@clawos-dev/clawd 0.2.742 → 0.2.744

package/dist/cli.cjs

@@ -6491,6 +6491,7 @@ var init_persona_schemas = __esm({
         gatewayUrl: external_exports.string().min(1),
         personaId: external_exports.string().min(1),
         publishedByMe: external_exports.boolean().optional(),
+        collaboratedByMe: external_exports.boolean().optional(),
         /** Display name (persona.json label) registered on the gateway; the row's top-level label stays the gateway id. */
         label: external_exports.string().optional(),
         environment: DeployEnvironmentSchema.optional(),
@@ -6661,7 +6662,7 @@ function changedConfigKeys(a2, b3) {
 function repoSlug(url) {
   return url.trim().replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
 }
-var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DEPLOY_PROMOTION_PHASES, DeployPromotionSchema, DeployEngineChannelSchema, DeployEngineChannelsSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, ENGINE_AUTH_SECRETS, ENGINE_AUTH_PARTIAL_BLOCKER, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_VERIFY_STAGE, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, ReservationStateSchema, DeployCloudStatusSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployLocalStateSchema, DeployPatchResultSchema, DeploySecretsResultSchema, DEPLOY_WORKFLOW_VERSION, workflowVersionForConfigKeys, DEFAULT_TASK_CONCURRENCY, CONFIG_KEYS, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployConfirmTestArgsSchema, DeployPromoteArgsSchema, DeployApplyConfigArgsSchema, DeployOpenTestArgsSchema, DeployEnvironmentArgsSchema, DeployConfirmTestResultSchema, DeployPromoteResultSchema, DeployOpenTestResultSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeploySetEngineAuthArgsSchema, DeployRerunJobArgsSchema, DEPLOY_STALE_BASE_ERROR, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
+var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployReleasedSchema, DEPLOY_PROMOTION_PHASES, DeployPromotionSchema, DeployEngineChannelSchema, DeployEngineChannelsSchema, DeployScanFileSchema, DeployRepoSchema, DeploySecretPresenceSchema, ENGINE_AUTH_SECRETS, ENGINE_AUTH_PARTIAL_BLOCKER, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_VERIFY_STAGE, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, CLOUD_ENGINES, DeployUnpublishRunSchema, ReservationStateSchema, DeployCloudStatusSchema, DeployStateSchema, DeployUnpublishResultSchema, DeployLocalStateSchema, DeployPatchResultSchema, DeploySecretsResultSchema, DEPLOY_WORKFLOW_VERSION, workflowVersionForConfigKeys, DEFAULT_TASK_CONCURRENCY, CONFIG_KEYS, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployPersonaRoleSchema, DeployEditLockSchema, DeployRepoAccessSchema, DeployCollaboratorSchema, DeployAccessSchema, DeployCollaboratorAddResultSchema, DeployCollaboratorAddArgsSchema, DeployCollaboratorRemoveArgsSchema, DeployEditLockArgsSchema, DeployEditLockResultSchema, DeployTakeoverResultSchema, DeployGetArgsSchema, DeployScanArgsSchema, DeployReleaseArgsSchema, DeployConfirmTestArgsSchema, DeployPromoteArgsSchema, DeployApplyConfigArgsSchema, DeployOpenTestArgsSchema, DeployEnvironmentArgsSchema, DeployConfirmTestResultSchema, DeployPromoteResultSchema, DeployOpenTestResultSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeploySetEngineAuthArgsSchema, DeployRerunJobArgsSchema, DEPLOY_STALE_BASE_ERROR, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
 var init_deploy_schemas = __esm({
   "../protocol/src/deploy-schemas.ts"() {
     "use strict";
@@ -6885,6 +6886,38 @@ var init_deploy_schemas = __esm({
     DeployPersonaArgsSchema = external_exports.object({
       personaId: external_exports.string().min(1)
     }).strict();
+    DeployPersonaRoleSchema = external_exports.enum(["owner", "editor", "admin"]);
+    DeployEditLockSchema = external_exports.object({
+      displayName: external_exports.string(),
+      /** 持有人是不是本人 */
+      mine: external_exports.boolean(),
+      acquiredAt: external_exports.string(),
+      expiresAt: external_exports.string()
+    }).strict();
+    DeployRepoAccessSchema = external_exports.enum(["invited", "active"]);
+    DeployCollaboratorSchema = external_exports.object({
+      unionId: external_exports.string(),
+      displayName: external_exports.string(),
+      githubLogin: external_exports.string().nullable(),
+      createdAt: external_exports.string(),
+      repoAccess: DeployRepoAccessSchema.optional()
+    }).strict();
+    DeployAccessSchema = external_exports.object({
+      role: DeployPersonaRoleSchema,
+      collaborators: external_exports.array(DeployCollaboratorSchema),
+      /** 没人持有或租约已过期 = null */
+      lock: DeployEditLockSchema.nullable(),
+      /** 有协作者的 persona 才走锁 */
+      lockRequired: external_exports.boolean()
+    }).strict();
+    DeployCollaboratorAddResultSchema = DeployAccessSchema.extend({
+      production: external_exports.object({ ok: external_exports.boolean(), reason: external_exports.string().optional() }).strict()
+    }).strict();
+    DeployCollaboratorAddArgsSchema = DeployPersonaArgsSchema.extend({ deviceId: external_exports.string().min(1) }).strict();
+    DeployCollaboratorRemoveArgsSchema = DeployPersonaArgsSchema.extend({ unionId: external_exports.string().min(1) }).strict();
+    DeployEditLockArgsSchema = DeployPersonaArgsSchema.extend({ action: external_exports.enum(["acquire", "renew", "release"]) }).strict();
+    DeployEditLockResultSchema = external_exports.object({ required: external_exports.boolean(), lock: DeployEditLockSchema.nullable() }).strict();
+    DeployTakeoverResultSchema = external_exports.object({ personaId: external_exports.string().min(1) }).strict();
     DeployGetArgsSchema = DeployPersonaArgsSchema.extend({
       releaseHead: external_exports.string().min(1).optional(),
       releaseId: external_exports.string().min(1).optional(),
@@ -9393,6 +9426,30 @@ var init_methods = __esm({
         summary: "\u4E0B\u7EBF\uFF1A\u89E6\u53D1 persona \u4ED3\u5E93\u91CC\u7684 clawd-unpublish.yml\uFF08workflow_dispatch\uFF09\uFF0C\u7531\u6D41\u6C34\u7EBF\u5728 gateway \u64A4\u6389\u6B63\u5F0F\u767B\u8BB0\u2014\u2014\u522B\u4EBA\u770B\u4E0D\u5230\u3001\u7528\u4E0D\u4E86\uFF1B\u4ED3\u5E93 / \u955C\u50CF / \u672C\u673A\u4E0A\u4E91\u8BB0\u5F55\u90FD\u4E0D\u52A8\uFF0C\u91CD\u65B0\u53D1\u5E03\u5C31\u56DE\u6765\u3002\u6700\u540E\u4E00\u6B21\u53D1\u5E03\u7684 commit \u91CC\u6CA1\u6709\u8FD9\u4EFD workflow\uFF08\u65E7\u6A21\u677F\uFF09\u65F6\u62D2\uFF0C\u8981\u5148\u91CD\u65B0\u53D1\u5E03\u4E00\u6B21\u3002\u56DE { before }\uFF1A\u89E6\u53D1\u4E4B\u524D\u73B0\u67E5\u7684\u6700\u65B0\u4E0B\u7EBF run id\uFF08\u6CA1\u4E0B\u7EBF\u8FC7 = null\uFF09\uFF0C\u9875\u9762\u62FF\u5B83\u8BA4\u65B0 run\uFF1Bowner-only\u3001human-only",
         args: DeployEnvironmentArgsSchema
       },
+      "deploy:access": {
+        summary: "\u6211\u5728\u8FD9\u4E2A\u4E91 persona \u4E0A\u7684\u89D2\u8272\uFF08owner / editor / admin\uFF09\u3001\u534F\u4F5C\u8005\u540D\u5355\u3001\u5F53\u524D\u7F16\u8F91\u9501\uFF08\u8C01\u5728\u7F16\u8F91\uFF09\u3002\u8BFB\u6D4B\u8BD5\u73AF\u5883\u7684\u4E2D\u5FC3\uFF08\u6BCF\u4E2A persona \u90FD\u5148\u8FC7\u6D4B\u8BD5\u73AF\u5883\uFF09\uFF1B\u534F\u4F5C\u8005\u7684 daemon \u987A\u624B\u628A\u672C\u673A GitHub \u767B\u5F55\u540D\u62A5\u7ED9\u4E2D\u5FC3\uFF0Cowner \u51ED\u5B83\u9080\u8BF7\u8FDB\u4ED3\u5E93\u3002\u4E2D\u5FC3\u62D2\u7EDD\uFF08\u4E0D\u662F\u53D1\u5E03\u8005\u4E5F\u4E0D\u662F\u534F\u4F5C\u8005\uFF09= \u62A5\u9519\uFF1Bowner-only",
+        args: DeployPersonaArgsSchema
+      },
+      "deploy:collaboratorAdd": {
+        summary: "\u52A0\u534F\u4F5C\u8005\uFF08\u4EC5 persona \u7684\u53D1\u5E03\u8005\uFF09\uFF1A\u5165\u53C2\u662F\u8054\u7CFB\u4EBA\u7684 deviceId\uFF0C\u4E2D\u5FC3\u7ECF\u8BBE\u5907\u7ED1\u5B9A\u89E3\u6790\u98DE\u4E66\u8EAB\u4EFD\uFF0C\u5BF9\u65B9\u8FD8\u6CA1\u7ED1\u98DE\u4E66\u8D26\u53F7\u4F1A\u62D2\u3002\u4EE5\u6D4B\u8BD5\u73AF\u5883\u7684\u4E2D\u5FC3\u4E3A\u51C6\uFF0C\u6B63\u5F0F\u73AF\u5883\u7684\u4E2D\u5FC3\u518D\u767B\u8BB0\u4E00\u4EFD\uFF08\u6CA1\u767B\u8BB0\u6210\u53EA\u5728\u54CD\u5E94\u7684 production \u91CC\u63D0\u793A\uFF09\u3002\u56DE\u52A0\u5B8C\u4E4B\u540E\u7684 deploy:access \u89C6\u56FE\u52A0 production\uFF1Bowner-only\u3001human-only",
+        args: DeployCollaboratorAddArgsSchema
+      },
+      "deploy:collaboratorRemove": {
+        summary: "\u79FB\u9664\u534F\u4F5C\u8005\uFF08\u4EC5\u53D1\u5E03\u8005\uFF09\uFF1A\u6D4B\u8BD5\u3001\u6B63\u5F0F\u4E24\u4E2A\u4E2D\u5FC3\u90FD\u79FB\u9664\u5E76\u653E\u6389\u5BF9\u65B9\u7684\u7F16\u8F91\u9501\u3002GitHub \u4ED3\u5E93\u91CC\u7684\u534F\u4F5C\u8005\u8EAB\u4EFD\u4E0D\u81EA\u52A8\u64A4\uFF0C\u8981\u53BB\u4ED3\u5E93\u8BBE\u7F6E\u91CC\u79FB\u9664\u3002\u56DE deploy:access \u89C6\u56FE\uFF1Bowner-only\u3001human-only",
+        args: DeployCollaboratorRemoveArgsSchema
+      },
+      "deploy:collaboratorSync": {
+        summary: "\u4EC5\u53D1\u5E03\u8005\uFF1A\u628A\u5DF2\u4E0A\u62A5 GitHub \u767B\u5F55\u540D\u7684\u534F\u4F5C\u8005\u9010\u4E2A\u9080\u8BF7\u4E3A\u4ED3\u5E93\u534F\u4F5C\u8005\uFF08write\uFF0C\u5E42\u7B49\uFF09\u3002\u56DE deploy:access \u89C6\u56FE\uFF0C\u534F\u4F5C\u8005\u5E26 repoAccess\uFF1Ainvited = \u9080\u8BF7\u5DF2\u53D1\u3001\u7B49\u5BF9\u65B9\u63A5\u53D7\uFF1Bactive = \u5DF2\u80FD\u63A8\u9001\uFF1Bowner-only",
+        args: DeployPersonaArgsSchema
+      },
+      "deploy:editLock": {
+        summary: "\u7F16\u8F91\u9501\uFF08\u53EA\u6709\u5E26\u534F\u4F5C\u8005\u7684 persona \u624D\u8D70\uFF09\uFF1Aacquire \u53D6\u9501\uFF08\u672C\u4EBA\u6301\u6709\u5373\u7EED\u7EA6\uFF09\u3001renew \u5FC3\u8DF3\uFF08\u9875\u9762\u5F00\u7740\u6BCF 30 \u79D2\u4E00\u6B21\uFF0C90 \u79D2\u6CA1\u5FC3\u8DF3\u9501\u81EA\u52A8\u8FC7\u671F\uFF09\u3001release \u91CA\u653E\u3002\u522B\u4EBA\u6301\u6709\u65F6 acquire / renew \u62A5\u9519\uFF0C\u6587\u6848\u5E26\u6301\u6709\u4EBA\u59D3\u540D\u3002\u56DE { required, lock }\uFF1Bowner-only",
+        args: DeployEditLockArgsSchema
+      },
+      "deploy:takeover": {
+        summary: "\u534F\u4F5C\u8005\u63A5\u624B\uFF1A\u672C\u673A\u6CA1\u6709\u8FD9\u4E2A persona \u65F6\uFF0C\u7528\u672C\u673A GitHub \u8EAB\u4EFD\u628A ottin4ttc/<personaId> clone \u6210\u672C\u5730 persona \u76EE\u5F55\uFF0C\u4E4B\u540E\u6CBF\u7528 deploy:*\u3002\u672C\u673A\u5DF2\u6709\u540C\u540D persona \u5C31\u62D2\uFF1B\u8981\u5148\u5728\u4ED3\u5E93\u91CC\u88AB\u9080\u8BF7\u5E76\u63A5\u53D7\uFF1Bowner-only\u3001human-only",
+        args: DeployPersonaArgsSchema
+      },
       "githubAuth:get": {
         summary: "\u672C\u673A\u7684 GitHub \u8EAB\u4EFD\uFF1Aauthorized\uFF08@login\uFF0C\u6765\u81EA git \u51ED\u636E\u5B58\u50A8 / \u672C\u673A\u51ED\u636E\u8868\uFF09/ missing / invalid\uFF08GitHub \u4E0D\u8BA4\uFF09/ pending\uFF08\u7B49 GitHub \u8DF3\u56DE\u4E2D\u5FC3\uFF09\u3002\u8BBE\u7F6E\u9875\u300C\u8D26\u53F7\u300D\u3001\u4E0A\u4E91\u9875\u9876\u4E0A\u90A3\u5F20\u5361\u3001PR \u6536\u4EF6\u7BB1\u90FD\u770B\u5B83\uFF1Bpending \u671F\u9875\u9762\u6BCF 2 \u79D2\u8F6E\u8BE2\uFF0Cdaemon \u987A\u624B\u5411\u4E2D\u5FC3\u9886 token\u3002\u65E0\u53C2\u6570",
         args: NO_ARGS
@@ -53728,7 +53785,8 @@ async function centralRequest(opts, path112, init) {
     let detail = "";
     try {
       const body = await res.json();
-      if (typeof body?.message === "string" && body.message) detail = `: ${body.message}`;
+      const message = Array.isArray(body?.message) ? body.message.filter((m3) => typeof m3 === "string").join("\uFF1B") : body?.message;
+      if (typeof message === "string" && message) detail = `: ${message}`;
     } catch {
     }
     throw new CentralClientError("API_ERROR", `central server HTTP ${res.status}${detail}`, void 0, res.status);
@@ -53918,7 +53976,36 @@ async function centralVisiblePersonas(opts) {
   if (typeof body.all !== "boolean" || !Array.isArray(body.personaIds) || !body.personaIds.every((p3) => typeof p3 === "string")) {
     throw new CentralClientError("BAD_RESPONSE", "personas/visible: expected { all: boolean, personaIds: string[] }");
   }
-  return { all: body.all, personaIds: body.personaIds };
+  const ids = body.personaIds;
+  const given = body.roles && typeof body.roles === "object" ? body.roles : void 0;
+  const roles = {};
+  for (const id of ids) roles[id] = given ? given[id] === "owner" ? "owner" : "editor" : "owner";
+  return { all: body.all, personaIds: ids, roles };
+}
+var personaPath = (personaId2) => `/api/persona-cloud/personas/${encodeURIComponent(personaId2)}`;
+async function centralPersonaAccess(opts) {
+  const body = await centralRequest(opts, `${personaPath(opts.personaId)}/access`, { method: "GET", bearer: opts.loginPass });
+  if (body.role !== "owner" && body.role !== "editor" && body.role !== "admin" || !Array.isArray(body.collaborators) || typeof body.lockRequired !== "boolean" || body.lock !== null && (typeof body.lock !== "object" || typeof body.lock?.displayName !== "string")) {
+    throw new CentralClientError("BAD_RESPONSE", "personas/access: unexpected shape");
+  }
+  return body;
+}
+async function centralAddCollaborator(opts) {
+  await centralRequest(opts, `${personaPath(opts.personaId)}/collaborators`, { method: "PUT", bearer: opts.loginPass, body: { deviceId: opts.deviceId } });
+}
+async function centralRemoveCollaborator(opts) {
+  await centralRequest(opts, `${personaPath(opts.personaId)}/collaborators/${encodeURIComponent(opts.unionId)}`, { method: "DELETE", bearer: opts.loginPass });
+}
+async function centralEditLock(opts) {
+  const method = opts.action === "acquire" ? "POST" : opts.action === "renew" ? "PUT" : "DELETE";
+  try {
+    const body = await centralRequest(opts, `${personaPath(opts.personaId)}/edit-lock`, { method, bearer: opts.loginPass });
+    if (opts.action === "release") return { held: true, required: true, lock: null };
+    return { held: true, required: body.required === void 0 ? true : body.required === true, lock: body.lock ?? null };
+  } catch (err) {
+    if (err instanceof CentralClientError && err.status === 409) return { held: false, message: err.message.replace(/^central server HTTP 409:? ?/, "") || "\u522B\u4EBA\u6B63\u5728\u7F16\u8F91" };
+    throw err;
+  }
 }
 async function centralPersonaThreads(opts) {
   const f2 = opts.fetchImpl ?? globalThis.fetch;
@@ -57665,7 +57752,7 @@ function createA2aHost(deps) {
         key,
         versions: delivery.versions
       });
-      const mine = views.filter((v3) => acked.includes(v3.taskId));
+      const mine = views.filter((v3) => acked.includes(v3.taskId) && !v3.line.handoff);
       if (mine.length) {
         const text = resultMessage(mine, (v3) => v3.targetDeviceId && v3.targetDeviceId !== deps.deviceId() ? `${v3.targetPersonaId}@${v3.targetDeviceId}` : v3.targetPersonaId);
         if (!deps.injectResult(sessionId, text)) {
@@ -58767,7 +58854,7 @@ var CloudApiKeyRequiredError = class extends Error {
   }
 };
 var CLOUD_PERSONA_ID_SUFFIX = "-cloud";
-function cloudPersonaToFile(p3, publishedByMe = false) {
+function cloudPersonaToFile(p3, publishedByMe = false, collaboratedByMe = false) {
   const at3 = p3.registeredAt ?? 0;
   return {
     personaId: p3.personaId + CLOUD_PERSONA_ID_SUFFIX,
@@ -58778,7 +58865,7 @@ function cloudPersonaToFile(p3, publishedByMe = false) {
     public: false,
     createdAt: at3,
     updatedAt: at3,
-    cloud: { gatewayUrl: p3.gatewayUrl, personaId: p3.personaId, ...publishedByMe ? { publishedByMe: true } : {}, ...p3.label ? { label: p3.label } : {} }
+    cloud: { gatewayUrl: p3.gatewayUrl, personaId: p3.personaId, ...publishedByMe ? { publishedByMe: true } : {}, ...collaboratedByMe ? { collaboratedByMe: true } : {}, ...p3.label ? { label: p3.label } : {} }
   };
 }
 var CloudGatewayClient = class {
@@ -63205,6 +63292,12 @@ function createGithubApi(args) {
     async dispatchWorkflow(slug, file, ref, inputs) {
       await must("POST", `/repos/${slug}/actions/workflows/${encodeURIComponent(file)}/dispatches`, "\u89E6\u53D1\u6D41\u6C34\u7EBF", { ref, ...inputs ? { inputs } : {} });
     },
+    async addCollaborator(slug, login) {
+      const r2 = await request("PUT", `/repos/${slug}/collaborators/${encodeURIComponent(login)}`, { permission: "push" });
+      if (r2.status === 201) return "invited";
+      if (r2.status === 204) return "active";
+      throw new GithubApiError(r2.status, explain(r2.status, `\u9080\u8BF7 ${login} \u8FDB\u4ED3\u5E93`, r2.json));
+    },
     async setDefaultBranch(slug, branch) {
       await must("PATCH", `/repos/${slug}`, "\u8BBE\u7F6E\u53D1\u5E03\u9ED8\u8BA4\u5206\u652F", { default_branch: branch });
     }
@@ -63940,6 +64033,25 @@ async function writeDockerfile(dir, personaId2, image) {
   const deployFile = await readDeployFileRaw(dir);
   if (deployFile !== void 0) await import_promises4.default.writeFile(import_node_path43.default.join(dir, INSTALL_FILE_PATH), renderInstallFile(deployFile));
 }
+async function cloneRepo(exec, args) {
+  const { org, name, dir } = args;
+  try {
+    await import_promises4.default.stat(dir);
+    throw new RepoError("\u672C\u673A\u5DF2\u7ECF\u6709\u8FD9\u4E2A\u76EE\u5F55\u4E86\uFF0C\u4E0D\u8986\u76D6");
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  const parent = import_node_path43.default.dirname(dir);
+  await import_promises4.default.mkdir(parent, { recursive: true });
+  try {
+    await networkGit(exec, parent, args.auth, ["clone", `https://github.com/${org}/${name}.git`, dir], "\u514B\u9686\u4ED3\u5E93");
+  } catch (err) {
+    if (err instanceof RepoError && /not found|404|Authentication failed|could not read/i.test(err.message)) {
+      throw new RepoError(`\u514B\u9686\u4E0D\u4E86 ${org}/${name}\uFF1A\u4ED3\u5E93\u4E0D\u5B58\u5728\uFF0C\u6216\u8FD8\u6CA1\u6709\u8BBF\u95EE\u6743\u9650\u2014\u2014\u8BF7\u5148\u63A5\u53D7 owner \u53D1\u6765\u7684 GitHub \u9080\u8BF7\uFF08\u90AE\u7BB1\u6216 github.com/notifications\uFF09`);
+    }
+    throw err;
+  }
+}
 var RepoAlreadyExistsError = class extends RepoError {
   constructor(slug) {
     super(`\u7EC4\u7EC7\u91CC\u5DF2\u7ECF\u6709 https://github.com/${slug} \u4E86`);
@@ -65399,6 +65511,7 @@ function buildDeployHandlers(deps) {
       checkPublisherTest();
     }
     if (await deps.claimPublisher(cloudPersonaIdOf(repo2.url), "integration") === "taken") throw invalid("\u6D4B\u8BD5\u73AF\u5883\u91CC\u7684\u8FD9\u4E2A\u540D\u5B57\u5DF2\u7531\u522B\u4EBA\u53D1\u5E03");
+    await holdEditLock(cloudPersonaIdOf(repo2.url));
     const releaseId = (0, import_node_crypto17.randomUUID)();
     try {
       const result = await release(deps.exec, api, { dir, now: deps.now, auth, manifest, rescanOnRemoteChange: !rollback2, onPrepared: async (head) => {
@@ -65457,6 +65570,7 @@ function buildDeployHandlers(deps) {
     const dir = mustPersona(personaId2);
     const repo2 = await repoInfo(deps.exec, dir);
     if (!repo2) throw invalid("\u8FD9\u4E2A persona \u8FD8\u6CA1\u4E0A\u8FC7\u4E91");
+    await assertNotEditor(cloudPersonaIdOf(repo2.url));
     const { api } = await requireGithub();
     const last = [...(await readHistory(dir)).releases].reverse().find((r2) => (r2.environment ?? "production") === environment);
     if (!last || !await fileInCommit(deps.exec, dir, last.head, UNPUBLISH_WORKFLOW_PATH)) throw invalid(UNPUBLISH_NEEDS_REPUBLISH);
@@ -65472,6 +65586,157 @@ function buildDeployHandlers(deps) {
     invalidateCloud(personaId2 + ":" + environment);
     return { response: { type: "deploy:unpublish", before: before?.runId ?? null } };
   };
+  const centralMessage = (err) => err instanceof CentralClientError && err.code === "API_ERROR" ? err.message.replace(/^central server HTTP \d+:? ?/, "") || err.message : err instanceof Error ? err.message : String(err);
+  const centralInvalid = (err) => invalid(centralMessage(err));
+  const mustCollaboration = () => {
+    if (!deps.collaboration) throw invalid("\u534F\u4F5C\u8005\u529F\u80FD\u7528\u4E0D\u4E86\uFF1A\u672C\u673A\u8FD8\u6CA1\u63A5\u4E0A\u4E2D\u5FC3");
+    return deps.collaboration;
+  };
+  async function cloudIdOf(personaId2) {
+    const repo2 = await repoInfo(deps.exec, mustPersona(personaId2));
+    if (!repo2) throw invalid("\u8FD9\u4E2A persona \u8FD8\u6CA1\u4E0A\u8FC7\u4E91");
+    return cloudPersonaIdOf(repo2.url);
+  }
+  const accessView = async (cloudId) => {
+    try {
+      return await mustCollaboration().access("integration", cloudId);
+    } catch (err) {
+      throw centralInvalid(err);
+    }
+  };
+  async function holdEditLock(cloudId) {
+    if (!deps.collaboration) return;
+    let got;
+    try {
+      got = await deps.collaboration.editLock("integration", cloudId, "acquire");
+    } catch (err) {
+      throw centralInvalid(err);
+    }
+    if (!got.held) throw invalid(got.message);
+  }
+  async function assertProductionKnowsPersona(cloudId) {
+    if (!deps.collaboration) return;
+    let mine;
+    try {
+      mine = await deps.collaboration.access("integration", cloudId);
+    } catch {
+      return;
+    }
+    if (mine.role !== "editor") return;
+    try {
+      await deps.collaboration.access("production", cloudId);
+    } catch (err) {
+      if (err instanceof CentralClientError && err.status === 403) throw invalid("\u8FD9\u4E2A persona \u8FD8\u6CA1\u5728\u7EBF\u4E0A\u73AF\u5883\u767B\u8BB0\u534F\u4F5C\u8005\uFF1A\u8BF7 owner \u5148\u4E0A\u7EBF\u4E00\u6B21\uFF0C\u6216\u91CD\u65B0\u6DFB\u52A0\u4F60");
+      throw centralInvalid(err);
+    }
+  }
+  async function assertNotEditor(cloudId) {
+    if (!deps.collaboration) return;
+    let info;
+    try {
+      info = await deps.collaboration.access("integration", cloudId);
+    } catch (err) {
+      if (err instanceof CentralClientError && err.status === 403) return;
+      throw centralInvalid(err);
+    }
+    if (info.role === "editor") throw invalid("\u4E0B\u7EBF\u53EA\u6709\u8FD9\u4E2A persona \u7684\u53D1\u5E03\u8005\u80FD\u505A");
+  }
+  const accessHandler = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const { personaId: personaId2 } = parseArgs2(DeployPersonaArgsSchema, frame, "deploy:access");
+    const cloudId = await cloudIdOf(personaId2);
+    const view2 = await accessView(cloudId);
+    return { response: { type: "deploy:access", ...view2 } };
+  };
+  const collaboratorAdd = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const { personaId: personaId2, deviceId } = parseArgs2(DeployCollaboratorAddArgsSchema, frame, "deploy:collaboratorAdd");
+    const cloudId = await cloudIdOf(personaId2);
+    const collaboration = mustCollaboration();
+    try {
+      await collaboration.add("integration", cloudId, deviceId);
+    } catch (err) {
+      throw centralInvalid(err);
+    }
+    let production;
+    try {
+      await collaboration.add("production", cloudId, deviceId);
+      production = { ok: true };
+    } catch (err) {
+      production = { ok: false, reason: centralMessage(err) };
+    }
+    return { response: { type: "deploy:collaboratorAdd", ...await accessView(cloudId), production } };
+  };
+  const collaboratorRemove = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const { personaId: personaId2, unionId } = parseArgs2(DeployCollaboratorRemoveArgsSchema, frame, "deploy:collaboratorRemove");
+    const cloudId = await cloudIdOf(personaId2);
+    const collaboration = mustCollaboration();
+    try {
+      await collaboration.remove("integration", cloudId, unionId);
+    } catch (err) {
+      throw centralInvalid(err);
+    }
+    await collaboration.remove("production", cloudId, unionId).catch((err) => deps.warn?.("remove collaborator from production failed", { cloudId, error: centralMessage(err) }));
+    return { response: { type: "deploy:collaboratorRemove", ...await accessView(cloudId) } };
+  };
+  const collaboratorSync = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const { personaId: personaId2 } = parseArgs2(DeployPersonaArgsSchema, frame, "deploy:collaboratorSync");
+    const dir = mustPersona(personaId2);
+    const repo2 = await repoInfo(deps.exec, dir);
+    if (!repo2) throw invalid("\u8FD9\u4E2A persona \u8FD8\u6CA1\u4E0A\u8FC7\u4E91");
+    const view2 = await accessView(cloudPersonaIdOf(repo2.url));
+    if (view2.role !== "owner") throw invalid("\u53EA\u6709\u8FD9\u4E2A persona \u7684\u53D1\u5E03\u8005\u80FD\u9080\u8BF7\u534F\u4F5C\u8005\u8FDB\u4ED3\u5E93");
+    const { api } = await requireGithub();
+    const slug = repoSlug(repo2.url);
+    const collaborators = [];
+    for (const c2 of view2.collaborators) {
+      if (!c2.githubLogin) {
+        collaborators.push(c2);
+        continue;
+      }
+      try {
+        collaborators.push({ ...c2, repoAccess: await api.addCollaborator(slug, c2.githubLogin) });
+      } catch (err) {
+        throw toClawdError(err);
+      }
+    }
+    return { response: { type: "deploy:collaboratorSync", ...view2, collaborators } };
+  };
+  const editLockHandler = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const { personaId: personaId2, action } = parseArgs2(DeployEditLockArgsSchema, frame, "deploy:editLock");
+    const cloudId = await cloudIdOf(personaId2);
+    let got;
+    try {
+      got = await mustCollaboration().editLock("integration", cloudId, action);
+    } catch (err) {
+      throw centralInvalid(err);
+    }
+    if (!got.held) throw invalid(got.message);
+    return { response: { type: "deploy:editLock", required: got.required, lock: got.lock } };
+  };
+  const takeover = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const { personaId: personaId2 } = parseArgs2(DeployPersonaArgsSchema, frame, "deploy:takeover");
+    if (deps.hasPersona(personaId2)) throw invalid("\u672C\u673A\u5DF2\u7ECF\u6709\u8FD9\u4E2A persona \u4E86");
+    if (!/^[a-z0-9-]{1,100}$/.test(personaId2)) throw invalid("persona \u540D\u53EA\u8BA4\u5C0F\u5199\u5B57\u6BCD\u3001\u6570\u5B57\u548C\u8FDE\u5B57\u7B26");
+    try {
+      await mustCollaboration().access("integration", personaId2);
+    } catch (err) {
+      if (err instanceof CentralClientError && err.status === 403) throw invalid("\u4F60\u4E0D\u662F\u8FD9\u4E2A persona \u7684\u534F\u4F5C\u8005\uFF1A\u8BF7 owner \u5148\u628A\u4F60\u52A0\u4E3A\u534F\u4F5C\u8005");
+      throw centralInvalid(err);
+    }
+    const { auth } = await requireGithub();
+    try {
+      await cloneRepo(deps.exec, { org: deps.org, name: personaId2, dir: deps.personaDir(personaId2), auth });
+    } catch (err) {
+      throw toClawdError(err);
+    }
+    deps.onPersonaCloned?.(personaId2);
+    return { response: { type: "deploy:takeover", personaId: personaId2 } };
+  };
   function releaseArgs(frame, schema) {
     const { type: _type, requestId: _requestId, ...args } = frame;
     return parseArgs2({ safeParse: schema.safeParse.bind(schema) }, args, String(frame.type));
@@ -65547,6 +65812,8 @@ function buildDeployHandlers(deps) {
     if (!recovering) await assertConfigTested(personaId2, record4);
     const repo2 = await repoInfo(deps.exec, mustPersona(personaId2));
     if (!repo2) throw invalid("\u4ED3\u5E93\u4E0D\u5B58\u5728");
+    await holdEditLock(cloudPersonaIdOf(repo2.url));
+    await assertProductionKnowsPersona(cloudPersonaIdOf(repo2.url));
     if (await deps.claimPublisher(cloudPersonaIdOf(repo2.url), "production") === "taken") throw invalid("\u7EBF\u4E0A\u73AF\u5883\u91CC\u7684\u8FD9\u4E2A\u540D\u5B57\u5DF2\u7531\u522B\u4EBA\u53D1\u5E03");
     const { api } = await requireGithub();
     const names = await targetSecrets(personaId2, mustPersona(personaId2), api, "production");
@@ -65701,7 +65968,13 @@ function buildDeployHandlers(deps) {
     "deploy:finishScan": serial(finishScan),
     "deploy:release": serial(releaseHandler),
     "deploy:rerunJob": serial(rerunJobHandler),
-    "deploy:unpublish": serial(unpublishHandler)
+    "deploy:unpublish": serial(unpublishHandler),
+    "deploy:access": accessHandler,
+    "deploy:collaboratorAdd": serial(collaboratorAdd),
+    "deploy:collaboratorRemove": serial(collaboratorRemove),
+    "deploy:collaboratorSync": serial(collaboratorSync),
+    "deploy:editLock": editLockHandler,
+    "deploy:takeover": serial(takeover)
   };
 }
 
@@ -75896,6 +76169,12 @@ var METHOD_GRANT_MAP = {
   "deploy:openTest": ADMIN_ANY,
   "deploy:rerunJob": ADMIN_ANY,
   "deploy:unpublish": ADMIN_ANY,
+  "deploy:access": ADMIN_ANY,
+  "deploy:collaboratorAdd": ADMIN_ANY,
+  "deploy:collaboratorRemove": ADMIN_ANY,
+  "deploy:collaboratorSync": ADMIN_ANY,
+  "deploy:editLock": ADMIN_ANY,
+  "deploy:takeover": ADMIN_ANY,
   // Connector handlers use the owner login to fetch or fill credentials; exclude guests.
   "cloud:connectors:list": ADMIN_ANY,
   "dashboard:openUrl": ADMIN_ANY,
@@ -76076,6 +76355,10 @@ var HUMAN_ONLY_METHODS = [
   "deploy:setEngineAuth",
   "deploy:rerunJob",
   "deploy:unpublish",
+  "deploy:collaboratorAdd",
+  "deploy:collaboratorRemove",
+  "deploy:collaboratorSync",
+  "deploy:takeover",
   "githubAuth:oauthStart",
   "githubAuth:authorize"
 ];
@@ -76120,7 +76403,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.742".length > 0 ? "0.2.742" : "dev";
+var version = "0.2.744".length > 0 ? "0.2.744" : "dev";
 
 // src/cli-probe/probe.ts
 var fs87 = __toESM(require("fs"), 1);
@@ -79475,15 +79758,16 @@ async function startDaemon(config) {
       const list = await cloudGateway.listPersonas();
       const loginPass = ownerIdentityStore.read()?.loginPass;
       const publishedIds = /* @__PURE__ */ new Set();
+      const collaboratedIds = /* @__PURE__ */ new Set();
       if (loginPass) {
         try {
           const visible = await centralVisiblePersonas({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, loginPass });
-          for (const id of visible.personaIds) publishedIds.add(id);
+          for (const id of visible.personaIds) (visible.roles[id] === "editor" ? collaboratedIds : publishedIds).add(id);
         } catch (err) {
           logger.warn("cloud bot publisher lookup failed; binding controls hidden", { reason: err.message });
         }
       }
-      const shadowed = personaRegistry.setCloudSnapshot(list.map((p3) => cloudPersonaToFile(p3, publishedIds.has(p3.personaId))));
+      const shadowed = personaRegistry.setCloudSnapshot(list.map((p3) => cloudPersonaToFile(p3, publishedIds.has(p3.personaId), collaboratedIds.has(p3.personaId) && !personaStore.has(p3.personaId))));
       if (shadowed.length > 0) {
         logger.warn("cloud personas shadowed by local personas with the same id", { personaIds: shadowed });
       }
@@ -80055,6 +80339,23 @@ async function startDaemon(config) {
         throw new Error(`\u5411\u4E2D\u5FC3\u767B\u8BB0\u53D1\u5E03\u8005\u5931\u8D25\uFF1A${err.message}`);
       }
     },
+    collaboration: /* @__PURE__ */ (() => {
+      const base = (environment) => {
+        const loginPass = targetLoginPass(environment);
+        if (!loginPass) throw new Error("\u8FD8\u6CA1\u767B\u5F55 clawd\uFF1A\u5148\u5728\u8BBE\u7F6E\u91CC\u767B\u5F55\u98DE\u4E66");
+        return { api: targetApi(environment), loginPass };
+      };
+      return {
+        access: async (environment, personaId2) => centralPersonaAccess({ ...base(environment), personaId: personaId2 }),
+        add: async (environment, personaId2, deviceId) => centralAddCollaborator({ ...base(environment), personaId: personaId2, deviceId }),
+        remove: async (environment, personaId2, unionId) => centralRemoveCollaborator({ ...base(environment), personaId: personaId2, unionId }),
+        editLock: async (environment, personaId2, action) => centralEditLock({ ...base(environment), personaId: personaId2, action })
+      };
+    })(),
+    onPersonaCloned: () => {
+      personaRegistry.reload();
+      void refreshCloudPersonas();
+    },
     now: () => Date.now(),
     warn: (msg, meta) => logger.warn(msg, meta),
     logger,