@clawos-dev/clawd 0.2.647 → 0.2.649

package/dist/app-builder-plugin/mcp-server.cjs

@@ -31292,6 +31292,8 @@ var EnvConnectorSchema = external_exports.object({
   id: external_exports.string().min(1),
   credentialSource: external_exports.enum(CREDENTIAL_SOURCES).optional(),
   auth: external_exports.enum(CONNECTOR_AUTHS).optional(),
+  // Stamped by deploy:release from the authenticated owner, never chosen by the UI.
+  publisherUnionId: external_exports.string().regex(/^on_[A-Za-z0-9_-]+$/).optional(),
   fields: external_exports.array(ConnectorFieldSchema).default([]),
   http: external_exports.object({ url: external_exports.string().min(1), headers: external_exports.record(external_exports.string(), external_exports.string()) }).optional()
 });
@@ -31523,6 +31525,11 @@ var DeployStateSchema = external_exports.object({
   personaId: external_exports.string().min(1),
   /** 本机 GitHub 身份（机器级，githubAuth:* 的同一份；上云页顶上那张卡用）。老 daemon 不给（可选只为兼容），UI 缺席时按未知处理 */
   github: GithubAuthStatusSchema.optional(),
+  /** Current publisher's Feishu tool grant, including authorization links before first release. */
+  publisherFeishuAuth: external_exports.object({
+    integration: external_exports.object({ connected: external_exports.boolean(), authUrl: external_exports.string().optional(), error: external_exports.string().optional() }).strict(),
+    production: external_exports.object({ connected: external_exports.boolean(), authUrl: external_exports.string().optional(), error: external_exports.string().optional() }).strict()
+  }).strict().optional(),
   repo: DeployRepoSchema.optional(),
   scans: external_exports.array(DeployScanSchema).default([]),
   releases: external_exports.array(DeployReleasedSchema).default([]),

package/dist/cli.cjs

@@ -6022,9 +6022,14 @@ var init_github_auth_schemas = __esm({
 function isFeishuBotConnector(c2) {
   return c2.name === "feishu" && c2.runner === "cli" && c2.kind === "env" && c2.credentialSource === "shared";
 }
+function isFeishuPublisherConnector(c2) {
+  return c2.name === "feishu" && c2.id === "feishu" && c2.runner === "cli" && c2.kind === "proxy" && c2.protocol === "lark-sidecar" && c2.credentialSource === "shared" && c2.auth === "oauth" && c2.fields.length === 0;
+}
 function connectorBlockers(c2) {
   if (!c2.credentialSource) return [`\u8FDE\u63A5\u5668 ${c2.name} \u8FD8\u6CA1\u9009\u7528\u8C01\u7684\u8D26\u53F7`];
   const out = [];
+  if (isFeishuPublisherConnector(c2)) return out;
+  if (c2.protocol === "lark-sidecar" && c2.credentialSource === "shared") return ["\u8FDE\u63A5\u5668 feishu \u7684\u53D1\u5E03\u8005 OAuth \u914D\u7F6E\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u91CD\u65B0\u9009\u62E9\u8D26\u53F7\u8EAB\u4EFD"];
   if (isFeishuBotConnector(c2)) {
     return FEISHU_BOT_FIELDS.filter((f2) => !c2.fields.includes(f2)).map((f2) => `\u8FDE\u63A5\u5668 feishu \u7684 Lark App Bot \u7F3A\u5C11 ${f2 === "LARKSUITE_CLI_APP_ID" ? "App ID" : "App Secret"}`);
   }
@@ -6138,6 +6143,8 @@ var init_environment_schemas = __esm({
       id: external_exports.string().min(1),
       credentialSource: external_exports.enum(CREDENTIAL_SOURCES).optional(),
       auth: external_exports.enum(CONNECTOR_AUTHS).optional(),
+      // Stamped by deploy:release from the authenticated owner, never chosen by the UI.
+      publisherUnionId: external_exports.string().regex(/^on_[A-Za-z0-9_-]+$/).optional(),
       fields: external_exports.array(ConnectorFieldSchema).default([]),
       http: external_exports.object({ url: external_exports.string().min(1), headers: external_exports.record(external_exports.string(), external_exports.string()) }).optional()
     });
@@ -6434,6 +6441,11 @@ var init_deploy_schemas = __esm({
       personaId: external_exports.string().min(1),
       /** 本机 GitHub 身份（机器级，githubAuth:* 的同一份；上云页顶上那张卡用）。老 daemon 不给（可选只为兼容），UI 缺席时按未知处理 */
       github: GithubAuthStatusSchema.optional(),
+      /** Current publisher's Feishu tool grant, including authorization links before first release. */
+      publisherFeishuAuth: external_exports.object({
+        integration: external_exports.object({ connected: external_exports.boolean(), authUrl: external_exports.string().optional(), error: external_exports.string().optional() }).strict(),
+        production: external_exports.object({ connected: external_exports.boolean(), authUrl: external_exports.string().optional(), error: external_exports.string().optional() }).strict()
+      }).strict().optional(),
       repo: DeployRepoSchema.optional(),
       scans: external_exports.array(DeployScanSchema).default([]),
       releases: external_exports.array(DeployReleasedSchema).default([]),
@@ -57576,7 +57588,7 @@ function cliConnectorFromFinding(item) {
 }
 function mergeConnector(existing, incoming) {
   if (!existing) return incoming;
-  if (isFeishuBotConnector(existing) && incoming.name === existing.name && incoming.runner === "cli") return existing;
+  if ((isFeishuBotConnector(existing) || isFeishuPublisherConnector(existing)) && incoming.name === existing.name && incoming.runner === "cli") return existing;
   const reviewed = existing.credentialSource !== void 0;
   return {
     ...incoming,
@@ -61477,6 +61489,7 @@ async function storeGithubAuth(args) {
 init_zod();
 var SLUG = "ottin4ttc/clawos";
 var WORKFLOW = ".github/workflows/base-image-acr.yml";
+var DOCKERFILE = "cloud-host/Dockerfile.base";
 var SHA = external_exports.string().regex(/^[a-f0-9]{40}$/);
 var SourceSchema = external_exports.object({ cloudHost: SHA, workflow: SHA });
 var BaseSchema = external_exports.object({
@@ -61502,6 +61515,25 @@ async function currentSource(api) {
   if (!source.success) throw new Error("\u5E95\u5EA7\u6E90\u7801\u7248\u672C\u8BB0\u5F55\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u5237\u65B0\u540E\u518D\u53D1\u5E03");
   return { commit, source: source.data };
 }
+function dockerfileInputs(text) {
+  if (!/^\s*FROM\s+/im.test(text)) throw new Error("\u8BFB\u4E0D\u5230\u53EF\u4FE1\u7684\u5E95\u5EA7\u6784\u5EFA\u914D\u65B9");
+  const logical = text.replace(/\\\r?\n/g, " ");
+  if (/^\s*RUN\b.*--mount=/im.test(logical)) throw new Error("\u5E95\u5EA7\u6302\u8F7D\u8F93\u5165\u65E0\u6CD5\u5B8C\u6574\u6BD4\u8F83\uFF0C\u8BF7\u91CD\u65B0\u6784\u5EFA");
+  const inputs = /* @__PURE__ */ new Set([DOCKERFILE, "cloud-host/.dockerignore", "cloud-host/Dockerfile.base.dockerignore"]);
+  for (const line of logical.split("\n")) {
+    const instruction = /^\s*(?:COPY|ADD)\s+(.+)$/i.exec(line)?.[1];
+    if (!instruction || /^--from=\S+\s/.test(instruction)) continue;
+    const tokens = instruction.startsWith("[") ? JSON.parse(instruction) : instruction.trim().split(/\s+/);
+    if (!Array.isArray(tokens) || tokens.length < 2) throw new Error("\u5E95\u5EA7 COPY \u8F93\u5165\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u91CD\u65B0\u6784\u5EFA");
+    for (const source of tokens.slice(0, -1)) {
+      if (typeof source !== "string" || !/^[A-Za-z0-9_-][A-Za-z0-9_./-]*$/.test(source) || source.split("/").some((segment) => !segment || segment === "." || segment === "..")) {
+        throw new Error("\u5E95\u5EA7 COPY \u8F93\u5165\u65E0\u6CD5\u5B8C\u6574\u6BD4\u8F83\uFF0C\u8BF7\u91CD\u65B0\u6784\u5EFA");
+      }
+      inputs.add("cloud-host/" + source.replace(/\/$/, ""));
+    }
+  }
+  return inputs;
+}
 async function readCurrentBase(api) {
   const current = await currentSource(api);
   const listed = await api.getJsonStrict(`/repos/${SLUG}/actions/workflows/base-image-acr.yml/runs?branch=release&per_page=1`);
@@ -61523,10 +61555,23 @@ async function readCurrentBase(api) {
   const parsed = BaseSchema.safeParse(await readReleaseArchive(await api.downloadArtifact(SLUG, artifact.id)));
   if (!parsed.success) throw new Error("\u5E95\u5EA7\u5236\u54C1\u7248\u672C\u8BB0\u5F55\u65E0\u6548\uFF0C\u8BF7\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6784\u5EFA");
   const release2 = parsed.data;
-  const matches = (source) => release2.source.cloudHost === source.cloudHost && release2.source.workflow === source.workflow;
-  if (release2.workflowCommit !== run.head_sha || !matches(current.source)) throw new Error("\u5E95\u5EA7\u5C1A\u672A\u6784\u5EFA\u5F53\u524D release \u6E90\u7801\uFF0C\u8BF7\u7B49\u5F85\u6216\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF");
+  const matches = async (candidate) => {
+    if (release2.source.workflow !== candidate.source.workflow) return false;
+    if (release2.source.cloudHost === candidate.source.cloudHost) return true;
+    if (release2.commit === candidate.commit) return false;
+    const comparison = await api.getJsonStrict(`/repos/${SLUG}/compare/${release2.commit}...${candidate.commit}`);
+    if (comparison.status !== "ahead" || !Array.isArray(comparison.files) || comparison.files.length >= 300 || comparison.files.some((file) => typeof file.filename !== "string" || !file.filename)) {
+      throw new Error("\u65E0\u6CD5\u5B8C\u6574\u6BD4\u8F83\u5E95\u5EA7\u8F93\u5165\uFF0C\u8BF7\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF");
+    }
+    if (comparison.files.some((file) => file.filename === DOCKERFILE || file.previous_filename === DOCKERFILE)) return false;
+    const recipe = await api.getJsonStrict(`/repos/${SLUG}/contents/${DOCKERFILE}?ref=${candidate.commit}`);
+    if (recipe.type !== "file" || recipe.encoding !== "base64" || typeof recipe.content !== "string") throw new Error("\u8BFB\u4E0D\u5230\u5E95\u5EA7\u6784\u5EFA\u914D\u65B9");
+    const inputs = dockerfileInputs(Buffer.from(recipe.content, "base64").toString("utf8"));
+    return comparison.files.every((file) => ![file.filename, file.previous_filename].some((filename) => filename && [...inputs].some((input) => filename === input || filename.startsWith(input + "/"))));
+  };
+  if (release2.commit !== run.head_sha || release2.workflowCommit !== run.head_sha || !await matches(current)) throw new Error("\u5E95\u5EA7\u5C1A\u672A\u6784\u5EFA\u5F53\u524D release \u6E90\u7801\uFF0C\u8BF7\u7B49\u5F85\u6216\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF");
   const after = await currentSource(api);
-  if (!matches(after.source)) throw new Error("\u5E95\u5EA7\u6E90\u7801\u5728\u53D1\u5E03\u51C6\u5907\u671F\u95F4\u53D8\u5316\uFF0C\u8BF7\u7B49\u65B0\u6784\u5EFA\u6210\u529F\u540E\u518D\u53D1\u5E03");
+  if ((after.source.cloudHost !== current.source.cloudHost || after.source.workflow !== current.source.workflow) && !await matches(after)) throw new Error("\u5E95\u5EA7\u6E90\u7801\u5728\u53D1\u5E03\u51C6\u5907\u671F\u95F4\u53D8\u5316\uFF0C\u8BF7\u7B49\u65B0\u6784\u5EFA\u6210\u529F\u540E\u518D\u53D1\u5E03");
   return release2;
 }
 
@@ -62939,9 +62984,22 @@ function buildDeployHandlers(deps) {
       run = historical ? selected?.environment === "integration" ? intRun : prodRun ?? run : prodTarget.run;
     }
     if (!historical && latestProductionRelease(file.releases) && (!api || github.status !== "authorized")) online = (await cachedCloud(personaId2, "production", run, unpublish, repo2 ? cloudPersonaIdOf(repo2.url) : personaId2)).online;
+    let publisherFeishuAuth;
+    if (scans.at(-1)?.manifest.connectors.some(isFeishuPublisherConnector)) {
+      const query2 = async (environment2) => {
+        try {
+          return await deps.publisherFeishuAuth(repo2 ? cloudPersonaIdOf(repo2.url) : personaId2, environment2);
+        } catch (e) {
+          return { connected: false, error: e instanceof Error ? e.message : "\u98DE\u4E66\u6388\u6743\u72B6\u6001\u67E5\u8BE2\u5931\u8D25" };
+        }
+      };
+      const [integration, production] = await Promise.all([query2("integration"), query2("production")]);
+      publisherFeishuAuth = { integration, production };
+    }
     return {
       personaId: personaId2,
       github,
+      ...publisherFeishuAuth ? { publisherFeishuAuth } : {},
       targets,
       promotions: file.promotions,
       ...repo2 ? { repo: repo2 } : {},
@@ -63161,7 +63219,7 @@ function buildDeployHandlers(deps) {
     }
     if (args.kind === "connector") {
       const incoming = cliConnectorFromFinding(item);
-      const previous = scan.manifest.connectors.some((c2) => c2.name === incoming.name) ? void 0 : [...file.scans].reverse().find((s2) => s2.status === "done")?.manifest.connectors.find((c2) => c2.name === incoming.name && isFeishuBotConnector(c2));
+      const previous = scan.manifest.connectors.some((c2) => c2.name === incoming.name) ? void 0 : [...file.scans].reverse().find((s2) => s2.status === "done")?.manifest.connectors.find((c2) => c2.name === incoming.name && (isFeishuBotConnector(c2) || isFeishuPublisherConnector(c2)));
       item = mergeConnector(previous, incoming);
     }
     if (args.kind === "package") item = await settlePackage(item);
@@ -63291,11 +63349,23 @@ function buildDeployHandlers(deps) {
       blockers.push(cloudEngine.tool === "claude" ? "\u8FD8\u6CA1\u9009\u4E91\u4E0A\u6A21\u578B\uFF08Claude \u7684\u4E91\u4E0A\u6A21\u578B\u4E0E\u672C\u673A\u5206\u5F00\u5B58\uFF09\u2014\u2014\u5728\u4E0A\u4E91\u9875\u300C\u5F15\u64CE\u4E0E\u6A21\u578B\u300D\u91CC\u9009\u4E00\u4E2A" : "\u8FD8\u6CA1\u9009\u6A21\u578B\uFF08\u5207\u5F15\u64CE\u65F6\u4F1A\u6E05\u7A7A\uFF09\u2014\u2014\u5728\u4E0A\u4E91\u9875\u300C\u5F15\u64CE\u4E0E\u6A21\u578B\u300D\u91CC\u9009\u4E00\u4E2A");
     }
     if (blockers.length > 0) throw invalid(`\u8FD8\u5DEE\uFF1A${blockers.join("\uFF1B")}`);
+    const publisherUnionId = ctx?.principal.feishuUnionId;
+    if (entry.manifest.connectors.some(isFeishuPublisherConnector) && !/^on_[A-Za-z0-9_-]+$/.test(publisherUnionId ?? "")) {
+      throw invalid("\u4F7F\u7528\u53D1\u5E03\u8005\u8D26\u53F7\u524D\uFF0C\u8BF7\u5148\u767B\u5F55\u98DE\u4E66");
+    }
+    if (entry.manifest.connectors.some(isFeishuPublisherConnector)) {
+      const status = await deps.publisherFeishuAuth?.(cloudPersonaIdOf(repo2.url), "integration");
+      if (!status?.connected) throw invalid("\u8BF7\u5148\u5728\u8FDE\u63A5\u5668\u533A\u5173\u8054\u53D1\u5E03\u8005\u7684\u6D4B\u8BD5\u73AF\u5883\u98DE\u4E66\u8D26\u53F7\uFF0C\u518D\u53D1\u5E03");
+    }
+    const manifest = { ...entry.manifest, connectors: entry.manifest.connectors.map((c2) => {
+      const { publisherUnionId: _untrusted, ...connector } = c2;
+      return isFeishuPublisherConnector(c2) ? { ...connector, publisherUnionId } : connector;
+    }) };
     await configureTestIdentity(api, repoSlug(repo2.url));
     if (await deps.claimPublisher(cloudPersonaIdOf(repo2.url), "integration") === "taken") throw invalid("\u6D4B\u8BD5\u73AF\u5883\u91CC\u7684\u8FD9\u4E2A\u540D\u5B57\u5DF2\u7531\u522B\u4EBA\u53D1\u5E03");
     const releaseId = (0, import_node_crypto14.randomUUID)();
     try {
-      const result = await release(deps.exec, api, { dir, now: deps.now, auth, manifest: entry.manifest, onPrepared: async (head) => {
+      const result = await release(deps.exec, api, { dir, now: deps.now, auth, manifest, onPrepared: async (head) => {
         const latest2 = await readHistory(dir);
         await writeScanFile(dir, { ...latest2, releases: [...latest2.releases, { id: releaseId, environment: "integration", head, contentHead: entry.head, scanId: entry.id, at: deps.now(), pushed: false }] });
       } });
@@ -63440,6 +63510,7 @@ function buildDeployHandlers(deps) {
     const scan = file.scans.find((s2) => s2.id === record4.scanId);
     if (!scan || scan.status !== "done") throw invalid("\u627E\u4E0D\u5230\u672C\u6B21\u6D4B\u8BD5\u7684\u5B8C\u6574\u626B\u63CF\uFF0C\u8BF7\u91CD\u65B0\u626B\u63CF");
     const missing = requiredEnvNames(scan.manifest).filter((name) => !names.find((s2) => s2.env === name)?.setAt);
+    if (scan.manifest.connectors.some(isFeishuPublisherConnector) && !(await deps.publisherFeishuAuth?.(cloudPersonaIdOf(repo2.url), "production"))?.connected) throw invalid("\u8BF7\u5148\u5728\u8FDE\u63A5\u5668\u533A\u5173\u8054\u53D1\u5E03\u8005\u7684\u7EBF\u4E0A\u73AF\u5883\u98DE\u4E66\u8D26\u53F7\uFF0C\u518D\u4E0A\u7EBF");
     if (missing.length || engineAuthState(names) === "partial") throw invalid("\u7EBF\u4E0A\u73AF\u5883\u51ED\u636E\u5C1A\u672A\u586B\u9F50\uFF1A" + (missing.join(" / ") || ENGINE_AUTH_PARTIAL_BLOCKER));
     const reuse = old && old.phase !== "failed" && (recovering || !old.verified || old.verified.verification.fingerprint === record4.verified.verification.fingerprint);
     if (old && !reuse && old.phase === "prepared") {
@@ -73942,17 +74013,17 @@ function buildCloudConnectorsHandlers(deps) {
     if (!loginPass) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "FEISHU_LOGIN_REQUIRED: \u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7684\u8FDE\u63A5\u5668\u7528\u4E0D\u4E86");
     return { loginPass };
   }
-  async function personalConnectors(personaId2) {
+  async function personalConnectors(personaId2, publisherUnionId) {
     const persona = deps.getPersona(personaId2);
     if (!persona) throw new ClawdError(ERROR_CODES.PERSONA_NOT_FOUND, `PERSONA_NOT_FOUND: \u6CA1\u6709\u8FD9\u4E2A persona\uFF08${personaId2}\uFF09`);
     if (!persona.cloud) throw invalid2(`${personaId2} \u4E0D\u662F\u4E91\u4E0A persona\uFF0C\u6CA1\u6709\u8FDE\u63A5\u5668\u533A`);
     const all = await deps.gatewayConnectors(persona.cloud.personaId, persona.cloud.gatewayUrl);
-    return { environment: persona.cloud.environment ?? "production", gatewayPersonaId: persona.cloud.personaId, connectors: all.filter((c2) => c2.credentialSource === "personal") };
+    return { environment: persona.cloud.environment ?? "production", gatewayPersonaId: persona.cloud.personaId, connectors: all.flatMap((c2) => c2.credentialSource === "personal" ? [c2] : isFeishuPublisherConnector(c2) && publisherUnionId && c2.publisherUnionId === publisherUnionId ? [{ ...c2, credentialSource: "personal" }] : []) };
   }
   const list = async (frame, _client, ctx) => {
     ensureOwner6(ctx);
     const { personaId: personaId2 } = parseArgs2(CloudConnectorsListArgsSchema, frame, "cloud:connectors:list");
-    const { gatewayPersonaId, connectors, environment } = await personalConnectors(personaId2);
+    const { gatewayPersonaId, connectors, environment } = await personalConnectors(personaId2, ctx?.principal.feishuUnionId);
     if (connectors.length === 0) return { response: { type: "cloud:connectors:list:ok", connectors: [] } };
     const login = requireLogin(environment);
     const r2 = await (deps.centralForEnvironment?.(environment) ?? deps.central).mine({ ...login, personaId: gatewayPersonaId, connectors });
@@ -74297,7 +74368,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.647".length > 0 ? "0.2.647" : "dev";
+var version = "0.2.649".length > 0 ? "0.2.649" : "dev";
 
 // src/cli-probe/probe.ts
 var fs85 = __toESM(require("fs"), 1);
@@ -76836,6 +76907,7 @@ async function startDaemon(config) {
   contactStore.load();
   const serverKeyStore = new ServerKeyStore(config.dataDir);
   const buildConnectAuthDeps = () => ({
+    ownerFeishuUnionId,
     isOwnerToken: (x2) => resolvedAuthToken != null && constantTimeEqual(x2, resolvedAuthToken),
     ownerPrincipalId,
     ownerDisplayName,
@@ -77957,6 +78029,18 @@ async function startDaemon(config) {
       const persona = list.find((p3) => p3.personaId === personaId2);
       return { online: persona !== void 0, ...persona?.image ? { image: persona.image } : {} };
     },
+    publisherFeishuAuth: async (personaId2, environment) => {
+      const loginPass = requireEnvironmentIdentity(environmentStores, environment).loginPass;
+      const result = await centralConnectorsMine({
+        api: targetApi(environment),
+        loginPass,
+        personaId: personaId2,
+        connectors: [{ name: "feishu", id: "feishu", kind: "proxy", runner: "cli", protocol: "lark-sidecar", credentialSource: "personal", auth: "oauth", fields: [] }]
+      });
+      const status = result.connectors.find((c2) => !!c2 && typeof c2 === "object" && "name" in c2 && c2.name === "feishu");
+      if (!status) throw new Error("\u4E2D\u5FC3\u672A\u8FD4\u56DE\u53D1\u5E03\u8005\u98DE\u4E66\u6388\u6743\u72B6\u6001");
+      return { connected: status.status === "connected", ...status.authUrl ? { authUrl: status.authUrl } : {} };
+    },
     testLoginPass: async () => {
       const loginPass = requireEnvironmentIdentity(environmentStores, "integration").loginPass;
       const credentials = await centralGetApiKey({ api: targetApi("integration"), loginPass });