@clawos-dev/clawd 0.2.68 → 0.2.69-beta.120.2a41cd5

package/dist/cli.cjs

@@ -605,8 +605,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path32, errorMaps, issueData } = params;
-      const fullPath = [...path32, ...issueData.path || []];
+      const { data, path: path31, errorMaps, issueData } = params;
+      const fullPath = [...path31, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -917,11 +917,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path32, key) {
+      constructor(parent, value, path31, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path32;
+        this._path = path31;
         this._key = key;
       }
       get path() {
@@ -4331,11 +4331,9 @@ var init_attachment_schemas = __esm({
       stale: external_exports.boolean().optional()
     });
     AttachmentSignUrlArgs = external_exports.object({
-      /** 群文件所属的 session */
-      sessionId: external_exports.string().min(1),
-      /** 相对 session.cwd 的路径；允许传绝对路径，daemon 端会归一化（必须在 cwd 内） */
-      relPath: external_exports.string().min(1),
-      /** TTL 秒数；缺省 24h；null 走永久 URL（不带 exp 字段） */
+      /** 要分享的绝对路径；签名只关心 absPath，不区分 persona/session */
+      absPath: external_exports.string().min(1),
+      /** TTL 秒数；缺省 24h；'never' 走 null 不带 exp 字段（永久有效） */
       ttlSeconds: external_exports.number().int().positive().nullable().optional()
     });
     AttachmentSignUrlResponseSchema = external_exports.object({
@@ -5335,8 +5333,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path32 = req.path;
-        _req.url = typeof path32 === "string" ? path32 : req.url ? req.url.path || req.url : void 0;
+        const path31 = req.path;
+        _req.url = typeof path31 === "string" ? path31 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -5501,14 +5499,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path32) {
+    function parsePath(path31) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path32.length; i++) {
-        const char = path32[i];
+      for (let i = 0; i < path31.length; i++) {
+        const char = path31[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -5639,10 +5637,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path32 of paths) {
-        const parts = parsePath(path32);
+      for (const path31 of paths) {
+        const parts = parsePath(path31);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path32, remove);
+          redactWildcardPath(obj, parts, censor, path31, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -5727,8 +5725,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path32) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path32];
+            const wrappedCensor = typeof censor === "function" ? (value, path31) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path31];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -5763,8 +5761,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path32 of pathsToClone) {
-        const parts = parsePath(path32);
+      for (const path31 of pathsToClone) {
+        const parts = parsePath(path31);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -5816,24 +5814,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path32) {
-      if (typeof path32 !== "string") {
+    function validatePath(path31) {
+      if (typeof path31 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path32 === "") {
+      if (path31 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path32.includes("..")) {
-        throw new Error(`Invalid redaction path (${path32})`);
+      if (path31.includes("..")) {
+        throw new Error(`Invalid redaction path (${path31})`);
       }
-      if (path32.includes(",")) {
-        throw new Error(`Invalid redaction path (${path32})`);
+      if (path31.includes(",")) {
+        throw new Error(`Invalid redaction path (${path31})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path32.length; i++) {
-        const char = path32[i];
+      for (let i = 0; i < path31.length; i++) {
+        const char = path31[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -5847,20 +5845,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path32})`);
+            throw new Error(`Invalid redaction path (${path31})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path32})`);
+        throw new Error(`Invalid redaction path (${path31})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path32 of paths) {
-        validatePath(path32);
+      for (const path31 of paths) {
+        validatePath(path31);
       }
     }
     function slowRedact(options = {}) {
@@ -6028,8 +6026,8 @@ var require_redaction = __commonJS({
         if (shape[k2] === null) {
           o[k2] = (value) => topCensor(value, [k2]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path32) => {
-            return censor(value, [k2, ...path32]);
+          const wrappedCensor = typeof censor === "function" ? (value, path31) => {
+            return censor(value, [k2, ...path31]);
           } : censor;
           o[k2] = Redact({
             paths: shape[k2],
@@ -6250,7 +6248,7 @@ var require_sonic_boom = __commonJS({
     var fs28 = require("fs");
     var EventEmitter2 = require("events");
     var inherits = require("util").inherits;
-    var path32 = require("path");
+    var path31 = require("path");
     var sleep = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -6304,7 +6302,7 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs28.mkdirSync(path32.dirname(file), { recursive: true });
+          if (sonic.mkdir) fs28.mkdirSync(path31.dirname(file), { recursive: true });
           const fd = fs28.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
@@ -6312,7 +6310,7 @@ var require_sonic_boom = __commonJS({
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs28.mkdir(path32.dirname(file), { recursive: true }, (err) => {
+        fs28.mkdir(path31.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
           fs28.open(file, flags, mode, fileOpened);
         });
@@ -9943,11 +9941,11 @@ var init_lib = __esm({
           }
         }
       },
-      addToPath: function addToPath(path32, added, removed, oldPosInc, options) {
-        var last = path32.lastComponent;
+      addToPath: function addToPath(path31, added, removed, oldPosInc, options) {
+        var last = path31.lastComponent;
         if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
           return {
-            oldPos: path32.oldPos + oldPosInc,
+            oldPos: path31.oldPos + oldPosInc,
             lastComponent: {
               count: last.count + 1,
               added,
@@ -9957,7 +9955,7 @@ var init_lib = __esm({
           };
         } else {
           return {
-            oldPos: path32.oldPos + oldPosInc,
+            oldPos: path31.oldPos + oldPosInc,
             lastComponent: {
               count: 1,
               added,
@@ -10388,10 +10386,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path32 = typeof rec.path === "string" ? rec.path : null;
+      const path31 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path32 || content == null) return null;
-      const entry = { path: path32, content };
+      if (!path31 || content == null) return null;
+      const entry = { path: path31, content };
       if (typeof rec.mtimeMs === "number") entry.mtimeMs = rec.mtimeMs;
       return entry;
     }).filter((m2) => m2 !== null);
@@ -11195,10 +11193,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path32 = typeof rec.path === "string" ? rec.path : null;
+      const path31 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path32 || content == null) return null;
-      const out = { path: path32, content };
+      if (!path31 || content == null) return null;
+      const out = { path: path31, content };
       if (typeof rec.mtimeMs === "number") out.mtimeMs = rec.mtimeMs;
       return out;
     }).filter((m2) => m2 !== null);
@@ -20112,7 +20110,7 @@ var require_websocket_server = __commonJS({
 // src/run-case/recorder.ts
 function startRunCaseRecorder(opts) {
   const now = opts.now ?? Date.now;
-  const dir = import_node_path28.default.dirname(opts.recordPath);
+  const dir = import_node_path27.default.dirname(opts.recordPath);
   let stream = null;
   let closing = false;
   let closedSettled = false;
@@ -20152,12 +20150,12 @@ function startRunCaseRecorder(opts) {
   };
   return { tap, close, closed };
 }
-var import_node_fs25, import_node_path28;
+var import_node_fs25, import_node_path27;
 var init_recorder = __esm({
   "src/run-case/recorder.ts"() {
     "use strict";
     import_node_fs25 = __toESM(require("fs"), 1);
-    import_node_path28 = __toESM(require("path"), 1);
+    import_node_path27 = __toESM(require("path"), 1);
   }
 });
 
@@ -20200,7 +20198,7 @@ var init_wire = __esm({
 // src/run-case/controller.ts
 async function runController(opts) {
   const now = opts.now ?? Date.now;
-  const cwd = opts.cwd ?? (0, import_node_fs26.mkdtempSync)(import_node_path29.default.join(import_node_os14.default.tmpdir(), "clawd-runcase-"));
+  const cwd = opts.cwd ?? (0, import_node_fs26.mkdtempSync)(import_node_path28.default.join(import_node_os14.default.tmpdir(), "clawd-runcase-"));
   const ownsCwd = opts.cwd === void 0;
   const recorder = startRunCaseRecorder({ recordPath: opts.record, now });
   const spawnCtx = { cwd };
@@ -20367,13 +20365,13 @@ async function runController(opts) {
   }
   return exitCode ?? 0;
 }
-var import_node_fs26, import_node_os14, import_node_path29;
+var import_node_fs26, import_node_os14, import_node_path28;
 var init_controller = __esm({
   "src/run-case/controller.ts"() {
     "use strict";
     import_node_fs26 = require("fs");
     import_node_os14 = __toESM(require("os"), 1);
-    import_node_path29 = __toESM(require("path"), 1);
+    import_node_path28 = __toESM(require("path"), 1);
     init_claude();
     init_stdout_splitter();
     init_permission_stdio();
@@ -20605,7 +20603,7 @@ Env (advanced):
 `;
 
 // src/index.ts
-var import_node_path27 = __toESM(require("path"), 1);
+var import_node_path26 = __toESM(require("path"), 1);
 var import_node_fs24 = __toESM(require("fs"), 1);
 
 // src/logger.ts
@@ -26852,24 +26850,14 @@ var AUTH_FILE_NAME = "auth.json";
 function authFilePath(dataDir) {
   return import_node_path22.default.join(dataDir, AUTH_FILE_NAME);
 }
-function loadOrCreateAuthFile(opts) {
+function loadOrCreateAuthToken(opts) {
   const file = authFilePath(opts.dataDir);
-  const generate = opts.generate ?? defaultGenerate;
-  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
   const existing = readAuthFile(file);
-  if (existing && existing.token && existing.signSecret) {
-    return {
-      token: existing.token,
-      signSecret: existing.signSecret,
-      createdAt: existing.createdAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
-    };
-  }
-  const token = existing?.token || generate();
-  const signSecret = existing?.signSecret || generate();
-  const createdAt = existing?.createdAt || now().toISOString();
-  const next = { token, signSecret, createdAt };
-  writeAuthFile(file, next);
-  return next;
+  if (existing && existing.token) return existing.token;
+  const token = (opts.generate ?? defaultGenerate)();
+  const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
+  writeAuthFile(file, { token, createdAt: now.toISOString() });
+  return token;
 }
 function defaultGenerate() {
   return import_node_crypto8.default.randomBytes(32).toString("base64url");
@@ -26878,14 +26866,13 @@ function readAuthFile(file) {
   try {
     const raw = import_node_fs20.default.readFileSync(file, "utf8");
     const parsed = JSON.parse(raw);
-    if (typeof parsed?.token !== "string" || parsed.token.length === 0) {
-      return null;
+    if (typeof parsed?.token === "string" && parsed.token.length > 0) {
+      return {
+        token: parsed.token,
+        createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : (/* @__PURE__ */ new Date(0)).toISOString()
+      };
     }
-    return {
-      token: parsed.token,
-      signSecret: typeof parsed.signSecret === "string" && parsed.signSecret.length > 0 ? parsed.signSecret : void 0,
-      createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : void 0
-    };
+    return null;
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") return null;
@@ -27554,7 +27541,6 @@ function buildPersonaHandlers(deps) {
 }
 
 // src/handlers/attachment.ts
-var import_node_path26 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 var DEFAULT_TTL_SECONDS = 24 * 3600;
@@ -27579,51 +27565,8 @@ function buildAttachmentHandlers(deps) {
         "httpBaseUrl unavailable (daemon HTTP not ready)"
       );
     }
-    if (!deps.sessionStore || !deps.getSessionScope || !deps.groupFileStore) {
-      throw new ClawdError(
-        ERROR_CODES.METHOD_NOT_IMPLEMENTED,
-        "signUrl requires session/group stores"
-      );
-    }
-    const sessionFile = deps.sessionStore.read(args.sessionId);
-    if (!sessionFile) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `session ${args.sessionId} not found`
-      );
-    }
-    const scope = deps.getSessionScope(args.sessionId);
-    if (!scope) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `session ${args.sessionId} scope unresolved`
-      );
-    }
-    const cwdAbs = import_node_path26.default.resolve(sessionFile.cwd);
-    const candidateAbs = import_node_path26.default.isAbsolute(args.relPath) ? import_node_path26.default.resolve(args.relPath) : import_node_path26.default.resolve(cwdAbs, args.relPath);
-    if (!isContainedIn2(candidateAbs, cwdAbs)) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        "relPath escapes session cwd"
-      );
-    }
-    const relPath = import_node_path26.default.relative(cwdAbs, candidateAbs);
-    if (relPath === "" || relPath.startsWith("..")) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        "relPath escapes session cwd"
-      );
-    }
-    const entries = deps.groupFileStore.list(scope, args.sessionId);
-    const entry = entries.find((e) => e.relPath === relPath && !e.stale);
-    if (!entry) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `relPath not in session group files or stale: ${relPath}`
-      );
-    }
     const ttl = args.ttlSeconds === null ? null : args.ttlSeconds ?? DEFAULT_TTL_SECONDS;
-    const parts = signUrlParts(secret, candidateAbs, ttl);
+    const parts = signUrlParts(secret, args.absPath, ttl);
     const url = buildSignedFileUrl(httpBaseUrl, parts);
     return {
       response: {
@@ -27709,12 +27652,6 @@ function buildAttachmentHandlers(deps) {
     "attachment.groupListPersona": groupListPersona
   };
 }
-function isContainedIn2(abs, root) {
-  const normalized = import_node_path26.default.resolve(abs);
-  const normalizedRoot = import_node_path26.default.resolve(root);
-  if (normalized === normalizedRoot) return true;
-  return normalized.startsWith(normalizedRoot + import_node_path26.default.sep);
-}
 
 // src/handlers/index.ts
 function buildMethodHandlers(deps) {
@@ -27738,7 +27675,7 @@ function buildMethodHandlers(deps) {
 async function startDaemon(config) {
   const logger = createLogger({
     level: config.logLevel,
-    file: import_node_path27.default.join(config.dataDir, "clawd.log")
+    file: import_node_path26.default.join(config.dataDir, "clawd.log")
   });
   logger.info("starting clawd", { version, config: { port: config.port, host: config.host, dataDir: config.dataDir } });
   const stateMgr = new StateFileManager({ dataDir: config.dataDir });
@@ -27750,12 +27687,10 @@ async function startDaemon(config) {
     logger.warn("stale state file detected, overwriting", { pid: pre.existing.pid });
   }
   let resolvedAuthToken = null;
-  let authFile = null;
   if (config.authToken && config.authToken.trim()) {
     resolvedAuthToken = config.authToken.trim();
   } else if (config.tunnel) {
-    authFile = loadOrCreateAuthFile({ dataDir: config.dataDir });
-    resolvedAuthToken = authFile.token;
+    resolvedAuthToken = loadOrCreateAuthToken({ dataDir: config.dataDir });
   }
   const authMode = resolvedAuthToken == null ? "none" : "first-message";
   let wsServer = null;
@@ -27772,7 +27707,7 @@ async function startDaemon(config) {
   const agents = new AgentsScanner();
   const history = new ClaudeHistoryReader();
   let transport = null;
-  const personaStore = new PersonaStore(import_node_path27.default.join(config.dataDir, "personas"));
+  const personaStore = new PersonaStore(import_node_path26.default.join(config.dataDir, "personas"));
   const defaultsRoot = findDefaultsRoot();
   if (defaultsRoot) {
     seedDefaultPersonas({ store: personaStore, defaultsRoot, logger });
@@ -27787,7 +27722,7 @@ async function startDaemon(config) {
     getAdapter,
     historyReader: history,
     dataDir: config.dataDir,
-    personaRoot: import_node_path27.default.join(config.dataDir, "personas"),
+    personaRoot: import_node_path26.default.join(config.dataDir, "personas"),
     personaStore,
     ownerDisplayName,
     mode: config.mode,
@@ -27810,7 +27745,7 @@ async function startDaemon(config) {
     // 文件可能 agent 写完又被自己删（罕见），用 size=0 / fallback mime 兜底。
     attachmentGroup: {
       onFileEdit: (input) => {
-        const absPath = import_node_path27.default.isAbsolute(input.relPath) ? input.relPath : import_node_path27.default.join(input.cwd, input.relPath);
+        const absPath = import_node_path26.default.isAbsolute(input.relPath) ? input.relPath : import_node_path26.default.join(input.cwd, input.relPath);
         let size = 0;
         try {
           size = import_node_fs24.default.statSync(absPath).size;
@@ -27911,12 +27846,11 @@ async function startDaemon(config) {
     // 根据 sessionId 反查 scope 写盘。
     attachment: {
       groupFileStore,
-      sessionStore: store,
       getHttpBaseUrl,
-      // HMAC sign secret：~/.clawd/auth.json signSecret 字段（与 WS Bearer token 独立）。
-      // --auth-token CLI 模式 / noAuth 模式 authFile 为 null → handler 自己返 NOT_IMPLEMENTED。
-      getSignSecret: () => authFile?.signSecret ?? "",
-      // group RPC + sign 都用：根据 sessionId 反查 scope；owner-mode persona session 走
+      // HMAC sign secret：复用 ~/.clawd/auth.json owner token（持久跨重启）。
+      // noAuth 模式 resolvedAuthToken 为 null → handler 自己返 NOT_IMPLEMENTED。
+      getSignSecret: () => resolvedAuthToken ?? "",
+      // group RPC：根据 sessionId 反查 scope；owner-mode persona session 走
       // 'persona/<pid>/owner'，default 走 'default'。
       getSessionScope: (sessionId) => {
         const file = store.read(sessionId);
@@ -27939,9 +27873,8 @@ async function startDaemon(config) {
     personaStore,
     groupFileStore,
     sessionStore: store,
-    // /files HMAC verify 用 auth.json 的 signSecret 字段（与 attachment.signUrl 同源）。
-    // --auth-token CLI 模式没 signSecret → 路由返 501，sign URL 功能整体禁用。
-    getSignSecret: () => authFile?.signSecret ?? null
+    // /files HMAC verify 用同一份 owner token 做 secret（与 attachment.signUrl 同源）
+    getSignSecret: () => resolvedAuthToken ?? null
   });
   wsServer = new LocalWsServer({
     host: config.host,
@@ -28079,8 +28012,8 @@ async function startDaemon(config) {
       const lines = [
         `Tunnel:      ${r.url}`,
         ...resolvedAuthToken ? [`Connect:     ${connectUrl}`] : [],
-        `Frpc config: ${import_node_path27.default.join(config.dataDir, "frpc.toml")}`,
-        `Frpc log:    ${import_node_path27.default.join(config.dataDir, "frpc.log")}`
+        `Frpc config: ${import_node_path26.default.join(config.dataDir, "frpc.toml")}`,
+        `Frpc log:    ${import_node_path26.default.join(config.dataDir, "frpc.log")}`
       ];
       const width = Math.max(...lines.map((l) => l.length));
       const bar = "\u2550".repeat(width + 4);
@@ -28093,7 +28026,7 @@ ${bar}
 
 `);
       try {
-        const connectPath = import_node_path27.default.join(config.dataDir, "connect.txt");
+        const connectPath = import_node_path26.default.join(config.dataDir, "connect.txt");
         import_node_fs24.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
       } catch {
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.68",
+  "version": "0.2.69-beta.120.2a41cd5",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",