@clawos-dev/clawd 0.2.686 → 0.2.690

package/dist/cli.cjs

@@ -43380,7 +43380,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net2 = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash5 } = require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash6 } = require("crypto");
     var { Duplex, Readable: Readable4 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -44040,7 +44040,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash5("sha1").update(key + GUID).digest("base64");
+        const digest = createHash6("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -44407,7 +44407,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash5 } = require("crypto");
+    var { createHash: createHash6 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -44708,7 +44708,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash5("sha1").update(key + GUID).digest("base64");
+        const digest = createHash6("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -46776,7 +46776,7 @@ function requireEnvironmentIdentity(stores, environment) {
 var import_node_path89 = __toESM(require("path"), 1);
 var import_node_fs68 = __toESM(require("fs"), 1);
 var import_node_os33 = __toESM(require("os"), 1);
-var import_node_crypto30 = require("crypto");
+var import_node_crypto31 = require("crypto");
 var import_node_url6 = require("url");
 
 // src/logger.ts
@@ -53581,6 +53581,10 @@ async function centralRequest(opts, path111, init) {
   }
   clearTimeout(timer);
   if (res.status === 401) {
+    const detail = await res.json().catch(() => null);
+    if (path111 === "/api/persona-cloud/github/oauth/token" && detail?.errorCode === "GITHUB_REAUTH_REQUIRED") {
+      throw new CentralClientError("API_ERROR", typeof detail.message === "string" ? detail.message : "\u8BF7\u91CD\u65B0\u5173\u8054 GitHub", void 0, 401);
+    }
     throw new CentralClientError("UNAUTHORIZED", "login pass rejected by center");
   }
   if (!res.ok) {
@@ -53759,11 +53763,12 @@ async function centralGithubAuthToken(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/github/oauth/token", {
     method: "POST",
     bearer: opts.loginPass,
-    body: {}
+    body: { ...opts.rejectedToken ? { rejectedToken: opts.rejectedToken } : {} }
   });
   if (body.token === null || body.token === void 0) return void 0;
   if (typeof body.token !== "string" || !body.token) throw new CentralClientError("BAD_RESPONSE", "github/oauth/token: malformed token");
-  return { token: body.token, login: typeof body.login === "string" ? body.login : "" };
+  if (body.expiresAt !== void 0 && (typeof body.expiresAt !== "string" || !Number.isFinite(Date.parse(body.expiresAt)))) throw new CentralClientError("BAD_RESPONSE", "github/oauth/token: malformed expiry");
+  return { token: body.token, login: typeof body.login === "string" ? body.login : "", ...typeof body.expiresAt === "string" ? { expiresAt: body.expiresAt } : {} };
 }
 async function centralClaimPublisher(opts) {
   await centralRequest(opts, `/api/persona-cloud/personas/${encodeURIComponent(opts.personaId)}/publisher`, {
@@ -57519,8 +57524,8 @@ function createGhRunner(defaults) {
   const baseTimeoutMs = defaults?.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
   const spawn17 = defaults?.execFile ?? import_node_child_process9.execFile;
   return {
-    run(args, opts) {
-      const token = defaults?.token?.();
+    async run(args, opts) {
+      const token = await defaults?.token?.();
       return new Promise((resolve9, reject) => {
         spawn17(
           "gh",
@@ -58044,25 +58049,59 @@ var CloudGatewayClient = class {
     return list.find((p3) => p3.personaId === gatewayPersonaId)?.connectors ?? [];
   }
   async workspaceCommand(personaId2, input) {
-    const { apiKey, gatewayUrl } = await this.credentials();
-    const res = await this.fetchImpl(
-      gatewayUrl + GATEWAY_ROUTES.workspace(personaId2),
-      {
-        method: "POST",
-        headers: {
-          authorization: `Bearer ${apiKey}`,
-          "content-type": "application/json"
-        },
-        body: JSON.stringify(input),
-        signal: AbortSignal.timeout(3e5)
+    const started = performance.now();
+    const traceId = typeof input.traceId === "string" && /^[A-Za-z0-9:_-]{1,128}$/.test(input.traceId) ? input.traceId : crypto.randomUUID();
+    const { traceId: _trace, ...body } = input;
+    const meta = {
+      traceId,
+      sessionId: input.sessionId,
+      personaId: personaId2,
+      action: input.action,
+      page: typeof input.page === "number" && Number.isInteger(input.page) && input.page >= 1 && input.page <= 1e3 ? input.page : void 0,
+      hasSearch: typeof input.search === "string" && input.search.length > 0,
+      searchLength: typeof input.search === "string" ? input.search.length : 0,
+      hasCursor: typeof input.cursor === "string"
+    };
+    const log = (event, detail) => {
+      try {
+        this.deps.logger?.info("cloud.workspace.daemon." + event, { ...meta, ...detail });
+      } catch {
       }
-    );
-    const body = await res.json();
-    if (!res.ok)
-      throw new Error(
-        body.error?.message ?? `Cloud workspace request failed (${res.status})`
-      );
-    return CloudWorkspaceResultSchema.parse(body);
+    };
+    const measure = async (stage, run) => {
+      const at3 = performance.now();
+      let outcome2 = "error";
+      try {
+        const value = await run();
+        outcome2 = "ok";
+        return value;
+      } finally {
+        log("stage", { stage, outcome: outcome2, durationMs: Math.round(performance.now() - at3) });
+      }
+    };
+    let outcome = "error";
+    let statusCode;
+    log("started", {});
+    try {
+      const { apiKey, gatewayUrl } = await measure("credentials", () => this.credentials());
+      const res = await measure("gateway.headers", () => this.fetchImpl(
+        gatewayUrl + GATEWAY_ROUTES.workspace(personaId2),
+        {
+          method: "POST",
+          headers: { authorization: "Bearer " + apiKey, "content-type": "application/json", "x-trace-id": traceId },
+          body: JSON.stringify(body),
+          signal: AbortSignal.timeout(3e5)
+        }
+      ));
+      statusCode = res.status;
+      const result = await measure("gateway.body", () => res.json());
+      if (!res.ok) throw new Error(result.error?.message ?? "Cloud workspace request failed (" + res.status + ")");
+      const parsed = CloudWorkspaceResultSchema.parse(result);
+      outcome = "ok";
+      return parsed;
+    } finally {
+      log("finished", { outcome, statusCode, durationMs: Math.round(performance.now() - started) });
+    }
   }
   async openTurn(personaId2, opts) {
     const { apiKey, gatewayUrl } = await this.credentials();
@@ -62165,23 +62204,38 @@ function createGithubApi(args) {
   const seal = args.seal ?? sealWithSodium;
   const timeoutMs = args.timeoutMs ?? TIMEOUT_MS;
   const secretsPath = (slug, environment) => `/repos/${slug}/${environment ? `environments/${encodeURIComponent(environment)}` : "actions"}/secrets`;
-  async function request(method, path111, body) {
-    let res;
-    try {
-      res = await doFetch(`${API}${path111}`, {
-        method,
-        headers: {
-          Authorization: `Bearer ${args.token}`,
-          Accept: "application/vnd.github+json",
-          "X-GitHub-Api-Version": "2022-11-28",
-          ...body !== void 0 ? { "Content-Type": "application/json" } : {}
-        },
-        ...body !== void 0 ? { body: JSON.stringify(body) } : {},
-        signal: AbortSignal.timeout(timeoutMs)
-      });
-    } catch (err) {
-      throw new GithubApiError(0, `\u8FDE\u4E0D\u4E0A GitHub\uFF1A${err instanceof Error ? err.message : String(err)}`);
+  async function authenticatedFetch(path111, init) {
+    let token = args.identity ? (await args.identity.refresh())?.token : args.token;
+    if (!token) throw new GithubApiError(401, "\u8BF7\u5148\u5173\u8054 GitHub");
+    for (let attempt = 0; ; attempt++) {
+      let res;
+      try {
+        res = await doFetch(API + path111, {
+          ...init,
+          headers: { ...init.headers, Authorization: "Bearer " + token },
+          signal: AbortSignal.timeout(timeoutMs)
+        });
+      } catch (err) {
+        throw new GithubApiError(0, "\u8FDE\u4E0D\u4E0A GitHub\uFF1A" + (err instanceof Error ? err.message : String(err)));
+      }
+      if (res.status !== 401 || attempt !== 0 || !args.identity) return res;
+      const renewed = await args.identity.recover(token);
+      if (!renewed || renewed.token === token) return res;
+      await res.body?.cancel();
+      token = renewed.token;
     }
+  }
+  async function request(method, path111, body) {
+    const res = await authenticatedFetch(path111, {
+      method,
+      redirect: "error",
+      headers: {
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+        ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+      },
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
     const text = await res.text();
     let json = void 0;
     if (text) {
@@ -62266,8 +62320,8 @@ function createGithubApi(args) {
       const signal = AbortSignal.timeout(timeoutMs);
       let res;
       try {
-        res = await doFetch(`${API}/repos/${slug}/actions/artifacts/${artifactId}/zip`, {
-          headers: { Authorization: `Bearer ${args.token}`, Accept: "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28" },
+        res = await authenticatedFetch(`/repos/${slug}/actions/artifacts/${artifactId}/zip`, {
+          headers: { Accept: "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28" },
           redirect: "manual",
           signal
         });
@@ -62892,7 +62946,8 @@ function networkOptions(auth) {
   return auth?.source === "file" ? { prefix: [...QUIET_GIT_ARGS, "-c", "credential.helper=", "-c", `credential.helper=${INLINE_HELPER}`], env: { ...QUIET_GIT_ENV, CLAWD_GITHUB_TOKEN: auth.token } } : { prefix: [...QUIET_GIT_ARGS], env: QUIET_GIT_ENV };
 }
 async function networkGit(exec, dir, auth, args, what) {
-  const opts = networkOptions(auth);
+  const current = typeof auth === "function" ? await auth() : auth;
+  const opts = networkOptions(current);
   return mustGit(exec, dir, [...opts.prefix, ...args], what, { timeoutMs: 12e4, env: opts.env });
 }
 async function gitPush(exec, dir, auth, refspec = "HEAD:refs/heads/integration") {
@@ -63807,7 +63862,11 @@ function buildDeployHandlers(deps) {
   async function requireGithub() {
     const auth = await deps.githubIdentity.refresh();
     if (!auth) throw new ClawdError(ERROR_CODES.INTERNAL, NO_GITHUB_AUTH);
-    return { auth, api: deps.githubApi(auth.token) };
+    return { auth: async () => {
+      const current = await deps.githubIdentity.refresh();
+      if (!current) throw new ClawdError(ERROR_CODES.INTERNAL, NO_GITHUB_AUTH);
+      return current;
+    }, api: deps.githubApi(auth.token) };
   }
   function mustPersona(personaId2) {
     if (!deps.hasPersona(personaId2)) {
@@ -65032,13 +65091,82 @@ function createGithubIdentity(deps) {
   let pendingOauth = null;
   let staleCenterToken;
   const listeners = /* @__PURE__ */ new Set();
-  async function refresh() {
-    const mine = ++seq;
-    const resolved = await deps.resolve();
-    if (mine === seq) auth = resolved;
-    return resolved;
+  let managedToken;
+  const oauthCandidate = (token) => /^gh[ou]_/.test(token);
+  const oauthManaged = (token) => oauthCandidate(token) && (managedToken === token || deps.isManaged?.(token) === true);
+  let acquisition;
+  let centerFlight;
+  let centerCache;
+  let writes = Promise.resolve();
+  function remember(got) {
+    const expiry = got.expiresAt ? Date.parse(got.expiresAt) - 6e4 : Infinity;
+    centerCache = { token: got.token, until: Math.min(deps.now() + 2e4, expiry) };
+  }
+  function persist(token, generation, managed = false) {
+    const write = writes.catch(() => {
+    }).then(async () => {
+      if (generation !== seq) return;
+      const stored = await deps.store(token);
+      if (generation !== seq) return;
+      deps.markManaged?.(managed ? token : void 0);
+      managedToken = managed ? token : void 0;
+      auth = stored;
+      statusCache.clear();
+      pendingOauth = null;
+      for (const cb of listeners) cb();
+    });
+    writes = write;
+    return write;
+  }
+  async function syncCenter(local, rejectedToken) {
+    if (!oauthCandidate(local.token)) return local;
+    const managed = oauthManaged(local.token);
+    if (!rejectedToken && centerCache?.token === local.token && deps.now() < centerCache.until) return local;
+    if (centerFlight) return centerFlight;
+    const generation = seq;
+    const task = (async () => {
+      let got;
+      try {
+        got = await deps.oauth.token(rejectedToken);
+      } catch (err) {
+        if (managed) throw err;
+        return local;
+      }
+      if (generation !== seq) return auth;
+      if (!got || !managed && got.token !== local.token) {
+        remember({ token: local.token });
+        return local;
+      }
+      if (!managed || got.token !== local.token) await persist(got.token, generation, true);
+      if (generation !== seq) return auth;
+      remember(got);
+      return auth ?? local;
+    })().finally(() => {
+      if (centerFlight === task) centerFlight = void 0;
+    });
+    centerFlight = task;
+    return task;
+  }
+  function refresh() {
+    if (acquisition) return acquisition;
+    const generation = seq;
+    const task = (async () => {
+      const resolved = await deps.resolve();
+      if (generation !== seq) return auth;
+      auth = resolved;
+      return resolved ? syncCenter(resolved) : void 0;
+    })().finally(() => {
+      if (acquisition === task) acquisition = void 0;
+    });
+    acquisition = task;
+    return task;
   }
-  async function whoami(a2) {
+  async function recover(rejectedToken) {
+    const current = await refresh();
+    if (!current || current.token !== rejectedToken || !oauthManaged(current.token)) return current;
+    return syncCenter(current, rejectedToken);
+  }
+  async function whoami(a2, recovering = false) {
     const hit = statusCache.get(a2.token);
     if (hit && deps.now() - hit.at < cacheMs) return hit.status;
     let status2;
@@ -65046,19 +65174,26 @@ function createGithubIdentity(deps) {
       const { login } = await deps.api(a2.token).whoami();
       status2 = { status: "authorized", login, source: a2.source };
     } catch (err) {
+      if (!recovering && err instanceof GithubApiError && err.status === 401 && oauthManaged(a2.token)) {
+        try {
+          const renewed = await recover(a2.token);
+          if (renewed && renewed.token !== a2.token) return whoami(renewed, true);
+        } catch (recoveryError) {
+          return { status: "invalid", message: recoveryError instanceof Error ? recoveryError.message : String(recoveryError) };
+        }
+      }
       status2 = { status: "invalid", message: err instanceof Error ? err.message : String(err) };
     }
     statusCache.set(a2.token, { at: deps.now(), status: status2 });
     return status2;
   }
   async function adopt(token) {
-    auth = await deps.store(token);
-    seq++;
-    statusCache.clear();
-    pendingOauth = null;
-    for (const cb of listeners) cb();
+    const generation = ++seq;
+    centerCache = void 0;
+    await persist(token, generation);
   }
   async function claimCenterToken() {
+    const generation = seq;
     let got;
     try {
       got = await deps.oauth.token();
@@ -65072,7 +65207,9 @@ function createGithubIdentity(deps) {
       if (err instanceof GithubApiError && err.status === 401) staleCenterToken = got.token;
       return false;
     }
-    await adopt(got.token);
+    if (generation !== seq) return false;
+    await persist(got.token, ++seq, true);
+    remember(got);
     return true;
   }
   async function settlePendingOauth() {
@@ -65090,13 +65227,19 @@ function createGithubIdentity(deps) {
   }
   async function status() {
     await settlePendingOauth();
-    const a2 = await refresh();
+    let a2;
+    try {
+      a2 = await refresh();
+    } catch (err) {
+      return { status: "invalid", message: err instanceof Error ? err.message : String(err) };
+    }
     const current = a2 ? await whoami(a2) : { status: "missing" };
     return pendingOauth && current.status !== "authorized" ? { status: "pending", authUrl: pendingOauth.authUrl } : current;
   }
   return {
     cached: () => auth,
     refresh,
+    recover,
     status,
     adopt,
     async authorize(raw) {
@@ -65111,7 +65254,7 @@ function createGithubIdentity(deps) {
     },
     // 已有身份时重新授权；直接返回 pending 链接，不能经 status() 被旧的 authorized 状态遮掉。
     async oauthStart(returnTo) {
-      const local = await refresh();
+      const local = await deps.resolve();
       if (!local && await claimCenterToken()) return status();
       try {
         staleCenterToken = (await deps.oauth.token())?.token;
@@ -69800,7 +69943,7 @@ var ContactStore = class {
 };
 
 // src/contact/connect-remote.ts
-var crypto5 = __toESM(require("crypto"), 1);
+var crypto6 = __toESM(require("crypto"), 1);
 init_protocol();
 var HANDSHAKE_TIMEOUT_MS = 5e3;
 var RPC_TIMEOUT_MS = 5e3;
@@ -69855,7 +69998,7 @@ async function connectRemote(args) {
     ws.once("close", onClose);
   });
   function call(method, payload) {
-    const requestId = crypto5.randomUUID();
+    const requestId = crypto6.randomUUID();
     return new Promise((resolve9, reject) => {
       const onMessage = (raw) => {
         let f2;
@@ -72324,7 +72467,7 @@ function buildDeviceHandlers(deps) {
 }
 
 // src/feishu-auth/verify-token.ts
-var crypto12 = __toESM(require("crypto"), 1);
+var crypto13 = __toESM(require("crypto"), 1);
 var CONNECT_TOKEN_PREFIX = "clawdtk1";
 function verifyConnectToken(args) {
   const now = args.nowSeconds ?? Math.floor(Date.now() / 1e3);
@@ -72336,7 +72479,7 @@ function verifyConnectToken(args) {
   const data = `${prefix}.${payloadB64}`;
   let signatureValid = false;
   try {
-    signatureValid = crypto12.verify(
+    signatureValid = crypto13.verify(
       null,
       Buffer.from(data, "utf8"),
       args.publicKeyPem,
@@ -74996,6 +75139,7 @@ function buildCloudConnectorsHandlers(deps) {
 
 // src/handlers/cloud-workspace.ts
 init_protocol();
+var import_node_crypto26 = require("crypto");
 function buildCloudWorkspaceHandlers(deps) {
   return {
     "cloud:workspace": async (frame, _client, ctx) => {
@@ -75023,17 +75167,34 @@ function buildCloudWorkspaceHandlers(deps) {
       ) || file.cloudPendingTurns?.length))
         throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "\u8BF7\u7B49\u5F85\u5F53\u524D\u4EFB\u52A1\u5B8C\u6210");
       const conversationId = file.cloudConversationId ?? file.cloudExecutionId ?? file.sessionId;
-      const result = CloudWorkspaceResultSchema.parse(
-        await deps.command(file, {
-          ...args,
-          workspaceId: file.cloudWorkspace?.workspaceId ?? file.sessionId,
-          conversationId,
-          ...file.toolSessionId ? { threadId: file.toolSessionId } : {}
-        })
-      );
-      if (result.binding && !file.cloudWorkspace)
-        deps.bind(file.sessionId, result.binding, conversationId);
-      return { response: { type: "cloud:workspace:ok", ...result } };
+      const traceId = typeof frame.requestId === "string" && /^[A-Za-z0-9:_-]{1,128}$/.test(frame.requestId) ? frame.requestId : (0, import_node_crypto26.randomUUID)();
+      const started = performance.now();
+      const meta = { traceId, sessionId: args.sessionId, action: args.action };
+      const log = (event, detail) => {
+        try {
+          deps.logger?.info("cloud.workspace.rpc." + event, { ...meta, ...detail });
+        } catch {
+        }
+      };
+      let outcome = "error";
+      log("started", {});
+      try {
+        const result = CloudWorkspaceResultSchema.parse(
+          await deps.command(file, {
+            ...args,
+            traceId,
+            workspaceId: file.cloudWorkspace?.workspaceId ?? file.sessionId,
+            conversationId,
+            ...file.toolSessionId ? { threadId: file.toolSessionId } : {}
+          })
+        );
+        if (result.binding && !file.cloudWorkspace)
+          deps.bind(file.sessionId, result.binding, conversationId);
+        outcome = "ok";
+        return { response: { type: "cloud:workspace:ok", ...result } };
+      } finally {
+        log("finished", { outcome, durationMs: Math.round(performance.now() - started) });
+      }
     }
   };
 }
@@ -75363,7 +75524,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.686".length > 0 ? "0.2.686" : "dev";
+var version = "0.2.690".length > 0 ? "0.2.690" : "dev";
 
 // src/cli-probe/probe.ts
 var fs86 = __toESM(require("fs"), 1);
@@ -75759,7 +75920,7 @@ init_protocol();
 // src/extension/bundle-zip.ts
 var import_promises12 = __toESM(require("fs/promises"), 1);
 var import_node_path78 = __toESM(require("path"), 1);
-var import_node_crypto26 = __toESM(require("crypto"), 1);
+var import_node_crypto27 = __toESM(require("crypto"), 1);
 var import_jszip3 = __toESM(require_lib3(), 1);
 async function bundleExtensionDir(dir) {
   const entries = await listFilesSorted(dir);
@@ -75774,7 +75935,7 @@ async function bundleExtensionDir(dir) {
     compression: "DEFLATE",
     compressionOptions: { level: 6 }
   });
-  const sha256 = import_node_crypto26.default.createHash("sha256").update(buffer).digest("hex");
+  const sha256 = import_node_crypto27.default.createHash("sha256").update(buffer).digest("hex");
   return { buffer, sha256 };
 }
 var FIXED_DATE = /* @__PURE__ */ new Date("2020-01-01T00:00:00.000Z");
@@ -75842,7 +76003,7 @@ function computePublishCheck(args) {
 var import_promises13 = __toESM(require("fs/promises"), 1);
 var import_node_path80 = __toESM(require("path"), 1);
 var import_node_os30 = __toESM(require("os"), 1);
-var import_node_crypto27 = __toESM(require("crypto"), 1);
+var import_node_crypto28 = __toESM(require("crypto"), 1);
 var import_jszip4 = __toESM(require_lib3(), 1);
 
 // src/extension/paths.ts
@@ -75871,7 +76032,7 @@ var InstallError = class extends Error {
 };
 async function installFromChannel(args, deps) {
   const { channelRef, snapshotHash, bundleZip } = args;
-  const computed = import_node_crypto27.default.createHash("sha256").update(bundleZip).digest("hex");
+  const computed = import_node_crypto28.default.createHash("sha256").update(bundleZip).digest("hex");
   if (computed !== snapshotHash) {
     throw new InstallError(
       "HASH_MISMATCH",
@@ -75963,7 +76124,7 @@ async function installFromChannel(args, deps) {
 var import_promises14 = __toESM(require("fs/promises"), 1);
 var import_node_path81 = __toESM(require("path"), 1);
 var import_node_os31 = __toESM(require("os"), 1);
-var import_node_crypto28 = __toESM(require("crypto"), 1);
+var import_node_crypto29 = __toESM(require("crypto"), 1);
 var import_jszip5 = __toESM(require_lib3(), 1);
 var UpdateError = class extends Error {
   constructor(code, message) {
@@ -76001,7 +76162,7 @@ async function updateFromChannel(args, deps) {
     if (e instanceof UpdateError) throw e;
     throw e;
   }
-  const computed = import_node_crypto28.default.createHash("sha256").update(bundleZip).digest("hex");
+  const computed = import_node_crypto29.default.createHash("sha256").update(bundleZip).digest("hex");
   if (computed !== snapshotHash) {
     throw new UpdateError(
       "HASH_MISMATCH",
@@ -77129,7 +77290,7 @@ async function uninstall(deps) {
 }
 
 // src/handlers/index.ts
-var import_node_crypto29 = require("crypto");
+var import_node_crypto30 = require("crypto");
 
 // src/handlers/peer-exec.ts
 init_protocol();
@@ -77286,7 +77447,7 @@ function buildMethodHandlers(deps) {
           const c2 = deps.contactStore.get(deviceId);
           return c2 ? { deviceId: c2.deviceId, remoteUrl: c2.remoteUrl, connectToken: c2.connectToken } : null;
         },
-        genId: () => (0, import_node_crypto29.randomUUID)(),
+        genId: () => (0, import_node_crypto30.randomUUID)(),
         now: () => Date.now(),
         forwardInboxPostToPeer,
         logger: deps.logger
@@ -78011,7 +78172,7 @@ async function startDaemon(config) {
   const channelStore = createChannelStore({
     filePath: import_node_path89.default.join(config.dataDir, "channels.json"),
     now: () => Date.now(),
-    genId: () => `ch-${(0, import_node_crypto30.randomUUID)().slice(0, 8)}`,
+    genId: () => `ch-${(0, import_node_crypto31.randomUUID)().slice(0, 8)}`,
     onFlushError: (err) => logger.error("channel store flush failed", {
       reason: err instanceof Error ? err.message : String(err)
     })
@@ -78020,7 +78181,7 @@ async function startDaemon(config) {
   const topicStore = createTopicStore({
     filePath: import_node_path89.default.join(config.dataDir, "topics.json"),
     now: () => Date.now(),
-    genId: () => `tp-${(0, import_node_crypto30.randomUUID)().slice(0, 8)}`,
+    genId: () => `tp-${(0, import_node_crypto31.randomUUID)().slice(0, 8)}`,
     onFlushError: (err) => logger.error("topic store flush failed", {
       reason: err instanceof Error ? err.message : String(err)
     })
@@ -78028,7 +78189,7 @@ async function startDaemon(config) {
   await topicStore.load();
   let deliverPendingRef;
   const personaDispatchManager = new PersonaDispatchManager({
-    genId: () => (0, import_node_crypto30.randomUUID)(),
+    genId: () => (0, import_node_crypto31.randomUUID)(),
     store: dispatchStore,
     now: () => Date.now(),
     onCompleted: (sid) => deliverPendingRef?.(sid),
@@ -78051,7 +78212,14 @@ async function startDaemon(config) {
   const localSecretsDir = import_node_path89.default.join(config.dataDir, LOCAL_SECRETS_DIRNAME);
   const readSecrets = () => readSecretTable({ bundleRoot: secretsBundleRoot, overrideDir: localSecretsDir, logger });
   const githubTokenFile = import_node_path89.default.join(localSecretsDir, GITHUB_TOKEN_FILE);
+  const managedGithubVar = "CLAWD_GITHUB_MANAGED_TOKEN_SHA256";
+  const githubFingerprint = (token) => (0, import_node_crypto31.createHash)("sha256").update(token).digest("hex");
   const githubIdentity = createGithubIdentity({
+    isManaged: (token) => readEnvFileVar(githubTokenFile, managedGithubVar) === githubFingerprint(token),
+    markManaged: (token) => {
+      if (token) upsertEnvFileVar(githubTokenFile, managedGithubVar, githubFingerprint(token));
+      else removeEnvFileVar(githubTokenFile, managedGithubVar);
+    },
     resolve: () => resolveGithubAuth({ exec: runCommand, fileToken: () => readEnvFileVar(githubTokenFile, GITHUB_TOKEN_VAR) }),
     store: (token) => storeGithubAuth({
       exec: runCommand,
@@ -78073,19 +78241,23 @@ async function startDaemon(config) {
           throw new ClawdError(ERROR_CODES.INTERNAL, `\u5411\u4E2D\u5FC3\u8981 GitHub \u6388\u6743\u94FE\u63A5\u6CA1\u6210\uFF1A${err instanceof Error ? err.message : String(err)}`);
         }
       },
-      token: async () => {
+      token: async (rejectedToken) => {
         const r2 = ownerIdentityStore.read();
         if (!r2) return void 0;
-        return centralGithubAuthToken({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, loginPass: r2.loginPass });
+        return centralGithubAuthToken({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, loginPass: r2.loginPass, ...rejectedToken ? { rejectedToken } : {} });
       }
     },
     now: () => Date.now(),
     logger
   });
-  void githubIdentity.refresh();
+  void githubIdentity.refresh().catch(() => {
+    logger.warn("github.identity.warm-failed");
+  });
   const resolvePersonaMcpConfig = (personaId2) => {
     const secrets = secretsWithGithubIdentity(readSecrets(), githubIdentity.cached());
-    void githubIdentity.refresh();
+    void githubIdentity.refresh().catch(() => {
+      logger.warn("github.identity.sync-failed");
+    });
     return renderPersonaMcpSecrets({
       personaId: personaId2,
       personaDir: import_node_path89.default.join(config.dataDir, "personas", personaId2),
@@ -78881,6 +79053,7 @@ async function startDaemon(config) {
         }
       },
       cloudWorkspace: {
+        logger,
         getFile: (id) => manager.get({ sessionId: id }).response,
         status: (id) => manager.getCurrentStatus(id),
         bind: (id, binding, conversationId) => manager.bindCloudWorkspace(id, binding, conversationId),
@@ -78913,7 +79086,7 @@ async function startDaemon(config) {
       shiftStore,
       shiftOwnerIdProvider: () => ownerPrincipalId,
       // PR 收件箱：github:* handler spawn 本机 gh CLI，凭据是 clawd 的 GitHub 身份（GH_TOKEN），没有才是 gh 自己的登录态
-      ghRunner: createGhRunner({ token: () => githubIdentity.cached()?.token }),
+      ghRunner: createGhRunner({ token: async () => (await githubIdentity.refresh())?.token }),
       githubIdentity,
       visitorStore
     })
@@ -79023,7 +79196,7 @@ async function startDaemon(config) {
     fetchArtifact: downloadArtifact(runCommand),
     debianPackage: lookupDebianPackage(),
     githubIdentity,
-    githubApi: (token) => createGithubApi({ token }),
+    githubApi: (token) => createGithubApi({ token, identity: githubIdentity }),
     org: PERSONA_REPO_ORG,
     claimPublisher: async (personaId2, environment = "production") => {
       const loginPass = targetLoginPass(environment);