@clawos-dev/clawd 0.2.67 → 0.2.69-beta.120.2a41cd5

package/dist/cli.cjs

@@ -605,8 +605,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path32, errorMaps, issueData } = params;
-      const fullPath = [...path32, ...issueData.path || []];
+      const { data, path: path31, errorMaps, issueData } = params;
+      const fullPath = [...path31, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -917,11 +917,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path32, key) {
+      constructor(parent, value, path31, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path32;
+        this._path = path31;
         this._key = key;
       }
       get path() {
@@ -4331,11 +4331,9 @@ var init_attachment_schemas = __esm({
       stale: external_exports.boolean().optional()
     });
     AttachmentSignUrlArgs = external_exports.object({
-      /** 群文件所属的 session */
-      sessionId: external_exports.string().min(1),
-      /** 相对 session.cwd 的路径；允许传绝对路径，daemon 端会归一化（必须在 cwd 内） */
-      relPath: external_exports.string().min(1),
-      /** TTL 秒数；缺省 24h；null 走永久 URL（不带 exp 字段） */
+      /** 要分享的绝对路径；签名只关心 absPath，不区分 persona/session */
+      absPath: external_exports.string().min(1),
+      /** TTL 秒数；缺省 24h；'never' 走 null 不带 exp 字段（永久有效） */
       ttlSeconds: external_exports.number().int().positive().nullable().optional()
     });
     AttachmentSignUrlResponseSchema = external_exports.object({
@@ -4470,7 +4468,7 @@ var init_persona_schemas = __esm({
 });
 
 // ../protocol/src/schemas.ts
-var SessionStatusSchema, UsageSchema, ContextUsageSchema, sessionMetaShape, SessionMetaSchema, ModelInfoSchema, ModeInfoSchema, ConfigFieldSchemaSchema, CapabilitiesGetArgs, CapabilitiesResponseSchema, AllowRuleSchema, SessionFileSchema, ParsedEventBase, HistoryUserMetaSchema, SubagentToolStatsSchema, StructuredPatchHunkSchema, ToolResultExtraSchema, MemoryEntrySchema, AskQuestionOptionSchema, AskQuestionItemSchema, ParsedEventSchema, SessionCreateArgs, SessionIdArgs, SessionUpdateArgs, SessionSendArgs, SessionRewindArgs, SessionRewindResponseSchema, SessionRewindDiffArgs, RewindDiffHunkSchema, RewindDiffFileSchema, SessionRewindDiffResponseSchema, SessionRewindableMessageIdsArgs, SessionRewindableMessageIdsResponseSchema, SessionResumeArgs, SessionForkArgs, SessionForkResponseSchema, SessionObserveArgs, SessionEventsArgs, PermissionRespondArgs, HistoryListArgs, HistoryReadArgs, HistorySubagentsArgs, HistorySubagentReadArgs, WorkspaceListArgs, WorkspaceReadArgs, SkillsListArgs, SkillEntrySchema, AgentEntrySchema, AgentsListArgs, AgentsListResponseSchema, SessionSubscribeArgs, SessionPinArgs, SessionReorderPinsArgs, GitRootArgs, GitRootResponseSchema, GitBranchArgs, GitBranchResponseSchema, GitBranchesArgs, GitBranchesResponseSchema, HistoryRecentDirsArgs, RecentDirEntrySchema, HistoryRecentDirsResponseSchema, SessionQuestionFrameSchema, SessionQuestionClearedFrameSchema, AnswerQuestionArgs, AnswerQuestionResponseSchema, CancelQuestionArgs, CancelQuestionResponseSchema, AuthRequestFrameSchema, AuthOkFrameSchema, TunnelExitedEventSchema, InfoRunningSessionSchema, InfoResponseSchema;
+var SessionStatusSchema, UsageSchema, ContextUsageSchema, sessionMetaShape, SessionMetaSchema, ModelInfoSchema, ModeInfoSchema, ConfigFieldSchemaSchema, CapabilitiesGetArgs, CapabilitiesResponseSchema, AllowRuleSchema, SessionFileSchema, ParsedEventBase, HistoryUserMetaSchema, SubagentToolStatsSchema, StructuredPatchHunkSchema, ToolResultExtraSchema, MemoryEntrySchema, AskQuestionOptionSchema, AskQuestionItemSchema, ParsedEventSchema, SessionCreateArgs, SessionIdArgs, SessionUpdateArgs, SessionSendArgs, SessionRewindArgs, SessionRewindResponseSchema, SessionRewindDiffArgs, RewindDiffHunkSchema, RewindDiffFileSchema, SessionRewindDiffResponseSchema, SessionRewindableMessageIdsArgs, SessionRewindableMessageIdsResponseSchema, SessionResumeArgs, SessionForkArgs, SessionForkResponseSchema, SessionObserveArgs, SessionEventsArgs, PermissionRespondArgs, HistoryListArgs, HistoryReadArgs, HistorySubagentsArgs, HistorySubagentReadArgs, WorkspaceListArgs, WorkspaceReadArgs, SkillsListArgs, SkillEntrySchema, AgentEntrySchema, AgentsListArgs, AgentsListResponseSchema, SessionSubscribeArgs, SessionPinArgs, SessionReorderPinsArgs, GitRootArgs, GitRootResponseSchema, GitBranchArgs, GitBranchResponseSchema, GitBranchesArgs, GitBranchesResponseSchema, HistoryRecentDirsArgs, RecentDirEntrySchema, HistoryRecentDirsResponseSchema, SessionQuestionFrameSchema, SessionQuestionClearedFrameSchema, AnswerQuestionArgs, AnswerQuestionResponseSchema, CancelQuestionArgs, CancelQuestionResponseSchema, AuthRequestFrameSchema, AuthOkFrameSchema, TunnelExitedEventSchema, TunnelUnavailableEventSchema, InfoRunningSessionSchema, InfoResponseSchema;
 var init_schemas = __esm({
   "../protocol/src/schemas.ts"() {
     "use strict";
@@ -4994,6 +4992,11 @@ var init_schemas = __esm({
       subdomain: external_exports.string().nullable(),
       url: external_exports.string().nullable()
     });
+    TunnelUnavailableEventSchema = external_exports.object({
+      type: external_exports.literal("tunnel:unavailable"),
+      reason: external_exports.string().min(1),
+      failedAt: external_exports.string().min(1)
+    });
     InfoRunningSessionSchema = external_exports.object({
       sessionId: external_exports.string().min(1),
       status: SessionStatusSchema,
@@ -5330,8 +5333,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path32 = req.path;
-        _req.url = typeof path32 === "string" ? path32 : req.url ? req.url.path || req.url : void 0;
+        const path31 = req.path;
+        _req.url = typeof path31 === "string" ? path31 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -5496,14 +5499,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path32) {
+    function parsePath(path31) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path32.length; i++) {
-        const char = path32[i];
+      for (let i = 0; i < path31.length; i++) {
+        const char = path31[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -5634,10 +5637,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path32 of paths) {
-        const parts = parsePath(path32);
+      for (const path31 of paths) {
+        const parts = parsePath(path31);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path32, remove);
+          redactWildcardPath(obj, parts, censor, path31, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -5722,8 +5725,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path32) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path32];
+            const wrappedCensor = typeof censor === "function" ? (value, path31) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path31];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -5758,8 +5761,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path32 of pathsToClone) {
-        const parts = parsePath(path32);
+      for (const path31 of pathsToClone) {
+        const parts = parsePath(path31);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -5811,24 +5814,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path32) {
-      if (typeof path32 !== "string") {
+    function validatePath(path31) {
+      if (typeof path31 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path32 === "") {
+      if (path31 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path32.includes("..")) {
-        throw new Error(`Invalid redaction path (${path32})`);
+      if (path31.includes("..")) {
+        throw new Error(`Invalid redaction path (${path31})`);
       }
-      if (path32.includes(",")) {
-        throw new Error(`Invalid redaction path (${path32})`);
+      if (path31.includes(",")) {
+        throw new Error(`Invalid redaction path (${path31})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path32.length; i++) {
-        const char = path32[i];
+      for (let i = 0; i < path31.length; i++) {
+        const char = path31[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -5842,20 +5845,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path32})`);
+            throw new Error(`Invalid redaction path (${path31})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path32})`);
+        throw new Error(`Invalid redaction path (${path31})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path32 of paths) {
-        validatePath(path32);
+      for (const path31 of paths) {
+        validatePath(path31);
       }
     }
     function slowRedact(options = {}) {
@@ -6023,8 +6026,8 @@ var require_redaction = __commonJS({
         if (shape[k2] === null) {
           o[k2] = (value) => topCensor(value, [k2]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path32) => {
-            return censor(value, [k2, ...path32]);
+          const wrappedCensor = typeof censor === "function" ? (value, path31) => {
+            return censor(value, [k2, ...path31]);
           } : censor;
           o[k2] = Redact({
             paths: shape[k2],
@@ -6245,7 +6248,7 @@ var require_sonic_boom = __commonJS({
     var fs28 = require("fs");
     var EventEmitter2 = require("events");
     var inherits = require("util").inherits;
-    var path32 = require("path");
+    var path31 = require("path");
     var sleep = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -6299,7 +6302,7 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs28.mkdirSync(path32.dirname(file), { recursive: true });
+          if (sonic.mkdir) fs28.mkdirSync(path31.dirname(file), { recursive: true });
           const fd = fs28.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
@@ -6307,7 +6310,7 @@ var require_sonic_boom = __commonJS({
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs28.mkdir(path32.dirname(file), { recursive: true }, (err) => {
+        fs28.mkdir(path31.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
           fs28.open(file, flags, mode, fileOpened);
         });
@@ -9938,11 +9941,11 @@ var init_lib = __esm({
           }
         }
       },
-      addToPath: function addToPath(path32, added, removed, oldPosInc, options) {
-        var last = path32.lastComponent;
+      addToPath: function addToPath(path31, added, removed, oldPosInc, options) {
+        var last = path31.lastComponent;
         if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
           return {
-            oldPos: path32.oldPos + oldPosInc,
+            oldPos: path31.oldPos + oldPosInc,
             lastComponent: {
               count: last.count + 1,
               added,
@@ -9952,7 +9955,7 @@ var init_lib = __esm({
           };
         } else {
           return {
-            oldPos: path32.oldPos + oldPosInc,
+            oldPos: path31.oldPos + oldPosInc,
             lastComponent: {
               count: 1,
               added,
@@ -10383,10 +10386,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path32 = typeof rec.path === "string" ? rec.path : null;
+      const path31 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path32 || content == null) return null;
-      const entry = { path: path32, content };
+      if (!path31 || content == null) return null;
+      const entry = { path: path31, content };
       if (typeof rec.mtimeMs === "number") entry.mtimeMs = rec.mtimeMs;
       return entry;
     }).filter((m2) => m2 !== null);
@@ -11190,10 +11193,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path32 = typeof rec.path === "string" ? rec.path : null;
+      const path31 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path32 || content == null) return null;
-      const out = { path: path32, content };
+      if (!path31 || content == null) return null;
+      const out = { path: path31, content };
       if (typeof rec.mtimeMs === "number") out.mtimeMs = rec.mtimeMs;
       return out;
     }).filter((m2) => m2 !== null);
@@ -20107,7 +20110,7 @@ var require_websocket_server = __commonJS({
 // src/run-case/recorder.ts
 function startRunCaseRecorder(opts) {
   const now = opts.now ?? Date.now;
-  const dir = import_node_path28.default.dirname(opts.recordPath);
+  const dir = import_node_path27.default.dirname(opts.recordPath);
   let stream = null;
   let closing = false;
   let closedSettled = false;
@@ -20147,12 +20150,12 @@ function startRunCaseRecorder(opts) {
   };
   return { tap, close, closed };
 }
-var import_node_fs25, import_node_path28;
+var import_node_fs25, import_node_path27;
 var init_recorder = __esm({
   "src/run-case/recorder.ts"() {
     "use strict";
     import_node_fs25 = __toESM(require("fs"), 1);
-    import_node_path28 = __toESM(require("path"), 1);
+    import_node_path27 = __toESM(require("path"), 1);
   }
 });
 
@@ -20195,7 +20198,7 @@ var init_wire = __esm({
 // src/run-case/controller.ts
 async function runController(opts) {
   const now = opts.now ?? Date.now;
-  const cwd = opts.cwd ?? (0, import_node_fs26.mkdtempSync)(import_node_path29.default.join(import_node_os14.default.tmpdir(), "clawd-runcase-"));
+  const cwd = opts.cwd ?? (0, import_node_fs26.mkdtempSync)(import_node_path28.default.join(import_node_os14.default.tmpdir(), "clawd-runcase-"));
   const ownsCwd = opts.cwd === void 0;
   const recorder = startRunCaseRecorder({ recordPath: opts.record, now });
   const spawnCtx = { cwd };
@@ -20362,13 +20365,13 @@ async function runController(opts) {
   }
   return exitCode ?? 0;
 }
-var import_node_fs26, import_node_os14, import_node_path29;
+var import_node_fs26, import_node_os14, import_node_path28;
 var init_controller = __esm({
   "src/run-case/controller.ts"() {
     "use strict";
     import_node_fs26 = require("fs");
     import_node_os14 = __toESM(require("os"), 1);
-    import_node_path29 = __toESM(require("path"), 1);
+    import_node_path28 = __toESM(require("path"), 1);
     init_claude();
     init_stdout_splitter();
     init_permission_stdio();
@@ -20600,7 +20603,7 @@ Env (advanced):
 `;
 
 // src/index.ts
-var import_node_path27 = __toESM(require("path"), 1);
+var import_node_path26 = __toESM(require("path"), 1);
 var import_node_fs24 = __toESM(require("fs"), 1);
 
 // src/logger.ts
@@ -26847,24 +26850,14 @@ var AUTH_FILE_NAME = "auth.json";
 function authFilePath(dataDir) {
   return import_node_path22.default.join(dataDir, AUTH_FILE_NAME);
 }
-function loadOrCreateAuthFile(opts) {
+function loadOrCreateAuthToken(opts) {
   const file = authFilePath(opts.dataDir);
-  const generate = opts.generate ?? defaultGenerate;
-  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
   const existing = readAuthFile(file);
-  if (existing && existing.token && existing.signSecret) {
-    return {
-      token: existing.token,
-      signSecret: existing.signSecret,
-      createdAt: existing.createdAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
-    };
-  }
-  const token = existing?.token || generate();
-  const signSecret = existing?.signSecret || generate();
-  const createdAt = existing?.createdAt || now().toISOString();
-  const next = { token, signSecret, createdAt };
-  writeAuthFile(file, next);
-  return next;
+  if (existing && existing.token) return existing.token;
+  const token = (opts.generate ?? defaultGenerate)();
+  const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
+  writeAuthFile(file, { token, createdAt: now.toISOString() });
+  return token;
 }
 function defaultGenerate() {
   return import_node_crypto8.default.randomBytes(32).toString("base64url");
@@ -26873,14 +26866,13 @@ function readAuthFile(file) {
   try {
     const raw = import_node_fs20.default.readFileSync(file, "utf8");
     const parsed = JSON.parse(raw);
-    if (typeof parsed?.token !== "string" || parsed.token.length === 0) {
-      return null;
+    if (typeof parsed?.token === "string" && parsed.token.length > 0) {
+      return {
+        token: parsed.token,
+        createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : (/* @__PURE__ */ new Date(0)).toISOString()
+      };
     }
-    return {
-      token: parsed.token,
-      signSecret: typeof parsed.signSecret === "string" && parsed.signSecret.length > 0 ? parsed.signSecret : void 0,
-      createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : void 0
-    };
+    return null;
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") return null;
@@ -27549,7 +27541,6 @@ function buildPersonaHandlers(deps) {
 }
 
 // src/handlers/attachment.ts
-var import_node_path26 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 var DEFAULT_TTL_SECONDS = 24 * 3600;
@@ -27574,51 +27565,8 @@ function buildAttachmentHandlers(deps) {
         "httpBaseUrl unavailable (daemon HTTP not ready)"
       );
     }
-    if (!deps.sessionStore || !deps.getSessionScope || !deps.groupFileStore) {
-      throw new ClawdError(
-        ERROR_CODES.METHOD_NOT_IMPLEMENTED,
-        "signUrl requires session/group stores"
-      );
-    }
-    const sessionFile = deps.sessionStore.read(args.sessionId);
-    if (!sessionFile) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `session ${args.sessionId} not found`
-      );
-    }
-    const scope = deps.getSessionScope(args.sessionId);
-    if (!scope) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `session ${args.sessionId} scope unresolved`
-      );
-    }
-    const cwdAbs = import_node_path26.default.resolve(sessionFile.cwd);
-    const candidateAbs = import_node_path26.default.isAbsolute(args.relPath) ? import_node_path26.default.resolve(args.relPath) : import_node_path26.default.resolve(cwdAbs, args.relPath);
-    if (!isContainedIn2(candidateAbs, cwdAbs)) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        "relPath escapes session cwd"
-      );
-    }
-    const relPath = import_node_path26.default.relative(cwdAbs, candidateAbs);
-    if (relPath === "" || relPath.startsWith("..")) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        "relPath escapes session cwd"
-      );
-    }
-    const entries = deps.groupFileStore.list(scope, args.sessionId);
-    const entry = entries.find((e) => e.relPath === relPath && !e.stale);
-    if (!entry) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `relPath not in session group files or stale: ${relPath}`
-      );
-    }
     const ttl = args.ttlSeconds === null ? null : args.ttlSeconds ?? DEFAULT_TTL_SECONDS;
-    const parts = signUrlParts(secret, candidateAbs, ttl);
+    const parts = signUrlParts(secret, args.absPath, ttl);
     const url = buildSignedFileUrl(httpBaseUrl, parts);
     return {
       response: {
@@ -27704,12 +27652,6 @@ function buildAttachmentHandlers(deps) {
     "attachment.groupListPersona": groupListPersona
   };
 }
-function isContainedIn2(abs, root) {
-  const normalized = import_node_path26.default.resolve(abs);
-  const normalizedRoot = import_node_path26.default.resolve(root);
-  if (normalized === normalizedRoot) return true;
-  return normalized.startsWith(normalizedRoot + import_node_path26.default.sep);
-}
 
 // src/handlers/index.ts
 function buildMethodHandlers(deps) {
@@ -27733,7 +27675,7 @@ function buildMethodHandlers(deps) {
 async function startDaemon(config) {
   const logger = createLogger({
     level: config.logLevel,
-    file: import_node_path27.default.join(config.dataDir, "clawd.log")
+    file: import_node_path26.default.join(config.dataDir, "clawd.log")
   });
   logger.info("starting clawd", { version, config: { port: config.port, host: config.host, dataDir: config.dataDir } });
   const stateMgr = new StateFileManager({ dataDir: config.dataDir });
@@ -27745,12 +27687,10 @@ async function startDaemon(config) {
     logger.warn("stale state file detected, overwriting", { pid: pre.existing.pid });
   }
   let resolvedAuthToken = null;
-  let authFile = null;
   if (config.authToken && config.authToken.trim()) {
     resolvedAuthToken = config.authToken.trim();
   } else if (config.tunnel) {
-    authFile = loadOrCreateAuthFile({ dataDir: config.dataDir });
-    resolvedAuthToken = authFile.token;
+    resolvedAuthToken = loadOrCreateAuthToken({ dataDir: config.dataDir });
   }
   const authMode = resolvedAuthToken == null ? "none" : "first-message";
   let wsServer = null;
@@ -27767,7 +27707,7 @@ async function startDaemon(config) {
   const agents = new AgentsScanner();
   const history = new ClaudeHistoryReader();
   let transport = null;
-  const personaStore = new PersonaStore(import_node_path27.default.join(config.dataDir, "personas"));
+  const personaStore = new PersonaStore(import_node_path26.default.join(config.dataDir, "personas"));
   const defaultsRoot = findDefaultsRoot();
   if (defaultsRoot) {
     seedDefaultPersonas({ store: personaStore, defaultsRoot, logger });
@@ -27782,7 +27722,7 @@ async function startDaemon(config) {
     getAdapter,
     historyReader: history,
     dataDir: config.dataDir,
-    personaRoot: import_node_path27.default.join(config.dataDir, "personas"),
+    personaRoot: import_node_path26.default.join(config.dataDir, "personas"),
     personaStore,
     ownerDisplayName,
     mode: config.mode,
@@ -27805,7 +27745,7 @@ async function startDaemon(config) {
     // 文件可能 agent 写完又被自己删（罕见），用 size=0 / fallback mime 兜底。
     attachmentGroup: {
       onFileEdit: (input) => {
-        const absPath = import_node_path27.default.isAbsolute(input.relPath) ? input.relPath : import_node_path27.default.join(input.cwd, input.relPath);
+        const absPath = import_node_path26.default.isAbsolute(input.relPath) ? input.relPath : import_node_path26.default.join(input.cwd, input.relPath);
         let size = 0;
         try {
           size = import_node_fs24.default.statSync(absPath).size;
@@ -27906,12 +27846,11 @@ async function startDaemon(config) {
     // 根据 sessionId 反查 scope 写盘。
     attachment: {
       groupFileStore,
-      sessionStore: store,
       getHttpBaseUrl,
-      // HMAC sign secret：~/.clawd/auth.json signSecret 字段（与 WS Bearer token 独立）。
-      // --auth-token CLI 模式 / noAuth 模式 authFile 为 null → handler 自己返 NOT_IMPLEMENTED。
-      getSignSecret: () => authFile?.signSecret ?? "",
-      // group RPC + sign 都用：根据 sessionId 反查 scope；owner-mode persona session 走
+      // HMAC sign secret：复用 ~/.clawd/auth.json owner token（持久跨重启）。
+      // noAuth 模式 resolvedAuthToken 为 null → handler 自己返 NOT_IMPLEMENTED。
+      getSignSecret: () => resolvedAuthToken ?? "",
+      // group RPC：根据 sessionId 反查 scope；owner-mode persona session 走
       // 'persona/<pid>/owner'，default 走 'default'。
       getSessionScope: (sessionId) => {
         const file = store.read(sessionId);
@@ -27934,9 +27873,8 @@ async function startDaemon(config) {
     personaStore,
     groupFileStore,
     sessionStore: store,
-    // /files HMAC verify 用 auth.json 的 signSecret 字段（与 attachment.signUrl 同源）。
-    // --auth-token CLI 模式没 signSecret → 路由返 501，sign URL 功能整体禁用。
-    getSignSecret: () => authFile?.signSecret ?? null
+    // /files HMAC verify 用同一份 owner token 做 secret（与 attachment.signUrl 同源）
+    getSignSecret: () => resolvedAuthToken ?? null
   });
   wsServer = new LocalWsServer({
     host: config.host,
@@ -28067,15 +28005,15 @@ async function startDaemon(config) {
     });
     try {
       const r = await tunnelMgr.start({ localPort: config.port });
-      stateSnapshot = { ...stateSnapshot, tunnelUrl: r.url };
+      stateSnapshot = { ...stateSnapshot, tunnelUrl: r.url, tunnelError: void 0 };
       stateMgr.write(stateSnapshot);
       currentTunnelUrl = r.url;
       const connectUrl = resolvedAuthToken ? `${r.url}#token=${resolvedAuthToken}` : r.url;
       const lines = [
         `Tunnel:      ${r.url}`,
         ...resolvedAuthToken ? [`Connect:     ${connectUrl}`] : [],
-        `Frpc config: ${import_node_path27.default.join(config.dataDir, "frpc.toml")}`,
-        `Frpc log:    ${import_node_path27.default.join(config.dataDir, "frpc.log")}`
+        `Frpc config: ${import_node_path26.default.join(config.dataDir, "frpc.toml")}`,
+        `Frpc log:    ${import_node_path26.default.join(config.dataDir, "frpc.log")}`
       ];
       const width = Math.max(...lines.map((l) => l.length));
       const bar = "\u2550".repeat(width + 4);
@@ -28088,19 +28026,30 @@ ${bar}
 
 `);
       try {
-        const connectPath = import_node_path27.default.join(config.dataDir, "connect.txt");
+        const connectPath = import_node_path26.default.join(config.dataDir, "connect.txt");
         import_node_fs24.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
       } catch {
       }
     } catch (err) {
+      const tunnelError = err?.message ?? String(err);
       try {
         await tunnelMgr.stop();
       } catch {
       }
       tunnelMgr = null;
-      stateMgr.delete();
-      await wss.stop();
-      throw err;
+      stateSnapshot = { ...stateSnapshot, tunnelUrl: void 0, tunnelError };
+      try {
+        stateMgr.write(stateSnapshot);
+      } catch {
+      }
+      wss.broadcastAll({
+        type: "tunnel:unavailable",
+        reason: tunnelError,
+        failedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      process.stdout.write(`Tunnel:      unavailable (local mode) \u2014 ${tunnelError}
+`);
+      logger.warn("tunnel unavailable, degraded to local mode", { reason: tunnelError });
     }
   }
   const shutdown = async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.67",
+  "version": "0.2.69-beta.120.2a41cd5",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",