@clawos-dev/clawd 0.2.673 → 0.2.674

package/dist/cli.cjs

@@ -6498,6 +6498,10 @@ function isScanFresh(scan, repo2, released) {
   if (scan.status !== "done") return false;
   return scan.head === contentHeadOf(repo2, released) && !repo2.dirty;
 }
+function isScanRollbackable(scan, repo2, released) {
+  if (!scan || !repo2 || scan.status !== "done" || !scan.head) return false;
+  return scan.head !== contentHeadOf(repo2, released);
+}
 function cloudEngineOk(tool) {
   return CLOUD_ENGINES.includes(tool || "claude");
 }
@@ -62867,6 +62871,25 @@ async function commitAll(exec, args) {
   }
   return mustGit(exec, args.dir, ["rev-parse", "HEAD"], "\u8BFB\u63D0\u4EA4");
 }
+async function restoreContent(exec, dir, sha) {
+  if (!/^[a-f0-9]{40}$/.test(sha)) throw new RepoError("\u626B\u63CF\u7ED1\u7684\u63D0\u4EA4\u4E0D\u662F\u5B8C\u6574 SHA\uFF0C\u65E0\u6CD5\u56DE\u5230\u90A3\u4E2A\u7248\u672C");
+  if (!await hasCommit(exec, dir, sha)) throw new RepoError("\u8FD9\u6B21\u626B\u63CF\u5BF9\u5E94\u7684\u7248\u672C\u5DF2\u4E0D\u5728\u672C\u673A\u4ED3\u5E93\u91CC\uFF0C\u65E0\u6CD5\u56DE\u5230\u5B83\u2014\u2014\u91CD\u65B0\u626B\u63CF");
+  const ancestor = await git(exec, dir, ["merge-base", "--is-ancestor", sha, "HEAD"]);
+  if (ancestor.code !== 0) throw new RepoError("\u8FD9\u6B21\u626B\u63CF\u5BF9\u5E94\u7684\u7248\u672C\u4E0D\u5728\u5F53\u524D\u5206\u652F\u7684\u5386\u53F2\u91CC\uFF0C\u65E0\u6CD5\u56DE\u5230\u5B83\u2014\u2014\u91CD\u65B0\u626B\u63CF");
+  const saved = await commitAll(exec, { dir, message: "clawd: \u4FDD\u5B58\u56DE\u5230\u5386\u53F2\u7248\u672C\u524D\u7684\u4FEE\u6539" });
+  try {
+    await mustGit(exec, dir, ["restore", `--source=${sha}`, "--staged", "--worktree", "--", ":/", `:(exclude)${PERSONA_FILE_REL}`], "\u56DE\u5230\u6240\u9009\u7248\u672C");
+    const identity = await identityArgs(exec, dir);
+    await mustGit(exec, dir, [...identity, "commit", "--allow-empty", "-m", `clawd: \u56DE\u5230 ${sha.slice(0, 7)} \u7248\u672C\u7684\u5185\u5BB9`], "\u63D0\u4EA4\u56DE\u6EDA");
+  } catch (err) {
+    await resetTo(exec, dir, saved);
+    throw err;
+  }
+  return saved;
+}
+async function resetTo(exec, dir, sha) {
+  await mustGit(exec, dir, ["reset", "--hard", sha], "\u64A4\u56DE\u56DE\u6EDA");
+}
 async function release(exec, api, args) {
   const info = await repoInfo(exec, args.dir);
   if (!info) throw new RepoError("\u8FD8\u6CA1\u6709\u4ED3\u5E93\uFF0C\u5148\u70B9\u4E00\u6B21\u300C\u53D1\u5E03\u5230\u4E91\u4E0A\u300D\u5EFA\u4ED3");
@@ -63034,6 +63057,16 @@ var import_node_stream3 = require("stream");
 var import_promises6 = require("stream/promises");
 var ARTIFACT_MAX_BYTES = 200 * 1024 * 1024;
 var ARTIFACT_TIMEOUT_MS = 12e4;
+var ARTIFACT_ATTEMPTS = 2;
+var TransientDownloadError = class extends Error {
+};
+function isTransient(err) {
+  if (err instanceof TransientDownloadError) return true;
+  const e = err;
+  if (e?.name === "TimeoutError" || e?.name === "AbortError") return true;
+  if (err instanceof TypeError) return true;
+  return /^(ECONNRESET|ETIMEDOUT|ECONNREFUSED|EAI_AGAIN|UND_ERR_)/.test(e?.code ?? e?.cause?.code ?? "");
+}
 function artifactKind(url, bin) {
   const u2 = new URL(url);
   if (u2.protocol !== "https:") throw new Error(`\u8D44\u4EA7\u53EA\u6536 https \u76F4\u94FE\uFF1A${url}`);
@@ -63058,37 +63091,49 @@ async function verifyArtifact(fetchArtifact, a2) {
   return { sha256: got.sha256, size: got.size };
 }
 function downloadArtifact(exec) {
-  return async (url, { listEntries }) => {
-    const res = await fetch(url, { signal: AbortSignal.timeout(ARTIFACT_TIMEOUT_MS), redirect: "follow" });
-    if (!res.ok || !res.body) throw new Error(`\u4E0B\u8F7D\u5931\u8D25 HTTP ${res.status}\uFF1A${url}`);
-    const declared = Number(res.headers.get("content-length") ?? 0);
-    if (declared > ARTIFACT_MAX_BYTES) throw new Error(`\u8D44\u4EA7 ${declared} \u5B57\u8282\uFF0C\u8D85\u8FC7\u4E0A\u9650 ${ARTIFACT_MAX_BYTES}\uFF1A${url}`);
-    const dir = await import_node_fs37.default.promises.mkdtemp(import_node_path44.default.join(import_node_os14.default.tmpdir(), "clawd-artifact-"));
-    const file = import_node_path44.default.join(dir, "pkg");
-    const hash = (0, import_node_crypto13.createHash)("sha256");
-    let size = 0;
-    const meter = new import_node_stream3.Transform({
-      transform(chunk, _enc, cb) {
-        size += chunk.length;
-        if (size > ARTIFACT_MAX_BYTES) return cb(new Error(`\u8D44\u4EA7\u8D85\u8FC7\u4E0A\u9650 ${ARTIFACT_MAX_BYTES} \u5B57\u8282\uFF1A${url}`));
-        hash.update(chunk);
-        cb(null, chunk);
+  return async (url, opts) => {
+    for (let attempt = 1; ; attempt++) {
+      try {
+        return await downloadOnce(exec, url, opts);
+      } catch (err) {
+        if (attempt >= ARTIFACT_ATTEMPTS || !isTransient(err)) throw err;
       }
-    });
-    try {
-      await (0, import_promises6.pipeline)(import_node_stream3.Readable.fromWeb(res.body), meter, import_node_fs37.default.createWriteStream(file));
-      let entries;
-      if (listEntries) {
-        const r2 = await exec("tar", ["-tzf", file], { timeoutMs: 3e4 });
-        if (r2.code !== 0) throw new Error(`\u4E0D\u662F\u5408\u6CD5\u7684 tar.gz\uFF1A${url}\uFF08${r2.stderr.trim()}\uFF09`);
-        entries = r2.stdout.split("\n").filter(Boolean);
-      }
-      return { sha256: hash.digest("hex"), size, ...entries ? { entries } : {} };
-    } finally {
-      await import_node_fs37.default.promises.rm(dir, { recursive: true, force: true });
     }
   };
 }
+async function downloadOnce(exec, url, { listEntries }) {
+  const res = await fetch(url, { signal: AbortSignal.timeout(ARTIFACT_TIMEOUT_MS), redirect: "follow" });
+  if (!res.ok || !res.body) {
+    const msg = `\u4E0B\u8F7D\u5931\u8D25 HTTP ${res.status}\uFF1A${url}`;
+    throw res.status >= 500 || res.status === 429 ? new TransientDownloadError(msg) : new Error(msg);
+  }
+  const declared = Number(res.headers.get("content-length") ?? 0);
+  if (declared > ARTIFACT_MAX_BYTES) throw new Error(`\u8D44\u4EA7 ${declared} \u5B57\u8282\uFF0C\u8D85\u8FC7\u4E0A\u9650 ${ARTIFACT_MAX_BYTES}\uFF1A${url}`);
+  const dir = await import_node_fs37.default.promises.mkdtemp(import_node_path44.default.join(import_node_os14.default.tmpdir(), "clawd-artifact-"));
+  const file = import_node_path44.default.join(dir, "pkg");
+  const hash = (0, import_node_crypto13.createHash)("sha256");
+  let size = 0;
+  const meter = new import_node_stream3.Transform({
+    transform(chunk, _enc, cb) {
+      size += chunk.length;
+      if (size > ARTIFACT_MAX_BYTES) return cb(new Error(`\u8D44\u4EA7\u8D85\u8FC7\u4E0A\u9650 ${ARTIFACT_MAX_BYTES} \u5B57\u8282\uFF1A${url}`));
+      hash.update(chunk);
+      cb(null, chunk);
+    }
+  });
+  try {
+    await (0, import_promises6.pipeline)(import_node_stream3.Readable.fromWeb(res.body), meter, import_node_fs37.default.createWriteStream(file));
+    let entries;
+    if (listEntries) {
+      const r2 = await exec("tar", ["-tzf", file], { timeoutMs: 3e4 });
+      if (r2.code !== 0) throw new Error(`\u4E0D\u662F\u5408\u6CD5\u7684 tar.gz\uFF1A${url}\uFF08${r2.stderr.trim()}\uFF09`);
+      entries = r2.stdout.split("\n").filter(Boolean);
+    }
+    return { sha256: hash.digest("hex"), size, ...entries ? { entries } : {} };
+  } finally {
+    await import_node_fs37.default.promises.rm(dir, { recursive: true, force: true });
+  }
+}
 
 // src/deploy/debian-apt.ts
 init_protocol();
@@ -63186,6 +63231,7 @@ async function requireIntegrationPublishingConfig(api, slug) {
 }
 
 // src/deploy/scan-base.ts
+init_protocol();
 function pickScanBase(args) {
   if (args.want === "hard") return { kind: "hard" };
   if (!args.hasUsableManifest || !args.releasedHead) return { kind: "hard" };
@@ -63195,6 +63241,12 @@ var SCAN_BASE_LABEL = {
   hard: "\u786C\u626B",
   soft: "\u8F6F\u626B"
 };
+function packageNeedsRereport(pkg, probed) {
+  if (probed === null || probed !== pkg.localVersion) return true;
+  if (packageBlockers(pkg).length > 0) return true;
+  const rootProvided = CLOUD_ROOT_PROVIDES.includes(pkg.name);
+  return !!pkg.from?.startsWith("apt:") && !rootProvided && !pkg.aptVersion && !pkg.aptMissing;
+}
 
 // src/deploy/run-status.ts
 init_protocol();
@@ -63754,6 +63806,10 @@ function buildDeployHandlers(deps) {
     const engineChannels = withChannels ? (await readHistory(dir)).engineChannels : void 0;
     return { response: { type: "deploy:secrets", environment, ...secrets ? { secrets } : {}, ...engineChannels ? { engineChannels } : {} } };
   }
+  async function stalePackageNames(packages) {
+    const probed = await Promise.all(packages.map((p3) => deps.probeLocalVersion(p3).catch(() => null)));
+    return packages.filter((p3, i2) => packageNeedsRereport(p3, probed[i2])).map((p3) => p3.name);
+  }
   async function beginScan(personaId2, dir, file, contentHead, want) {
     liveScans.set(personaId2, {});
     const released = latestProductionRelease(file.releases);
@@ -63784,7 +63840,8 @@ function buildDeployHandlers(deps) {
       ...scanBase.base ? { base: scanBase.base } : {}
     };
     await writeScanFile(dir, replaceScan(file, entry));
-    const started = deps.startScan(personaId2, scanBase, entry.id);
+    const rereport = scanBase.kind === "soft" ? await stalePackageNames(entry.manifest.packages) : [];
+    const started = deps.startScan(personaId2, scanBase, entry.id, rereport);
     if ("sessionId" in started) {
       liveScans.set(personaId2, { sessionId: started.sessionId });
       await writeScanFile(dir, replaceScan(await readHistory(dir), { ...entry, scanSessionId: started.sessionId }));
@@ -63909,7 +63966,7 @@ function buildDeployHandlers(deps) {
     }
     return secretsResult(args.personaId, dir, api, args.environment, true);
   };
-  async function settlePackage(pkg) {
+  async function settlePackage(pkg, existing) {
     const localVersion = await deps.probeLocalVersion(pkg);
     const { artifact: reported, ...rest } = pkg;
     if (pkg.from?.startsWith("apt:")) {
@@ -63921,6 +63978,10 @@ function buildDeployHandlers(deps) {
     if (!reported) return out;
     if (!pkg.version) throw invalid(`\u9489\u8D44\u4EA7\u8981\u5148\u8BF4\u6E05\u662F\u54EA\u4E2A\u7248\u672C\u7684\uFF1A\`${pkg.name}\` \u5E26 artifact \u7684\u4E0A\u62A5\u5FC5\u987B\u540C\u65F6\u5E26 version`);
     if (pkg.version !== version2) throw invalid(`\u672C\u673A\u88C5\u7684 \`${pkg.name}\` \u662F ${version2}\uFF0C\u4F60\u6309 ${pkg.version} \u627E\u7684\u8D44\u4EA7\uFF1B\u6309 ${version2} \u91CD\u627E`);
+    const prior = existing?.artifact;
+    if (prior && existing?.version === version2 && prior.url === reported.url && prior.bin === reported.bin) {
+      return { ...out, artifact: prior };
+    }
     let verified;
     try {
       verified = await verifyArtifact(deps.fetchArtifact, reported);
@@ -63966,7 +64027,7 @@ function buildDeployHandlers(deps) {
       const previous = scan.manifest.connectors.some((c2) => c2.name === incoming.name) ? void 0 : [...file.scans].reverse().find((s2) => s2.status === "done")?.manifest.connectors.find((c2) => c2.name === incoming.name && (isFeishuBotConnector(c2) || isFeishuPublisherConnector(c2)));
       item = mergeConnector(previous, incoming);
     }
-    if (args.kind === "package") item = await settlePackage(item);
+    if (args.kind === "package") item = await settlePackage(item, scan.manifest.packages.find((p3) => p3.name === item.name));
     const target = `${args.kind}:${item.name}`;
     await writeScanFile(dir, replaceScan(file, {
       ...scan,
@@ -64055,7 +64116,18 @@ function buildDeployHandlers(deps) {
     const changed = changedConfigKeys(configOfPersona(deps.personaEngine(personaId2) ?? {}), await testedConfigOf(mustPersona(personaId2), record4));
     if (changed?.length) throw invalid(`\u914D\u7F6E\u6539\u8FC7\u4E86\uFF08${changed.map((k3) => CONFIG_KEY_LABEL[k3]).join("\u3001")}\uFF09\uFF0C\u5148\u300C\u5E94\u7528\u5230\u6D4B\u8BD5\u73AF\u5883\u300D\u5E76\u786E\u8BA4\uFF0C\u518D\u4E0A\u7EBF`);
   };
-  const releaseHandler = async (frame, _client, ctx) => {
+  const releaseHandler = async (frame, client, ctx) => {
+    let undoRollback;
+    try {
+      return await releaseScan(frame, client, ctx, (undo) => {
+        undoRollback = undo;
+      });
+    } catch (err) {
+      if (undoRollback) await undoRollback();
+      throw err;
+    }
+  };
+  const releaseScan = async (frame, _client, ctx, armUndo) => {
     ensureOwner(ctx);
     const { personaId: personaId2, scanId } = parseArgs2(DeployReleaseArgsSchema, frame, "deploy:release");
     const dir = mustPersona(personaId2);
@@ -64067,12 +64139,17 @@ function buildDeployHandlers(deps) {
     if (repo2.branch !== "integration") throw invalid("\u8BF7\u91CD\u65B0\u626B\u63CF\uFF0C\u5207\u5230\u6D4B\u8BD5\u53D1\u5E03\u5206\u652F\u540E\u518D\u53D1\u5E03");
     const file = await readHistory(dir);
     const entry = mustScan(file, scanId);
-    const publisherTest = discoverPublisherTest(dir);
-    const testBlockers = [...publisherTest.problems, ...entry.notes.filter((note) => note.startsWith(TEST_SCAN_NOTE_PREFIX))];
-    if (JSON.stringify(publisherTest.test) !== JSON.stringify(entry.manifest.test)) testBlockers.push("\u6D4B\u8BD5\u58F0\u660E\u5DF2\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u626B\u63CF");
-    if (testBlockers.length) throw invalid("\u8FD8\u5DEE\uFF1A" + testBlockers.join("\uFF1B"));
+    const checkPublisherTest = () => {
+      const publisherTest = discoverPublisherTest(dir);
+      const testBlockers = [...publisherTest.problems, ...entry.notes.filter((note) => note.startsWith(TEST_SCAN_NOTE_PREFIX))];
+      if (JSON.stringify(publisherTest.test) !== JSON.stringify(entry.manifest.test)) testBlockers.push("\u6D4B\u8BD5\u58F0\u660E\u5DF2\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u626B\u63CF");
+      if (testBlockers.length) throw invalid("\u8FD8\u5DEE\uFF1A" + testBlockers.join("\uFF1B"));
+    };
     const pending = file.releases.find((r2) => r2.environment === "integration" && r2.scanId === scanId && !r2.pushed);
-    if (pending) {
+    const releasedAtHead = file.releases.find((r2) => r2.head === repo2.head);
+    const rollback2 = isScanRollbackable(entry, repo2, releasedAtHead);
+    if (!rollback2) checkPublisherTest();
+    if (pending && !rollback2) {
       try {
         await configureTestIdentity(api, repoSlug(repo2.url));
         await pushRelease(deps.exec, dir, auth, pending.head);
@@ -64089,7 +64166,9 @@ function buildDeployHandlers(deps) {
       return { response: { type: "deploy:release", sha: already.head, actionsUrl: "https://github.com/" + repoSlug(repo2.url) + "/actions" } };
     }
     if (entry.status !== "done") throw invalid(entry.status === "scanning" ? "\u8FD9\u6B21\u626B\u63CF\u8FD8\u5728\u8DD1\uFF0C\u7B49\u5B83\u626B\u5B8C" : "\u8FD9\u6B21\u626B\u63CF\u6CA1\u8DD1\u5B8C\uFF0C\u6E05\u5355\u4E0D\u5B8C\u6574\u2014\u2014\u91CD\u65B0\u626B\u63CF");
-    if (!isScanFresh(entry, repo2, file.releases.find((r2) => r2.head === repo2.head))) {
+    if (rollback2) {
+      if (file.scans.some((s2) => s2.status === "scanning" && isLiveScan(liveScans.get(personaId2), s2))) throw invalid("\u6709\u4E00\u6B21\u626B\u63CF\u6B63\u5728\u8DD1\uFF0C\u7B49\u5B83\u626B\u5B8C\u518D\u56DE\u5230\u65E7\u7248\u672C\u53D1\u5E03");
+    } else if (!isScanFresh(entry, repo2, releasedAtHead)) {
       throw invalid(repo2.dirty ? "\u6709\u672A\u63D0\u4EA4\u7684\u6539\u52A8\uFF0C\u6E05\u5355\u662F\u6539\u52A8\u524D\u626B\u7684\u2014\u2014\u91CD\u65B0\u626B\u63CF" : "\u8FD9\u6B21\u626B\u63CF\u5BF9\u5E94\u7684\u4E0D\u662F\u5F53\u524D\u8FD9\u4E00\u7248 persona\u2014\u2014\u91CD\u65B0\u626B\u63CF");
     }
     const blockers = [];
@@ -64123,8 +64202,19 @@ function buildDeployHandlers(deps) {
       return isFeishuPublisherConnector(c2) ? { ...connector, publisherUnionId } : connector;
     }) };
     await configureTestIdentity(api, repoSlug(repo2.url));
+    if (rollback2) {
+      let saved;
+      try {
+        saved = await restoreContent(deps.exec, dir, entry.head);
+      } catch (err) {
+        throw toClawdError(err);
+      }
+      armUndo(() => resetTo(deps.exec, dir, saved));
+      checkPublisherTest();
+    }
     if (await deps.claimPublisher(cloudPersonaIdOf(repo2.url), "integration") === "taken") throw invalid("\u6D4B\u8BD5\u73AF\u5883\u91CC\u7684\u8FD9\u4E2A\u540D\u5B57\u5DF2\u7531\u522B\u4EBA\u53D1\u5E03");
     const releaseId = (0, import_node_crypto14.randomUUID)();
+    armUndo(void 0);
     try {
       const result = await release(deps.exec, api, { dir, now: deps.now, auth, manifest, onPrepared: async (head) => {
         const latest2 = await readHistory(dir);
@@ -74948,7 +75038,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.673".length > 0 ? "0.2.673" : "dev";
+var version = "0.2.674".length > 0 ? "0.2.674" : "dev";
 
 // src/cli-probe/probe.ts
 var fs86 = __toESM(require("fs"), 1);
@@ -78643,12 +78733,13 @@ async function startDaemon(config) {
       personaRegistry.setCloudSnapshot([...personaRegistry.list().filter((p3) => p3.cloud?.environment === "integration" && p3.personaId !== id), test], "integration");
       return id;
     },
-    startScan: (personaId2, scanBase, scanId) => {
+    startScan: (personaId2, scanBase, scanId, rereportPackages) => {
       const baseLines = scanBase.base ? [
         `\u672C\u6B21\u662F**${SCAN_BASE_LABEL[scanBase.kind]}**\uFF1A\u53EA\u770B\u8DDF\u7EBF\u4E0A\u6B63\u8DD1\u90A3\u7248\u7684\u5DEE\u522B\uFF0C`,
         `\u90A3\u4E00\u7248\u662F commit ${scanBase.base}\u3002`,
         `\u5148\u5728 persona \u76EE\u5F55\u8DD1 \`git diff --name-only ${scanBase.base} -- .\` \u62FF\u5230\u6539\u52A8\u6E05\u5355\uFF0C`,
-        "\u53EA\u91CD\u770B\u8FD9\u4E9B\u6587\u4EF6\uFF08\u53CA\u5B83\u4EEC\u5F15\u51FA\u53BB\u7684\u90A3\u4E00\u8DF3\uFF09\uFF1B\u6E05\u5355\u91CC\u5176\u4F59\u6761\u76EE\u6309 skill \u8F6F\u626B\u90A3\u8282\u5904\u7406\u3002"
+        "\u53EA\u91CD\u770B\u8FD9\u4E9B\u6587\u4EF6\uFF08\u53CA\u5B83\u4EEC\u5F15\u51FA\u53BB\u7684\u90A3\u4E00\u8DF3\uFF09\uFF1B\u6E05\u5355\u91CC\u5176\u4F59\u6761\u76EE\u6309 skill \u8F6F\u626B\u90A3\u8282\u5904\u7406\u3002",
+        rereportPackages.length ? `\u6E05\u5355\u91CC\u7684 package\uFF0Cdaemon \u5DF2\u63A2\u8FC7\u672C\u673A\u7248\u672C\uFF1B\u4E3A\u91CD\u63A2\u7248\u672C\u800C\u8981\u4F60\u91CD\u62A5\u7684\u53EA\u6709\u8FD9\u51E0\u6761\uFF08\u7248\u672C\u53D8\u4E86\u6216\u8D44\u4EA7\u6CA1\u9489\u5168\uFF09\uFF1A${rereportPackages.join("\u3001")}\u3002\u5176\u4F59 package \u4E0D\u5FC5\u4E3A\u4E86\u91CD\u63A2\u7248\u672C\u800C\u91CD\u62A5\uFF1Bdiff \u91CC\u6539\u5230\u7684\u4F9D\u8D56\u7167\u5E38\u4E0A\u62A5\u3002` : "\u6E05\u5355\u91CC\u7684 package\uFF0Cdaemon \u5DF2\u63A2\u8FC7\u672C\u673A\u7248\u672C\uFF0C\u5168\u90FD\u6CA1\u53D8\uFF0C\u4E0D\u5FC5\u4E3A\u4E86\u91CD\u63A2\u7248\u672C\u800C\u91CD\u62A5\uFF1Bdiff \u91CC\u6539\u5230\u7684\u4F9D\u8D56\u7167\u5E38\u4E0A\u62A5\u3002"
       ] : [
         `\u672C\u6B21\u662F**${SCAN_BASE_LABEL[scanBase.kind]}**\uFF1A\u4ECE\u96F6\u628A persona \u6574\u4E2A\u8BFB\u4E00\u904D\uFF0C\u6E05\u5355\u662F\u7A7A\u7684\u3002`
       ];

package/dist/persona-defaults/persona-clawd-butler/.claude/skills/scan-persona-for-deploy/SKILL.md

@@ -17,7 +17,7 @@ description: 老板要把某个 persona 发布到云上时触发——把这个
 | 档 | 任务里会说 | 你要做什么 |
 |---|---|---|
 | **硬扫** | 「从零把 persona 整个读一遍」 | 清单是空的，从零填 |
-| **软扫** | 「只看跟线上正跑那版的差别，那一版是 commit `<sha>`」 | 先把已有清单的 `package` 重报一遍让 daemon 重探版本，再在**已有清单**上打补丁 |
+| **软扫** | 「只看跟线上正跑那版的差别，那一版是 commit `<sha>`」 | 在**已有清单**上打补丁；清单里的 `package` 由 daemon 先探过版本，只有任务点名的几条要你重报 |
 
 软扫的第一件事，在 persona 目录里跑：
 
@@ -27,29 +27,35 @@ git diff --name-only <任务里给的 sha> -- .
 
 拿到的就是要重看的文件——**这是已跟踪内容与给定 commit 的差异入口；未跟踪文件、外部依赖和运行配置不在此命令覆盖内**。清单里其余的 `secret` / `connector`
 条目原样有效，不用重报：重报没变的东西不但白花时间，还会让本来稳定的字段（比如凭据的命名引用）无谓地变来变去。
-**`package` 条目例外——每次软扫都要重报一遍**，见下一节。
+`package` 条目同理，只是多了一道 daemon 的预检，见下一节。
 
-### 软扫先把清单里的 package 重报一遍
+### 软扫里的 package：只重报任务点名的
 
-版本是 daemon 在你每次报 `package` 时探本机得来的（见「边查边报」那节），**不重报就不探**：
-本机把某个工具升了级、或者上一版单据是没有探测那阵扫的，清单上的版本都不会自己变。所以拿到 diff 之后、
-读改动文件之前，先做这一步：
+软扫开始时 daemon 已经在本机把清单里每个 `package` 的版本重探了一遍：版本没变、资产也钉全的，原样保留，
+**不用为了重探版本而重报**——重报带 `artifact` 的 `github:` 包会让 daemon 再下载一次 release 资产（几十 MB），
+网络一抖整个扫描就失败，而这条本来没有任何变化。
+
+任务里会写「为重探版本而要你重报的只有这几条：……」（或「全都没变」）。**下面这套重报流程只对点名的那几条做，没点名的不为它重报。**
+daemon 只比本机版本和资产是否钉全，看不见别的：如果 diff 里的改动动到了某个依赖本身（换了安装源 `from`、抬了 `min`、
+换了资产 url 之类），那一条照常按「边查边报」重新上报，不论点没点名。
 
 1. 调 `deploy:get`，在 `scans` 里找 `id` 等于任务给的 scanId 那条，拿它的 `manifest.packages` 和 `evidence`。
-2. 对 `packages` 里的每一条调一次 `deploy:reportFinding`（`kind: "package"`）：
-   - `item` 只带 `name` / `from` / `min` / `version`；有 `artifact` 的只带 `{ url, bin }`。
+2. 对点名的每一条调一次 `deploy:reportFinding`（`kind: "package"`）：
+   - `item` 只带 `name` / `from` / `min` / `version`；有 `artifact` 的只带 `{ url, bin }`
+     （url 和 bin 没变就不用换，daemon 会沿用已核过的 sha256 / size，不再下载）。**已有 `artifact` 的包一次报完，
+     别走「先报 `{ name, from }`、再带资产重报」的两步**——第一步没带 `artifact`，会把已钉的资产覆盖掉，第二步只能重新下载。
      `localVersion`、`artifact.sha256`、`artifact.size` 是 daemon 写的，**不要带**（带了 sha256 会被按形状拒）。
    - `evidence` 用记录里 `target` 等于 `package:<name>` 那条的 `reason` / `file` / `quote` 原样回传。
    - 记录里**没有**这条 evidence 的（老板在页面上手工补的条目）跳过不报——上报口要求 evidence，编一条就是造假。
    - 被拒就按错误里说的做：`github:` 包本机版本变了，daemon 会告诉你新版本，按它重找资产再报（规则见 package 那节第 2 步）。
-   - **记录里没有 `artifact` 的 `github:` 包（早先扫的旧单据），重报之后接着把资产钉上**：按 package 那节「`github:` 要钉资产」
+   - **点名的 `github:` 包若记录里没有 `artifact`（早先扫的旧单据），重报之后接着把资产钉上**：按 package 那节「`github:` 要钉资产」
      第 2 步，用这次返回的 `version` 找 linux-amd64 资产再报一次。没钉资产的 `github:` 包云上装不了，页面会拦着不让发布。
 3. 然后再去读改动文件。改动涉及的条目在那一趟会再报一次，新结论盖过这里的，顺序不能反。
 
 两件最容易做错的事：
 
-- **改动列表是空的，不等于没活干。** 老板点了重扫，页面正卡在「分析中」，你照样要把上面那步重报做完、
-  走到收尾那步调 `deploy:finishScan`，只是中间不用再报别的。
+- **改动列表是空的，不等于没活干。** 老板点了重扫，页面正卡在「分析中」，你照样要走完收尾（任务点名了要重报的 package 也要先报完），
+  调 `deploy:finishScan`，只是中间不用再报别的。
 - **diff 给的是入口，不是边界。** 改的可能只是 `CLAUDE.md` 里一行命令，而那行命令背后的脚本
   带着一整串工具依赖。**改动文件引出去的那一跳照样要跟**，规则同下面「读什么」那节。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.673",
+  "version": "0.2.674",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",