@clawos-dev/clawd 0.2.631 → 0.2.635

package/dist/cli.cjs

@@ -7690,14 +7690,16 @@ var init_dashboard_schemas = __esm({
 });
 
 // ../protocol/src/persona-schemas.ts
-var PERSONA_SIZES, PersonaSizeSchema, PersonaFileSchema, PersonaSkillSummarySchema, PersonaPluginSummarySchema, CodexSandboxSettingsSchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema;
+var PERSONA_SIZES, PersonaSizeSchema, PERSONA_CPUS, PersonaCpuSchema, PersonaFileSchema, PersonaSkillSummarySchema, PersonaPluginSummarySchema, CodexSandboxSettingsSchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema;
 var init_persona_schemas = __esm({
   "../protocol/src/persona-schemas.ts"() {
     "use strict";
     init_zod();
     init_release_schemas();
-    PERSONA_SIZES = ["tiny", "small", "medium", "large"];
+    PERSONA_SIZES = ["tiny", "small", "medium", "large", "xlarge"];
     PersonaSizeSchema = external_exports.enum(PERSONA_SIZES);
+    PERSONA_CPUS = [0.5, 1, 2];
+    PersonaCpuSchema = external_exports.number().refine((cpu) => PERSONA_CPUS.includes(cpu), "Unsupported CPU");
     PersonaFileSchema = external_exports.object({
       personaId: external_exports.string(),
       label: external_exports.string(),
@@ -7714,6 +7716,7 @@ var init_persona_schemas = __esm({
       tool: external_exports.string().optional(),
       /** Cloud resource size is string-compatible in stored files and narrowed at update/deploy boundaries; local execution ignores it. */
       size: external_exports.string().optional(),
+      cpu: external_exports.number().finite().optional(),
       /** Cloud task-Pod concurrency, validated at release. Local execution ignores it; changes apply on the next publication. */
       taskConcurrency: external_exports.number().int().positive().optional(),
       createdAt: external_exports.number(),
@@ -7811,6 +7814,7 @@ var init_persona_schemas = __esm({
         effort: external_exports.string().optional(),
         tool: external_exports.string().optional(),
         size: PersonaSizeSchema.optional(),
+        cpu: PersonaCpuSchema.optional(),
         taskConcurrency: PersonaFileSchema.shape.taskConcurrency,
         personality: external_exports.string().optional(),
         // 人格补充层正文（见 PersonaInfoResponseSchema.personalityLocal）。与 personality 各写
@@ -42487,7 +42491,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net2 = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash6 } = require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash5 } = require("crypto");
     var { Duplex, Readable: Readable4 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -43147,7 +43151,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash6("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -43514,7 +43518,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash6 } = require("crypto");
+    var { createHash: createHash5 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -43815,7 +43819,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash6("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -45000,7 +45004,7 @@ var CodexHistoryReader = class {
   }
   async read(args) {
     const locate = createCodexRolloutLocator(this.deps.roots);
-    const segments = this.parseThreadSegments(locate, args.toolSessionId);
+    const segments = parseCodexThreadSegments(locate, args.toolSessionId);
     const messages = [];
     for (const segment of segments) {
       messages.push(...await withSubagentResults(
@@ -45020,7 +45024,7 @@ var CodexHistoryReader = class {
   }
   async readSubagent(args) {
     const locate = createCodexRolloutLocator(this.deps.roots);
-    const owner2 = this.parseThreadSegments(locate, args.toolSessionId).find((segment) => segment.parsed.subagents.some((sub) => sub.agentId === args.subagentId));
+    const owner2 = parseCodexThreadSegments(locate, args.toolSessionId).find((segment) => segment.parsed.subagents.some((sub) => sub.agentId === args.subagentId));
     const child = this.parseThread(locate, args.subagentId);
     if (!owner2 || child.meta?.threadId !== args.subagentId || child.meta.parentThreadId !== owner2.threadId) {
       throw new Error(
@@ -45036,7 +45040,7 @@ var CodexHistoryReader = class {
     return [];
   }
   parseThread(locate, threadId) {
-    const segments = this.parseThreadSegments(locate, threadId);
+    const segments = parseCodexThreadSegments(locate, threadId);
     const current = segments[segments.length - 1].parsed;
     return {
       ...current,
@@ -45045,30 +45049,30 @@ var CodexHistoryReader = class {
       turns: segments.flatMap((s2) => s2.parsed.turns)
     };
   }
-  parseThreadSegments(locate, threadId, endByteOffset, seen = /* @__PURE__ */ new Set()) {
-    const key = threadId.toLowerCase();
-    if (seen.has(key)) throw new Error(`Codex fork history cycle at thread ${threadId}`);
-    seen.add(key);
-    try {
-      const file = locate(threadId);
-      if (!file) throw new Error(`Codex rollout not found for thread ${threadId}`);
-      const bytes = import_node_fs3.default.readFileSync(file);
-      if (endByteOffset !== void 0 && endByteOffset > bytes.length) {
-        throw new Error(`Codex fork history_base exceeds source rollout ${threadId}`);
-      }
-      const text = (endByteOffset === void 0 ? bytes : bytes.subarray(0, endByteOffset)).toString("utf8");
-      const parsed = parseCodexRollout(text);
-      if (parsed.meta?.threadId.toLowerCase() !== key) {
-        throw new Error(`Codex rollout metadata does not match thread ${threadId}`);
-      }
-      const base = historyBase(text);
-      const inherited = base ? this.parseThreadSegments(locate, base.threadId, base.endByteOffset, seen) : [];
-      return [...inherited, { threadId, parsed }];
-    } finally {
-      seen.delete(key);
-    }
-  }
 };
+function parseCodexThreadSegments(locate, threadId, endByteOffset, seen = /* @__PURE__ */ new Set()) {
+  const key = threadId.toLowerCase();
+  if (seen.has(key)) throw new Error(`Codex fork history cycle at thread ${threadId}`);
+  seen.add(key);
+  try {
+    const file = locate(threadId);
+    if (!file) throw new Error(`Codex rollout not found for thread ${threadId}`);
+    const bytes = import_node_fs3.default.readFileSync(file);
+    if (endByteOffset !== void 0 && endByteOffset > bytes.length) {
+      throw new Error(`Codex fork history_base exceeds source rollout ${threadId}`);
+    }
+    const text = (endByteOffset === void 0 ? bytes : bytes.subarray(0, endByteOffset)).toString("utf8");
+    const parsed = parseCodexRollout(text);
+    if (parsed.meta?.threadId.toLowerCase() !== key) {
+      throw new Error(`Codex rollout metadata does not match thread ${threadId}`);
+    }
+    const base = historyBase(text);
+    const inherited = base ? parseCodexThreadSegments(locate, base.threadId, base.endByteOffset, seen) : [];
+    return [...inherited, { threadId, parsed }];
+  } finally {
+    seen.delete(key);
+  }
+}
 
 // src/tools/cloud-history-pages.ts
 var import_node_crypto = require("crypto");
@@ -45483,7 +45487,7 @@ function requireEnvironmentIdentity(stores, environment) {
 var import_node_path85 = __toESM(require("path"), 1);
 var import_node_fs66 = __toESM(require("fs"), 1);
 var import_node_os31 = __toESM(require("os"), 1);
-var import_node_crypto30 = require("crypto");
+var import_node_crypto29 = require("crypto");
 var import_node_url6 = require("url");
 
 // src/logger.ts
@@ -45983,6 +45987,37 @@ var SessionStore = class {
   filePath(sessionId) {
     return import_node_path6.default.join(this.root, `${safeFileName(sessionId)}.json`);
   }
+  // Exact prepared cloud turn bodies (images inlined as base64) live beside the session file, never in it, so they are
+  // not persisted with every write or broadcast; restart recovery replays them byte-for-byte (the gateway rejects a
+  // changed body for the same turn ID). Each write prunes payloads of turns no longer in cloudPendingTurns.
+  cloudPayloadDir(sessionId) {
+    return import_node_path6.default.join(this.root, `${safeFileName(sessionId)}.cloud-payloads`);
+  }
+  writeCloudPayload(sessionId, turnId, text) {
+    const dir = this.cloudPayloadDir(sessionId);
+    import_node_fs7.default.mkdirSync(dir, { recursive: true });
+    const target = import_node_path6.default.join(dir, safeFileName(turnId));
+    const tmp = `${target}.tmp-${process.pid}-${Date.now()}`;
+    import_node_fs7.default.writeFileSync(tmp, text, { encoding: "utf8", mode: 384 });
+    import_node_fs7.default.renameSync(tmp, target);
+  }
+  readCloudPayload(sessionId, turnId) {
+    try {
+      return import_node_fs7.default.readFileSync(import_node_path6.default.join(this.cloudPayloadDir(sessionId), safeFileName(turnId)), "utf8");
+    } catch {
+      return null;
+    }
+  }
+  pruneCloudPayloads(file) {
+    const dir = this.cloudPayloadDir(file.sessionId);
+    if (!import_node_fs7.default.existsSync(dir)) return;
+    const keep = new Set((file.cloudPendingTurns ?? []).map((turn) => safeFileName(turn.id)));
+    if (keep.size === 0) {
+      import_node_fs7.default.rmSync(dir, { recursive: true, force: true });
+      return;
+    }
+    for (const name of import_node_fs7.default.readdirSync(dir)) if (!keep.has(name)) import_node_fs7.default.rmSync(import_node_path6.default.join(dir, name), { force: true });
+  }
   ensureDir() {
     import_node_fs7.default.mkdirSync(this.root, { recursive: true });
   }
@@ -46004,9 +46039,14 @@ var SessionStore = class {
     const tmp = `${target}.tmp-${process.pid}-${Date.now()}`;
     import_node_fs7.default.writeFileSync(tmp, JSON.stringify(validated, null, 2), { encoding: "utf8", mode: 384 });
     import_node_fs7.default.renameSync(tmp, target);
+    try {
+      this.pruneCloudPayloads(validated);
+    } catch {
+    }
     return validated;
   }
   delete(sessionId) {
+    import_node_fs7.default.rmSync(this.cloudPayloadDir(sessionId), { recursive: true, force: true });
     try {
       import_node_fs7.default.unlinkSync(this.filePath(sessionId));
       return true;
@@ -47402,14 +47442,6 @@ function reduceSessionInner(state, input, deps) {
     case "inject-events": {
       return applyEventBatch(state, input.events, deps);
     }
-    case "cloud-command-prepared": {
-      const pending = state.file.cloudPendingCommand;
-      const turn = state.file.cloudPendingTurns?.find((item) => item.id === input.commandId);
-      if ((!pending || pending.id !== input.commandId) && !turn) return { state, effects: [] };
-      const next = cloneState(state);
-      next.file = turn ? { ...next.file, cloudPendingTurns: next.file.cloudPendingTurns?.map((item) => item.id === input.commandId ? { ...item, text: input.text, prepared: true } : item) } : { ...next.file, cloudPendingCommand: { id: pending.id, text: input.text, prepared: true } };
-      return { state: next, effects: [{ kind: "persist-file", file: next.file }] };
-    }
     case "cloud-turn-terminal": {
       if (!state.file.cloudPendingTurns?.some((item) => item.id === input.turnId)) return { state, effects: [] };
       const next = cloneState(state);
@@ -47419,9 +47451,13 @@ function reduceSessionInner(state, input, deps) {
     case "proc-exit": {
       const next = cloneState(state);
       next.procAlive = false;
+      if (isCloudTool(next.file.tool) && next.file.cloudPendingCommand && !next.file.cloudPendingTurns) {
+        next.file = { ...next.file, cloudPendingCommand: void 0 };
+      }
       if (isCloudTool(next.file.tool) && !next.file.cloudPendingCommand && next.file.cloudGatewaySessionId) {
         next.file = { ...next.file, cloudGatewaySessionId: void 0 };
       }
+      const cloudFileChanged = next.file !== state.file;
       next.status = "stopped";
       next.stdinClosed = false;
       next.pendingBgTasks = [];
@@ -47444,7 +47480,7 @@ function reduceSessionInner(state, input, deps) {
       return {
         state: next,
         effects: [
-          ...isCloudTool(state.file.tool) && state.file.cloudGatewaySessionId && !next.file.cloudGatewaySessionId ? [{ kind: "persist-file", file: next.file }] : [],
+          ...cloudFileChanged ? [{ kind: "persist-file", file: next.file }] : [],
           ...interruptEffects,
           {
             kind: "emit-frame",
@@ -47901,7 +47937,10 @@ var SessionRunner = class {
       this.input({ kind: "command", command: { kind: "spawn-if-needed" } });
       const pending = this.state.file.cloudPendingCommand;
       if (pending) this.session?.startTurn(pending.text, pending.id, pending.prepared === true);
-      for (const turn of this.state.file.cloudPendingTurns ?? []) this.session?.startTurn(turn.text, turn.id, turn.prepared === true);
+      for (const turn of this.state.file.cloudPendingTurns ?? []) {
+        const payload = turn.prepared ? null : this.hooks.store.readCloudPayload(this.state.file.sessionId, turn.id);
+        this.session?.startTurn(payload ?? turn.text, turn.id, payload !== null || turn.prepared === true);
+      }
     } finally {
       this.recoveringCloud = false;
     }
@@ -48224,10 +48263,9 @@ var SessionRunner = class {
         }, "broadcast"),
         onCommandPrepared: (commandId, text, prepared) => {
           const pending = this.state.file.cloudPendingTurns?.find((turn) => turn.id === commandId) ?? this.state.file.cloudPendingCommand;
-          if (!pending || pending.id !== commandId || prepared && pending.text !== text) return false;
-          if (!prepared) {
-            this.hooks.store.write(this.state.file.cloudPendingTurns?.some((turn) => turn.id === commandId) ? { ...this.state.file, cloudPendingTurns: this.state.file.cloudPendingTurns.map((turn) => turn.id === commandId ? { ...turn, text, prepared: true } : turn) } : { ...this.state.file, cloudPendingCommand: { id: commandId, text, prepared: true } });
-            this.input({ kind: "cloud-command-prepared", commandId, text });
+          if (!pending || pending.id !== commandId) return false;
+          if (!prepared && pending !== this.state.file.cloudPendingCommand) {
+            this.hooks.store.writeCloudPayload(this.state.file.sessionId, commandId, text);
           }
           return true;
         },
@@ -48420,6 +48458,24 @@ var SessionManager = class {
   setCloudCanceller(cancel) {
     this.cloudCancel = cancel;
   }
+  /**
+   * Cancel only an in-flight cloud turn before a local stop / delete / reset. Idle conversations need no gateway
+   * call, and a failed cancel must not block the local action (offline / logged out / gateway errors).
+   */
+  async cancelCloudTurns(file, runner) {
+    const inFlight = (file.cloudConversationId || file.cloudGatewaySessionId) && (file.cloudPendingCommand || file.cloudPendingTurns?.length);
+    if (!inFlight) {
+      runner?.confirmCloudCancelled();
+      return;
+    }
+    if (!this.cloudCancel) throw new Error("cloud canceller is not configured");
+    try {
+      await this.cloudCancel(file, runner);
+    } catch (err) {
+      this.deps.logger?.warn("cloud cancel failed; continuing locally", { sessionId: file.sessionId, message: err.message });
+      runner?.confirmCloudCancelled();
+    }
+  }
   // sessionId → SessionRunner；在 send / ensureSession 时按需创建
   runners = /* @__PURE__ */ new Map();
   // 标题生成 in-flight 防重（进程内）；跨重启防重靠 SessionFile.aiLabelGeneratedAt
@@ -49178,12 +49234,7 @@ var SessionManager = class {
     const file = this.findOwnedSession(args.sessionId);
     if (!file) throw new ClawdError(ERROR_CODES.SESSION_NOT_FOUND, args.sessionId);
     const runner = this.runners.get(args.sessionId) ?? null;
-    if (isCloudTool(file.tool)) {
-      if (file.cloudConversationId || file.cloudGatewaySessionId) {
-        if (!this.cloudCancel) throw new Error("cloud canceller is not configured");
-        await this.cloudCancel(file, runner);
-      } else runner?.confirmCloudCancelled();
-    }
+    if (isCloudTool(file.tool)) await this.cancelCloudTurns(file, runner);
     return this.delete(args);
   }
   send(args, senderPrincipal) {
@@ -49327,12 +49378,7 @@ var SessionManager = class {
   async stop(args) {
     const file = this.findOwnedSession(args.sessionId);
     const runner = this.runners.get(args.sessionId);
-    if (file && isCloudTool(file.tool)) {
-      if (file.cloudConversationId || file.cloudGatewaySessionId) {
-        if (!this.cloudCancel) throw new Error("cloud canceller is not configured");
-        await this.cloudCancel(file, runner ?? null);
-      } else runner?.confirmCloudCancelled();
-    }
+    if (file && isCloudTool(file.tool)) await this.cancelCloudTurns(file, runner ?? null);
     if (!runner) {
       if (file && isCloudTool(file.tool) && (file.cloudPendingCommand || file.cloudPendingTurns?.length)) this.writeOwned({ ...file, cloudPendingCommand: void 0, cloudPendingTurns: void 0 });
       return { response: { ok: true }, broadcast: [] };
@@ -49528,11 +49574,7 @@ var SessionManager = class {
   async newSessionWithCloudCancel(args) {
     const file = this.getFile(args.sessionId);
     if (isCloudTool(file.tool)) {
-      const runner = this.runners.get(args.sessionId) ?? null;
-      if (file.cloudConversationId || file.cloudGatewaySessionId) {
-        if (!this.cloudCancel) throw new Error("cloud canceller is not configured");
-        await this.cloudCancel(file, runner);
-      } else runner?.confirmCloudCancelled();
+      await this.cancelCloudTurns(file, this.runners.get(args.sessionId) ?? null);
       return this.newSession(args);
     }
     return this.newSession(args);
@@ -56538,11 +56580,72 @@ function buildShiftInternalHandlers(deps) {
 }
 
 // src/handlers/deploy.ts
-var import_node_crypto14 = require("crypto");
+var import_node_crypto13 = require("crypto");
 
 // src/deploy/verified-release.ts
-var import_node_crypto12 = require("crypto");
+var import_node_crypto11 = require("crypto");
+
+// src/deploy/release-archive.ts
 var import_jszip = __toESM(require_lib3(), 1);
+function inspectArchive(bytes) {
+  const data = Buffer.from(bytes);
+  let end = -1;
+  for (let at4 = data.length - 22; at4 >= Math.max(0, data.length - 65557); at4--) {
+    if (data.readUInt32LE(at4) === 101010256 && at4 + 22 + data.readUInt16LE(at4 + 20) === data.length) {
+      end = at4;
+      break;
+    }
+  }
+  if (end < 0 || data.readUInt16LE(end + 4) || data.readUInt16LE(end + 6)) throw new Error("\u5236\u54C1\u5F52\u6863\u683C\u5F0F\u4E0D\u652F\u6301");
+  const count = data.readUInt16LE(end + 10);
+  const length = data.readUInt32LE(end + 12);
+  let at3 = data.readUInt32LE(end + 16), roots = 0;
+  if (count === 65535 || at3 + length !== end) throw new Error("\u5236\u54C1\u5F52\u6863\u683C\u5F0F\u4E0D\u652F\u6301");
+  for (let i2 = 0; i2 < count; i2++) {
+    if (at3 + 46 > end || data.readUInt32LE(at3) !== 33639248) throw new Error("\u5236\u54C1\u5F52\u6863\u683C\u5F0F\u4E0D\u6B63\u786E");
+    const nameLength = data.readUInt16LE(at3 + 28);
+    const next = at3 + 46 + nameLength + data.readUInt16LE(at3 + 30) + data.readUInt16LE(at3 + 32);
+    if (next > end) throw new Error("\u5236\u54C1\u5F52\u6863\u683C\u5F0F\u4E0D\u6B63\u786E");
+    const name = data.subarray(at3 + 46, at3 + 46 + nameLength).toString("utf8");
+    if (name === "candidate-release.json") {
+      roots++;
+      if (data.readUInt32LE(at3 + 24) > 64 * 1024) throw new Error("\u5236\u54C1 JSON \u8D85\u8FC7\u5927\u5C0F\u9650\u5236");
+      if (data.readUInt16LE(at3 + 8) & 1) throw new Error("\u5236\u54C1\u5F52\u6863\u4E0D\u80FD\u52A0\u5BC6");
+    }
+    at3 = next;
+  }
+  if (at3 !== end) throw new Error("\u5236\u54C1\u5F52\u6863\u683C\u5F0F\u4E0D\u6B63\u786E");
+  if (roots > 1) throw new Error("\u5236\u54C1\u5F52\u6863\u6709\u91CD\u590D\u7684\u6839 JSON");
+  if (roots !== 1) throw new Error("\u5236\u54C1\u7F3A\u5C11\u6839\u76EE\u5F55\u7684 candidate-release.json");
+}
+async function readReleaseArchive(bytes) {
+  if (bytes.length > 1024 * 1024) throw new Error("\u5236\u54C1\u5F52\u6863\u8D85\u8FC7\u5927\u5C0F\u9650\u5236");
+  inspectArchive(bytes);
+  const zip = await import_jszip.default.loadAsync(bytes);
+  const entry = zip.file("candidate-release.json");
+  if (!entry || entry.dir || entry.unsafeOriginalName && entry.unsafeOriginalName !== "candidate-release.json") throw new Error("\u5236\u54C1\u7F3A\u5C11\u6839\u76EE\u5F55\u7684 candidate-release.json");
+  const chunks = [];
+  let size = 0;
+  await new Promise((resolve9, reject) => {
+    const stream = entry.nodeStream("nodebuffer");
+    stream.on("data", (data) => {
+      size += data.length;
+      if (size > 64 * 1024) {
+        stream.pause();
+        reject(new Error("\u5236\u54C1 JSON \u8D85\u8FC7\u5927\u5C0F\u9650\u5236"));
+        return;
+      }
+      chunks.push(Buffer.from(data));
+    }).on("error", reject).on("end", resolve9).resume();
+  });
+  let raw;
+  try {
+    raw = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new Error("\u5236\u54C1 JSON \u4E0D\u662F\u5408\u6CD5\u683C\u5F0F");
+  }
+  return raw;
+}
 
 // src/cloud/gateway-client.ts
 init_protocol();
@@ -56710,6 +56813,9 @@ var CloudGatewayClient = class {
     return CloudVolumeUsageSchema.parse(body.volume);
   }
 };
+var TURN_RETRY_BASE_MS = 250;
+var TURN_RETRY_MAX_MS = 3e4;
+var TURN_RETRY_MAX_FAILURES = 12;
 function openHttpTurn(opts) {
   const { fetchImpl, gatewayUrl, apiKey, personaId: personaId2, conversationId, turnId, text, expectedEngine, engineSessionId, instructions, effort, personaMode, purpose, logger } = opts;
   const body = JSON.stringify({
@@ -56753,8 +56859,9 @@ function openHttpTurn(opts) {
     if (!gapCbs.length) earlyGap = true;
     for (const cb of gapCbs) cb();
   };
-  const retryWait = () => new Promise((resolve9) => {
-    const timer = setTimeout(resolve9, 250);
+  let failures = 0;
+  const retryWait = (ms) => new Promise((resolve9) => {
+    const timer = setTimeout(resolve9, ms);
     timer.unref?.();
     abort.signal.addEventListener("abort", () => {
       clearTimeout(timer);
@@ -56796,6 +56903,7 @@ function openHttpTurn(opts) {
         for (; ; ) {
           const { value, done } = await reader.read();
           if (done || closed) break;
+          if (value.byteLength) failures = 0;
           pending += decoder.decode(value, { stream: true });
           let delimiter2;
           while ((delimiter2 = /\r?\n\r?\n/.exec(pending)) !== null) {
@@ -56832,7 +56940,12 @@ function openHttpTurn(opts) {
         }
         logger?.warn("cloud turn SSE disconnected; reconnecting", { message: error.message, turnId });
       }
-      if (!closed) await retryWait();
+      if (closed) return;
+      if (++failures > TURN_RETRY_MAX_FAILURES) {
+        state({ conversationId, turnId, status: "failed", errorCode: "GATEWAY_UNREACHABLE" });
+        return;
+      }
+      await retryWait(Math.min(TURN_RETRY_BASE_MS * 2 ** (failures - 1), TURN_RETRY_MAX_MS));
     }
   })();
   return {
@@ -60940,6 +61053,63 @@ async function storeGithubAuth(args) {
   return { token: args.token, source: "file" };
 }
 
+// src/deploy/base-release.ts
+init_zod();
+var SLUG = "ottin4ttc/clawos";
+var WORKFLOW = ".github/workflows/base-image-acr.yml";
+var SHA = external_exports.string().regex(/^[a-f0-9]{40}$/);
+var SourceSchema = external_exports.object({ cloudHost: SHA, workflow: SHA });
+var BaseSchema = external_exports.object({
+  version: external_exports.literal(1),
+  component: external_exports.literal("base"),
+  environment: external_exports.literal("integration"),
+  commit: SHA,
+  image: external_exports.string().regex(/^registry(?:-vpc)?\.cn-hangzhou\.aliyuncs\.com\/ttc-prod\/clawd-persona-base@sha256:[a-f0-9]{64}$/),
+  source: SourceSchema,
+  workflowCommit: SHA,
+  buildId: external_exports.string().min(1)
+});
+async function currentSource(api) {
+  const head = await api.getJsonStrict(`/repos/${SLUG}/commits/release`);
+  if (!SHA.safeParse(head?.sha).success || !SHA.safeParse(head?.commit?.tree?.sha).success) throw new Error("\u8BFB\u4E0D\u5230\u53EF\u4FE1\u7684 release \u5E95\u5EA7\u6E90\u7801\u7248\u672C");
+  const commit = SHA.parse(head?.sha), tree = SHA.parse(head?.commit?.tree?.sha);
+  const [root, workflow] = await Promise.all([
+    api.getJsonStrict(`/repos/${SLUG}/git/trees/${tree}`),
+    api.getJsonStrict(`/repos/${SLUG}/contents/${WORKFLOW}?ref=${commit}`)
+  ]);
+  if (root?.truncated || workflow?.type !== "file") throw new Error("\u8BFB\u4E0D\u5230\u5B8C\u6574\u5E95\u5EA7\u6E90\u7801\u7248\u672C");
+  const source = SourceSchema.safeParse({ cloudHost: root?.tree?.find((e) => e.path === "cloud-host" && e.type === "tree")?.sha, workflow: workflow.sha });
+  if (!source.success) throw new Error("\u5E95\u5EA7\u6E90\u7801\u7248\u672C\u8BB0\u5F55\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u5237\u65B0\u540E\u518D\u53D1\u5E03");
+  return { commit, source: source.data };
+}
+async function readCurrentBase(api) {
+  const current = await currentSource(api);
+  const listed = await api.getJsonStrict(`/repos/${SLUG}/actions/workflows/base-image-acr.yml/runs?branch=release&per_page=1`);
+  const run = listed?.workflow_runs?.[0];
+  if (!run || !Number.isSafeInteger(run.id) || run.id <= 0 || !Number.isSafeInteger(run.run_attempt) || run.run_attempt <= 0 || run.head_branch !== "release" || run.path !== WORKFLOW || run.head_repository?.full_name !== SLUG || !["push", "workflow_dispatch"].includes(run.event)) throw new Error("\u6CA1\u6709\u53EF\u4FE1\u7684 release \u5E95\u5EA7\u6784\u5EFA\uFF0C\u8BF7\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF\u540E\u518D\u53D1\u5E03");
+  if (run.status !== "completed" || run.conclusion !== "success") throw new Error("\u6700\u65B0\u5E95\u5EA7\u6784\u5EFA\u5C1A\u672A\u6210\u529F\uFF0C\u8BF7\u67E5\u770B clawos \u5E95\u5EA7 Actions \u540E\u518D\u53D1\u5E03");
+  SHA.parse(run.head_sha);
+  let artifact;
+  for (let page = 1; page <= 30; page++) {
+    const list = await api.getJsonStrict(`/repos/${SLUG}/actions/runs/${run.id}/artifacts?per_page=100&page=${page}`);
+    if (!Array.isArray(list?.artifacts)) throw new Error("\u8BFB\u4E0D\u5230\u5E95\u5EA7\u6784\u5EFA\u5236\u54C1");
+    const hits = list.artifacts.filter((a2) => a2.name === `base-candidate-${run.id}-${run.run_attempt}`);
+    if (hits.length > 1 || artifact && hits.length) throw new Error("\u5E95\u5EA7\u6784\u5EFA\u6709\u591A\u4EFD\u5339\u914D\u5236\u54C1\uFF0C\u8BF7\u91CD\u65B0\u6784\u5EFA");
+    artifact ??= hits[0];
+    if (list.artifacts.length < 100 && (list.total_count === void 0 || page * 100 >= list.total_count)) break;
+    if (page === 30) throw new Error("\u5E95\u5EA7\u5236\u54C1\u540D\u5355\u672A\u5B8C\u6574\u8BFB\u5230");
+  }
+  if (!artifact || artifact.expired || !Number.isSafeInteger(artifact.id) || artifact.id <= 0 || !artifact.workflow_run || artifact.workflow_run.id !== run.id || artifact.workflow_run.head_sha !== run.head_sha) throw new Error("\u5E95\u5EA7\u5236\u54C1\u4E0D\u5B58\u5728\u3001\u5DF2\u8FC7\u671F\u6216\u7248\u672C\u4E0D\u5339\u914D\uFF0C\u8BF7\u91CD\u65B0\u6784\u5EFA");
+  const parsed = BaseSchema.safeParse(await readReleaseArchive(await api.downloadArtifact(SLUG, artifact.id)));
+  if (!parsed.success) throw new Error("\u5E95\u5EA7\u5236\u54C1\u7248\u672C\u8BB0\u5F55\u65E0\u6548\uFF0C\u8BF7\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6784\u5EFA");
+  const release2 = parsed.data;
+  const matches = (source) => release2.source.cloudHost === source.cloudHost && release2.source.workflow === source.workflow;
+  if (release2.workflowCommit !== run.head_sha || !matches(current.source)) throw new Error("\u5E95\u5EA7\u5C1A\u672A\u6784\u5EFA\u5F53\u524D release \u6E90\u7801\uFF0C\u8BF7\u7B49\u5F85\u6216\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF");
+  const after = await currentSource(api);
+  if (!matches(after.source)) throw new Error("\u5E95\u5EA7\u6E90\u7801\u5728\u53D1\u5E03\u51C6\u5907\u671F\u95F4\u53D8\u5316\uFF0C\u8BF7\u7B49\u65B0\u6784\u5EFA\u6210\u529F\u540E\u518D\u53D1\u5E03");
+  return release2;
+}
+
 // src/deploy/release-workflow.ts
 init_protocol();
 function renderDeployWorkflow(config) {
@@ -61040,6 +61210,7 @@ function renderDeployWorkflow(config) {
     "            --model '${{ steps.plan.outputs.model }}' \\",
     "            --effort '${{ steps.plan.outputs.effort }}' \\",
     "            --size '${{ steps.plan.outputs.size }}' \\",
+    "            --cpu '${{ steps.plan.outputs.cpu }}' \\",
     "            --task-concurrency '${{ steps.plan.outputs.task_concurrency }}' \\",
     "            --engine '${{ steps.plan.outputs.engine }}' \\",
     "            --connectors '${{ steps.plan.outputs.connectors }}' \\",
@@ -61164,30 +61335,6 @@ function renderDeployWorkflow(config) {
   ].join("\n");
 }
 
-// src/deploy/templates.ts
-var import_node_crypto11 = require("crypto");
-
-// src/deploy/default-base-release.json
-var default_base_release_default = {
-  version: 1,
-  environment: "integration",
-  component: "base",
-  image: "registry-vpc.cn-hangzhou.aliyuncs.com/ttc-prod/clawd-persona-base@sha256:9a0952c6bc94a6595374da7db125b5089b476d0bd88f280bd981757d9f572c22",
-  commit: "8dfab2c57781e9f9600e3f99a79adcfbef455f2e",
-  verification: {
-    status: "passed",
-    fingerprint: "d7b03abb9d2bf3a4d7f6f88ac43a2d33d6ec7a7c94ae816f7dae11d67d338194",
-    checks: [
-      "base-smoke",
-      "codex-smoke",
-      "pi-smoke",
-      "workspace-persistence"
-    ],
-    endpoint: "https://persona-int.clawos.chat",
-    verifiedAt: "2026-10-08T09:34:53.131Z"
-  }
-};
-
 // src/deploy/templates.ts
 init_protocol();
 var CLAWOS_REPO = "ottin4ttc/clawos";
@@ -61201,17 +61348,6 @@ var DOCKERIGNORE_PATH = ".dockerignore";
 var ACR_REGISTRY = "registry.cn-hangzhou.aliyuncs.com";
 var ACR_VPC_REGISTRY = "registry-vpc.cn-hangzhou.aliyuncs.com";
 var ACR_NAMESPACE = "ttc-prod";
-var acceptedBase = VerifiedBaseReleaseSchema.parse(default_base_release_default);
-var baseFingerprint = (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify({
-  component: acceptedBase.component,
-  image: acceptedBase.image,
-  commit: acceptedBase.commit,
-  baseImage: null,
-  pipelineCommit: null,
-  repository: null
-})).digest("hex");
-if (baseFingerprint !== acceptedBase.verification.fingerprint) throw new Error("\u5E73\u53F0\u9ED8\u8BA4\u5E95\u5EA7\u4E0E\u5DF2\u9A8C\u6536\u5236\u54C1\u4E0D\u4E00\u81F4");
-var BASE_IMAGE = acceptedBase.image.replace(`${ACR_VPC_REGISTRY}/`, `${ACR_REGISTRY}/`);
 var PERSONA_LAYER_SCRIPT = "/opt/persona-layer.mjs";
 var CLOUD_PERSONAS_ROOT = "/clawd/personas";
 var GITIGNORE_LINES = [
@@ -61236,9 +61372,9 @@ function personaIdOf(repoName) {
   return String(repoName).toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
 }
 function renderDockerfile(personaId2, baseImage) {
-  if (baseImage !== void 0 && !/^[a-z0-9.-]+(?::[0-9]+)?\/[a-z0-9._/-]+@sha256:[a-f0-9]{64}$/.test(baseImage)) throw new Error("base image must be a complete digest reference");
+  if (typeof baseImage !== "string" || !/^[a-z0-9.-]+(?::[0-9]+)?\/[a-z0-9._/-]+@sha256:[a-f0-9]{64}$/.test(baseImage)) throw new Error("base image must be a complete digest reference");
   if (!/^[a-z0-9][a-z0-9-]{0,39}$/.test(personaId2)) throw new Error(`persona id \u4E0D\u5408\u5F62\u72B6\uFF08[a-z0-9-]\uFF0C\u226440\uFF09\uFF1A${JSON.stringify(personaId2)}`);
-  const fromImage = (baseImage ?? BASE_IMAGE).replace(`${ACR_VPC_REGISTRY}/`, `${ACR_REGISTRY}/`);
+  const fromImage = baseImage.replace(`${ACR_VPC_REGISTRY}/`, `${ACR_REGISTRY}/`);
   const dir = `${CLOUD_PERSONAS_ROOT}/${personaId2}`;
   return [
     "# \u7531 clawd \u751F\u6210\u3001\u7531 clawd \u7EF4\u62A4\uFF1A\u6BCF\u6B21\u300C\u53D1\u5E03\u300D\u90FD\u4F1A\u7528\u5F53\u524D\u6A21\u677F\u91CD\u5199\u8FD9\u4EFD\u6587\u4EF6\u518D\u63D0\u4EA4\uFF0C\u624B\u6539\u4F1A\u88AB\u76D6\u6389\u3002",
@@ -61522,19 +61658,11 @@ async function writeWorkflow(dir) {
     await import_promises5.default.writeFile(wf, body);
   }
 }
-async function writeDockerfile(dir, personaId2) {
-  let baseImage;
-  try {
-    baseImage = (await import_promises5.default.readFile(import_node_path38.default.join(dir, ".clawd", "base-image.txt"), "utf8")).trim();
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  }
-  if (baseImage === void 0) {
-    baseImage = BASE_IMAGE;
-    await import_promises5.default.mkdir(import_node_path38.default.join(dir, ".clawd"), { recursive: true });
-    await import_promises5.default.writeFile(import_node_path38.default.join(dir, ".clawd", "base-image.txt"), `${baseImage}
+async function writeDockerfile(dir, personaId2, image) {
+  const baseImage = image.replace("registry-vpc.cn-hangzhou.aliyuncs.com/", "registry.cn-hangzhou.aliyuncs.com/");
+  await import_promises5.default.mkdir(import_node_path38.default.join(dir, ".clawd"), { recursive: true });
+  await import_promises5.default.writeFile(import_node_path38.default.join(dir, ".clawd", "base-image.txt"), `${baseImage}
 `);
-  }
   await import_promises5.default.writeFile(import_node_path38.default.join(dir, DOCKERFILE_PATH), renderDockerfile(personaId2, baseImage));
   await import_promises5.default.writeFile(import_node_path38.default.join(dir, DOCKERIGNORE_PATH), DOCKERIGNORE_TEMPLATE);
 }
@@ -61638,6 +61766,7 @@ async function commitAll(exec, args) {
 async function release(exec, api, args) {
   const info = await repoInfo(exec, args.dir);
   if (!info) throw new RepoError("\u8FD8\u6CA1\u6709\u4ED3\u5E93\uFF0C\u5148\u70B9\u4E00\u6B21\u300C\u53D1\u5E03\u5230\u4E91\u4E0A\u300D\u5EFA\u4ED3");
+  const base = await readCurrentBase(api);
   await prepareIntegration(exec, args.dir, args.auth);
   const before = await readDeployFileRaw(args.dir);
   let committed = false;
@@ -61646,7 +61775,7 @@ async function release(exec, api, args) {
     await api.enableActions(repoSlug(info.url));
     await writeGitignore(args.dir);
     await writeWorkflow(args.dir);
-    await writeDockerfile(args.dir, cloudPersonaIdOf(info.url));
+    await writeDockerfile(args.dir, cloudPersonaIdOf(info.url), base.image);
     const identity = await identityArgs(exec, args.dir);
     await mustGit(exec, args.dir, ["add", "-A"], "\u6682\u5B58\u6587\u4EF6");
     const stamp = new Date(args.now()).toISOString();
@@ -61668,7 +61797,7 @@ init_protocol();
 function validatePersonaRelease(raw, expected) {
   const record4 = VerifiedPersonaReleaseSchema.parse(raw);
   if (record4.repository !== expected.repository || record4.commit !== expected.commit || new URL(record4.verification.endpoint).origin !== expected.endpoint) throw new Error("\u5236\u54C1\u4E0E\u672C\u6B21\u6D4B\u8BD5\u4ED3\u5E93\u3001\u63D0\u4EA4\u6216\u73AF\u5883\u4E0D\u4E00\u81F4");
-  const fingerprint = (0, import_node_crypto12.createHash)("sha256").update(JSON.stringify({
+  const fingerprint = (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify({
     component: record4.component,
     image: record4.image,
     commit: record4.commit,
@@ -61679,37 +61808,6 @@ function validatePersonaRelease(raw, expected) {
   if (record4.verification.fingerprint !== fingerprint) throw new Error("\u5236\u54C1\u5DF2\u504F\u79BB\u6D4B\u8BD5\u65F6\u7684\u7248\u672C\uFF0C\u8BF7\u91CD\u65B0\u6D4B\u8BD5");
   return record4;
 }
-function inspectArchive(bytes) {
-  const data = Buffer.from(bytes);
-  let end = -1;
-  for (let at4 = data.length - 22; at4 >= Math.max(0, data.length - 65557); at4--) {
-    if (data.readUInt32LE(at4) === 101010256 && at4 + 22 + data.readUInt16LE(at4 + 20) === data.length) {
-      end = at4;
-      break;
-    }
-  }
-  if (end < 0 || data.readUInt16LE(end + 4) || data.readUInt16LE(end + 6)) throw new Error("\u5236\u54C1\u5F52\u6863\u683C\u5F0F\u4E0D\u652F\u6301");
-  const count = data.readUInt16LE(end + 10);
-  const length = data.readUInt32LE(end + 12);
-  let at3 = data.readUInt32LE(end + 16), roots = 0;
-  if (count === 65535 || at3 + length !== end) throw new Error("\u5236\u54C1\u5F52\u6863\u683C\u5F0F\u4E0D\u652F\u6301");
-  for (let i2 = 0; i2 < count; i2++) {
-    if (at3 + 46 > end || data.readUInt32LE(at3) !== 33639248) throw new Error("\u5236\u54C1\u5F52\u6863\u683C\u5F0F\u4E0D\u6B63\u786E");
-    const nameLength = data.readUInt16LE(at3 + 28);
-    const next = at3 + 46 + nameLength + data.readUInt16LE(at3 + 30) + data.readUInt16LE(at3 + 32);
-    if (next > end) throw new Error("\u5236\u54C1\u5F52\u6863\u683C\u5F0F\u4E0D\u6B63\u786E");
-    const name = data.subarray(at3 + 46, at3 + 46 + nameLength).toString("utf8");
-    if (name === "candidate-release.json") {
-      roots++;
-      if (data.readUInt32LE(at3 + 24) > 64 * 1024) throw new Error("\u5236\u54C1 JSON \u8D85\u8FC7\u5927\u5C0F\u9650\u5236");
-      if (data.readUInt16LE(at3 + 8) & 1) throw new Error("\u5236\u54C1\u5F52\u6863\u4E0D\u80FD\u52A0\u5BC6");
-    }
-    at3 = next;
-  }
-  if (at3 !== end) throw new Error("\u5236\u54C1\u5F52\u6863\u683C\u5F0F\u4E0D\u6B63\u786E");
-  if (roots > 1) throw new Error("\u5236\u54C1\u5F52\u6863\u6709\u91CD\u590D\u7684\u6839 JSON");
-  if (roots !== 1) throw new Error("\u5236\u54C1\u7F3A\u5C11\u6839\u76EE\u5F55\u7684 candidate-release.json");
-}
 async function readVerifiedRelease(api, slug, run) {
   if (run.environment !== "integration" || run.status !== "completed" || run.conclusion !== "success" || !run.jobs.some((j2) => j2.key === "deploy" && j2.status === "done")) throw new Error("\u6D4B\u8BD5\u90E8\u7F72\u8FD8\u6CA1\u6709\u6210\u529F\uFF0C\u4E0D\u80FD\u8BFB\u53D6\u5DF2\u6D4B\u5236\u54C1");
   let artifact;
@@ -61725,31 +61823,7 @@ async function readVerifiedRelease(api, slug, run) {
   if (!artifact || artifact.expired || !Number.isSafeInteger(artifact.id) || artifact.id <= 0) throw new Error("\u5DF2\u6D4B\u5236\u54C1\u4E0D\u5B58\u5728\u6216\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u53D1\u5E03\u6D4B\u8BD5");
   if (artifact.workflow_run && (artifact.workflow_run.id !== run.runId || artifact.workflow_run.head_sha !== run.headSha)) throw new Error("\u5236\u54C1\u4E0D\u5C5E\u4E8E\u672C\u6B21\u6D4B\u8BD5\u6D41\u6C34\u7EBF");
   const bytes = await api.downloadArtifact(slug, artifact.id);
-  if (bytes.length > 1024 * 1024) throw new Error("\u5236\u54C1\u5F52\u6863\u8D85\u8FC7\u5927\u5C0F\u9650\u5236");
-  inspectArchive(bytes);
-  const zip = await import_jszip.default.loadAsync(bytes);
-  const entry = zip.file("candidate-release.json");
-  if (!entry || entry.dir || entry.unsafeOriginalName && entry.unsafeOriginalName !== "candidate-release.json") throw new Error("\u5236\u54C1\u7F3A\u5C11\u6839\u76EE\u5F55\u7684 candidate-release.json");
-  const chunks = [];
-  let size = 0;
-  await new Promise((resolve9, reject) => {
-    const stream = entry.nodeStream("nodebuffer");
-    stream.on("data", (data) => {
-      size += data.length;
-      if (size > 64 * 1024) {
-        stream.pause();
-        reject(new Error("\u5236\u54C1 JSON \u8D85\u8FC7\u5927\u5C0F\u9650\u5236"));
-        return;
-      }
-      chunks.push(Buffer.from(data));
-    }).on("error", reject).on("end", resolve9).resume();
-  });
-  let raw;
-  try {
-    raw = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-  } catch {
-    throw new Error("\u5236\u54C1 JSON \u4E0D\u662F\u5408\u6CD5\u683C\u5F0F");
-  }
+  const raw = await readReleaseArchive(bytes);
   return { artifactId: artifact.id, release: validatePersonaRelease(raw, {
     repository: slug,
     commit: run.headSha,
@@ -61757,8 +61831,8 @@ async function readVerifiedRelease(api, slug, run) {
   }) };
 }
 function requireDialogueVerification(release2, run) {
-  if (!release2.verification.checks.includes("persona-dialogue") || !run.jobs.some((j2) => j2.key === DEPLOY_VERIFY_STAGE && j2.status === "done")) {
-    throw new Error("\u8FD9\u6B21\u53D1\u5E03\u8FD8\u6CA1\u6709\u901A\u8FC7\u81EA\u52A8\u5BF9\u8BDD\u9A8C\u8BC1\uFF0C\u8BF7\u91CD\u65B0\u626B\u63CF\u5E76\u53D1\u5E03\u6D4B\u8BD5\u73AF\u5883");
+  if (!["persona-dialogue", "persona-task"].every((check) => release2.verification.checks.includes(check)) || !run.jobs.some((j2) => j2.key === DEPLOY_VERIFY_STAGE && j2.status === "done")) {
+    throw new Error("\u8FD9\u6B21\u53D1\u5E03\u8FD8\u6CA1\u6709\u901A\u8FC7\u81EA\u52A8 Conversation / Task \u9A8C\u8BC1\uFF0C\u8BF7\u91CD\u65B0\u626B\u63CF\u5E76\u53D1\u5E03\u6D4B\u8BD5\u73AF\u5883");
   }
 }
 function integrationPersonaForRelease(cloud, release2, releaseId) {
@@ -61844,7 +61918,7 @@ async function resumePromotion(deps, original, options = {}) {
 init_protocol();
 
 // src/deploy/artifact.ts
-var import_node_crypto13 = require("crypto");
+var import_node_crypto12 = require("crypto");
 var import_node_fs34 = __toESM(require("fs"), 1);
 var import_node_os11 = __toESM(require("os"), 1);
 var import_node_path39 = __toESM(require("path"), 1);
@@ -61883,7 +61957,7 @@ function downloadArtifact(exec) {
     if (declared > ARTIFACT_MAX_BYTES) throw new Error(`\u8D44\u4EA7 ${declared} \u5B57\u8282\uFF0C\u8D85\u8FC7\u4E0A\u9650 ${ARTIFACT_MAX_BYTES}\uFF1A${url}`);
     const dir = await import_node_fs34.default.promises.mkdtemp(import_node_path39.default.join(import_node_os11.default.tmpdir(), "clawd-artifact-"));
     const file = import_node_path39.default.join(dir, "pkg");
-    const hash = (0, import_node_crypto13.createHash)("sha256");
+    const hash = (0, import_node_crypto12.createHash)("sha256");
     let size = 0;
     const meter = new import_node_stream3.Transform({
       transform(chunk, _enc, cb) {
@@ -62781,7 +62855,7 @@ function buildDeployHandlers(deps) {
     if (blockers.length > 0) throw invalid(`\u8FD8\u5DEE\uFF1A${blockers.join("\uFF1B")}`);
     await configureTestIdentity(api, repoSlug(repo2.url));
     if (await deps.claimPublisher(cloudPersonaIdOf(repo2.url), "integration") === "taken") throw invalid("\u6D4B\u8BD5\u73AF\u5883\u91CC\u7684\u8FD9\u4E2A\u540D\u5B57\u5DF2\u7531\u522B\u4EBA\u53D1\u5E03");
-    const releaseId = (0, import_node_crypto14.randomUUID)();
+    const releaseId = (0, import_node_crypto13.randomUUID)();
     try {
       const result = await release(deps.exec, api, { dir, now: deps.now, auth, manifest: entry.manifest, onPrepared: async (head) => {
         const latest2 = await readHistory(dir);
@@ -62934,7 +63008,7 @@ function buildDeployHandlers(deps) {
       const latest = await readHistory(mustPersona(personaId2));
       await writeScanFile(mustPersona(personaId2), { ...latest, promotions: latest.promotions.map((p3) => p3.id === old.id ? { ...p3, phase: "failed", error: "\u51C6\u5907\u9636\u6BB5\u6D4B\u8BD5\u7248\u672C\u5DF2\u53D8\u5316\uFF0C\u5DF2\u7531\u91CD\u65B0\u786E\u8BA4\u7684\u65B0\u4EFB\u52A1\u66FF\u4EE3" } : p3) });
     }
-    const promotion = await continuePromotion(personaId2, record4, reuse ? { ...old, verified: snapshot ?? record4.verified } : { id: (0, import_node_crypto14.randomUUID)(), releaseId, at: deps.now(), phase: "prepared", verified: record4.verified }, true);
+    const promotion = await continuePromotion(personaId2, record4, reuse ? { ...old, verified: snapshot ?? record4.verified } : { id: (0, import_node_crypto13.randomUUID)(), releaseId, at: deps.now(), phase: "prepared", verified: record4.verified }, true);
     return { response: { type: "deploy:promote", promotion } };
   };
   const openTest = async (frame, _client, ctx) => {
@@ -64720,7 +64794,7 @@ ${formatLarkSpeakerReminder(speaker)}`
 }
 
 // src/lark-bot-connector/envelope.ts
-var import_node_crypto15 = require("crypto");
+var import_node_crypto14 = require("crypto");
 var LARK_ENVELOPE_PREFIX = "clawdlbe1";
 function verifyLarkEventEnvelope(args) {
   const { token, publicKeyPem } = args;
@@ -64739,7 +64813,7 @@ function verifyLarkEventEnvelope(args) {
   const data = Buffer.from(`${prefix}.${payloadB64}`, "utf8");
   let sigOk = false;
   try {
-    sigOk = (0, import_node_crypto15.verify)(null, data, publicKeyPem, Buffer.from(sigB64, "base64url"));
+    sigOk = (0, import_node_crypto14.verify)(null, data, publicKeyPem, Buffer.from(sigB64, "base64url"));
   } catch {
     sigOk = false;
   }
@@ -65342,7 +65416,7 @@ async function portableCloudInput(text, resolvers) {
 }
 
 // src/tools/cloud-turn-session.ts
-var import_node_crypto16 = require("crypto");
+var import_node_crypto15 = require("crypto");
 function createCloudTurnSession(args) {
   const { ctx, sink, client, personaId: personaId2, engine, instructions, engineSessionId, prepare } = args;
   let conversationId = ctx.cloudConversationId ?? ctx.cloudExecutionId;
@@ -65364,7 +65438,7 @@ function createCloudTurnSession(args) {
     void client.commandTurn(personaId2, conversationId, turnId, command).catch((e) => sink.onError(`\u4E91\u4E0A\u547D\u4EE4\u5931\u8D25\uFF1A${e.message}`));
   };
   return {
-    startTurn(text, commandId = (0, import_node_crypto16.randomUUID)(), prepared = false) {
+    startTurn(text, commandId = (0, import_node_crypto15.randomUUID)(), prepared = false) {
       if (closed || live.has(commandId)) return;
       conversationId ??= commandId;
       live.add(commandId);
@@ -65677,7 +65751,7 @@ var PiRpcClient = class {
 
 // src/tools/pi-session.ts
 var import_node_child_process11 = require("child_process");
-var import_node_crypto17 = require("crypto");
+var import_node_crypto16 = require("crypto");
 var import_node_fs40 = __toESM(require("fs"), 1);
 var import_node_path44 = __toESM(require("path"), 1);
 
@@ -65959,7 +66033,7 @@ ${dirs.map((d2) => `- ${d2}`).join("\n")}`;
 }
 function createPiSession(ctx, sink, deps = {}) {
   const cmd = process.env.PI_BIN ?? "pi";
-  const sessionId = ctx.toolSessionId ?? (0, import_node_crypto17.randomUUID)();
+  const sessionId = ctx.toolSessionId ?? (0, import_node_crypto16.randomUUID)();
   const skillsDir = import_node_path44.default.join(ctx.cwd, ".claude", "skills");
   const exists = deps.skillsDirExists ?? ((d2) => import_node_fs40.default.existsSync(d2));
   const args = buildPiArgs(ctx, {
@@ -67321,7 +67395,7 @@ var wrapper_default = import_websocket.default;
 
 // src/transport/local-ws-server.ts
 var import_node_http = __toESM(require("http"), 1);
-var import_node_crypto18 = require("crypto");
+var import_node_crypto17 = require("crypto");
 var LocalWsServer = class {
   constructor(opts) {
     this.opts = opts;
@@ -67531,7 +67605,7 @@ var LocalWsServer = class {
     }
   }
   onConnection(socket, remoteAddress) {
-    const id = (0, import_node_crypto18.randomUUID)();
+    const id = (0, import_node_crypto17.randomUUID)();
     const subscribedSessions = /* @__PURE__ */ new Map();
     const handle = {
       id,
@@ -68447,7 +68521,7 @@ var import_node_path53 = __toESM(require("path"), 1);
 // src/attachment/upload.ts
 var import_node_fs47 = __toESM(require("fs"), 1);
 var import_node_path51 = __toESM(require("path"), 1);
-var import_node_crypto19 = __toESM(require("crypto"), 1);
+var import_node_crypto18 = __toESM(require("crypto"), 1);
 var import_promises8 = require("stream/promises");
 var UploadError = class extends Error {
   constructor(code, message) {
@@ -68471,11 +68545,11 @@ async function writeUploadedAttachment(args) {
   } catch (err) {
     throw new UploadError("STORAGE_ERROR", `mkdir failed: ${err.message}`);
   }
-  const hasher = import_node_crypto19.default.createHash("sha256");
+  const hasher = import_node_crypto18.default.createHash("sha256");
   let actualSize = 0;
   const tmpPath = import_node_path51.default.join(
     attachmentsRoot,
-    `.upload-${process.pid}-${Date.now()}-${import_node_crypto19.default.randomBytes(4).toString("hex")}`
+    `.upload-${process.pid}-${Date.now()}-${import_node_crypto18.default.randomBytes(4).toString("hex")}`
   );
   try {
     await (0, import_promises8.pipeline)(
@@ -69325,7 +69399,7 @@ function runAttachmentGc(args) {
 // src/attachment/group.ts
 var import_node_fs50 = __toESM(require("fs"), 1);
 var import_node_path55 = __toESM(require("path"), 1);
-var import_node_crypto20 = __toESM(require("crypto"), 1);
+var import_node_crypto19 = __toESM(require("crypto"), 1);
 init_protocol();
 var GroupFileStore = class {
   dataDir;
@@ -69403,7 +69477,7 @@ var GroupFileStore = class {
       entries[idx] = next;
     } else {
       next = {
-        id: `gf-${import_node_crypto20.default.randomBytes(6).toString("base64url")}`,
+        id: `gf-${import_node_crypto19.default.randomBytes(6).toString("base64url")}`,
         relPath: input.relPath,
         from: input.from,
         label: input.label,
@@ -69525,7 +69599,7 @@ function readSpawnedByDesktopFromEnv(env = process.env) {
 // src/tunnel/tunnel-manager.ts
 var import_node_fs55 = __toESM(require("fs"), 1);
 var import_node_path60 = __toESM(require("path"), 1);
-var import_node_crypto21 = __toESM(require("crypto"), 1);
+var import_node_crypto20 = __toESM(require("crypto"), 1);
 var import_node_child_process16 = require("child_process");
 
 // src/tunnel/tunnel-store.ts
@@ -70022,7 +70096,7 @@ var TunnelManager = class {
         override: this.deps.frpcBinaryOverride ?? void 0
       });
       const tomlPath = import_node_path60.default.join(this.deps.dataDir, "frpc.toml");
-      const proxyName = `clawd-${t2.subdomain}-${localPort}-${import_node_crypto21.default.randomBytes(3).toString("hex")}`;
+      const proxyName = `clawd-${t2.subdomain}-${localPort}-${import_node_crypto20.default.randomBytes(3).toString("hex")}`;
       const toml = buildFrpcToml({
         serverAddr: t2.frpsHost,
         serverPort: t2.frpsPort,
@@ -70123,7 +70197,7 @@ async function waitForFrpcReady(proc, timeoutMs) {
 // src/tunnel/device-key.ts
 var import_node_os22 = __toESM(require("os"), 1);
 var import_node_path61 = __toESM(require("path"), 1);
-var import_node_crypto22 = __toESM(require("crypto"), 1);
+var import_node_crypto21 = __toESM(require("crypto"), 1);
 var DERIVE_SALT = "clawd-tunnel-device-v1";
 function deriveStableDeviceKey(opts = {}) {
   const hostname = opts.hostname ?? import_node_os22.default.hostname();
@@ -70133,13 +70207,13 @@ function deriveStableDeviceKey(opts = {}) {
   const normalizedDataDir = opts.dataDir ? import_node_path61.default.resolve(opts.dataDir) : null;
   const isDefaultDir = normalizedDataDir == null || normalizedDataDir === defaultDataDir;
   const input = isDefaultDir ? `${hostname}::${uid}` : `${hostname}::${uid}::${normalizedDataDir}`;
-  return import_node_crypto22.default.createHmac("sha256", DERIVE_SALT).update(input).digest("hex").slice(0, 32);
+  return import_node_crypto21.default.createHmac("sha256", DERIVE_SALT).update(input).digest("hex").slice(0, 32);
 }
 
 // src/auth-store.ts
 var import_node_fs56 = __toESM(require("fs"), 1);
 var import_node_path62 = __toESM(require("path"), 1);
-var import_node_crypto23 = __toESM(require("crypto"), 1);
+var import_node_crypto22 = __toESM(require("crypto"), 1);
 var AUTH_FILE_NAME = "auth.json";
 function authFilePath(dataDir) {
   return import_node_path62.default.join(dataDir, AUTH_FILE_NAME);
@@ -70176,10 +70250,10 @@ function loadOrCreateTunnelDeviceKey(opts) {
   return tunnelDeviceKey;
 }
 function defaultGenerateToken() {
-  return import_node_crypto23.default.randomBytes(32).toString("base64url");
+  return import_node_crypto22.default.randomBytes(32).toString("base64url");
 }
 function defaultGenerateOwnerPrincipalId() {
-  return `owner-${import_node_crypto23.default.randomUUID()}`;
+  return `owner-${import_node_crypto22.default.randomUUID()}`;
 }
 function readAuthFile(file) {
   try {
@@ -70311,7 +70385,7 @@ var OwnerIdentityStore = class {
 };
 
 // src/feishu-auth/login-flow.ts
-var import_node_crypto24 = __toESM(require("crypto"), 1);
+var import_node_crypto23 = __toESM(require("crypto"), 1);
 var STATE_TTL_MS = 5 * 60 * 1e3;
 var LoginFlow = class {
   constructor(deps) {
@@ -70321,7 +70395,7 @@ var LoginFlow = class {
   pendingStates = /* @__PURE__ */ new Map();
   generation = 0;
   start() {
-    const state = import_node_crypto24.default.randomBytes(16).toString("base64url");
+    const state = import_node_crypto23.default.randomBytes(16).toString("base64url");
     const now = (this.deps.now ?? Date.now)();
     this.pendingStates.set(state, { issuedAt: now, owner: this.deps.expectedUnionId?.() });
     this.gcExpired(now);
@@ -70855,7 +70929,7 @@ init_protocol();
 var import_node_fs59 = __toESM(require("fs"), 1);
 var import_node_os24 = __toESM(require("os"), 1);
 var import_node_path65 = __toESM(require("path"), 1);
-var import_node_crypto25 = require("crypto");
+var import_node_crypto24 = require("crypto");
 init_claude_history();
 function readJsonlEntries(file) {
   const raw = import_node_fs59.default.readFileSync(file, "utf8");
@@ -70892,7 +70966,7 @@ function forkSession(input) {
     throw new Error(`fork: messageUuid not found in transcript: ${input.messageUuid}`);
   }
   const sliced = mainEntries.slice(0, targetIdx + 1);
-  const forkedToolSessionId = (0, import_node_crypto25.randomUUID)();
+  const forkedToolSessionId = (0, import_node_crypto24.randomUUID)();
   let parentUuid = null;
   const forkedLines = [];
   for (const entry of sliced) {
@@ -70946,10 +71020,15 @@ async function forkCodexThread(input, deps = {}) {
   if (rollout.meta?.threadId.toLowerCase() !== input.sourceThreadId.toLowerCase()) {
     throw new Error(`codex fork: source thread metadata does not match ${input.sourceThreadId}`);
   }
-  if (!rollout.turns.some((turn) => turn.turnId === input.turnId && turn.status === "completed")) {
-    throw new Error(`codex fork: completed turn not found: ${input.turnId}`);
+  const completed = (turns) => turns.some((turn) => turn.turnId === input.turnId && turn.status === "completed");
+  let owner2 = { threadId: input.sourceThreadId, home: source.home };
+  if (!completed(rollout.turns)) {
+    const segment = parseCodexThreadSegments(createCodexRolloutLocator(input.roots), input.sourceThreadId).find((item) => completed(item.parsed.turns));
+    const home = segment && locateCodexThread(input.roots, segment.threadId)?.home;
+    if (!segment || !home) throw new Error(`codex fork: completed turn not found: ${input.turnId}`);
+    owner2 = { threadId: segment.threadId, home };
   }
-  const connection = (deps.open ?? openCodexAppServer)(source.home, input.targetCwd);
+  const connection = (deps.open ?? openCodexAppServer)(owner2.home, input.targetCwd);
   const timeoutMs = deps.timeoutMs ?? DEFAULT_CODEX_QUERY_TIMEOUT_MS;
   let timer;
   const timeout = new Promise((_3, reject) => {
@@ -70964,7 +71043,7 @@ async function forkCodexThread(input, deps = {}) {
       });
       client.notify("initialized", {});
       const result = await client.request("thread/fork", {
-        threadId: input.sourceThreadId,
+        threadId: owner2.threadId,
         lastTurnId: input.turnId,
         cwd: input.targetCwd
       });
@@ -70972,7 +71051,7 @@ async function forkCodexThread(input, deps = {}) {
       if (typeof forkedToolSessionId !== "string" || !forkedToolSessionId) {
         throw new Error("codex fork: app-server returned no thread id");
       }
-      const forked = locateCodexThread([import_node_path66.default.join(source.home, "sessions")], forkedToolSessionId);
+      const forked = locateCodexThread([import_node_path66.default.join(owner2.home, "sessions")], forkedToolSessionId);
       if (!forked) throw new Error(`codex fork: rollout not found for forked thread ${forkedToolSessionId}`);
       return { forkedToolSessionId, forkedFilePath: forked.file };
     })()]);
@@ -73651,7 +73730,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.631".length > 0 ? "0.2.631" : "dev";
+var version = "0.2.635".length > 0 ? "0.2.635" : "dev";
 
 // src/cli-probe/probe.ts
 var fs84 = __toESM(require("fs"), 1);
@@ -74045,7 +74124,7 @@ init_protocol();
 // src/extension/bundle-zip.ts
 var import_promises12 = __toESM(require("fs/promises"), 1);
 var import_node_path74 = __toESM(require("path"), 1);
-var import_node_crypto26 = __toESM(require("crypto"), 1);
+var import_node_crypto25 = __toESM(require("crypto"), 1);
 var import_jszip3 = __toESM(require_lib3(), 1);
 async function bundleExtensionDir(dir) {
   const entries = await listFilesSorted(dir);
@@ -74060,7 +74139,7 @@ async function bundleExtensionDir(dir) {
     compression: "DEFLATE",
     compressionOptions: { level: 6 }
   });
-  const sha256 = import_node_crypto26.default.createHash("sha256").update(buffer).digest("hex");
+  const sha256 = import_node_crypto25.default.createHash("sha256").update(buffer).digest("hex");
   return { buffer, sha256 };
 }
 var FIXED_DATE = /* @__PURE__ */ new Date("2020-01-01T00:00:00.000Z");
@@ -74128,7 +74207,7 @@ function computePublishCheck(args) {
 var import_promises13 = __toESM(require("fs/promises"), 1);
 var import_node_path76 = __toESM(require("path"), 1);
 var import_node_os28 = __toESM(require("os"), 1);
-var import_node_crypto27 = __toESM(require("crypto"), 1);
+var import_node_crypto26 = __toESM(require("crypto"), 1);
 var import_jszip4 = __toESM(require_lib3(), 1);
 
 // src/extension/paths.ts
@@ -74157,7 +74236,7 @@ var InstallError = class extends Error {
 };
 async function installFromChannel(args, deps) {
   const { channelRef, snapshotHash, bundleZip } = args;
-  const computed = import_node_crypto27.default.createHash("sha256").update(bundleZip).digest("hex");
+  const computed = import_node_crypto26.default.createHash("sha256").update(bundleZip).digest("hex");
   if (computed !== snapshotHash) {
     throw new InstallError(
       "HASH_MISMATCH",
@@ -74249,7 +74328,7 @@ async function installFromChannel(args, deps) {
 var import_promises14 = __toESM(require("fs/promises"), 1);
 var import_node_path77 = __toESM(require("path"), 1);
 var import_node_os29 = __toESM(require("os"), 1);
-var import_node_crypto28 = __toESM(require("crypto"), 1);
+var import_node_crypto27 = __toESM(require("crypto"), 1);
 var import_jszip5 = __toESM(require_lib3(), 1);
 var UpdateError = class extends Error {
   constructor(code, message) {
@@ -74287,7 +74366,7 @@ async function updateFromChannel(args, deps) {
     if (e instanceof UpdateError) throw e;
     throw e;
   }
-  const computed = import_node_crypto28.default.createHash("sha256").update(bundleZip).digest("hex");
+  const computed = import_node_crypto27.default.createHash("sha256").update(bundleZip).digest("hex");
   if (computed !== snapshotHash) {
     throw new UpdateError(
       "HASH_MISMATCH",
@@ -75415,7 +75494,7 @@ async function uninstall(deps) {
 }
 
 // src/handlers/index.ts
-var import_node_crypto29 = require("crypto");
+var import_node_crypto28 = require("crypto");
 
 // src/handlers/peer-exec.ts
 init_protocol();
@@ -75572,7 +75651,7 @@ function buildMethodHandlers(deps) {
           const c2 = deps.contactStore.get(deviceId);
           return c2 ? { deviceId: c2.deviceId, remoteUrl: c2.remoteUrl, connectToken: c2.connectToken } : null;
         },
-        genId: () => (0, import_node_crypto29.randomUUID)(),
+        genId: () => (0, import_node_crypto28.randomUUID)(),
         now: () => Date.now(),
         forwardInboxPostToPeer,
         logger: deps.logger
@@ -76292,7 +76371,7 @@ async function startDaemon(config) {
   const channelStore = createChannelStore({
     filePath: import_node_path85.default.join(config.dataDir, "channels.json"),
     now: () => Date.now(),
-    genId: () => `ch-${(0, import_node_crypto30.randomUUID)().slice(0, 8)}`,
+    genId: () => `ch-${(0, import_node_crypto29.randomUUID)().slice(0, 8)}`,
     onFlushError: (err) => logger.error("channel store flush failed", {
       reason: err instanceof Error ? err.message : String(err)
     })
@@ -76301,7 +76380,7 @@ async function startDaemon(config) {
   const topicStore = createTopicStore({
     filePath: import_node_path85.default.join(config.dataDir, "topics.json"),
     now: () => Date.now(),
-    genId: () => `tp-${(0, import_node_crypto30.randomUUID)().slice(0, 8)}`,
+    genId: () => `tp-${(0, import_node_crypto29.randomUUID)().slice(0, 8)}`,
     onFlushError: (err) => logger.error("topic store flush failed", {
       reason: err instanceof Error ? err.message : String(err)
     })
@@ -76309,7 +76388,7 @@ async function startDaemon(config) {
   await topicStore.load();
   let deliverPendingRef;
   const personaDispatchManager = new PersonaDispatchManager({
-    genId: () => (0, import_node_crypto30.randomUUID)(),
+    genId: () => (0, import_node_crypto29.randomUUID)(),
     store: dispatchStore,
     now: () => Date.now(),
     onCompleted: (sid) => deliverPendingRef?.(sid),