@clawos-dev/clawd 0.2.725 → 0.2.726

package/dist/cli.cjs

@@ -6650,7 +6650,7 @@ function changedConfigKeys(a2, b3) {
 function repoSlug(url) {
   return url.trim().replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
 }
-var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DEPLOY_PROMOTION_PHASES, DeployPromotionSchema, DeployEngineChannelSchema, DeployEngineChannelsSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, ENGINE_AUTH_SECRETS, ENGINE_AUTH_PARTIAL_BLOCKER, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_VERIFY_STAGE, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, ReservationStateSchema, DeployCloudStatusSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployLocalStateSchema, DeployPatchResultSchema, DeploySecretsResultSchema, DEPLOY_WORKFLOW_VERSION, workflowVersionForConfigKeys, DEFAULT_TASK_CONCURRENCY, CONFIG_KEYS, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployConfirmTestArgsSchema, DeployPromoteArgsSchema, DeployApplyConfigArgsSchema, DeployOpenTestArgsSchema, DeployEnvironmentArgsSchema, DeployConfirmTestResultSchema, DeployPromoteResultSchema, DeployOpenTestResultSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeploySetEngineAuthArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
+var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DEPLOY_PROMOTION_PHASES, DeployPromotionSchema, DeployEngineChannelSchema, DeployEngineChannelsSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, ENGINE_AUTH_SECRETS, ENGINE_AUTH_PARTIAL_BLOCKER, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_VERIFY_STAGE, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, ReservationStateSchema, DeployCloudStatusSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployLocalStateSchema, DeployPatchResultSchema, DeploySecretsResultSchema, DEPLOY_WORKFLOW_VERSION, workflowVersionForConfigKeys, DEFAULT_TASK_CONCURRENCY, CONFIG_KEYS, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployConfirmTestArgsSchema, DeployPromoteArgsSchema, DeployApplyConfigArgsSchema, DeployOpenTestArgsSchema, DeployEnvironmentArgsSchema, DeployConfirmTestResultSchema, DeployPromoteResultSchema, DeployOpenTestResultSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeploySetEngineAuthArgsSchema, DeployRerunJobArgsSchema, DEPLOY_STALE_BASE_ERROR, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
 var init_deploy_schemas = __esm({
   "../protocol/src/deploy-schemas.ts"() {
     "use strict";
@@ -6929,6 +6929,7 @@ var init_deploy_schemas = __esm({
       releaseId: external_exports.string().optional(),
       jobId: external_exports.number()
     }).strict();
+    DEPLOY_STALE_BASE_ERROR = "\u5E95\u5EA7\u5DF2\u66F4\u65B0\uFF0C\u91CD\u8BD5\u4ECD\u4F1A\u7528\u65E7\u5E95\u5EA7\u6784\u5EFA\u2014\u2014\u8BF7\u91CD\u65B0\u53D1\u5E03\u6D4B\u8BD5\u73AF\u5883";
     DeployReportFindingArgsSchema = external_exports.object({
       personaId: external_exports.string().min(1),
       kind: external_exports.enum(["package", "secret", "connector"]),
@@ -62837,6 +62838,14 @@ async function readCurrentBase(api) {
   if (release2.source.cloudHost !== source.cloudHost || release2.source.workflow !== source.workflow) throw new Error("\u5E95\u5EA7\u5236\u54C1\u6E90\u7801\u7248\u672C\u4E0E\u6784\u5EFA\u63D0\u4EA4\u4E0D\u5339\u914D\uFF0C\u8BF7\u91CD\u65B0\u8FD0\u884C\u5E95\u5EA7\u6D41\u6C34\u7EBF");
   return release2;
 }
+var publicBaseImage = (image) => image.replace("registry-vpc.cn-hangzhou.aliyuncs.com/", "registry.cn-hangzhou.aliyuncs.com/");
+async function pinnedBaseStale(api, slug, sha) {
+  const file = await api.getJson(`/repos/${slug}/contents/.clawd/base-image.txt?ref=${sha}`);
+  if (file?.type !== "file" || file.encoding !== "base64" || typeof file.content !== "string") return false;
+  const pinned = Buffer.from(file.content, "base64").toString("utf8").trim();
+  const current = await readCurrentBase(api).catch(() => void 0);
+  return !!current && publicBaseImage(pinned) !== publicBaseImage(current.image);
+}
 
 // src/deploy/release-workflow.ts
 init_protocol();
@@ -63426,7 +63435,7 @@ async function writeWorkflow(dir) {
   }
 }
 async function writeDockerfile(dir, personaId2, image) {
-  const baseImage = image.replace("registry-vpc.cn-hangzhou.aliyuncs.com/", "registry.cn-hangzhou.aliyuncs.com/");
+  const baseImage = publicBaseImage(image);
   await import_promises5.default.mkdir(import_node_path44.default.join(dir, ".clawd"), { recursive: true });
   await import_promises5.default.writeFile(import_node_path44.default.join(dir, ".clawd", "base-image.txt"), `${baseImage}
 `);
@@ -64922,9 +64931,13 @@ function buildDeployHandlers(deps) {
     const promotion = environment === "production" ? file.promotions.at(-1) : void 0;
     const run = record4?.legacy ? await runByHead(api, slug, record4.head) : record4 ? await findReleaseRun(api, slug, { environment, head: record4.head, promotionId: promotion?.id }) : void 0;
     if (!run) throw invalid("\u67E5\u4E0D\u5230\u8FD9\u4E2A\u4ED3\u5E93\u4E0A\u7684\u6D41\u6C34\u7EBF\uFF08GitHub \u6CA1\u54CD\u5E94\uFF0C\u6216\u8005\u8FD8\u6CA1\u8DD1\u8FC7\uFF09");
-    if (!run.jobs.some((j2) => j2.jobId === jobId)) {
+    const job = run.jobs.find((j2) => j2.jobId === jobId);
+    if (!job) {
       throw invalid("\u8FD9\u4E00\u6BB5\u4E0D\u5728\u6700\u65B0\u90A3\u6761\u6D41\u6C34\u7EBF\u91CC\u4E86\uFF0C\u5237\u65B0\u4E00\u4E0B\u518D\u91CD\u8BD5");
     }
+    if (environment === "integration" && job.key === "build") {
+      if (await pinnedBaseStale(api, slug, run.headSha)) throw invalid(DEPLOY_STALE_BASE_ERROR);
+    }
     try {
       if (record4?.environment === "integration") {
         await configureTestIdentity(api, slug);
@@ -76145,7 +76158,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.725".length > 0 ? "0.2.725" : "dev";
+var version = "0.2.726".length > 0 ? "0.2.726" : "dev";
 
 // src/cli-probe/probe.ts
 var fs87 = __toESM(require("fs"), 1);