY_STAGE_STATUSES);
-    DEPLOY_STAGE_KEYS = ["build", "smoke", "deploy"];
+    DEPLOY_VERIFY_STAGE = "verify";
+    DEPLOY_STAGE_KEYS = ["build", "smoke", "deploy", DEPLOY_VERIFY_STAGE];
     DeployStageKeySchema = external_exports.enum(DEPLOY_STAGE_KEYS);
     DeployJobSchema = external_exports.object({
       key: DeployStageKeySchema,
@@ -60940,6 +60941,7 @@ async function storeGithubAuth(args) {
 }
 
 // src/deploy/release-workflow.ts
+init_protocol();
 function renderDeployWorkflow(config) {
   const identity = [
     "      - name: Select pinned source identities",
@@ -61142,6 +61144,22 @@ function renderDeployWorkflow(config) {
     ...download("${{ inputs.environment == 'production' && 'persona-candidate' || 'persona-smoked' }}"),
     ...contract,
     ...runtime("register"),
+    ...job(DEPLOY_VERIFY_STAGE),
+    "    needs: deploy",
+    "    if: inputs.environment != 'production'",
+    "    steps:",
+    ...download("persona-smoked"),
+    ...contract,
+    "      - name: Verify ordinary user conversation after deployment",
+    "        env:",
+    `          CLAWD_INT_API_URL: \${{ vars.CLAWD_INT_API_URL || '${DEPLOY_TARGETS.integration.api}' }}`,
+    "          CLAWD_INT_TEST_LOGIN_PASS: ${{ secrets.CLAWD_INT_TEST_LOGIN_PASS }}",
+    "        run: |",
+    "          node clawos/cloud-host/pipeline/persona-verify.mjs \\",
+    "            --file candidate-release.json \\",
+    "            --persona-id '${{ steps.plan.outputs.persona_id }}' \\",
+    "            --engine '${{ steps.plan.outputs.engine }}'",
+    "",
     ...upload("persona-verified-${{ github.run_attempt }}")
   ].join("\n");
 }
@@ -61738,6 +61756,11 @@ async function readVerifiedRelease(api, slug, run) {
     endpoint: DEPLOY_TARGETS.integration.gateway
   }) };
 }
+function requireDialogueVerification(release2, run) {
+  if (!release2.verification.checks.includes("persona-dialogue") || !run.jobs.some((j2) => j2.key === DEPLOY_VERIFY_STAGE && j2.status === "done")) {
+    throw new Error("\u8FD9\u6B21\u53D1\u5E03\u8FD8\u6CA1\u6709\u901A\u8FC7\u81EA\u52A8\u5BF9\u8BDD\u9A8C\u8BC1\uFF0C\u8BF7\u91CD\u65B0\u626B\u63CF\u5E76\u53D1\u5E03\u6D4B\u8BD5\u73AF\u5883");
+  }
+}
 function integrationPersonaForRelease(cloud, release2, releaseId) {
   const cloudName = cloudPersonaIdOf("https://github.com/" + release2.repository);
   if (cloud.personaId !== cloudName || cloud.image !== release2.image) return void 0;
@@ -62652,6 +62675,9 @@ function buildDeployHandlers(deps) {
     }
     return view(personaId2);
   };
+  const configureTestIdentity = async (api, slug) => {
+    await api.putSecret(slug, "CLAWD_INT_TEST_LOGIN_PASS", await deps.testLoginPass(), "integration");
+  };
   const releaseHandler = async (frame, _client, ctx) => {
     ensureOwner(ctx);
     const { personaId: personaId2, scanId } = parseArgs2(DeployReleaseArgsSchema, frame, "deploy:release");
@@ -62667,6 +62693,7 @@ function buildDeployHandlers(deps) {
     const pending = file.releases.find((r2) => r2.environment === "integration" && r2.scanId === scanId && !r2.pushed);
     if (pending) {
       try {
+        await configureTestIdentity(api, repoSlug(repo2.url));
         await pushRelease(deps.exec, dir, auth, pending.head);
         await api.setDefaultBranch(repoSlug(repo2.url), "integration");
         await writeScanFile(dir, { ...file, releases: file.releases.map((r2) => r2.id === pending.id ? { ...r2, pushed: true } : r2) });
@@ -62676,7 +62703,10 @@ function buildDeployHandlers(deps) {
       }
     }
     const already = [...file.releases].reverse().find((r2) => r2.environment === "integration" && r2.scanId === scanId && r2.pushed && r2.head === repo2.head);
-    if (already && !repo2.dirty) return { response: { type: "deploy:release", sha: already.head, actionsUrl: "https://github.com/" + repoSlug(repo2.url) + "/actions" } };
+    if (already && !repo2.dirty) {
+      await configureTestIdentity(api, repoSlug(repo2.url));
+      return { response: { type: "deploy:release", sha: already.head, actionsUrl: "https://github.com/" + repoSlug(repo2.url) + "/actions" } };
+    }
     if (entry.status !== "done") throw invalid(entry.status === "scanning" ? "\u8FD9\u6B21\u626B\u63CF\u8FD8\u5728\u8DD1\uFF0C\u7B49\u5B83\u626B\u5B8C" : "\u8FD9\u6B21\u626B\u63CF\u6CA1\u8DD1\u5B8C\uFF0C\u6E05\u5355\u4E0D\u5B8C\u6574\u2014\u2014\u91CD\u65B0\u626B\u63CF");
     if (!isScanFresh(entry, repo2, file.releases.find((r2) => r2.head === repo2.head))) {
       throw invalid(repo2.dirty ? "\u6709\u672A\u63D0\u4EA4\u7684\u6539\u52A8\uFF0C\u6E05\u5355\u662F\u6539\u52A8\u524D\u626B\u7684\u2014\u2014\u91CD\u65B0\u626B\u63CF" : "\u8FD9\u6B21\u626B\u63CF\u5BF9\u5E94\u7684\u4E0D\u662F\u5F53\u524D\u8FD9\u4E00\u7248 persona\u2014\u2014\u91CD\u65B0\u626B\u63CF");
@@ -62698,6 +62728,7 @@ function buildDeployHandlers(deps) {
       blockers.push("\u8FD8\u6CA1\u9009\u6A21\u578B\uFF08\u5207\u5F15\u64CE\u65F6\u4F1A\u6E05\u7A7A\uFF09\u2014\u2014\u5728\u4E0A\u4E91\u9875\u300C\u5F15\u64CE\u4E0E\u6A21\u578B\u300D\u91CC\u9009\u4E00\u4E2A");
     }
     if (blockers.length > 0) throw invalid(`\u8FD8\u5DEE\uFF1A${blockers.join("\uFF1B")}`);
+    await configureTestIdentity(api, repoSlug(repo2.url));
     if (await deps.claimPublisher(cloudPersonaIdOf(repo2.url), "integration") === "taken") throw invalid("\u6D4B\u8BD5\u73AF\u5883\u91CC\u7684\u8FD9\u4E2A\u540D\u5B57\u5DF2\u7531\u522B\u4EBA\u53D1\u5E03");
     const releaseId = (0, import_node_crypto14.randomUUID)();
     try {
@@ -62734,6 +62765,7 @@ function buildDeployHandlers(deps) {
     }
     try {
       if (record4?.environment === "integration") {
+        await configureTestIdentity(api, slug);
         await writeScanFile(dir, { ...file, releases: file.releases.map((r2) => r2.id === record4.id ? { ...r2, confirmation: void 0, verified: void 0, artifactId: void 0 } : r2) });
       }
       await rerunJob(api, slug, jobId);
@@ -62770,7 +62802,7 @@ function buildDeployHandlers(deps) {
     const { type: _type, requestId: _requestId, ...args } = frame;
     return parseArgs2({ safeParse: schema.safeParse.bind(schema) }, args, String(frame.type));
   }
-  async function testedRelease(personaId2, releaseId, checkOnline = true) {
+  async function testedRelease(personaId2, releaseId, checkOnline = true, requireDialogue = false) {
     const dir = mustPersona(personaId2);
     const file = await readHistory(dir);
     const record4 = file.releases.find((r2) => r2.id === releaseId);
@@ -62781,6 +62813,13 @@ function buildDeployHandlers(deps) {
     const run = record4.runId ? await runById(api, repoSlug(repo2.url), record4.runId, "integration") : await findReleaseRun(api, repoSlug(repo2.url), { environment: "integration", head: record4.head });
     if (!run || run.headSha !== record4.head) throw invalid("\u6682\u65F6\u67E5\u4E0D\u5230\u672C\u6B21\u6D4B\u8BD5\u6D41\u6C34\u7EBF\uFF0C\u8BF7\u5237\u65B0");
     const { artifactId, release: verified } = await readVerifiedRelease(api, repoSlug(repo2.url), run);
+    if (requireDialogue) {
+      try {
+        requireDialogueVerification(verified, run);
+      } catch (e) {
+        throw invalid(e.message);
+      }
+    }
     if (checkOnline && (await deps.cloudState(cloudPersonaIdOf(repo2.url), "integration")).image !== verified.image) throw invalid("\u6D4B\u8BD5\u73AF\u5883\u7684\u7248\u672C\u5DF2\u7ECF\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u53D1\u5E03\u6D4B\u8BD5\u5E76\u786E\u8BA4");
     const changed = record4.runId !== run.runId || record4.runAttempt !== run.runAttempt || record4.verified?.verification.fingerprint !== verified.verification.fingerprint;
     const updated = { ...record4, artifactId, verified, runId: run.runId, runAttempt: run.runAttempt ?? 1, ...changed ? { confirmation: void 0 } : {} };
@@ -62813,7 +62852,7 @@ function buildDeployHandlers(deps) {
   const confirmTest = async (frame, _client, ctx) => {
     ensureOwner(ctx);
     const { personaId: personaId2, releaseId } = releaseArgs(frame, DeployConfirmTestArgsSchema);
-    const record4 = await testedRelease(personaId2, releaseId);
+    const record4 = await testedRelease(personaId2, releaseId, true, true);
     const confirmation = record4.confirmation ?? { fingerprint: record4.verified.verification.fingerprint, runId: record4.runId, runAttempt: record4.runAttempt, at: deps.now() };
     const dir = mustPersona(personaId2), file = await readHistory(dir);
     await writeScanFile(dir, { ...file, releases: file.releases.map((r2) => r2.id === releaseId ? { ...r2, confirmation } : r2) });
@@ -62829,8 +62868,7 @@ function buildDeployHandlers(deps) {
     const stored = file.releases.find((r2) => r2.id === releaseId);
     const snapshot = old?.verified ?? (stored?.confirmation?.fingerprint === stored?.verified?.verification.fingerprint ? stored?.verified : void 0);
     if (recovering && (!snapshot || !stored)) throw invalid("\u539F\u4E0A\u7EBF\u4EFB\u52A1\u7684\u5DF2\u6D4B\u5236\u54C1\u8BB0\u5F55\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u5148\u6838\u5B9E\u539F\u6D41\u6C34\u7EBF\uFF1B\u4E0D\u4F1A\u6539\u7528\u65B0\u7684\u6D4B\u8BD5\u7248\u672C");
-    const record4 = recovering ? { ...stored, verified: snapshot } : await testedRelease(personaId2, releaseId);
-    if (!recovering && (!record4.confirmation || record4.confirmation.fingerprint !== record4.verified.verification.fingerprint || record4.confirmation.runId !== record4.runId || record4.confirmation.runAttempt !== record4.runAttempt)) throw invalid("\u8BF7\u5148\u5728\u6D4B\u8BD5\u73AF\u5883\u8BD5\u7528\uFF0C\u5E76\u786E\u8BA4\u8FD9\u6B21\u6D4B\u8BD5\u901A\u8FC7");
+    const record4 = recovering ? { ...stored, verified: snapshot } : await testedRelease(personaId2, releaseId, true, true);
     const repo2 = await repoInfo(deps.exec, mustPersona(personaId2));
     if (!repo2) throw invalid("\u4ED3\u5E93\u4E0D\u5B58\u5728");
     if (await deps.claimPublisher(cloudPersonaIdOf(repo2.url), "production") === "taken") throw invalid("\u7EBF\u4E0A\u73AF\u5883\u91CC\u7684\u8FD9\u4E2A\u540D\u5B57\u5DF2\u7531\u522B\u4EBA\u53D1\u5E03");
@@ -73562,7 +73600,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.625".length > 0 ? "0.2.625" : "dev";
+var version = "0.2.627".length > 0 ? "0.2.627" : "dev";
 
 // src/cli-probe/probe.ts
 var fs84 = __toESM(require("fs"), 1);
@@ -77221,6 +77259,12 @@ async function startDaemon(config) {
       const persona = list.find((p3) => p3.personaId === personaId2);
       return { online: persona !== void 0, ...persona?.image ? { image: persona.image } : {} };
     },
+    testLoginPass: async () => {
+      const loginPass = requireEnvironmentIdentity(environmentStores, "integration").loginPass;
+      const credentials = await centralGetApiKey({ api: targetApi("integration"), loginPass });
+      if (!credentials.apiKey) await centralIssueApiKey({ api: targetApi("integration"), loginPass });
+      return loginPass;
+    },
     openTestPersona: async (_personaId, release2, releaseId) => {
       const loginPass = requireEnvironmentIdentity(environmentStores, "integration").loginPass;
       const credentials = await centralGetApiKey({ api: targetApi("integration"), loginPass });