@clawos-dev/clawd 0.2.724 → 0.2.726

package/dist/app-builder-plugin/mcp-server.cjs

@@ -31785,7 +31785,9 @@ var DeployJobSchema = external_exports.object({
   /** GitHub 的 job databaseId，`gh run rerun --job` 要用。还没跑起来的段没有 */
   jobId: external_exports.number().optional(),
   startedAt: external_exports.number().optional(),
-  completedAt: external_exports.number().optional()
+  completedAt: external_exports.number().optional(),
+  /** 只有 build 段：构建期 CLI 校验没过、只报警没拦的条目（一条一句） */
+  cliWarnings: external_exports.array(external_exports.string()).optional()
 }).strict();
 var DeployRunSchema = external_exports.object({
   runId: external_exports.number(),

package/dist/cli.cjs

@@ -6650,7 +6650,7 @@ function changedConfigKeys(a2, b3) {
 function repoSlug(url) {
   return url.trim().replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
 }
-var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DEPLOY_PROMOTION_PHASES, DeployPromotionSchema, DeployEngineChannelSchema, DeployEngineChannelsSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, ENGINE_AUTH_SECRETS, ENGINE_AUTH_PARTIAL_BLOCKER, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_VERIFY_STAGE, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, ReservationStateSchema, DeployCloudStatusSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployLocalStateSchema, DeployPatchResultSchema, DeploySecretsResultSchema, DEPLOY_WORKFLOW_VERSION, workflowVersionForConfigKeys, DEFAULT_TASK_CONCURRENCY, CONFIG_KEYS, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployConfirmTestArgsSchema, DeployPromoteArgsSchema, DeployApplyConfigArgsSchema, DeployOpenTestArgsSchema, DeployEnvironmentArgsSchema, DeployConfirmTestResultSchema, DeployPromoteResultSchema, DeployOpenTestResultSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeploySetEngineAuthArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
+var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DEPLOY_PROMOTION_PHASES, DeployPromotionSchema, DeployEngineChannelSchema, DeployEngineChannelsSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, ENGINE_AUTH_SECRETS, ENGINE_AUTH_PARTIAL_BLOCKER, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_VERIFY_STAGE, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, ReservationStateSchema, DeployCloudStatusSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployLocalStateSchema, DeployPatchResultSchema, DeploySecretsResultSchema, DEPLOY_WORKFLOW_VERSION, workflowVersionForConfigKeys, DEFAULT_TASK_CONCURRENCY, CONFIG_KEYS, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployConfirmTestArgsSchema, DeployPromoteArgsSchema, DeployApplyConfigArgsSchema, DeployOpenTestArgsSchema, DeployEnvironmentArgsSchema, DeployConfirmTestResultSchema, DeployPromoteResultSchema, DeployOpenTestResultSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeploySetEngineAuthArgsSchema, DeployRerunJobArgsSchema, DEPLOY_STALE_BASE_ERROR, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
 var init_deploy_schemas = __esm({
   "../protocol/src/deploy-schemas.ts"() {
     "use strict";
@@ -6763,7 +6763,9 @@ var init_deploy_schemas = __esm({
       /** GitHub 的 job databaseId，`gh run rerun --job` 要用。还没跑起来的段没有 */
       jobId: external_exports.number().optional(),
       startedAt: external_exports.number().optional(),
-      completedAt: external_exports.number().optional()
+      completedAt: external_exports.number().optional(),
+      /** 只有 build 段：构建期 CLI 校验没过、只报警没拦的条目（一条一句） */
+      cliWarnings: external_exports.array(external_exports.string()).optional()
     }).strict();
     DeployRunSchema = external_exports.object({
       runId: external_exports.number(),
@@ -6927,6 +6929,7 @@ var init_deploy_schemas = __esm({
       releaseId: external_exports.string().optional(),
       jobId: external_exports.number()
     }).strict();
+    DEPLOY_STALE_BASE_ERROR = "\u5E95\u5EA7\u5DF2\u66F4\u65B0\uFF0C\u91CD\u8BD5\u4ECD\u4F1A\u7528\u65E7\u5E95\u5EA7\u6784\u5EFA\u2014\u2014\u8BF7\u91CD\u65B0\u53D1\u5E03\u6D4B\u8BD5\u73AF\u5883";
     DeployReportFindingArgsSchema = external_exports.object({
       personaId: external_exports.string().min(1),
       kind: external_exports.enum(["package", "secret", "connector"]),
@@ -62835,6 +62838,14 @@ async function readCurrentBase(api) {
   if (release2.source.cloudHost !== source.cloudHost || release2.source.workflow !== source.workflow) throw new Error("\u5E95\u5EA7\u5236\u54C1\u6E90\u7801\u7248\u672C\u4E0E\u6784\u5EFA\u63D0\u4EA4\u4E0D\u5339\u914D\uFF0C\u8BF7\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF");
   return release2;
 }
+var publicBaseImage = (image) => image.replace("registry-vpc.cn-hangzhou.aliyuncs.com/", "registry.cn-hangzhou.aliyuncs.com/");
+async function pinnedBaseStale(api, slug, sha) {
+  const file = await api.getJson(`/repos/${slug}/contents/.clawd/base-image.txt?ref=${sha}`);
+  if (file?.type !== "file" || file.encoding !== "base64" || typeof file.content !== "string") return false;
+  const pinned = Buffer.from(file.content, "base64").toString("utf8").trim();
+  const current = await readCurrentBase(api).catch(() => void 0);
+  return !!current && publicBaseImage(pinned) !== publicBaseImage(current.image);
+}
 
 // src/deploy/release-workflow.ts
 init_protocol();
@@ -63424,7 +63435,7 @@ async function writeWorkflow(dir) {
   }
 }
 async function writeDockerfile(dir, personaId2, image) {
-  const baseImage = image.replace("registry-vpc.cn-hangzhou.aliyuncs.com/", "registry.cn-hangzhou.aliyuncs.com/");
+  const baseImage = publicBaseImage(image);
   await import_promises5.default.mkdir(import_node_path44.default.join(dir, ".clawd"), { recursive: true });
   await import_promises5.default.writeFile(import_node_path44.default.join(dir, ".clawd", "base-image.txt"), `${baseImage}
 `);
@@ -63913,6 +63924,15 @@ function packageNeedsRereport(pkg, probed) {
 init_protocol();
 var INTEGRATION_CONFIG_RUN_PREFIX = "persona-integration-config-";
 var runsOf = (slug, file, query) => `/repos/${slug}/actions/workflows/${encodeURIComponent(file)}/runs?${query}`;
+var CLI_WARNING_TITLE = "CLI version check";
+async function withCliWarnings(api, slug, jobs) {
+  const build = jobs.find((j2) => j2.key === "build");
+  if (build?.status !== "done" || build.jobId === void 0) return { jobs, read: true };
+  const listed = await api.getJson(`/repos/${slug}/check-runs/${build.jobId}/annotations?per_page=100`);
+  if (!Array.isArray(listed)) return { jobs, read: false };
+  const warnings = listed.filter((a2) => a2?.annotation_level === "warning" && a2.title === CLI_WARNING_TITLE && typeof a2.message === "string").flatMap((a2) => String(a2.message).split("\n").filter(Boolean));
+  return { jobs: warnings.length ? jobs.map((j2) => j2 === build ? { ...j2, cliWarnings: warnings } : j2) : jobs, read: true };
+}
 var pipelineJobKey = (name) => DEPLOY_STAGE_KEYS.find((k3) => name === k3 || name.startsWith(`${k3} `));
 function stageStatusOf(status, conclusion) {
   if (status === "queued" || status === "requested" || status === "pending") return "pending";
@@ -64001,8 +64021,9 @@ async function readPinnedRun(api, slug, raw, environment, promotionId, jobsCache
       if (listed.jobs.length < 100 && (listed.total_count === void 0 || page * 100 >= listed.total_count)) break;
       if (page === 30) return void 0;
     }
-    jobs = DEPLOY_STAGE_KEYS.map((key) => byKey.get(key)).filter((j2) => j2 !== void 0);
-    if (status === "completed" && jobsCache) {
+    const annotated = await withCliWarnings(api, slug, DEPLOY_STAGE_KEYS.map((key) => byKey.get(key)).filter((j2) => j2 !== void 0));
+    jobs = annotated.jobs;
+    if (status === "completed" && jobsCache && annotated.read) {
       if (jobsCache.size >= COMPLETED_JOBS_CACHE_MAX) jobsCache.delete(jobsCache.keys().next().value);
       jobsCache.set(cacheKey, jobs);
     }
@@ -64041,7 +64062,7 @@ async function fetchRun(api, slug, query) {
     status: runStatusOf(String(raw.status ?? "")),
     htmlUrl: raw.html_url,
     // 按流水线的顺序排，不跟着 GitHub 返回的顺序走
-    jobs: DEPLOY_STAGE_KEYS.map((k3) => byKey.get(k3)).filter((j2) => j2 !== void 0)
+    jobs: (await withCliWarnings(api, slug, DEPLOY_STAGE_KEYS.map((k3) => byKey.get(k3)).filter((j2) => j2 !== void 0))).jobs
   };
 }
 async function latestUnpublish(api, slug, environment) {
@@ -64910,9 +64931,13 @@ function buildDeployHandlers(deps) {
     const promotion = environment === "production" ? file.promotions.at(-1) : void 0;
     const run = record4?.legacy ? await runByHead(api, slug, record4.head) : record4 ? await findReleaseRun(api, slug, { environment, head: record4.head, promotionId: promotion?.id }) : void 0;
     if (!run) throw invalid("\u67E5\u4E0D\u5230\u8FD9\u4E2A\u4ED3\u5E93\u4E0A\u7684\u6D41\u6C34\u7EBF\uFF08GitHub \u6CA1\u54CD\u5E94\uFF0C\u6216\u8005\u8FD8\u6CA1\u8DD1\u8FC7\uFF09");
-    if (!run.jobs.some((j2) => j2.jobId === jobId)) {
+    const job = run.jobs.find((j2) => j2.jobId === jobId);
+    if (!job) {
       throw invalid("\u8FD9\u4E00\u6BB5\u4E0D\u5728\u6700\u65B0\u90A3\u6761\u6D41\u6C34\u7EBF\u91CC\u4E86\uFF0C\u5237\u65B0\u4E00\u4E0B\u518D\u91CD\u8BD5");
     }
+    if (environment === "integration" && job.key === "build") {
+      if (await pinnedBaseStale(api, slug, run.headSha)) throw invalid(DEPLOY_STALE_BASE_ERROR);
+    }
     try {
       if (record4?.environment === "integration") {
         await configureTestIdentity(api, slug);
@@ -76133,7 +76158,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.724".length > 0 ? "0.2.724" : "dev";
+var version = "0.2.726".length > 0 ? "0.2.726" : "dev";
 
 // src/cli-probe/probe.ts
 var fs87 = __toESM(require("fs"), 1);