@clawos-dev/clawd 0.2.79-beta.149.201b46d → 0.2.80-beta.150.2767f59

package/dist/cli.cjs

@@ -646,8 +646,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path39, errorMaps, issueData } = params;
-      const fullPath = [...path39, ...issueData.path || []];
+      const { data, path: path42, errorMaps, issueData } = params;
+      const fullPath = [...path42, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -958,11 +958,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path39, key) {
+      constructor(parent, value, path42, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path39;
+        this._path = path42;
         this._key = key;
       }
       get path() {
@@ -5564,8 +5564,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path39 = req.path;
-        _req.url = typeof path39 === "string" ? path39 : req.url ? req.url.path || req.url : void 0;
+        const path42 = req.path;
+        _req.url = typeof path42 === "string" ? path42 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -5730,14 +5730,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path39) {
+    function parsePath(path42) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path39.length; i++) {
-        const char = path39[i];
+      for (let i = 0; i < path42.length; i++) {
+        const char = path42[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -5868,10 +5868,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path39 of paths) {
-        const parts = parsePath(path39);
+      for (const path42 of paths) {
+        const parts = parsePath(path42);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path39, remove);
+          redactWildcardPath(obj, parts, censor, path42, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -5956,8 +5956,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path39) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path39];
+            const wrappedCensor = typeof censor === "function" ? (value, path42) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path42];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -5992,8 +5992,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path39 of pathsToClone) {
-        const parts = parsePath(path39);
+      for (const path42 of pathsToClone) {
+        const parts = parsePath(path42);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -6045,24 +6045,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path39) {
-      if (typeof path39 !== "string") {
+    function validatePath(path42) {
+      if (typeof path42 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path39 === "") {
+      if (path42 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path39.includes("..")) {
-        throw new Error(`Invalid redaction path (${path39})`);
+      if (path42.includes("..")) {
+        throw new Error(`Invalid redaction path (${path42})`);
       }
-      if (path39.includes(",")) {
-        throw new Error(`Invalid redaction path (${path39})`);
+      if (path42.includes(",")) {
+        throw new Error(`Invalid redaction path (${path42})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path39.length; i++) {
-        const char = path39[i];
+      for (let i = 0; i < path42.length; i++) {
+        const char = path42[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -6076,20 +6076,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path39})`);
+            throw new Error(`Invalid redaction path (${path42})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path39})`);
+        throw new Error(`Invalid redaction path (${path42})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path39 of paths) {
-        validatePath(path39);
+      for (const path42 of paths) {
+        validatePath(path42);
       }
     }
     function slowRedact(options = {}) {
@@ -6257,8 +6257,8 @@ var require_redaction = __commonJS({
         if (shape[k2] === null) {
           o[k2] = (value) => topCensor(value, [k2]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path39) => {
-            return censor(value, [k2, ...path39]);
+          const wrappedCensor = typeof censor === "function" ? (value, path42) => {
+            return censor(value, [k2, ...path42]);
           } : censor;
           o[k2] = Redact({
             paths: shape[k2],
@@ -6476,10 +6476,10 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "../node_modules/.pnpm/sonic-boom@4.2.1/node_modules/sonic-boom/index.js"(exports2, module2) {
     "use strict";
-    var fs34 = require("fs");
+    var fs33 = require("fs");
     var EventEmitter2 = require("events");
     var inherits = require("util").inherits;
-    var path39 = require("path");
+    var path42 = require("path");
     var sleep = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -6533,20 +6533,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs34.mkdirSync(path39.dirname(file), { recursive: true });
-          const fd = fs34.openSync(file, flags, mode);
+          if (sonic.mkdir) fs33.mkdirSync(path42.dirname(file), { recursive: true });
+          const fd = fs33.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs34.mkdir(path39.dirname(file), { recursive: true }, (err) => {
+        fs33.mkdir(path42.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs34.open(file, flags, mode, fileOpened);
+          fs33.open(file, flags, mode, fileOpened);
         });
       } else {
-        fs34.open(file, flags, mode, fileOpened);
+        fs33.open(file, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -6587,8 +6587,8 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs34.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs34.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs33.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs33.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
@@ -6597,15 +6597,15 @@ var require_sonic_boom = __commonJS({
         this._actualWrite = actualWrite;
         fsWriteSync = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs34.writeSync(this.fd, this._writingBuf);
+            return fs33.writeSync(this.fd, this._writingBuf);
           }
-          return fs34.writeSync(this.fd, this._writingBuf, "utf8");
+          return fs33.writeSync(this.fd, this._writingBuf, "utf8");
         };
         fsWrite = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs34.write(this.fd, this._writingBuf, this.release);
+            return fs33.write(this.fd, this._writingBuf, this.release);
           }
-          return fs34.write(this.fd, this._writingBuf, "utf8", this.release);
+          return fs33.write(this.fd, this._writingBuf, "utf8", this.release);
         };
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
@@ -6662,7 +6662,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs34.fsyncSync(this.fd);
+          fs33.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -6776,7 +6776,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs34.fsync(this.fd, (err) => {
+            fs33.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -6878,7 +6878,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs34.close(fd, (err) => {
+          fs33.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -6927,7 +6927,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = Buffer.isBuffer(buf) ? fs34.writeSync(this.fd, buf) : fs34.writeSync(this.fd, buf, "utf8");
+          const n = Buffer.isBuffer(buf) ? fs33.writeSync(this.fd, buf) : fs33.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -6943,7 +6943,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs34.fsyncSync(this.fd);
+        fs33.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -6964,7 +6964,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs34.writeSync(this.fd, buf);
+          const n = fs33.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -6992,13 +6992,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = Buffer.isBuffer(this._writingBuf) ? fs34.writeSync(this.fd, this._writingBuf) : fs34.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = Buffer.isBuffer(this._writingBuf) ? fs33.writeSync(this.fd, this._writingBuf) : fs33.writeSync(this.fd, this._writingBuf, "utf8");
           release(null, written);
         } catch (err) {
           release(err);
         }
       } else {
-        fs34.write(this.fd, this._writingBuf, release);
+        fs33.write(this.fd, this._writingBuf, release);
       }
     }
     function actualWriteBuffer() {
@@ -7007,7 +7007,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs34.writeSync(this.fd, this._writingBuf);
+          const written = fs33.writeSync(this.fd, this._writingBuf);
           release(null, written);
         } catch (err) {
           release(err);
@@ -7016,7 +7016,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs34.write(this.fd, this._writingBuf, release);
+        fs33.write(this.fd, this._writingBuf, release);
       }
     }
     function actualClose(sonic) {
@@ -7032,12 +7032,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs34.fsync(sonic.fd, closeWrapped);
+        fs33.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs34.close(sonic.fd, done);
+          fs33.close(sonic.fd, done);
         } else {
           done();
         }
@@ -7716,7 +7716,7 @@ var require_transport = __commonJS({
     "use strict";
     var { createRequire } = require("module");
     var getCallers = require_caller();
-    var { join: join11, isAbsolute, sep: sep2 } = require("path");
+    var { join: join11, isAbsolute: isAbsolute2, sep: sep3 } = require("path");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
     var ThreadStream = require_thread_stream();
@@ -7815,7 +7815,7 @@ var require_transport = __commonJS({
       return buildStream(fixTarget(target), options, worker, sync);
       function fixTarget(origin) {
         origin = bundlerOverrides[origin] || origin;
-        if (isAbsolute(origin) || origin.indexOf("file://") === 0) {
+        if (isAbsolute2(origin) || origin.indexOf("file://") === 0) {
           return origin;
         }
         if (origin === "pino/file") {
@@ -7824,7 +7824,7 @@ var require_transport = __commonJS({
         let fixTarget2;
         for (const filePath of callers) {
           try {
-            const context = filePath === "node:repl" ? process.cwd() + sep2 : filePath;
+            const context = filePath === "node:repl" ? process.cwd() + sep3 : filePath;
             fixTarget2 = createRequire(context).resolve(origin);
             break;
           } catch (err) {
@@ -9401,7 +9401,7 @@ var require_multistream = __commonJS({
 var require_pino = __commonJS({
   "../node_modules/.pnpm/pino@9.14.0/node_modules/pino/pino.js"(exports2, module2) {
     "use strict";
-    var os15 = require("os");
+    var os16 = require("os");
     var stdSerializers = require_pino_std_serializers();
     var caller = require_caller();
     var redaction = require_redaction();
@@ -9448,7 +9448,7 @@ var require_pino = __commonJS({
     } = symbols;
     var { epochTime, nullTime } = time;
     var { pid } = process;
-    var hostname = os15.hostname();
+    var hostname = os16.hostname();
     var defaultErrorSerializer = stdSerializers.err;
     var defaultOptions = {
       level: "info",
@@ -10172,11 +10172,11 @@ var init_lib = __esm({
           }
         }
       },
-      addToPath: function addToPath(path39, added, removed, oldPosInc, options) {
-        var last = path39.lastComponent;
+      addToPath: function addToPath(path42, added, removed, oldPosInc, options) {
+        var last = path42.lastComponent;
         if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
           return {
-            oldPos: path39.oldPos + oldPosInc,
+            oldPos: path42.oldPos + oldPosInc,
             lastComponent: {
               count: last.count + 1,
               added,
@@ -10186,7 +10186,7 @@ var init_lib = __esm({
           };
         } else {
           return {
-            oldPos: path39.oldPos + oldPosInc,
+            oldPos: path42.oldPos + oldPosInc,
             lastComponent: {
               count: 1,
               added,
@@ -10617,10 +10617,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path39 = typeof rec.path === "string" ? rec.path : null;
+      const path42 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path39 || content == null) return null;
-      const entry = { path: path39, content };
+      if (!path42 || content == null) return null;
+      const entry = { path: path42, content };
       if (typeof rec.mtimeMs === "number") entry.mtimeMs = rec.mtimeMs;
       return entry;
     }).filter((m2) => m2 !== null);
@@ -11083,8 +11083,8 @@ var init_claude_history = __esm({
 // src/tools/sandbox.ts
 function shouldSandbox(cwd, personaRoot) {
   if (!personaRoot) return false;
-  const sep2 = personaRoot.endsWith(path12.sep) ? "" : path12.sep;
-  return cwd.startsWith(personaRoot + sep2) && cwd !== personaRoot;
+  const sep3 = personaRoot.endsWith(path12.sep) ? "" : path12.sep;
+  return cwd.startsWith(personaRoot + sep3) && cwd !== personaRoot;
 }
 function inferSandboxSettingsPath(cwd, personaRoot) {
   if (!shouldSandbox(cwd, personaRoot)) return null;
@@ -11446,10 +11446,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path39 = typeof rec.path === "string" ? rec.path : null;
+      const path42 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path39 || content == null) return null;
-      const out = { path: path39, content };
+      if (!path42 || content == null) return null;
+      const out = { path: path42, content };
       if (typeof rec.mtimeMs === "number") out.mtimeMs = rec.mtimeMs;
       return out;
     }).filter((m2) => m2 !== null);
@@ -20369,11 +20369,11 @@ function startRunCaseRecorder(opts) {
   let closing = false;
   let closedSettled = false;
   let closedResolve;
-  const closed = new Promise((resolve2) => {
+  const closed = new Promise((resolve6) => {
     closedResolve = () => {
       if (closedSettled) return;
       closedSettled = true;
-      resolve2();
+      resolve6();
     };
   });
   const ensureStream = () => {
@@ -20465,8 +20465,8 @@ async function runController(opts) {
   let exitCode = null;
   let procExited = false;
   let resolveProcExit;
-  const procExitPromise = new Promise((resolve2) => {
-    resolveProcExit = resolve2;
+  const procExitPromise = new Promise((resolve6) => {
+    resolveProcExit = resolve6;
   });
   const writeEvent = (event) => {
     try {
@@ -21892,8 +21892,8 @@ function startRecorder(opts) {
   const filePath = import_node_path5.default.join(dir, `${tsForFilename(now())}.jsonl`);
   let stream = null;
   let closedResolve;
-  const closed = new Promise((resolve2) => {
-    closedResolve = resolve2;
+  const closed = new Promise((resolve6) => {
+    closedResolve = resolve6;
   });
   let exited = false;
   const ensureStream = () => {
@@ -22047,13 +22047,13 @@ var SessionRunner = class {
   // 已经停止则立即 resolve；超时（默认 3000ms）抛错由上层透传成 RPC error
   async waitUntilStopped(timeoutMs = DEFAULT_WAIT_STOP_TIMEOUT_MS) {
     if (!this.state.procAlive) return;
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve6, reject) => {
       let settled = false;
       const onStop = () => {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
-        resolve2();
+        resolve6();
       };
       const timer = setTimeout(() => {
         if (settled) return;
@@ -22144,7 +22144,7 @@ var SessionRunner = class {
     };
     const payload = JSON.stringify(frame) + "\n";
     const timeoutMs = opts.timeoutMs ?? DEFAULT_CONTROL_REQUEST_TIMEOUT_MS;
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve6, reject) => {
       const timer = setTimeout(() => {
         const pending = this.pendingControlRequests.get(requestId);
         if (!pending) return;
@@ -22152,7 +22152,7 @@ var SessionRunner = class {
         reject(new Error(`control_request timeout: ${subtype}`));
       }, timeoutMs);
       timer.unref?.();
-      this.pendingControlRequests.set(requestId, { resolve: resolve2, reject, timer });
+      this.pendingControlRequests.set(requestId, { resolve: resolve6, reject, timer });
       try {
         proc.stdin?.write(payload);
         this.recorder?.tapStdinWrite(payload);
@@ -25043,10 +25043,10 @@ function createPopupDetector(opts) {
       return visible;
     },
     writeBytes(data) {
-      return new Promise((resolve2) => {
+      return new Promise((resolve6) => {
         term.write(data, () => {
           tick();
-          resolve2();
+          resolve6();
         });
       });
     },
@@ -25717,7 +25717,7 @@ var LocalWsServer = class {
   pingIntervalMs;
   async start() {
     const host = this.opts.host ?? "127.0.0.1";
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve6, reject) => {
       const httpServer = import_node_http.default.createServer((req, res) => this.handleHttpRequest(req, res));
       const wss = new import_websocket_server.default({ noServer: true, clientTracking: true });
       httpServer.on("upgrade", (req, socket, head) => {
@@ -25727,7 +25727,7 @@ var LocalWsServer = class {
       });
       httpServer.on("listening", () => {
         this.logger?.info("ws listening", { host, port: this.opts.port });
-        resolve2();
+        resolve6();
       });
       httpServer.on("error", (err) => {
         this.logger?.error("ws server error", { err: err.message });
@@ -25748,11 +25748,11 @@ var LocalWsServer = class {
       if (c.pingTimer) clearInterval(c.pingTimer);
     }
     this.clients.clear();
-    await new Promise((resolve2) => {
-      this.wss?.close(() => resolve2());
+    await new Promise((resolve6) => {
+      this.wss?.close(() => resolve6());
     });
-    await new Promise((resolve2) => {
-      this.httpServer?.close(() => resolve2());
+    await new Promise((resolve6) => {
+      this.httpServer?.close(() => resolve6());
     });
     this.wss = null;
     this.httpServer = null;
@@ -26759,38 +26759,17 @@ var ReceivedCapabilityStore = class {
   }
 };
 
-// src/state/legacy-migration.ts
-var fs19 = __toESM(require("fs"), 1);
-var path21 = __toESM(require("path"), 1);
-var TARGETS = [
-  { src: "capabilities.json", bak: "capabilities.legacy.bak" },
-  { src: "remote-personas", bak: "remote-personas.legacy.bak" },
-  { src: "peers.json", bak: "peers.legacy.bak" }
-];
-function migrateLegacyFiles(dataDir) {
-  for (const t of TARGETS) {
-    const srcPath = path21.join(dataDir, t.src);
-    const bakPath = path21.join(dataDir, t.bak);
-    if (!fs19.existsSync(srcPath)) continue;
-    if (fs19.existsSync(bakPath)) continue;
-    try {
-      fs19.renameSync(srcPath, bakPath);
-    } catch {
-    }
-  }
-}
-
 // src/received-capability/connect-remote.ts
 var crypto6 = __toESM(require("crypto"), 1);
 var HANDSHAKE_TIMEOUT_MS = 5e3;
 var RPC_TIMEOUT_MS = 5e3;
 async function connectRemote(args) {
   const ws = new wrapper_default(args.url);
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve6, reject) => {
     const onError = (e) => reject(e);
     ws.once("open", () => {
       ws.off("error", onError);
-      resolve2();
+      resolve6();
     });
     ws.once("error", onError);
   });
@@ -26802,7 +26781,7 @@ async function connectRemote(args) {
       selfDisplayName: args.selfDisplayName
     })
   );
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve6, reject) => {
     const onMessage = (raw) => {
       let f;
       try {
@@ -26812,7 +26791,7 @@ async function connectRemote(args) {
       }
       if (f.type === "auth:ok" || f.type === "ready") {
         ws.off("message", onMessage);
-        resolve2();
+        resolve6();
         return;
       }
       if (f.type === "auth:error" || f.code === 4401) {
@@ -26828,7 +26807,7 @@ async function connectRemote(args) {
   });
   function call(method, payload) {
     const requestId = crypto6.randomUUID();
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve6, reject) => {
       const onMessage = (raw) => {
         let f;
         try {
@@ -26841,7 +26820,7 @@ async function connectRemote(args) {
         if (f.error || f.type?.endsWith(":error")) {
           reject(new Error(f.message ?? f.error ?? "rpc error"));
         } else {
-          resolve2(f);
+          resolve6(f);
         }
       };
       ws.on("message", onMessage);
@@ -26872,61 +26851,61 @@ async function connectRemote(args) {
 }
 
 // src/migrations/2026-05-20-flatten-sessions.ts
-var fs20 = __toESM(require("fs"), 1);
-var path22 = __toESM(require("path"), 1);
+var fs19 = __toESM(require("fs"), 1);
+var path21 = __toESM(require("path"), 1);
 var MIGRATION_FLAG_NAME = ".migration.v1.done";
 function migrateFlattenSessions(opts) {
   const dataDir = opts.dataDir;
   const now = opts.now ?? Date.now;
-  const sessionsDir = path22.join(dataDir, "sessions");
-  const flagPath = path22.join(sessionsDir, MIGRATION_FLAG_NAME);
-  if (existsSync4(flagPath)) {
+  const sessionsDir = path21.join(dataDir, "sessions");
+  const flagPath = path21.join(sessionsDir, MIGRATION_FLAG_NAME);
+  if (existsSync3(flagPath)) {
     return { skipped: true, flagWritten: false, movedBare: 0, movedVmOwner: 0, archivedListener: 0 };
   }
   let movedBare = 0;
   let movedVmOwner = 0;
   let archivedListener = 0;
-  const defaultDir = path22.join(sessionsDir, "default");
-  if (existsSync4(defaultDir)) {
+  const defaultDir = path21.join(sessionsDir, "default");
+  if (existsSync3(defaultDir)) {
     for (const entry of readdirSafe(defaultDir)) {
       if (!entry.endsWith(".json")) continue;
-      const src = path22.join(defaultDir, entry);
-      const dst = path22.join(sessionsDir, entry);
-      fs20.renameSync(src, dst);
+      const src = path21.join(defaultDir, entry);
+      const dst = path21.join(sessionsDir, entry);
+      fs19.renameSync(src, dst);
       movedBare += 1;
     }
     rmdirIfEmpty(defaultDir);
   }
   for (const pid of readdirSafe(sessionsDir)) {
-    const personaDir = path22.join(sessionsDir, pid);
+    const personaDir = path21.join(sessionsDir, pid);
     if (!isDir(personaDir)) continue;
     if (pid === "default") continue;
-    const ownerSrc = path22.join(personaDir, "owner");
-    if (existsSync4(ownerSrc) && isDir(ownerSrc)) {
-      const ownerDst = path22.join(dataDir, "personas", pid, ".clawd", "sessions", "owner");
-      fs20.mkdirSync(ownerDst, { recursive: true });
+    const ownerSrc = path21.join(personaDir, "owner");
+    if (existsSync3(ownerSrc) && isDir(ownerSrc)) {
+      const ownerDst = path21.join(dataDir, "personas", pid, ".clawd", "sessions", "owner");
+      fs19.mkdirSync(ownerDst, { recursive: true });
       for (const file of readdirSafe(ownerSrc)) {
         if (!file.endsWith(".json")) continue;
-        fs20.renameSync(path22.join(ownerSrc, file), path22.join(ownerDst, file));
+        fs19.renameSync(path21.join(ownerSrc, file), path21.join(ownerDst, file));
         movedVmOwner += 1;
       }
       rmdirIfEmpty(ownerSrc);
     }
-    const listenerSrc = path22.join(personaDir, "listener");
-    if (existsSync4(listenerSrc) && isDir(listenerSrc)) {
-      const archiveDst = path22.join(dataDir, ".legacy", `listener-${pid}`);
-      fs20.mkdirSync(archiveDst, { recursive: true });
+    const listenerSrc = path21.join(personaDir, "listener");
+    if (existsSync3(listenerSrc) && isDir(listenerSrc)) {
+      const archiveDst = path21.join(dataDir, ".legacy", `listener-${pid}`);
+      fs19.mkdirSync(archiveDst, { recursive: true });
       for (const file of readdirSafe(listenerSrc)) {
         if (!file.endsWith(".json")) continue;
-        fs20.renameSync(path22.join(listenerSrc, file), path22.join(archiveDst, file));
+        fs19.renameSync(path21.join(listenerSrc, file), path21.join(archiveDst, file));
         archivedListener += 1;
       }
       rmdirIfEmpty(listenerSrc);
     }
     rmdirIfEmpty(personaDir);
   }
-  fs20.mkdirSync(sessionsDir, { recursive: true });
-  fs20.writeFileSync(flagPath, JSON.stringify({ migratedAt: now() }, null, 2));
+  fs19.mkdirSync(sessionsDir, { recursive: true });
+  fs19.writeFileSync(flagPath, JSON.stringify({ migratedAt: now() }, null, 2));
   return {
     skipped: false,
     flagWritten: true,
@@ -26935,9 +26914,9 @@ function migrateFlattenSessions(opts) {
     archivedListener
   };
 }
-function existsSync4(p2) {
+function existsSync3(p2) {
   try {
-    fs20.statSync(p2);
+    fs19.statSync(p2);
     return true;
   } catch {
     return false;
@@ -26945,21 +26924,21 @@ function existsSync4(p2) {
 }
 function isDir(p2) {
   try {
-    return fs20.statSync(p2).isDirectory();
+    return fs19.statSync(p2).isDirectory();
   } catch {
     return false;
   }
 }
 function readdirSafe(p2) {
   try {
-    return fs20.readdirSync(p2);
+    return fs19.readdirSync(p2);
   } catch {
     return [];
   }
 }
 function rmdirIfEmpty(p2) {
   try {
-    fs20.rmdirSync(p2);
+    fs19.rmdirSync(p2);
   } catch {
   }
 }
@@ -27713,10 +27692,10 @@ async function extractFrpcFromTarball(tarball, binDir, version2, platform, destB
   const work = import_node_path19.default.join(binDir, `extract-${process.pid}-${Date.now()}`);
   import_node_fs17.default.mkdirSync(work, { recursive: true });
   try {
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve6, reject) => {
       const proc = (0, import_node_child_process3.spawn)("tar", ["xzf", tarball, "-C", work], { stdio: "pipe" });
       proc.on("error", reject);
-      proc.on("exit", (code) => code === 0 ? resolve2() : reject(new Error(`tar exited ${code}`)));
+      proc.on("exit", (code) => code === 0 ? resolve6() : reject(new Error(`tar exited ${code}`)));
     });
     const dirName = `frp_${version2}_${platform.os}_${platform.arch}`;
     const src = import_node_path19.default.join(work, dirName, "frpc");
@@ -27817,7 +27796,7 @@ async function killStaleFrpc(deps) {
 }
 async function defaultScanFrpcPidsByCmdline(tomlPath, logger) {
   if (process.platform === "win32") return [];
-  return new Promise((resolve2) => {
+  return new Promise((resolve6) => {
     const ps = (0, import_node_child_process4.spawn)("ps", ["-axo", "pid=,command="], { stdio: ["ignore", "pipe", "ignore"] });
     let buf = "";
     ps.stdout.on("data", (c) => {
@@ -27834,11 +27813,11 @@ async function defaultScanFrpcPidsByCmdline(tomlPath, logger) {
         const pid = parseInt(m2[1], 10);
         if (Number.isFinite(pid) && pid > 0) pids.push(pid);
       }
-      resolve2(pids);
+      resolve6(pids);
     });
     ps.on("error", (e) => {
       logger?.warn("tunnel: ps scan failed", { err: e.message });
-      resolve2([]);
+      resolve6([]);
     });
   });
 }
@@ -27916,17 +27895,17 @@ var TunnelManager = class {
       return;
     }
     proc.kill("SIGTERM");
-    await new Promise((resolve2) => {
+    await new Promise((resolve6) => {
       const t = setTimeout(() => {
         try {
           proc.kill("SIGKILL");
         } catch {
         }
-        resolve2();
+        resolve6();
       }, 5e3);
       proc.once("exit", () => {
         clearTimeout(t);
-        resolve2();
+        resolve6();
       });
     });
     clearFrpcPid(this.deps.dataDir);
@@ -28030,14 +28009,14 @@ function formatFrpcTail(raw, maxLines = 12) {
   return ["\u2500\u2500\u2500 frpc output (last lines) \u2500\u2500\u2500", tail, "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"].join("\n");
 }
 async function waitForFrpcReady(proc, timeoutMs) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve6) => {
     let settled = false;
     let buf = "";
     const finish = (r) => {
       if (settled) return;
       settled = true;
       cleanup();
-      resolve2(r);
+      resolve6(r);
     };
     const onData = (chunk) => {
       buf += String(chunk);
@@ -28560,6 +28539,7 @@ function buildPermissionHandlers(deps) {
 }
 
 // src/handlers/history.ts
+var path34 = __toESM(require("path"), 1);
 init_protocol();
 
 // src/session/recent-dirs.ts
@@ -28576,16 +28556,76 @@ function listRecentDirs(store, limit = 50) {
   return Array.from(latestByCwd.entries()).map(([cwd, updatedAt]) => ({ cwd, updatedAt })).sort((a, b2) => a.updatedAt > b2.updatedAt ? -1 : a.updatedAt < b2.updatedAt ? 1 : 0).slice(0, limit);
 }
 
+// src/permission/persona-paths.ts
+var path33 = __toESM(require("path"), 1);
+function getAllowedPersonaIds(grants, action) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const g2 of grants) {
+    if (g2.resource.type !== "persona") continue;
+    const acted = g2.actions.includes(action) || g2.actions.includes("admin");
+    if (!acted) continue;
+    if (g2.resource.id === "*") return "*";
+    ids.add(g2.resource.id);
+  }
+  return ids;
+}
+function isGuestPathAllowed(grants, absPath, personaRoot, action = "read") {
+  const root = path33.resolve(personaRoot);
+  const target = path33.resolve(absPath);
+  const sep3 = root.endsWith(path33.sep) ? "" : path33.sep;
+  if (!target.startsWith(root + sep3)) return false;
+  const rel = path33.relative(root, target);
+  if (!rel || rel.startsWith("..")) return false;
+  const personaId = rel.split(path33.sep)[0];
+  if (!personaId) return false;
+  const allowed = getAllowedPersonaIds(grants, action);
+  if (allowed === "*") return true;
+  return allowed.has(personaId);
+}
+function personaIdFromPath(absPath, personaRoot) {
+  const root = path33.resolve(personaRoot);
+  const target = path33.resolve(absPath);
+  const sep3 = root.endsWith(path33.sep) ? "" : path33.sep;
+  if (!target.startsWith(root + sep3)) return null;
+  const rel = path33.relative(root, target);
+  if (!rel || rel.startsWith("..")) return null;
+  const id = rel.split(path33.sep)[0];
+  return id || null;
+}
+
 // src/handlers/history.ts
 init_protocol();
+function assertGuestPath(ctx, absPath, personaRoot, method) {
+  if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
+  if (!isGuestPathAllowed(ctx.grants, absPath, personaRoot, "read")) {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      `guest ${ctx.principal.id} cannot ${method} path ${absPath}`
+    );
+  }
+}
 function buildHistoryHandlers(deps) {
-  const { manager, history, store } = deps;
-  const projects = async () => {
+  const { manager, history, store, personaRoot } = deps;
+  const projects = async (_frame, _client, ctx) => {
     const list2 = await history.listProjects();
+    if (ctx?.principal.kind === "guest" && personaRoot) {
+      const filtered = list2.filter((p2) => {
+        const pid = personaIdFromPath(p2.projectPath, personaRoot);
+        if (!pid) return false;
+        return isGuestPathAllowed(
+          ctx.grants,
+          path34.join(personaRoot, pid),
+          personaRoot,
+          "read"
+        );
+      });
+      return { response: { type: "history:projects", projects: filtered } };
+    }
     return { response: { type: "history:projects", projects: list2 } };
   };
-  const list = async (frame) => {
+  const list = async (frame, _client, ctx) => {
     const args = HistoryListArgs.parse(frame);
+    assertGuestPath(ctx, path34.resolve(args.projectPath), personaRoot, "history:list");
     const sessions = await history.listSessions(args);
     return { response: { type: "history:list", sessions } };
   };
@@ -28615,18 +28655,26 @@ function buildHistoryHandlers(deps) {
     });
     return { response: { type: "history:read", ...res } };
   };
-  const subagents = async (frame) => {
+  const subagents = async (frame, _client, ctx) => {
     const args = HistorySubagentsArgs.parse(frame);
+    assertGuestPath(ctx, path34.resolve(args.cwd), personaRoot, "history:subagents");
     const subs = await history.listSubagents(args);
     return { response: { type: "history:subagents", subagents: subs } };
   };
-  const subagentRead = async (frame) => {
+  const subagentRead = async (frame, _client, ctx) => {
     const args = HistorySubagentReadArgs.parse(frame);
+    assertGuestPath(ctx, path34.resolve(args.cwd), personaRoot, "history:subagent-read");
     const res = await history.readSubagent(args);
     return { response: { type: "history:subagent-read", ...res } };
   };
-  const recentDirs = async () => {
+  const recentDirs = async (_frame, _client, ctx) => {
     const dirs = listRecentDirs(store);
+    if (ctx?.principal.kind === "guest" && personaRoot) {
+      const filtered = dirs.filter(
+        (d) => isGuestPathAllowed(ctx.grants, path34.resolve(d.cwd), personaRoot, "read")
+      );
+      return { response: { type: "history:recentDirs", dirs: filtered } };
+    }
     return { response: { type: "history:recentDirs", dirs } };
   };
   return {
@@ -28640,26 +28688,47 @@ function buildHistoryHandlers(deps) {
 }
 
 // src/handlers/workspace.ts
+var path35 = __toESM(require("path"), 1);
+var os13 = __toESM(require("os"), 1);
 init_protocol();
+init_protocol();
+function assertGuestPath2(ctx, absPath, personaRoot, method) {
+  if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
+  if (!isGuestPathAllowed(ctx.grants, absPath, personaRoot, "read")) {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      `guest ${ctx.principal.id} cannot ${method} path ${absPath}`
+    );
+  }
+}
 function buildWorkspaceHandlers(deps) {
-  const { workspace, skills, agents } = deps;
-  const list = async (frame) => {
+  const { workspace, skills, agents, personaRoot } = deps;
+  const list = async (frame, _client, ctx) => {
     const args = WorkspaceListArgs.parse(frame);
-    const res = workspace.list(args);
+    const isGuest = ctx?.principal.kind === "guest";
+    const fallbackCwd = isGuest && personaRoot ? personaRoot : os13.homedir();
+    const resolvedCwd = path35.resolve(args.cwd ?? fallbackCwd);
+    const target = args.path ? path35.resolve(resolvedCwd, args.path) : resolvedCwd;
+    assertGuestPath2(ctx, target, personaRoot, "workspace:list");
+    const res = workspace.list({ ...args, cwd: resolvedCwd });
     return { response: { type: "workspace:list", ...res } };
   };
-  const read = async (frame) => {
+  const read = async (frame, _client, ctx) => {
     const args = WorkspaceReadArgs.parse(frame);
+    const target = path35.isAbsolute(args.path) ? path35.resolve(args.path) : path35.resolve(args.cwd, args.path);
+    assertGuestPath2(ctx, target, personaRoot, "workspace:read");
     const res = workspace.read(args);
     return { response: { type: "workspace:read", ...res } };
   };
-  const skillsList = async (frame) => {
+  const skillsList = async (frame, _client, ctx) => {
     const args = SkillsListArgs.parse(frame);
+    assertGuestPath2(ctx, path35.resolve(args.cwd), personaRoot, "skills:list");
     const list2 = skills.list(args);
     return { response: { type: "skills:list", skills: list2 } };
   };
-  const agentsList = async (frame) => {
+  const agentsList = async (frame, _client, ctx) => {
     const args = AgentsListArgs.parse(frame);
+    assertGuestPath2(ctx, path35.resolve(args.cwd), personaRoot, "agents:list");
     const list2 = agents.list(args);
     return { response: { type: "agents:list", agents: list2 } };
   };
@@ -28672,6 +28741,8 @@ function buildWorkspaceHandlers(deps) {
 }
 
 // src/handlers/git.ts
+var path37 = __toESM(require("path"), 1);
+init_protocol();
 init_protocol();
 
 // src/workspace/git.ts
@@ -28754,19 +28825,32 @@ async function listGitBranches(cwd) {
 }
 
 // src/handlers/git.ts
-function buildGitHandlers() {
-  const root = async (frame) => {
+function assertGuestCwd(ctx, cwd, personaRoot, method) {
+  if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
+  if (!isGuestPathAllowed(ctx.grants, path37.resolve(cwd), personaRoot, "read")) {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      `guest ${ctx.principal.id} cannot ${method} cwd ${cwd}`
+    );
+  }
+}
+function buildGitHandlers(deps) {
+  const { personaRoot } = deps;
+  const root = async (frame, _client, ctx) => {
     const args = GitRootArgs.parse(frame);
+    assertGuestCwd(ctx, args.cwd, personaRoot, "git:root");
     const res = await getGitRoot(args.cwd);
     return { response: { type: "git:root", ...res } };
   };
-  const branch = async (frame) => {
+  const branch = async (frame, _client, ctx) => {
     const args = GitBranchArgs.parse(frame);
+    assertGuestCwd(ctx, args.cwd, personaRoot, "git:branch");
     const res = await readGitBranch(args.cwd);
     return { response: { type: "git:branch", ...res } };
   };
-  const branches = async (frame) => {
+  const branches = async (frame, _client, ctx) => {
     const args = GitBranchesArgs.parse(frame);
+    assertGuestCwd(ctx, args.cwd, personaRoot, "git:branches");
     const res = await listGitBranches(args.cwd);
     return { response: { type: "git:branches", ...res } };
   };
@@ -29203,12 +29287,19 @@ function buildPersonaHandlers(deps) {
       response: { type: "persona:list", personas }
     };
   };
-  const get = async (frame) => {
+  const get = async (frame, _client, ctx) => {
     const args = PersonaIdArgsSchema.parse(frame);
     const persona = personaRegistry.get(args.personaId) ?? null;
     if (!persona) {
       return { response: { type: "persona:info", persona: null } };
     }
+    const isGuest = ctx?.principal.kind === "guest";
+    if (isGuest) {
+      const allowed = persona.public && assertGrant(ctx.grants, { type: "persona", id: persona.personaId }, "read");
+      if (!allowed) {
+        return { response: { type: "persona:info", persona: null } };
+      }
+    }
     const personality = personaManager.readPersonality(args.personaId) ?? "";
     const skills = personaManager.listSkills(args.personaId);
     const plugins = personaManager.listEnabledPlugins(args.personaId);
@@ -29252,8 +29343,17 @@ var import_node_path26 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 var DEFAULT_TTL_SECONDS = 24 * 3600;
+function assertGuestAttachmentPath(ctx, absPath, personaRoot, method) {
+  if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
+  if (!isGuestPathAllowed(ctx.grants, absPath, personaRoot, "read")) {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      `guest ${ctx.principal.id} cannot ${method} path ${absPath}`
+    );
+  }
+}
 function buildAttachmentHandlers(deps) {
-  const signUrl = async (frame) => {
+  const signUrl = async (frame, _client, ctx) => {
     const parsed = AttachmentSignUrlArgs.safeParse(frame);
     if (!parsed.success) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, parsed.error.message);
@@ -29295,6 +29395,7 @@ function buildAttachmentHandlers(deps) {
     }
     const cwdAbs = import_node_path26.default.resolve(sessionFile.cwd);
     const candidateAbs = import_node_path26.default.isAbsolute(args.relPath) ? import_node_path26.default.resolve(args.relPath) : import_node_path26.default.resolve(cwdAbs, args.relPath);
+    assertGuestAttachmentPath(ctx, candidateAbs, deps.personaRoot, "attachment.signUrl");
     const entries = deps.groupFileStore.list(scope, args.sessionId);
     const entry = entries.find((e) => {
       const storedAbs = import_node_path26.default.isAbsolute(e.relPath) ? import_node_path26.default.resolve(e.relPath) : import_node_path26.default.resolve(cwdAbs, e.relPath);
@@ -29317,7 +29418,13 @@ function buildAttachmentHandlers(deps) {
       }
     };
   };
-  const groupAdd = async (frame) => {
+  function guardGuestBySessionCwd(ctx, sessionId, method) {
+    if (!ctx || ctx.principal.kind !== "guest" || !deps.personaRoot || !deps.sessionStore) return;
+    const f = deps.sessionStore.read(sessionId);
+    if (!f) return;
+    assertGuestAttachmentPath(ctx, import_node_path26.default.resolve(f.cwd), deps.personaRoot, method);
+  }
+  const groupAdd = async (frame, _client, ctx) => {
     if (!deps.groupFileStore || !deps.getSessionScope) {
       throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, "groupFileStore not wired");
     }
@@ -29326,6 +29433,7 @@ function buildAttachmentHandlers(deps) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, parsed.error.message);
     }
     const args = parsed.data;
+    guardGuestBySessionCwd(ctx, args.sessionId, "attachment.groupAdd");
     const scope = deps.getSessionScope(args.sessionId);
     if (!scope) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, `session ${args.sessionId} not found`);
@@ -29340,7 +29448,7 @@ function buildAttachmentHandlers(deps) {
     });
     return { response: { type: "attachment.groupAdd", entry } };
   };
-  const groupRemove = async (frame) => {
+  const groupRemove = async (frame, _client, ctx) => {
     if (!deps.groupFileStore || !deps.getSessionScope) {
       throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, "groupFileStore not wired");
     }
@@ -29348,6 +29456,7 @@ function buildAttachmentHandlers(deps) {
     if (!parsed.success) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, parsed.error.message);
     }
+    guardGuestBySessionCwd(ctx, parsed.data.sessionId, "attachment.groupRemove");
     const scope = deps.getSessionScope(parsed.data.sessionId);
     if (!scope) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "session not found");
@@ -29361,7 +29470,7 @@ function buildAttachmentHandlers(deps) {
     }
     return { response: { type: "attachment.groupRemove", removed: true } };
   };
-  const groupList = async (frame) => {
+  const groupList = async (frame, _client, ctx) => {
     if (!deps.groupFileStore || !deps.getSessionScope) {
       throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, "groupFileStore not wired");
     }
@@ -29369,6 +29478,7 @@ function buildAttachmentHandlers(deps) {
     if (!parsed.success) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, parsed.error.message);
     }
+    guardGuestBySessionCwd(ctx, parsed.data.sessionId, "attachment.groupList");
     const scope = deps.getSessionScope(parsed.data.sessionId);
     if (!scope) return { response: { type: "attachment.groupList", entries: [] } };
     const entries = deps.groupFileStore.list(scope, parsed.data.sessionId);
@@ -29389,7 +29499,7 @@ function buildMethodHandlers(deps) {
     ...buildPermissionHandlers(deps),
     ...buildHistoryHandlers(deps),
     ...buildWorkspaceHandlers(deps),
-    ...buildGitHandlers(),
+    ...buildGitHandlers(deps),
     ...buildCapabilitiesHandlers(deps),
     ...buildMetaHandlers(deps),
     ...buildPersonaHandlers({
@@ -29480,39 +29590,49 @@ var METHOD_GRANT_MAP = {
   "permission:respond": CAPABILITY_SCOPED,
   "session:answerQuestion": CAPABILITY_SCOPED,
   "session:cancelQuestion": CAPABILITY_SCOPED,
-  "history:projects": ADMIN_ANY,
-  "history:list": ADMIN_ANY,
+  // 2026-05-25 老板拍板：guest 用别人 daemon 的 chat 必须能读 history / workspace /
+  // attachment / skills / agents / git 元信息，下沉到 capability-scoped；handler 内
+  // 用 isGuestPathAllowed (persona-paths.ts) 限制路径必须在 personaRoot/<allowed-pid>/** 下，
+  // 防止跨 persona 越权读 owner 私有文件。
+  "history:projects": CAPABILITY_SCOPED,
+  "history:list": CAPABILITY_SCOPED,
   // history:read 取一条 session 的 CC JSONL 历史。guest 进 persona VM 后必须能读自己
   // 创建的 session 历史（chat view 加载历史消息走这条），所以下沉到 capability-scoped；
   // handler 内按 ctx.capabilityId === file.creatorPrincipalId 拦越权。
   "history:read": CAPABILITY_SCOPED,
-  "history:subagents": ADMIN_ANY,
-  "history:subagent-read": ADMIN_ANY,
-  "history:recentDirs": ADMIN_ANY,
-  "workspace:list": ADMIN_ANY,
-  "workspace:read": ADMIN_ANY,
-  "skills:list": ADMIN_ANY,
-  "agents:list": ADMIN_ANY,
-  "git:root": ADMIN_ANY,
-  "git:branch": ADMIN_ANY,
-  "git:branches": ADMIN_ANY,
+  "history:subagents": CAPABILITY_SCOPED,
+  "history:subagent-read": CAPABILITY_SCOPED,
+  "history:recentDirs": CAPABILITY_SCOPED,
+  "workspace:list": CAPABILITY_SCOPED,
+  "workspace:read": CAPABILITY_SCOPED,
+  "skills:list": CAPABILITY_SCOPED,
+  "agents:list": CAPABILITY_SCOPED,
+  "git:root": CAPABILITY_SCOPED,
+  "git:branch": CAPABILITY_SCOPED,
+  "git:branches": CAPABILITY_SCOPED,
   "capabilities:get": ADMIN_ANY,
   "persona:create": ADMIN_ANY,
-  // persona:list 下沉到 CAPABILITY_SCOPED：guest 调用合法（用于 People 面板展开
-  // 对方分享的 personas），handler 端按 ctx + persona.public + assertGrant 过滤。
+  // persona:list / persona:get 下沉到 CAPABILITY_SCOPED：guest 调用合法
+  // （list 用于 People 面板展开对方分享的 personas；get 用于 guest 视角下
+  // PersonaDrawer 展示 persona 详情 readOnly），handler 端按 ctx + persona.public
+  // + assertGrant 过滤，两者口径一致。
+  // persona:update / persona:delete 保持 ADMIN_ANY：UI 端 guest viewerRole 下
+  // 已干掉编辑入口，dispatcher 这层是双保险——非法 RPC 401 兜底。
   "persona:list": CAPABILITY_SCOPED,
-  "persona:get": ADMIN_ANY,
+  "persona:get": CAPABILITY_SCOPED,
   "persona:update": ADMIN_ANY,
   "persona:delete": ADMIN_ANY,
   "session:pty:input": ADMIN_ANY,
   "session:pty:resize": ADMIN_ANY,
   "session:pty:snapshot": ADMIN_ANY,
-  // file-sharing attachment.* RPC：dispatcher 用 admin-only 兜底（wire-level 拦），
-  // 实际只有 owner 能调（personal token 链路 2026-05-21 删除，HTTP Bearer 只识别 owner）
-  "attachment.signUrl": ADMIN_ANY,
-  "attachment.groupAdd": ADMIN_ANY,
-  "attachment.groupRemove": ADMIN_ANY,
-  "attachment.groupList": ADMIN_ANY
+  // file-sharing attachment.* RPC：dispatcher 放行；handler 内按 sessionId 反查
+  // session.ownerPersonaId + ctx.grants 跑 assertGrant，限制 guest 只能签 / 操作
+  // 自己被授权 persona 下的 session 文件。HTTP Bearer 仍然只识别 owner，所以 guest
+  // 拿到 signed URL 后还要 HTTP 端校验通过才能取到文件——这里 RPC 层 ACL 是第一道。
+  "attachment.signUrl": CAPABILITY_SCOPED,
+  "attachment.groupAdd": CAPABILITY_SCOPED,
+  "attachment.groupRemove": CAPABILITY_SCOPED,
+  "attachment.groupList": CAPABILITY_SCOPED
 };
 function computeGrantForFrame(method, frame) {
   const rule = METHOD_GRANT_MAP[method];
@@ -29552,7 +29672,6 @@ async function startDaemon(config) {
   const ownerPrincipalId = authFile.ownerPrincipalId;
   const ownerDisplayName = loadOwnerDisplayName(config.dataDir);
   const authMode = resolvedAuthToken == null ? "none" : "first-message";
-  migrateLegacyFiles(config.dataDir);
   const inboxStore = new InboxStore(config.dataDir);
   const inboxManager = new InboxManager(inboxStore, (_peerOwnerId, frame) => {
     wsServer?.broadcastToOwners(frame);
@@ -29786,8 +29905,12 @@ async function startDaemon(config) {
       getSignSecret: () => authFile?.signSecret ?? "",
       // group RPC + sign 都用：根据 sessionId 反查 scope。owner-mode persona session 走
       // 'persona/<pid>/owner'，default 走 'default'。
-      getSessionScope: (sid) => manager.findOwnedSessionScope(sid)
+      getSessionScope: (sid) => manager.findOwnedSessionScope(sid),
+      // guest path guard：candidate 必须在 personaRoot 子树下
+      personaRoot: import_node_path27.default.join(config.dataDir, "personas")
     },
+    // workspace/git/history/skills/agents handler 共用的 guest path guard 锚点
+    personaRoot: import_node_path27.default.join(config.dataDir, "personas"),
     // Task 1.9: capability:issue/list/revoke handler 依赖
     capabilityManager,
     // v2 Phase 5: capability:issue 返回的 shareUrl 用此 base URL 拼接。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.79-beta.149.201b46d",
+  "version": "0.2.80-beta.150.2767f59",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",