@clawos-dev/clawd 0.2.675 → 0.2.676

package/dist/app-builder-plugin/mcp-server.cjs

@@ -31036,6 +31036,114 @@ var import_node_path5 = require("path");
 var import_promises2 = __toESM(require("fs/promises"), 1);
 var import_node_path4 = __toESM(require("path"), 1);
 
+// ../protocol/src/cloud-workspace-schemas.ts
+var WORKSPACE_COMPARISON_VALUES = ["head", "index"];
+var Id = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9-]{0,127}$/);
+var RepoId = external_exports.string().regex(/^[1-9][0-9]*$/);
+var Part = external_exports.string().regex(/^[A-Za-z0-9_.-]+$/);
+var WorkspaceBranchSchema = external_exports.string().min(1).max(255).refine(
+  (b) => !b.startsWith("-") && b !== "HEAD" && !b.startsWith("/") && !b.endsWith("/") && !b.endsWith(".") && !/[\s~^:?*\[\\\x00-\x1f\x7f]/.test(b) && !b.includes("..") && !b.includes("@{") && !b.includes("//") && b.split("/").every((s) => !s.startsWith(".") && !s.endsWith(".lock")),
+  "Invalid Git branch"
+);
+var FilePath = external_exports.string().min(1).max(4096).refine(
+  (p) => !p.startsWith("/") && !p.includes("\0") && !p.split(/[\\/]/).includes("..")
+);
+var WorkspaceBindingSchema = external_exports.object({
+  workspaceId: Id,
+  repoId: RepoId,
+  owner: Part,
+  name: Part,
+  sourceBranch: WorkspaceBranchSchema,
+  defaultBranch: WorkspaceBranchSchema
+}).strict();
+var WorkspaceRepoSchema = external_exports.object({
+  repoId: RepoId,
+  owner: Part,
+  name: Part,
+  defaultBranch: external_exports.string(),
+  private: external_exports.boolean(),
+  description: external_exports.string().nullable()
+});
+var WorkspacePrSchema = external_exports.object({
+  number: external_exports.number().int().positive(),
+  url: external_exports.string().url().refine((u) => new URL(u).origin === "https://github.com"),
+  base: external_exports.string(),
+  head: external_exports.string()
+});
+var WorkspaceStatusSchema = WorkspaceBindingSchema.extend({
+  initialCommit: external_exports.string(),
+  head: external_exports.string(),
+  actualBranch: external_exports.string().nullable(),
+  branches: external_exports.array(external_exports.string()).optional(),
+  files: external_exports.array(
+    external_exports.object({
+      path: FilePath,
+      previousPath: external_exports.string().optional(),
+      comparison: external_exports.enum(WORKSPACE_COMPARISON_VALUES).optional(),
+      status: external_exports.string(),
+      added: external_exports.number().nonnegative(),
+      removed: external_exports.number().nonnegative(),
+      binary: external_exports.boolean(),
+      untracked: external_exports.boolean().optional()
+    })
+  ),
+  totalFiles: external_exports.number().int().nonnegative().optional(),
+  filesTruncated: external_exports.boolean().optional(),
+  added: external_exports.number().nonnegative(),
+  removed: external_exports.number().nonnegative(),
+  dirty: external_exports.boolean(),
+  conflicted: external_exports.boolean(),
+  version: external_exports.string(),
+  measuredAt: external_exports.number(),
+  pendingPublication: external_exports.object({ operationId: Id, expectedVersion: external_exports.string(), stage: external_exports.string() }).optional(),
+  pr: WorkspacePrSchema.nullable().optional(),
+  savedAt: external_exports.number().nullable().optional()
+});
+var Session = external_exports.object({ sessionId: Id });
+var CloudWorkspaceArgsSchema = external_exports.discriminatedUnion("action", [
+  Session.extend({
+    action: external_exports.literal("repositories"),
+    page: external_exports.number().int().min(1).max(1e3).optional(),
+    search: external_exports.string().max(100).optional()
+  }).strict(),
+  Session.extend({
+    action: external_exports.literal("branches"),
+    repoId: RepoId,
+    page: external_exports.number().int().min(1).max(1e3).optional()
+  }).strict(),
+  Session.extend({
+    action: external_exports.literal("bind"),
+    repoId: RepoId,
+    branch: WorkspaceBranchSchema
+  }).strict(),
+  Session.extend({ action: external_exports.literal("status") }).strict(),
+  Session.extend({
+    action: external_exports.literal("switch"),
+    branch: WorkspaceBranchSchema,
+    create: external_exports.boolean().optional()
+  }).strict(),
+  Session.extend({ action: external_exports.literal("diff"), filePath: FilePath }).strict(),
+  Session.extend({
+    action: external_exports.literal("publish"),
+    operationId: Id,
+    expectedVersion: external_exports.string().min(1).max(128)
+  }).strict()
+]);
+var CloudWorkspaceResultSchema = external_exports.object({
+  binding: WorkspaceBindingSchema.nullable().optional(),
+  workspace: WorkspaceStatusSchema.nullable().optional(),
+  repositories: external_exports.array(WorkspaceRepoSchema).optional(),
+  branches: external_exports.array(external_exports.string()).optional(),
+  hasMore: external_exports.boolean().optional(),
+  diff: external_exports.object({
+    path: FilePath,
+    patch: external_exports.string(),
+    binary: external_exports.boolean(),
+    truncated: external_exports.boolean()
+  }).optional(),
+  pr: WorkspacePrSchema.optional()
+});
+
 // ../protocol/src/subscription-channel.ts
 var SubscriptionChannelSchema = external_exports.object({
   id: external_exports.string().min(1),
@@ -32982,6 +33090,7 @@ var SessionFileSchema = external_exports.object({
   cloudExecutionId: external_exports.string().min(1).optional(),
   /** First turn ID of the per-query SSE conversation. */
   cloudConversationId: external_exports.string().min(1).optional(),
+  cloudWorkspace: WorkspaceBindingSchema.optional(),
   /** Accepted local turns whose terminal gateway status has not been observed. */
   cloudPendingTurns: external_exports.array(external_exports.object({ id: external_exports.string().min(1), text: external_exports.string(), prepared: external_exports.boolean().optional() })).optional(),
   /** Owner gateway session observed in ready; proves the remote Pod was opened. */
@@ -33934,6 +34043,10 @@ var METHOD_DOCS = {
     summary: "\u586B\u5199\u578B\u8FDE\u63A5\u5668\uFF1A\u628A\u4F7F\u7528\u8005\u672C\u4EBA\u7684\u51ED\u636E\u503C\u4EA4\u7ED9\u4E2D\u5FC3\u52A0\u5BC6\u5165\u5E93\uFF08\u4E00\u6B21\u586B\u5199\u5168\u5C40\u5171\u7528\uFF09\u3002**\u8FD9\u662F\u503C\u552F\u4E00\u7684\u5165\u53E3**\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u3001\u672C\u673A\u4E0D\u843D\u76D8\uFF1B\u683C\u540D\u5FC5\u987B\u662F\u8BE5\u8FDE\u63A5\u5668\u58F0\u660E\u8FC7\u7684\uFF1Bowner-only",
     args: CloudConnectorFillArgsSchema
   },
+  "cloud:workspace": {
+    summary: "Inspect or operate the calling owner cloud session Git workspace; paths and GitHub credentials stay server-side.",
+    args: CloudWorkspaceArgsSchema
+  },
   "cloud:volume:get": {
     summary: "\u8C03\u7528\u65B9\u81EA\u5DF1\u90A3\u5757\u4E91\u76D8\u4E0A\u4E00\u8F6E\u672B\u7684\u7528\u91CF\uFF08usedBytes / sizeBytes / measuredAt\uFF09\u3002\u4EC5 gateway \u7684 disk \u5907\u9009\u540E\u7AEF\u6709\u503C\uFF08\u90A3\u91CC\u6309\u4EBA\u4E0D\u6309 persona\uFF1A\u4E91\u4E0A\u6240\u6709 persona \u5171\u7528\u4E00\u5757\u76D8\uFF09\uFF0C\u7EBF\u4E0A snapshot \u540E\u7AEF\u6CA1\u6709\u4E91\u76D8\u3001\u6052\u56DE null\u3002daemon \u62FF\u672C\u673A api key \u95EE gateway /me/volume\uFF1B\u6CA1\u767B\u5F55 / \u6CA1 key / gateway \u4E0D\u901A / \u6CA1\u8DD1\u8FC7\u4EFB\u52A1 / \u5F53\u524D\u540E\u7AEF\u6CA1\u6709\u4E91\u76D8\u4E00\u5F8B\u56DE volume:null\uFF08\u89D2\u6807\u4E0D\u6E32\uFF09\uFF0C\u4E0D\u629B\uFF1Bowner-only\u3002\u65E0\u53C2\u6570\uFF08\u67E5\u7684\u662F\u8C03\u7528\u65B9\u81EA\u5DF1\u7684\u76D8\uFF09",
     args: NO_ARGS
@@ -34277,15 +34390,15 @@ var METHOD_DOCS = {
     summary: "\u5217\u51FA\u767B\u5F55\u8BBF\u95EE\u8FC7\u672C\u673A public persona \u7684 web \u8BBF\u5BA2\u3002owner-only",
     args: NO_ARGS
   },
-  "whoami": {
+  whoami: {
     summary: "\u8FD4\u56DE\u672C\u8FDE\u63A5\u7684\u8EAB\u4EFD\uFF1Aowner \u663E\u793A\u540D + capability wire \u5F62\u6001 + \u88AB\u6388\u6743\u7684 persona \u5217\u8868\u3002\u4EFB\u4F55 authed \u8FDE\u63A5\u53EF\u8C03",
     args: NO_ARGS
   },
-  "info": {
+  info: {
     summary: "daemon \u8FD0\u884C\u65F6\u4FE1\u606F\uFF1A\u7248\u672C / \u534F\u8BAE\u7248\u672C / \u4E3B\u673A / \u53EF\u7528 tool / \u5728\u8DD1\u7684\u4F1A\u8BDD / tunnel URL \u7B49",
     args: NO_ARGS
   },
-  "ping": {
+  ping: {
     summary: "\u5B58\u6D3B\u63A2\u6D4B\uFF0C\u56DE pong",
     args: NO_ARGS
   },

package/dist/cli.cjs

@@ -4149,6 +4149,121 @@ var init_zod = __esm({
   }
 });
 
+// ../protocol/src/cloud-workspace-schemas.ts
+var WORKSPACE_COMPARISON_VALUES, Id, RepoId, Part, WorkspaceBranchSchema, FilePath, WorkspaceBindingSchema, WorkspaceRepoSchema, WorkspacePrSchema, WorkspaceStatusSchema, Session, CloudWorkspaceArgsSchema, CloudWorkspaceResultSchema;
+var init_cloud_workspace_schemas = __esm({
+  "../protocol/src/cloud-workspace-schemas.ts"() {
+    "use strict";
+    init_zod();
+    WORKSPACE_COMPARISON_VALUES = ["head", "index"];
+    Id = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9-]{0,127}$/);
+    RepoId = external_exports.string().regex(/^[1-9][0-9]*$/);
+    Part = external_exports.string().regex(/^[A-Za-z0-9_.-]+$/);
+    WorkspaceBranchSchema = external_exports.string().min(1).max(255).refine(
+      (b3) => !b3.startsWith("-") && b3 !== "HEAD" && !b3.startsWith("/") && !b3.endsWith("/") && !b3.endsWith(".") && !/[\s~^:?*\[\\\x00-\x1f\x7f]/.test(b3) && !b3.includes("..") && !b3.includes("@{") && !b3.includes("//") && b3.split("/").every((s2) => !s2.startsWith(".") && !s2.endsWith(".lock")),
+      "Invalid Git branch"
+    );
+    FilePath = external_exports.string().min(1).max(4096).refine(
+      (p3) => !p3.startsWith("/") && !p3.includes("\0") && !p3.split(/[\\/]/).includes("..")
+    );
+    WorkspaceBindingSchema = external_exports.object({
+      workspaceId: Id,
+      repoId: RepoId,
+      owner: Part,
+      name: Part,
+      sourceBranch: WorkspaceBranchSchema,
+      defaultBranch: WorkspaceBranchSchema
+    }).strict();
+    WorkspaceRepoSchema = external_exports.object({
+      repoId: RepoId,
+      owner: Part,
+      name: Part,
+      defaultBranch: external_exports.string(),
+      private: external_exports.boolean(),
+      description: external_exports.string().nullable()
+    });
+    WorkspacePrSchema = external_exports.object({
+      number: external_exports.number().int().positive(),
+      url: external_exports.string().url().refine((u2) => new URL(u2).origin === "https://github.com"),
+      base: external_exports.string(),
+      head: external_exports.string()
+    });
+    WorkspaceStatusSchema = WorkspaceBindingSchema.extend({
+      initialCommit: external_exports.string(),
+      head: external_exports.string(),
+      actualBranch: external_exports.string().nullable(),
+      branches: external_exports.array(external_exports.string()).optional(),
+      files: external_exports.array(
+        external_exports.object({
+          path: FilePath,
+          previousPath: external_exports.string().optional(),
+          comparison: external_exports.enum(WORKSPACE_COMPARISON_VALUES).optional(),
+          status: external_exports.string(),
+          added: external_exports.number().nonnegative(),
+          removed: external_exports.number().nonnegative(),
+          binary: external_exports.boolean(),
+          untracked: external_exports.boolean().optional()
+        })
+      ),
+      totalFiles: external_exports.number().int().nonnegative().optional(),
+      filesTruncated: external_exports.boolean().optional(),
+      added: external_exports.number().nonnegative(),
+      removed: external_exports.number().nonnegative(),
+      dirty: external_exports.boolean(),
+      conflicted: external_exports.boolean(),
+      version: external_exports.string(),
+      measuredAt: external_exports.number(),
+      pendingPublication: external_exports.object({ operationId: Id, expectedVersion: external_exports.string(), stage: external_exports.string() }).optional(),
+      pr: WorkspacePrSchema.nullable().optional(),
+      savedAt: external_exports.number().nullable().optional()
+    });
+    Session = external_exports.object({ sessionId: Id });
+    CloudWorkspaceArgsSchema = external_exports.discriminatedUnion("action", [
+      Session.extend({
+        action: external_exports.literal("repositories"),
+        page: external_exports.number().int().min(1).max(1e3).optional(),
+        search: external_exports.string().max(100).optional()
+      }).strict(),
+      Session.extend({
+        action: external_exports.literal("branches"),
+        repoId: RepoId,
+        page: external_exports.number().int().min(1).max(1e3).optional()
+      }).strict(),
+      Session.extend({
+        action: external_exports.literal("bind"),
+        repoId: RepoId,
+        branch: WorkspaceBranchSchema
+      }).strict(),
+      Session.extend({ action: external_exports.literal("status") }).strict(),
+      Session.extend({
+        action: external_exports.literal("switch"),
+        branch: WorkspaceBranchSchema,
+        create: external_exports.boolean().optional()
+      }).strict(),
+      Session.extend({ action: external_exports.literal("diff"), filePath: FilePath }).strict(),
+      Session.extend({
+        action: external_exports.literal("publish"),
+        operationId: Id,
+        expectedVersion: external_exports.string().min(1).max(128)
+      }).strict()
+    ]);
+    CloudWorkspaceResultSchema = external_exports.object({
+      binding: WorkspaceBindingSchema.nullable().optional(),
+      workspace: WorkspaceStatusSchema.nullable().optional(),
+      repositories: external_exports.array(WorkspaceRepoSchema).optional(),
+      branches: external_exports.array(external_exports.string()).optional(),
+      hasMore: external_exports.boolean().optional(),
+      diff: external_exports.object({
+        path: FilePath,
+        patch: external_exports.string(),
+        binary: external_exports.boolean(),
+        truncated: external_exports.boolean()
+      }).optional(),
+      pr: WorkspacePrSchema.optional()
+    });
+  }
+});
+
 // ../node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/Options.js
 var ignoreOverride, defaultOptions, getDefaultOptions;
 var init_Options = __esm({
@@ -8088,6 +8203,7 @@ var init_schemas = __esm({
   "../protocol/src/schemas.ts"() {
     "use strict";
     init_zod();
+    init_cloud_workspace_schemas();
     init_release_schemas();
     init_events();
     init_attachment_schemas();
@@ -8183,6 +8299,7 @@ var init_schemas = __esm({
       cloudExecutionId: external_exports.string().min(1).optional(),
       /** First turn ID of the per-query SSE conversation. */
       cloudConversationId: external_exports.string().min(1).optional(),
+      cloudWorkspace: WorkspaceBindingSchema.optional(),
       /** Accepted local turns whose terminal gateway status has not been observed. */
       cloudPendingTurns: external_exports.array(external_exports.object({ id: external_exports.string().min(1), text: external_exports.string(), prepared: external_exports.boolean().optional() })).optional(),
       /** Owner gateway session observed in ready; proves the remote Pod was opened. */
@@ -8870,6 +8987,7 @@ var init_methods = __esm({
   "../protocol/src/methods.ts"() {
     "use strict";
     init_zod();
+    init_cloud_workspace_schemas();
     init_esm();
     init_subscription_channel();
     init_attachment_schemas();
@@ -9184,6 +9302,10 @@ var init_methods = __esm({
         summary: "\u586B\u5199\u578B\u8FDE\u63A5\u5668\uFF1A\u628A\u4F7F\u7528\u8005\u672C\u4EBA\u7684\u51ED\u636E\u503C\u4EA4\u7ED9\u4E2D\u5FC3\u52A0\u5BC6\u5165\u5E93\uFF08\u4E00\u6B21\u586B\u5199\u5168\u5C40\u5171\u7528\uFF09\u3002**\u8FD9\u662F\u503C\u552F\u4E00\u7684\u5165\u53E3**\uFF1A\u5165\u53C2\u4E0D\u8FDB\u65E5\u5FD7\u3001\u54CD\u5E94\u4E0D\u56DE\u663E\u3001\u672C\u673A\u4E0D\u843D\u76D8\uFF1B\u683C\u540D\u5FC5\u987B\u662F\u8BE5\u8FDE\u63A5\u5668\u58F0\u660E\u8FC7\u7684\uFF1Bowner-only",
         args: CloudConnectorFillArgsSchema
       },
+      "cloud:workspace": {
+        summary: "Inspect or operate the calling owner cloud session Git workspace; paths and GitHub credentials stay server-side.",
+        args: CloudWorkspaceArgsSchema
+      },
       "cloud:volume:get": {
         summary: "\u8C03\u7528\u65B9\u81EA\u5DF1\u90A3\u5757\u4E91\u76D8\u4E0A\u4E00\u8F6E\u672B\u7684\u7528\u91CF\uFF08usedBytes / sizeBytes / measuredAt\uFF09\u3002\u4EC5 gateway \u7684 disk \u5907\u9009\u540E\u7AEF\u6709\u503C\uFF08\u90A3\u91CC\u6309\u4EBA\u4E0D\u6309 persona\uFF1A\u4E91\u4E0A\u6240\u6709 persona \u5171\u7528\u4E00\u5757\u76D8\uFF09\uFF0C\u7EBF\u4E0A snapshot \u540E\u7AEF\u6CA1\u6709\u4E91\u76D8\u3001\u6052\u56DE null\u3002daemon \u62FF\u672C\u673A api key \u95EE gateway /me/volume\uFF1B\u6CA1\u767B\u5F55 / \u6CA1 key / gateway \u4E0D\u901A / \u6CA1\u8DD1\u8FC7\u4EFB\u52A1 / \u5F53\u524D\u540E\u7AEF\u6CA1\u6709\u4E91\u76D8\u4E00\u5F8B\u56DE volume:null\uFF08\u89D2\u6807\u4E0D\u6E32\uFF09\uFF0C\u4E0D\u629B\uFF1Bowner-only\u3002\u65E0\u53C2\u6570\uFF08\u67E5\u7684\u662F\u8C03\u7528\u65B9\u81EA\u5DF1\u7684\u76D8\uFF09",
         args: NO_ARGS
@@ -9527,15 +9649,15 @@ var init_methods = __esm({
         summary: "\u5217\u51FA\u767B\u5F55\u8BBF\u95EE\u8FC7\u672C\u673A public persona \u7684 web \u8BBF\u5BA2\u3002owner-only",
         args: NO_ARGS
       },
-      "whoami": {
+      whoami: {
         summary: "\u8FD4\u56DE\u672C\u8FDE\u63A5\u7684\u8EAB\u4EFD\uFF1Aowner \u663E\u793A\u540D + capability wire \u5F62\u6001 + \u88AB\u6388\u6743\u7684 persona \u5217\u8868\u3002\u4EFB\u4F55 authed \u8FDE\u63A5\u53EF\u8C03",
         args: NO_ARGS
       },
-      "info": {
+      info: {
         summary: "daemon \u8FD0\u884C\u65F6\u4FE1\u606F\uFF1A\u7248\u672C / \u534F\u8BAE\u7248\u672C / \u4E3B\u673A / \u53EF\u7528 tool / \u5728\u8DD1\u7684\u4F1A\u8BDD / tunnel URL \u7B49",
         args: NO_ARGS
       },
-      "ping": {
+      ping: {
         summary: "\u5B58\u6D3B\u63A2\u6D4B\uFF0C\u56DE pong",
         args: NO_ARGS
       },
@@ -9970,6 +10092,7 @@ var init_runtime = __esm({
     init_engine_schemas();
     init_tool_family();
     init_subscription_channel();
+    init_cloud_workspace_schemas();
   }
 });
 
@@ -48008,6 +48131,7 @@ function buildSpawnContext(state, deps) {
   const ctx = {
     cwd: file.cwd,
     cloudExecutionId: file.cloudExecutionId,
+    ...file.cloudWorkspace ? { cloudWorkspace: file.cloudWorkspace } : {},
     ...file.cloudEnvironment ? { cloudEnvironment: file.cloudEnvironment } : {},
     ...file.cloudExpectedImage ? { cloudExpectedImage: file.cloudExpectedImage } : {},
     ...file.testReleaseId ? { testReleaseId: file.testReleaseId } : {},
@@ -49902,7 +50026,10 @@ var SessionManager = class {
       const expand = (p3) => p3 === "~" ? home : p3.startsWith("~/") ? import_node_path14.default.join(home, p3.slice(2)) : p3;
       const codexCfg = this.deps.personaStore?.readCodexSandboxSettings(scope.personaId) ?? null;
       subSessionMeta.codexSandbox = {
-        writableRoots: [subSessionMeta.userWorkDir, ...(codexCfg?.writableRoots ?? []).map(expand)],
+        writableRoots: [
+          subSessionMeta.userWorkDir,
+          ...(codexCfg?.writableRoots ?? []).map(expand)
+        ],
         denyRead: codexCfg?.denyRead ?? [],
         network: codexCfg?.network ?? false
       };
@@ -50345,6 +50472,24 @@ var SessionManager = class {
     this.writeOwned(updated);
     return { response: updated, broadcast: [] };
   }
+  bindCloudWorkspace(sessionId, binding, conversationId) {
+    const file = this.getFile(sessionId);
+    if (!isCloudTool(file.tool) || file.cloudPendingTurns?.length)
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        "Cloud workspace cannot bind while a turn is pending"
+      );
+    if (file.cloudWorkspace && JSON.stringify(file.cloudWorkspace) !== JSON.stringify(binding))
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        "Workspace binding is immutable"
+      );
+    this.runners.get(sessionId)?.confirmCloudCancelled();
+    this.update({
+      sessionId,
+      patch: { cloudWorkspace: binding, cloudConversationId: conversationId }
+    });
+  }
   /**
    * [T-17] observer 检测到 CC 挪走 transcript（cwd 中途变化）后的 cwd 校正入口。
    * 不进 withCollector：observer 回调没有 in-flight RPC，session:info 帧走
@@ -50711,6 +50856,11 @@ var SessionManager = class {
   }
   newSession(args) {
     const existingFile = this.getFile(args.sessionId);
+    if (existingFile.cloudWorkspace)
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        "\u6B64\u4F1A\u8BDD\u5DF2\u7ED1\u5B9A\u5DE5\u4F5C\u533A\uFF0C\u8BF7\u65B0\u5EFA\u4F1A\u8BDD\u4EE5\u5F00\u59CB\u72EC\u7ACB\u73B0\u573A"
+      );
     this.titleGenPending.get(args.sessionId)?.abort();
     this.titleGenPending.delete(args.sessionId);
     const nextToolSessionId = this.deps.mode === "tui" && (existingFile.tool ?? "claude") === "claude" ? (0, import_node_crypto5.randomUUID)() : void 0;
@@ -50763,6 +50913,11 @@ var SessionManager = class {
   }
   async newSessionWithCloudCancel(args) {
     const file = this.getFile(args.sessionId);
+    if (file.cloudWorkspace)
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        "\u6B64\u4F1A\u8BDD\u5DF2\u7ED1\u5B9A\u5DE5\u4F5C\u533A\uFF0C\u8BF7\u65B0\u5EFA\u4F1A\u8BDD\u4EE5\u5F00\u59CB\u72EC\u7ACB\u73B0\u573A"
+      );
     if (isCloudTool(file.tool)) {
       await this.cancelCloudTurns(file, this.runners.get(args.sessionId) ?? null);
       return this.newSession(args);
@@ -50770,7 +50925,12 @@ var SessionManager = class {
     return this.newSession(args);
   }
   resume(args) {
-    this.getFile(args.sessionId);
+    const file = this.getFile(args.sessionId);
+    if (file.cloudWorkspace && file.toolSessionId !== args.toolSessionId)
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        "\u5DE5\u4F5C\u533A\u4E0D\u80FD\u5207\u6362\u5230\u53E6\u4E00\u6761\u539F\u751F\u4F1A\u8BDD\u5386\u53F2"
+      );
     const runner = this.runners.get(args.sessionId);
     if (runner) {
       const { value, broadcast } = this.withCollector(() => {
@@ -57741,6 +57901,7 @@ var GATEWAY_ROUTES = {
   turnCommand: (personaId2, turnId) => `/p/${encodeURIComponent(personaId2)}/turns/${encodeURIComponent(turnId)}/commands`,
   conversationCancel: (personaId2, conversationId) => `/p/${encodeURIComponent(personaId2)}/conversations/${encodeURIComponent(conversationId)}:cancel`,
   volume: () => "/me/volume",
+  workspace: (personaId2) => `/p/${encodeURIComponent(personaId2)}/workspace`,
   metrics: (personaId2) => `/metrics/${encodeURIComponent(personaId2)}`
 };
 var METRICS_TIMEOUT_MS = 3e4;
@@ -57824,6 +57985,27 @@ var CloudGatewayClient = class {
     const list = await this.fetchDeployments(trimSlash(gatewayUrl));
     return list.find((p3) => p3.personaId === gatewayPersonaId)?.connectors ?? [];
   }
+  async workspaceCommand(personaId2, input) {
+    const { apiKey, gatewayUrl } = await this.credentials();
+    const res = await this.fetchImpl(
+      gatewayUrl + GATEWAY_ROUTES.workspace(personaId2),
+      {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${apiKey}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(input),
+        signal: AbortSignal.timeout(3e5)
+      }
+    );
+    const body = await res.json();
+    if (!res.ok)
+      throw new Error(
+        body.error?.message ?? `Cloud workspace request failed (${res.status})`
+      );
+    return CloudWorkspaceResultSchema.parse(body);
+  }
   async openTurn(personaId2, opts) {
     const { apiKey, gatewayUrl } = await this.credentials();
     const health = await this.fetchImpl(gatewayUrl + GATEWAY_ROUTES.healthz());
@@ -57910,6 +58092,7 @@ function openHttpTurn(opts) {
       conversationId,
       turnId,
       expectedEngine,
+      ...opts.workspaceId ? { workspaceId: opts.workspaceId } : {},
       ...opts.expectedImage ? { expectedImage: opts.expectedImage } : {},
       ...purpose ? { purpose } : {},
       ...engineSessionId ? { engineSessionId } : {},
@@ -57948,10 +58131,14 @@ function openHttpTurn(opts) {
   const retryWait = (ms) => new Promise((resolve9) => {
     const timer = setTimeout(resolve9, ms);
     timer.unref?.();
-    abort.signal.addEventListener("abort", () => {
-      clearTimeout(timer);
-      resolve9();
-    }, { once: true });
+    abort.signal.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timer);
+        resolve9();
+      },
+      { once: true }
+    );
   });
   void (async () => {
     while (!closed) {
@@ -66603,6 +66790,7 @@ function createCloudTurnSession(args) {
             turnId: commandId,
             text: portable,
             expectedEngine: engine,
+            ...ctx.cloudWorkspace ? { workspaceId: ctx.cloudWorkspace.workspaceId } : {},
             ...ctx.cloudExpectedImage ? { expectedImage: ctx.cloudExpectedImage } : {},
             // pi / claude 的会话 id 预分配（引擎按它新建或续那个会话文件）；codex 的 thread id 在协议内
             ...(engine === "pi" || engine === "claude") && !ctx.titleOnly ? { engineSessionId: engineSessionId ?? conversationId } : {},
@@ -74714,6 +74902,44 @@ function buildCloudConnectorsHandlers(deps) {
   };
 }
 
+// src/handlers/cloud-workspace.ts
+init_protocol();
+function buildCloudWorkspaceHandlers(deps) {
+  return {
+    "cloud:workspace": async (frame, _client, ctx) => {
+      if (ctx?.principal.kind !== "owner")
+        throw new ClawdError(
+          ERROR_CODES.UNAUTHORIZED,
+          "cloud:workspace requires owner context"
+        );
+      const { type: _type, requestId: _requestId, ...body } = frame;
+      const args = parseArgs2(CloudWorkspaceArgsSchema, body, "cloud:workspace");
+      const file = deps.getFile(args.sessionId);
+      if (!isCloudTool(file.tool))
+        throw new ClawdError(
+          ERROR_CODES.VALIDATION_ERROR,
+          "Workspace operations require a cloud session"
+        );
+      if (["bind", "switch", "publish"].includes(args.action) && (!["idle", "running-idle", "stopped", "error"].includes(
+        deps.status(file.sessionId)
+      ) || file.cloudPendingTurns?.length))
+        throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "\u8BF7\u7B49\u5F85\u5F53\u524D\u4EFB\u52A1\u5B8C\u6210");
+      const conversationId = file.cloudConversationId ?? file.cloudExecutionId ?? file.sessionId;
+      const result = CloudWorkspaceResultSchema.parse(
+        await deps.command(file, {
+          ...args,
+          workspaceId: file.cloudWorkspace?.workspaceId ?? file.sessionId,
+          conversationId,
+          ...file.toolSessionId ? { threadId: file.toolSessionId } : {}
+        })
+      );
+      if (result.binding && !file.cloudWorkspace)
+        deps.bind(file.sessionId, result.binding, conversationId);
+      return { response: { type: "cloud:workspace:ok", ...result } };
+    }
+  };
+}
+
 // src/handlers/cloud-volume.ts
 init_protocol();
 function ensureOwner7(ctx) {
@@ -74785,9 +75011,9 @@ var ADMIN_ANY = {
 };
 var CAPABILITY_SCOPED = { kind: "capability-scoped" };
 var METHOD_GRANT_MAP = {
-  "info": { kind: "public" },
-  "ping": { kind: "public" },
-  "whoami": { kind: "public" },
+  info: { kind: "public" },
+  ping: { kind: "public" },
+  whoami: { kind: "public" },
   // Introspection includes denied methods so callers can discover their authorization boundaries.
   "meta:methods": { kind: "public" },
   // Public inbox handlers still bind guest access to the authenticated peer device, not arbitrary DM buckets.
@@ -74824,6 +75050,7 @@ var METHOD_GRANT_MAP = {
   "dashboard:openUrl": ADMIN_ANY,
   "cloud:connectors:fill": ADMIN_ANY,
   "cloud:volume:get": ADMIN_ANY,
+  "cloud:workspace": ADMIN_ANY,
   // Session handlers resolve the target and enforce guest access; the dispatcher cannot authorize from method alone.
   "session:create": CAPABILITY_SCOPED,
   "session:importExternal": CAPABILITY_SCOPED,
@@ -75038,7 +75265,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.675".length > 0 ? "0.2.675" : "dev";
+var version = "0.2.676".length > 0 ? "0.2.676" : "dev";
 
 // src/cli-probe/probe.ts
 var fs86 = __toESM(require("fs"), 1);
@@ -76990,6 +77217,7 @@ function buildMethodHandlers(deps) {
     ...buildDeviceHandlers(deps.feishuDevice),
     ...buildCloudConnectorsHandlers(deps.cloudConnectors),
     ...buildCloudVolumeHandlers(deps.cloudVolume),
+    ...deps.cloudWorkspace ? buildCloudWorkspaceHandlers(deps.cloudWorkspace) : {},
     ...buildDashboardHandlers(deps.dashboard),
     ...deps.attachment ? buildAttachmentHandlers(deps.attachment) : {},
     ...buildExtensionHandlers({
@@ -78552,6 +78780,20 @@ async function startDaemon(config) {
           fill: (args) => centralConnectorFill({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args })
         }
       },
+      cloudWorkspace: {
+        getFile: (id) => manager.get({ sessionId: id }).response,
+        status: (id) => manager.getCurrentStatus(id),
+        bind: (id, binding, conversationId) => manager.bindCloudWorkspace(id, binding, conversationId),
+        command: (file, input) => {
+          const personaId2 = personaIdFromCloudCwd(file.cwd);
+          if (!personaId2)
+            throw new Error("Cloud workspace requires a registered persona URL");
+          return gatewayForEnvironment(file.cloudEnvironment).workspaceCommand(
+            personaId2,
+            input
+          );
+        }
+      },
       cloudVolume: {
         getLoginPass: () => ownerIdentityStore.read()?.loginPass ?? null,
         fetchVolume: () => cloudGateway.fetchVolume(),