@clawos-dev/clawd 0.2.648 → 0.2.649

package/dist/cli.cjs

@@ -61489,6 +61489,7 @@ async function storeGithubAuth(args) {
 init_zod();
 var SLUG = "ottin4ttc/clawos";
 var WORKFLOW = ".github/workflows/base-image-acr.yml";
+var DOCKERFILE = "cloud-host/Dockerfile.base";
 var SHA = external_exports.string().regex(/^[a-f0-9]{40}$/);
 var SourceSchema = external_exports.object({ cloudHost: SHA, workflow: SHA });
 var BaseSchema = external_exports.object({
@@ -61514,6 +61515,25 @@ async function currentSource(api) {
   if (!source.success) throw new Error("\u5E95\u5EA7\u6E90\u7801\u7248\u672C\u8BB0\u5F55\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u5237\u65B0\u540E\u518D\u53D1\u5E03");
   return { commit, source: source.data };
 }
+function dockerfileInputs(text) {
+  if (!/^\s*FROM\s+/im.test(text)) throw new Error("\u8BFB\u4E0D\u5230\u53EF\u4FE1\u7684\u5E95\u5EA7\u6784\u5EFA\u914D\u65B9");
+  const logical = text.replace(/\\\r?\n/g, " ");
+  if (/^\s*RUN\b.*--mount=/im.test(logical)) throw new Error("\u5E95\u5EA7\u6302\u8F7D\u8F93\u5165\u65E0\u6CD5\u5B8C\u6574\u6BD4\u8F83\uFF0C\u8BF7\u91CD\u65B0\u6784\u5EFA");
+  const inputs = /* @__PURE__ */ new Set([DOCKERFILE, "cloud-host/.dockerignore", "cloud-host/Dockerfile.base.dockerignore"]);
+  for (const line of logical.split("\n")) {
+    const instruction = /^\s*(?:COPY|ADD)\s+(.+)$/i.exec(line)?.[1];
+    if (!instruction || /^--from=\S+\s/.test(instruction)) continue;
+    const tokens = instruction.startsWith("[") ? JSON.parse(instruction) : instruction.trim().split(/\s+/);
+    if (!Array.isArray(tokens) || tokens.length < 2) throw new Error("\u5E95\u5EA7 COPY \u8F93\u5165\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u91CD\u65B0\u6784\u5EFA");
+    for (const source of tokens.slice(0, -1)) {
+      if (typeof source !== "string" || !/^[A-Za-z0-9_-][A-Za-z0-9_./-]*$/.test(source) || source.split("/").some((segment) => !segment || segment === "." || segment === "..")) {
+        throw new Error("\u5E95\u5EA7 COPY \u8F93\u5165\u65E0\u6CD5\u5B8C\u6574\u6BD4\u8F83\uFF0C\u8BF7\u91CD\u65B0\u6784\u5EFA");
+      }
+      inputs.add("cloud-host/" + source.replace(/\/$/, ""));
+    }
+  }
+  return inputs;
+}
 async function readCurrentBase(api) {
   const current = await currentSource(api);
   const listed = await api.getJsonStrict(`/repos/${SLUG}/actions/workflows/base-image-acr.yml/runs?branch=release&per_page=1`);
@@ -61535,10 +61555,23 @@ async function readCurrentBase(api) {
   const parsed = BaseSchema.safeParse(await readReleaseArchive(await api.downloadArtifact(SLUG, artifact.id)));
   if (!parsed.success) throw new Error("\u5E95\u5EA7\u5236\u54C1\u7248\u672C\u8BB0\u5F55\u65E0\u6548\uFF0C\u8BF7\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6784\u5EFA");
   const release2 = parsed.data;
-  const matches = (source) => release2.source.cloudHost === source.cloudHost && release2.source.workflow === source.workflow;
-  if (release2.workflowCommit !== run.head_sha || !matches(current.source)) throw new Error("\u5E95\u5EA7\u5C1A\u672A\u6784\u5EFA\u5F53\u524D release \u6E90\u7801\uFF0C\u8BF7\u7B49\u5F85\u6216\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF");
+  const matches = async (candidate) => {
+    if (release2.source.workflow !== candidate.source.workflow) return false;
+    if (release2.source.cloudHost === candidate.source.cloudHost) return true;
+    if (release2.commit === candidate.commit) return false;
+    const comparison = await api.getJsonStrict(`/repos/${SLUG}/compare/${release2.commit}...${candidate.commit}`);
+    if (comparison.status !== "ahead" || !Array.isArray(comparison.files) || comparison.files.length >= 300 || comparison.files.some((file) => typeof file.filename !== "string" || !file.filename)) {
+      throw new Error("\u65E0\u6CD5\u5B8C\u6574\u6BD4\u8F83\u5E95\u5EA7\u8F93\u5165\uFF0C\u8BF7\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF");
+    }
+    if (comparison.files.some((file) => file.filename === DOCKERFILE || file.previous_filename === DOCKERFILE)) return false;
+    const recipe = await api.getJsonStrict(`/repos/${SLUG}/contents/${DOCKERFILE}?ref=${candidate.commit}`);
+    if (recipe.type !== "file" || recipe.encoding !== "base64" || typeof recipe.content !== "string") throw new Error("\u8BFB\u4E0D\u5230\u5E95\u5EA7\u6784\u5EFA\u914D\u65B9");
+    const inputs = dockerfileInputs(Buffer.from(recipe.content, "base64").toString("utf8"));
+    return comparison.files.every((file) => ![file.filename, file.previous_filename].some((filename) => filename && [...inputs].some((input) => filename === input || filename.startsWith(input + "/"))));
+  };
+  if (release2.commit !== run.head_sha || release2.workflowCommit !== run.head_sha || !await matches(current)) throw new Error("\u5E95\u5EA7\u5C1A\u672A\u6784\u5EFA\u5F53\u524D release \u6E90\u7801\uFF0C\u8BF7\u7B49\u5F85\u6216\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF");
   const after = await currentSource(api);
-  if (!matches(after.source)) throw new Error("\u5E95\u5EA7\u6E90\u7801\u5728\u53D1\u5E03\u51C6\u5907\u671F\u95F4\u53D8\u5316\uFF0C\u8BF7\u7B49\u65B0\u6784\u5EFA\u6210\u529F\u540E\u518D\u53D1\u5E03");
+  if ((after.source.cloudHost !== current.source.cloudHost || after.source.workflow !== current.source.workflow) && !await matches(after)) throw new Error("\u5E95\u5EA7\u6E90\u7801\u5728\u53D1\u5E03\u51C6\u5907\u671F\u95F4\u53D8\u5316\uFF0C\u8BF7\u7B49\u65B0\u6784\u5EFA\u6210\u529F\u540E\u518D\u53D1\u5E03");
   return release2;
 }
 
@@ -74335,7 +74368,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.648".length > 0 ? "0.2.648" : "dev";
+var version = "0.2.649".length > 0 ? "0.2.649" : "dev";
 
 // src/cli-probe/probe.ts
 var fs85 = __toESM(require("fs"), 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.648",
+  "version": "0.2.649",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",