@clawos-dev/clawd 0.2.731 → 0.2.733

package/dist/app-builder-plugin/mcp-server.cjs

@@ -31378,12 +31378,6 @@ var EnvPackageSchema = external_exports.object({
    */
   aptVersion: external_exports.string().optional()
 });
-var EnvSecretSchema = external_exports.object({
-  name: external_exports.string().min(1),
-  // 解析出的值注入到哪些环境变量。一份凭据可含多个字段（AK 是 id+secret 两个，
-  // supabase 是 url/anon/service-role/jwt 四个），所以是数组不是单值。
-  env: external_exports.array(external_exports.string().min(1)).min(1)
-});
 var ConnectorNameSchema = external_exports.string().regex(/^[a-z0-9-]+$/, "\u8FDE\u63A5\u5668\u540D\u53EA\u80FD\u662F\u5C0F\u5199\u5B57\u6BCD\u3001\u6570\u5B57\u548C\u77ED\u6A2A\u7EBF");
 var CONNECTOR_KINDS = ["proxy", "env"];
 var CONNECTOR_RUNNERS = ["mcp", "cli"];
@@ -31391,6 +31385,10 @@ var CONNECTOR_PROTOCOLS = ["bearer", "lark-sidecar"];
 var CREDENTIAL_SOURCES = ["none", "shared", "personal"];
 var CONNECTOR_AUTHS = ["oauth", "fields"];
 var ConnectorFieldSchema = external_exports.string().regex(/^[A-Z][A-Z0-9_]*$/, "\u8981\u586B\u7684\u53D8\u91CF\u540D\u53EA\u80FD\u662F\u5927\u5199\u5B57\u6BCD\u3001\u6570\u5B57\u548C\u4E0B\u5212\u7EBF\uFF0C\u4E14\u4EE5\u5B57\u6BCD\u5F00\u5934");
+var EnvVarSchema = external_exports.object({
+  name: external_exports.string().min(1),
+  env: external_exports.array(ConnectorFieldSchema).min(1)
+});
 var EnvConnectorSchema = external_exports.object({
   name: ConnectorNameSchema,
   kind: external_exports.enum(CONNECTOR_KINDS),
@@ -31415,6 +31413,12 @@ var normalizeLegacyManifest = (v) => {
     const { assets: _dropped, ...rest } = o;
     o = rest;
   }
+  if ("secrets" in o && Array.isArray(o.secrets)) {
+    const { secrets, ...rest } = o;
+    const fields = new Set((Array.isArray(rest.connectors) ? rest.connectors : []).flatMap((c) => Array.isArray(c?.fields) ? c.fields : []));
+    const legacy = secrets.map((g) => ({ ...g, env: Array.isArray(g?.env) ? g.env.filter((e) => !fields.has(e)) : g?.env })).filter((g) => !Array.isArray(g.env) || g.env.length > 0);
+    o = { ...rest, envVars: [...Array.isArray(rest.envVars) ? rest.envVars : [], ...legacy] };
+  }
   return o;
 };
 var PublisherTestSchema = external_exports.object({
@@ -31426,12 +31430,13 @@ var PublisherTestSchema = external_exports.object({
 var MANIFEST_BODY = {
   test: PublisherTestSchema.optional(),
   packages: external_exports.array(EnvPackageSchema),
-  secrets: external_exports.array(EnvSecretSchema),
+  /** 环境变量（见 `EnvVarSchema`）。缺省空：没声明就是没有。 */
+  envVars: external_exports.array(EnvVarSchema).default([]),
   /**
    * 装了哪些连接器（design 2026-09-11-mcp-connector §3.1）。一条一个对象，形状见 `EnvConnectorSchema`。
    *
-   * 不复用 secrets：那段说的是「需要一份值，由部署者填」；连接器的凭据谁出是单据上点出来的，
-   * 三种来源里只有「共享」才落到 Secrets，而且靠 `sharedConnectorSecrets` 在消费处并入，不写进那段。
+   * 凭据归连接器自己（`fields`），不进 envVars：谁出是单据上点出来的，
+   * 三种来源里只有「共享」才落到 Secrets，而且靠 `sharedConnectorSecrets` 在消费处并入。
    *
    * **缺省空而不是必填**：本机上已有的单据不用为此重扫一遍；没声明就是没装。
    */
@@ -31445,7 +31450,7 @@ var EnvironmentManifestSchema = external_exports.preprocess(normalizeLegacyManif
   ...MANIFEST_BODY
 }).strict());
 var EnvEvidenceSchema = external_exports.object({
-  // 这条证据支持的是哪一项：`${kind}:${name}`，如 'package:aliyun' / 'secret:aliyun-ak' / 'connector:feishu'
+  // 这条证据支持的是哪一项：`${kind}:${name}`，如 'package:aliyun' / 'env:aliyun-ak' / 'connector:feishu'
   target: external_exports.string().min(1),
   reason: external_exports.string().min(1),
   file: external_exports.string().min(1),
@@ -31950,7 +31955,7 @@ var DeployRerunJobArgsSchema = external_exports.object({
 }).strict();
 var DeployReportFindingArgsSchema = external_exports.object({
   personaId: external_exports.string().min(1),
-  kind: external_exports.enum(["package", "secret", "connector"]),
+  kind: external_exports.enum(["package", "env", "connector"]),
   // 该条目在 manifest 对应数组里的内容（形状随 kind 变，handler 按 kind 收窄校验）
   // connector 的 item 是 butler 报的 CLI 连接器（{ name, fields? }），daemon 补齐 kind / runner / id 后落进清单；
   // MCP 连接器不经这里——由 daemon 从 .mcp.json 机械列出（design 2026-09-11-mcp-connector §3.2）
@@ -34013,7 +34018,7 @@ var METHOD_DOCS = {
     }
   },
   "deploy:reportFinding": {
-    summary: "\u626B\u63CF\u4E2D\u7684 butler \u9010\u6761\u4E0A\u62A5\u4E00\u4E2A\u53D1\u73B0\uFF08cli / secret / asset\uFF09\u3002**\u8FB9\u626B\u8FB9\u62A5**\uFF0C\u9875\u9762\u968F\u4E4B\u4E00\u70B9\u70B9\u586B\u5145\uFF1B\u540C (kind,name) \u91CD\u590D\u4E0A\u62A5\u5373\u8986\u76D6\u3002\u53EA\u56DE\u626B\u63CF\u5386\u53F2 `scans`\uFF08\u540C deploy:patch\uFF09\uFF0C\u4E0D\u56DE\u6574\u4EFD\u72B6\u6001\uFF1Bowner-only\u2014\u2014butler \u4F1A\u8BDD\u672C\u8EAB\u8DD1\u5728 owner \u6A21\u5F0F",
+    summary: "\u626B\u63CF\u4E2D\u7684 butler \u9010\u6761\u4E0A\u62A5\u4E00\u4E2A\u53D1\u73B0\uFF08package / env / connector\uFF09\u3002**\u8FB9\u626B\u8FB9\u62A5**\uFF0C\u9875\u9762\u968F\u4E4B\u4E00\u70B9\u70B9\u586B\u5145\uFF1B\u540C (kind,name) \u91CD\u590D\u4E0A\u62A5\u5373\u8986\u76D6\u3002\u53EA\u56DE\u626B\u63CF\u5386\u53F2 `scans`\uFF08\u540C deploy:patch\uFF09\uFF0C\u4E0D\u56DE\u6574\u4EFD\u72B6\u6001\uFF1Bowner-only\u2014\u2014butler \u4F1A\u8BDD\u672C\u8EAB\u8DD1\u5728 owner \u6A21\u5F0F",
     args: DeployReportFindingArgsSchema
   },
   "deploy:finishScan": {

package/dist/cli.cjs

@@ -6174,9 +6174,13 @@ function sharedConnectorSecrets(m3) {
   return m3.connectors.filter((c2) => c2.credentialSource === "shared" && c2.fields.length > 0).map((c2) => ({ name: c2.name, env: [...c2.fields] }));
 }
 function requiredSecretEnvNames(m3) {
-  return [.../* @__PURE__ */ new Set([...m3.secrets.flatMap((s2) => s2.env), ...sharedConnectorSecrets(m3).flatMap((s2) => s2.env)])];
+  return [.../* @__PURE__ */ new Set([...m3.envVars.flatMap((s2) => s2.env), ...sharedConnectorSecrets(m3).flatMap((s2) => s2.env)])];
 }
-var EnvArtifactSchema, CLOUD_DEBIAN, CLOUD_ROOT_PROVIDES, CLOUD_BASE_PROVIDES, EnvPackageSchema, EnvSecretSchema, ConnectorNameSchema, CONNECTOR_KINDS, CONNECTOR_RUNNERS, CONNECTOR_PROTOCOLS, CREDENTIAL_SOURCES, CONNECTOR_AUTHS, ConnectorFieldSchema, EnvConnectorSchema, FEISHU_BOT_FIELDS, GO_SPEC_RE, GO_MOVING_REFS, normalizeLegacyManifest, PUBLISHER_TEST_NOTE_PREFIX, PublisherTestSchema, MANIFEST_BODY, EnvManifestBodySchema, EnvironmentManifestSchema, EnvEvidenceSchema;
+function envVarBlockers(m3) {
+  const fields = new Set(m3.connectors.flatMap((c2) => c2.fields));
+  return [...new Set(m3.envVars.flatMap((v3) => v3.env))].filter((env) => fields.has(env)).map((env) => `${env} \u540C\u65F6\u662F\u73AF\u5883\u53D8\u91CF\u548C\u8FDE\u63A5\u5668\u7684\u5B57\u6BB5\uFF0C\u53EA\u80FD\u7559\u4E00\u5904\u2014\u2014\u91CD\u65B0\u626B\u63CF`);
+}
+var EnvArtifactSchema, CLOUD_DEBIAN, CLOUD_ROOT_PROVIDES, CLOUD_BASE_PROVIDES, EnvPackageSchema, ConnectorNameSchema, CONNECTOR_KINDS, CONNECTOR_RUNNERS, CONNECTOR_PROTOCOLS, CREDENTIAL_SOURCES, CONNECTOR_AUTHS, ConnectorFieldSchema, EnvVarSchema, EnvConnectorSchema, FEISHU_BOT_FIELDS, GO_SPEC_RE, GO_MOVING_REFS, normalizeLegacyManifest, PUBLISHER_TEST_NOTE_PREFIX, PublisherTestSchema, MANIFEST_BODY, EnvManifestBodySchema, EnvironmentManifestSchema, EnvEvidenceSchema;
 var init_environment_schemas = __esm({
   "../protocol/src/environment-schemas.ts"() {
     "use strict";
@@ -6246,12 +6250,6 @@ var init_environment_schemas = __esm({
        */
       aptVersion: external_exports.string().optional()
     });
-    EnvSecretSchema = external_exports.object({
-      name: external_exports.string().min(1),
-      // 解析出的值注入到哪些环境变量。一份凭据可含多个字段（AK 是 id+secret 两个，
-      // supabase 是 url/anon/service-role/jwt 四个），所以是数组不是单值。
-      env: external_exports.array(external_exports.string().min(1)).min(1)
-    });
     ConnectorNameSchema = external_exports.string().regex(/^[a-z0-9-]+$/, "\u8FDE\u63A5\u5668\u540D\u53EA\u80FD\u662F\u5C0F\u5199\u5B57\u6BCD\u3001\u6570\u5B57\u548C\u77ED\u6A2A\u7EBF");
     CONNECTOR_KINDS = ["proxy", "env"];
     CONNECTOR_RUNNERS = ["mcp", "cli"];
@@ -6259,6 +6257,10 @@ var init_environment_schemas = __esm({
     CREDENTIAL_SOURCES = ["none", "shared", "personal"];
     CONNECTOR_AUTHS = ["oauth", "fields"];
     ConnectorFieldSchema = external_exports.string().regex(/^[A-Z][A-Z0-9_]*$/, "\u8981\u586B\u7684\u53D8\u91CF\u540D\u53EA\u80FD\u662F\u5927\u5199\u5B57\u6BCD\u3001\u6570\u5B57\u548C\u4E0B\u5212\u7EBF\uFF0C\u4E14\u4EE5\u5B57\u6BCD\u5F00\u5934");
+    EnvVarSchema = external_exports.object({
+      name: external_exports.string().min(1),
+      env: external_exports.array(ConnectorFieldSchema).min(1)
+    });
     EnvConnectorSchema = external_exports.object({
       name: ConnectorNameSchema,
       kind: external_exports.enum(CONNECTOR_KINDS),
@@ -6286,6 +6288,12 @@ var init_environment_schemas = __esm({
         const { assets: _dropped, ...rest } = o2;
         o2 = rest;
       }
+      if ("secrets" in o2 && Array.isArray(o2.secrets)) {
+        const { secrets, ...rest } = o2;
+        const fields = new Set((Array.isArray(rest.connectors) ? rest.connectors : []).flatMap((c2) => Array.isArray(c2?.fields) ? c2.fields : []));
+        const legacy = secrets.map((g3) => ({ ...g3, env: Array.isArray(g3?.env) ? g3.env.filter((e) => !fields.has(e)) : g3?.env })).filter((g3) => !Array.isArray(g3.env) || g3.env.length > 0);
+        o2 = { ...rest, envVars: [...Array.isArray(rest.envVars) ? rest.envVars : [], ...legacy] };
+      }
       return o2;
     };
     PUBLISHER_TEST_NOTE_PREFIX = "Publisher test: ";
@@ -6298,12 +6306,13 @@ var init_environment_schemas = __esm({
     MANIFEST_BODY = {
       test: PublisherTestSchema.optional(),
       packages: external_exports.array(EnvPackageSchema),
-      secrets: external_exports.array(EnvSecretSchema),
+      /** 环境变量（见 `EnvVarSchema`）。缺省空：没声明就是没有。 */
+      envVars: external_exports.array(EnvVarSchema).default([]),
       /**
        * 装了哪些连接器（design 2026-09-11-mcp-connector §3.1）。一条一个对象，形状见 `EnvConnectorSchema`。
        *
-       * 不复用 secrets：那段说的是「需要一份值，由部署者填」；连接器的凭据谁出是单据上点出来的，
-       * 三种来源里只有「共享」才落到 Secrets，而且靠 `sharedConnectorSecrets` 在消费处并入，不写进那段。
+       * 凭据归连接器自己（`fields`），不进 envVars：谁出是单据上点出来的，
+       * 三种来源里只有「共享」才落到 Secrets，而且靠 `sharedConnectorSecrets` 在消费处并入。
        *
        * **缺省空而不是必填**：本机上已有的单据不用为此重扫一遍；没声明就是没装。
        */
@@ -6317,7 +6326,7 @@ var init_environment_schemas = __esm({
       ...MANIFEST_BODY
     }).strict());
     EnvEvidenceSchema = external_exports.object({
-      // 这条证据支持的是哪一项：`${kind}:${name}`，如 'package:aliyun' / 'secret:aliyun-ak' / 'connector:feishu'
+      // 这条证据支持的是哪一项：`${kind}:${name}`，如 'package:aliyun' / 'env:aliyun-ak' / 'connector:feishu'
       target: external_exports.string().min(1),
       reason: external_exports.string().min(1),
       file: external_exports.string().min(1),
@@ -6934,7 +6943,7 @@ var init_deploy_schemas = __esm({
     DEPLOY_STALE_BASE_ERROR = "\u5E95\u5EA7\u5DF2\u66F4\u65B0\uFF0C\u91CD\u8BD5\u4ECD\u4F1A\u7528\u65E7\u5E95\u5EA7\u6784\u5EFA\u2014\u2014\u8BF7\u91CD\u65B0\u53D1\u5E03\u6D4B\u8BD5\u73AF\u5883";
     DeployReportFindingArgsSchema = external_exports.object({
       personaId: external_exports.string().min(1),
-      kind: external_exports.enum(["package", "secret", "connector"]),
+      kind: external_exports.enum(["package", "env", "connector"]),
       // 该条目在 manifest 对应数组里的内容（形状随 kind 变，handler 按 kind 收窄校验）
       // connector 的 item 是 butler 报的 CLI 连接器（{ name, fields? }），daemon 补齐 kind / runner / id 后落进清单；
       // MCP 连接器不经这里——由 daemon 从 .mcp.json 机械列出（design 2026-09-11-mcp-connector §3.2）
@@ -9286,7 +9295,7 @@ var init_methods = __esm({
         }
       },
       "deploy:reportFinding": {
-        summary: "\u626B\u63CF\u4E2D\u7684 butler \u9010\u6761\u4E0A\u62A5\u4E00\u4E2A\u53D1\u73B0\uFF08cli / secret / asset\uFF09\u3002**\u8FB9\u626B\u8FB9\u62A5**\uFF0C\u9875\u9762\u968F\u4E4B\u4E00\u70B9\u70B9\u586B\u5145\uFF1B\u540C (kind,name) \u91CD\u590D\u4E0A\u62A5\u5373\u8986\u76D6\u3002\u53EA\u56DE\u626B\u63CF\u5386\u53F2 `scans`\uFF08\u540C deploy:patch\uFF09\uFF0C\u4E0D\u56DE\u6574\u4EFD\u72B6\u6001\uFF1Bowner-only\u2014\u2014butler \u4F1A\u8BDD\u672C\u8EAB\u8DD1\u5728 owner \u6A21\u5F0F",
+        summary: "\u626B\u63CF\u4E2D\u7684 butler \u9010\u6761\u4E0A\u62A5\u4E00\u4E2A\u53D1\u73B0\uFF08package / env / connector\uFF09\u3002**\u8FB9\u626B\u8FB9\u62A5**\uFF0C\u9875\u9762\u968F\u4E4B\u4E00\u70B9\u70B9\u586B\u5145\uFF1B\u540C (kind,name) \u91CD\u590D\u4E0A\u62A5\u5373\u8986\u76D6\u3002\u53EA\u56DE\u626B\u63CF\u5386\u53F2 `scans`\uFF08\u540C deploy:patch\uFF09\uFF0C\u4E0D\u56DE\u6574\u4EFD\u72B6\u6001\uFF1Bowner-only\u2014\u2014butler \u4F1A\u8BDD\u672C\u8EAB\u8DD1\u5728 owner \u6A21\u5F0F",
         args: DeployReportFindingArgsSchema
       },
       "deploy:finishScan": {
@@ -49195,6 +49204,33 @@ function attachPersonaSecretMcp(ctx, resolve9) {
   return { ...ctx, mcpConfigs: [...ctx.mcpConfigs ?? [], ref] };
 }
 
+// src/persona/persona-env-vars.ts
+init_protocol();
+function personaEnvVars(args) {
+  let parsed;
+  try {
+    parsed = DeployFileSchema.safeParse(JSON.parse(args.manifestText));
+  } catch {
+    throw new Error("deploy.json \u4E0D\u662F\u5408\u6CD5 JSON");
+  }
+  if (!parsed.success) throw new Error("deploy.json \u8BFB\u4E0D\u51FA\u6E05\u5355");
+  const names = [...new Set(parsed.data.manifest.envVars.flatMap((v3) => v3.env))];
+  const env = {};
+  const missing = [];
+  for (const name of names) {
+    const value = args.secrets[name];
+    if (value) env[name] = value;
+    else missing.push(name);
+  }
+  return { env, missing };
+}
+function attachPersonaEnvVars(ctx, resolve9) {
+  if (!resolve9 || !ctx.personaId) return ctx;
+  const vars = resolve9(ctx.personaId);
+  if (Object.keys(vars).length === 0) return ctx;
+  return { ...ctx, env: { ...vars, ...ctx.env } };
+}
+
 // src/ipc-recorder.ts
 var import_node_fs15 = __toESM(require("fs"), 1);
 var import_node_path14 = __toESM(require("path"), 1);
@@ -49696,6 +49732,7 @@ var SessionRunner = class {
     let ctx;
     try {
       ctx = attachPersonaSecretMcp(rawCtx, this.hooks.resolvePersonaMcpConfig);
+      if (!this.state.file.larkChatId) ctx = attachPersonaEnvVars(ctx, this.hooks.resolvePersonaEnvVars);
     } catch (err) {
       const message = `persona secret mcp render failed: ${err instanceof Error ? err.message : String(err)}`;
       this.hooks.logger?.error("persona.mcp-secret.render-failed", {
@@ -50236,6 +50273,7 @@ var SessionManager = class {
       getClawosApi: this.deps.getClawosApi,
       getMcpConfigs: () => this.deps.mcpConfigs ?? [],
       resolvePersonaMcpConfig: this.deps.resolvePersonaMcpConfig,
+      resolvePersonaEnvVars: this.deps.resolvePersonaEnvVars,
       // 只传人格补充层读闭包，避免把整个 store 下沉；缺 store 不追加。
       readPersonalityLocal: this.deps.personaStore ? (id) => this.deps.personaStore?.readPersonalityLocal(id) ?? null : void 0,
       lookupDispatchByBSessionId: this.deps.personaDispatchManager ? (bSid) => this.deps.personaDispatchManager?.lookupDispatchByBSessionId(bSid) : void 0,
@@ -58985,7 +59023,9 @@ function normalizeLegacyScan(raw) {
       rest.evidence = rest.evidence.map((e) => {
         if (!e || typeof e !== "object" || typeof e.target !== "string") return e;
         const target = e.target;
-        return target.startsWith("cli:") ? { ...e, target: `package:${target.slice("cli:".length)}` } : e;
+        if (target.startsWith("cli:")) return { ...e, target: `package:${target.slice("cli:".length)}` };
+        if (target.startsWith("secret:")) return { ...e, target: `env:${target.slice("secret:".length)}` };
+        return e;
       });
     }
     return rest;
@@ -59029,14 +59069,14 @@ function replaceScan(file, entry) {
   return { ...file, scans: idx === -1 ? [...file.scans, entry] : file.scans.map((s2, i2) => i2 === idx ? entry : s2) };
 }
 function emptyDeployFile() {
-  return { version: 1, manifest: { version: 1, packages: [], secrets: [], connectors: [] } };
+  return { version: 1, manifest: { version: 1, packages: [], envVars: [], connectors: [] } };
 }
 var PackageFindingSchema = EnvPackageSchema.omit({ localVersion: true, artifact: true, aptMissing: true, aptVersion: true }).extend({
   artifact: external_exports.object({ url: external_exports.string().url(), bin: external_exports.string() }).strict().optional()
 });
 var FINDING_SCHEMAS = {
   package: PackageFindingSchema,
-  secret: EnvSecretSchema,
+  env: EnvVarSchema,
   // 仅收 CLI 连接器发现；MCP 由 scanMcpConnectors 从配置列出。
   connector: CliConnectorFindingSchema
 };
@@ -59090,7 +59130,7 @@ function upsertFinding(manifest, kind, item) {
     const connectors = idx2 === -1 ? [...have, merged] : have.map((c2, i2) => i2 === idx2 ? merged : c2);
     return { ...manifest, connectors };
   }
-  const key = kind === "package" ? "packages" : "secrets";
+  const key = kind === "package" ? "packages" : "envVars";
   const list = [...manifest[key]];
   const idx = list.findIndex((x2) => x2.name === item.name);
   if (idx === -1) list.push(item);
@@ -63114,6 +63154,7 @@ var UNPUBLISH_WORKFLOW_FILE = "clawd-unpublish.yml";
 var UNPUBLISH_WORKFLOW_PATH = `.github/workflows/${UNPUBLISH_WORKFLOW_FILE}`;
 var DOCKERFILE_PATH = "Dockerfile";
 var DOCKERIGNORE_PATH = ".dockerignore";
+var INSTALL_FILE_PATH = ".clawd/deploy-install.json";
 var ACR_REGISTRY = "registry.cn-hangzhou.aliyuncs.com";
 var ACR_VPC_REGISTRY = "registry-vpc.cn-hangzhou.aliyuncs.com";
 var ACR_NAMESPACE = "ttc-prod";
@@ -63140,6 +63181,13 @@ function mergeGitignore(existing) {
 function personaIdOf(repoName) {
   return String(repoName).toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
 }
+function renderInstallFile(deployFileRaw) {
+  const parsed = JSON.parse(deployFileRaw);
+  const manifest = parsed.manifest ?? parsed;
+  const assets = Array.isArray(manifest.assets) && manifest.assets.length ? { assets: manifest.assets } : {};
+  return `${JSON.stringify({ version: 1, manifest: { packages: manifest.packages ?? manifest.clis ?? [], ...assets } }, null, 2)}
+`;
+}
 function renderDockerfile(personaId2, baseImage) {
   if (typeof baseImage !== "string" || !/^[a-z0-9.-]+(?::[0-9]+)?\/[a-z0-9._/-]+@sha256:[a-f0-9]{64}$/.test(baseImage)) throw new Error("base image must be a complete digest reference");
   if (!/^[a-z0-9][a-z0-9-]{0,39}$/.test(personaId2)) throw new Error(`persona id \u4E0D\u5408\u5F62\u72B6\uFF08[a-z0-9-]\uFF0C\u226440\uFF09\uFF1A${JSON.stringify(personaId2)}`);
@@ -63149,9 +63197,11 @@ function renderDockerfile(personaId2, baseImage) {
     "# \u7531 clawd \u751F\u6210\u3001\u7531 clawd \u7EF4\u62A4\uFF1A\u6BCF\u6B21\u300C\u53D1\u5E03\u300D\u90FD\u4F1A\u7528\u5F53\u524D\u6A21\u677F\u91CD\u5199\u8FD9\u4EFD\u6587\u4EF6\u518D\u63D0\u4EA4\uFF0C\u624B\u6539\u4F1A\u88AB\u76D6\u6389\u3002",
     "# \u963F\u91CC\u4E91\u5BB9\u5668\u955C\u50CF\u670D\u52A1\uFF08ACR\uFF09\u4ECE\u8FD9\u4E2A\u4ED3\u5E93\u6784 persona \u955C\u50CF\u65F6\u7528\u5B83\uFF1BGitHub \u7684 runner \u4E0D\u6784\u3001\u4E0D\u63A8\u955C\u50CF\u3002",
     "# \u8981\u88C5\u4EC0\u4E48\u5199\u5728 .clawd/deploy.json \u91CC\uFF0C\u7531\u5E95\u5EA7\u81EA\u5E26\u7684\u5B89\u88C5\u5668\u5728\u6784\u5EFA\u65F6\u73B0\u88C5\u2014\u2014\u8FD9\u91CC\u4E0D\u5217\u4EFB\u4F55\u4E00\u6761\u4F9D\u8D56\uFF0C",
-    "# \u6240\u4EE5\u6587\u4EF6\u4E0D\u968F\u6E05\u5355\u53D8\uFF1B\u5148\u53EA\u62F7\u6E05\u5355\u518D\u88C5\uFF0Cpersona \u5185\u5BB9\u6539\u4E86\u4E5F\u4E0D\u7528\u91CD\u88C5\u3002",
+    "# \u6240\u4EE5\u6587\u4EF6\u4E0D\u968F\u6E05\u5355\u53D8\uFF1B\u5148\u53EA\u62F7\u5B89\u88C5\u6E05\u5355\uFF08deploy-install.json\uFF0C\u53EA\u542B\u8981\u88C5\u7684\u4E1C\u897F\uFF09\u518D\u88C5\uFF0Cpersona \u5185\u5BB9\u6216\u51ED\u636E\u914D\u7F6E\u6539\u4E86\u4E5F\u4E0D\u7528\u91CD\u88C5\u3002",
+    "# deploy-install.json \u7531\u53D1\u5E03\u65F6\u4ECE deploy.json \u751F\u6210\uFF1A\u6539\u8981\u88C5\u7684\u5305\u987B\u7ECF clawd \u53D1\u5E03\uFF0C\u624B\u6539 deploy.json \u518D push \u4E0D\u4F1A\u751F\u6548\u3002",
     `FROM ${fromImage}`,
-    `COPY .clawd/deploy.json ${dir}/.clawd/deploy.json`,
+    // 拷到安装器读的位置；最后一条 COPY . 再用完整的 deploy.json 盖回来
+    `COPY ${INSTALL_FILE_PATH} ${dir}/.clawd/deploy.json`,
     `RUN node ${PERSONA_LAYER_SCRIPT} ${dir}`,
     `COPY . ${dir}/`,
     ""
@@ -63293,7 +63343,7 @@ var runCommand = (cmd, args, opts = {}) => new Promise((resolve9) => {
 // src/deploy/repo.ts
 var DEPLOY_FILE_REL = DEPLOY_FILE.split(import_node_path44.default.sep).join("/");
 var PERSONA_FILE_REL = ".clawd/persona.json";
-var DIRTY_IGNORED = [DEPLOY_FILE_REL, PERSONA_FILE_REL];
+var DIRTY_IGNORED = [DEPLOY_FILE_REL, PERSONA_FILE_REL, INSTALL_FILE_PATH];
 var RepoError = class extends Error {
 };
 var tail = (s2, n2 = 400) => s2.trim().slice(-n2);
@@ -63452,6 +63502,8 @@ async function writeDockerfile(dir, personaId2, image) {
 `);
   await import_promises5.default.writeFile(import_node_path44.default.join(dir, DOCKERFILE_PATH), renderDockerfile(personaId2, baseImage));
   await import_promises5.default.writeFile(import_node_path44.default.join(dir, DOCKERIGNORE_PATH), DOCKERIGNORE_TEMPLATE);
+  const deployFile = await readDeployFileRaw(dir);
+  if (deployFile !== void 0) await import_promises5.default.writeFile(import_node_path44.default.join(dir, INSTALL_FILE_PATH), renderInstallFile(deployFile));
 }
 var RepoAlreadyExistsError = class extends RepoError {
   constructor(slug) {
@@ -64594,8 +64646,8 @@ function buildDeployHandlers(deps) {
     const args = parseArgs2(DeployPutSecretArgsSchema, frame, "deploy:putSecret");
     const dir = mustPersona(args.personaId);
     const { manifest } = mustScan(await readHistory(dir), args.scanId);
-    const declared = [...manifest.secrets, ...sharedConnectorSecrets(manifest)].find((s2) => s2.name === args.name);
-    if (!declared) throw invalid(`\u6E05\u5355\u91CC\u6CA1\u6709\u53EB\u300C${args.name}\u300D\u7684\u51ED\u636E`);
+    const declared = [...manifest.envVars, ...sharedConnectorSecrets(manifest)].find((s2) => s2.name === args.name);
+    if (!declared) throw invalid(`\u6E05\u5355\u91CC\u6CA1\u6709\u53EB\u300C${args.name}\u300D\u7684\u73AF\u5883\u53D8\u91CF\u6216\u5171\u4EAB\u8FDE\u63A5\u5668`);
     const allowed = new Set(declared.env);
     for (const key of Object.keys(args.values)) {
       if (!allowed.has(key)) throw invalid(`\u300C${args.name}\u300D\u6CA1\u6709\u58F0\u660E\u73AF\u5883\u53D8\u91CF ${key}`);
@@ -64881,6 +64933,7 @@ function buildDeployHandlers(deps) {
     if (missing.length > 0) blockers.push(`${missing.join(" / ")} \u8FD8\u6CA1\u586B`);
     if (engineAuthState(secrets) === "partial") blockers.push(ENGINE_AUTH_PARTIAL_BLOCKER);
     for (const c2 of entry.manifest.connectors) blockers.push(...connectorBlockers(c2));
+    blockers.push(...envVarBlockers(entry.manifest));
     for (const p3 of entry.manifest.packages) blockers.push(...packageBlockers(p3));
     const cloudEngine = cloudEngineSettings(deps.personaEngine(personaId2) ?? {});
     if (!cloudEngine.model) {
@@ -76169,7 +76222,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.731".length > 0 ? "0.2.731" : "dev";
+var version = "0.2.733".length > 0 ? "0.2.733" : "dev";
 
 // src/cli-probe/probe.ts
 var fs87 = __toESM(require("fs"), 1);
@@ -78949,6 +79002,23 @@ async function startDaemon(config) {
       logger
     });
   };
+  const resolvePersonaEnvVars = (personaId2) => {
+    const file = import_node_path90.default.join(config.dataDir, "personas", personaId2, DEPLOY_FILE);
+    let manifestText;
+    try {
+      manifestText = import_node_fs69.default.readFileSync(file, "utf8");
+    } catch {
+      return {};
+    }
+    try {
+      const { env, missing } = personaEnvVars({ manifestText, secrets: readSecrets() });
+      if (missing.length > 0) logger.warn("persona.env-vars.missing", { personaId: personaId2, names: missing });
+      return env;
+    } catch (err) {
+      logger.warn("persona.env-vars.unreadable", { personaId: personaId2, message: err instanceof Error ? err.message : String(err) });
+      return {};
+    }
+  };
   const mcpDaemonUrl = `http://127.0.0.1:${config.port}`;
   const dispatchServerCandidates = [
     import_node_path90.default.join(here, "dispatch", "mcp-server.cjs"),
@@ -79140,6 +79210,7 @@ async function startDaemon(config) {
     mcpConfigs,
     // Render MCP configs outside the pure reducer because rendering performs filesystem IO.
     resolvePersonaMcpConfig,
+    resolvePersonaEnvVars,
     generateTitle: (file, firstMessage, signal) => generateSessionTitle(file, firstMessage, {
       logger,
       signal,