feat: 内置虾盘云 + 设备指纹绑定 + Release 流水线

- 新增 portable/lib/{fingerprint,xiapan-client,bootstrap-xiapan}.mjs：
  跨平台设备指纹（Win USB/disk + Mac UUID + Linux machine-id + seed 兜底）
  生成 sk-uc-{fingerprint} 形式的虾盘云 apiKey，启动时 merge 到 openclaw.json
- Config.html 顶部新增「已绑定虾盘云」横幅：指纹来源 + Key + 余额 + 充值/解绑
- config-server 增加 /api/xiapan/{status,bind,unbind} 三个端点
- Electron app 在 whenReady 调 bootstrap，新增 sync-lib.js 让 build 前自动同步
- 锁 OpenClaw 版本到 2026.4.29（OPENCLAW_VERSION 单一来源）
- 删除死代码 portable/充值.html
- 新增 .github/workflows/release.yml：tag 触发，出 portable zip + Electron exe/dmg
- README 增加内置虾盘云说明 + 直接下载发行版指引

Author: dongsheng123132

.github/workflows/release.yml

@@ -0,0 +1,209 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to publish (e.g. v2.1.0). Leave empty to use the most recent tag.'
+        required: false
+        default: ''
+
+permissions:
+  contents: write
+
+jobs:
+  portable-windows:
+    name: Portable Windows zip
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Read OpenClaw version
+        id: openclaw_version
+        shell: bash
+        run: |
+          version=$(tr -d '[:space:]' < OPENCLAW_VERSION)
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Run portable setup (Windows)
+        shell: cmd
+        run: |
+          cd portable
+          call setup.bat
+
+      - name: Stage portable folder
+        shell: bash
+        run: |
+          mkdir -p dist
+          tag_name="${GITHUB_REF_NAME:-${{ github.event.inputs.tag }}}"
+          stage_dir="dist/u-claw-portable-windows-${tag_name}"
+          mkdir -p "$stage_dir"
+          cp -R portable/. "$stage_dir/"
+          # Drop dev-only large files we don't ship
+          rm -rf "$stage_dir/data/logs" 2>/dev/null || true
+
+      - name: Zip portable
+        shell: pwsh
+        run: |
+          $tag = if ($env:GITHUB_REF_NAME) { $env:GITHUB_REF_NAME } else { '${{ github.event.inputs.tag }}' }
+          $stage = "dist/u-claw-portable-windows-$tag"
+          $out = "dist/u-claw-portable-windows-$tag.zip"
+          Compress-Archive -Path "$stage/*" -DestinationPath $out -CompressionLevel Optimal
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: portable-windows
+          path: dist/u-claw-portable-windows-*.zip
+
+  portable-mac:
+    name: Portable macOS zip
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Run portable setup (mac)
+        run: |
+          cd portable
+          bash setup.sh
+
+      - name: Stage portable folder
+        run: |
+          mkdir -p dist
+          tag_name="${GITHUB_REF_NAME:-${{ github.event.inputs.tag }}}"
+          stage_dir="dist/u-claw-portable-mac-${tag_name}"
+          mkdir -p "$stage_dir"
+          cp -R portable/. "$stage_dir/"
+          rm -rf "$stage_dir/data/logs" 2>/dev/null || true
+
+      - name: Zip portable
+        run: |
+          tag_name="${GITHUB_REF_NAME:-${{ github.event.inputs.tag }}}"
+          cd dist
+          zip -qry "u-claw-portable-mac-${tag_name}.zip" "u-claw-portable-mac-${tag_name}"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: portable-mac
+          path: dist/u-claw-portable-mac-*.zip
+
+  desktop-windows:
+    name: Electron Windows installer
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install dependencies
+        shell: cmd
+        run: |
+          cd u-claw-app
+          npm install --registry=https://registry.npmmirror.com
+
+      - name: Build Windows installer
+        shell: cmd
+        run: |
+          cd u-claw-app
+          npm run build:win
+        env:
+          # Skip code signing — we ship unsigned. README documents the SmartScreen workaround.
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: desktop-windows
+          path: |
+            u-claw-app/release/*.exe
+            u-claw-app/release/*.exe.blockmap
+
+  desktop-mac:
+    name: Electron macOS DMG
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install dependencies
+        run: |
+          cd u-claw-app
+          npm install --registry=https://registry.npmmirror.com
+
+      - name: Build macOS DMG
+        run: |
+          cd u-claw-app
+          npm run build:mac-arm64
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: desktop-mac
+          path: |
+            u-claw-app/release/*.dmg
+            u-claw-app/release/*.dmg.blockmap
+
+  publish:
+    name: Publish GitHub Release
+    needs: [portable-windows, portable-mac, desktop-windows, desktop-mac]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Resolve tag
+        id: tag
+        run: |
+          if [ -n "${{ github.event.inputs.tag }}" ]; then
+            tag="${{ github.event.inputs.tag }}"
+          else
+            tag="${GITHUB_REF_NAME}"
+          fi
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+
+      - name: Read OpenClaw version
+        id: openclaw_version
+        run: |
+          version=$(tr -d '[:space:]' < OPENCLAW_VERSION)
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Create or update release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.tag.outputs.tag }}
+          name: U-Claw ${{ steps.tag.outputs.tag }}
+          body: |
+            ## U-Claw ${{ steps.tag.outputs.tag }}
+
+            - 内置虾盘云：首次启动自动绑定本机/U盘指纹，生成 `sk-...` apiKey
+            - OpenClaw runtime: `${{ steps.openclaw_version.outputs.version }}`
+            - 充值入口：https://u-claw.org/cloud.html
+
+            > Windows 安装包未做代码签名，首次运行需在 SmartScreen 选择"仍要运行"。
+            > macOS DMG 未做公证，首次启动需 `xattr -rd com.apple.quarantine /Applications/U-Claw.app` 或右键打开。
+          files: |
+            artifacts/portable-windows/*
+            artifacts/portable-mac/*
+            artifacts/desktop-windows/*
+            artifacts/desktop-mac/*
+          fail_on_unmatched_files: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

OPENCLAW_VERSION

@@ -0,0 +1 @@
+2026.4.29

README.md

@@ -22,6 +22,18 @@ U-Claw（虾盘）是一个**制作教程 + 全套源代码**，教你把 [OpenC
 
 > 📖 **[完整教程](https://u-claw.org/tutorial.html)** — 从零开始的手工安装指南、模型配置、聊天平台接入，小白也能看懂。
 
+### 🔗 内置虾盘云：开箱即用
+
+每个 U-Claw 实例首次启动会**自动**根据当前 U 盘 / 硬盘的指纹生成一个 `sk-...` 形式的虾盘云 apiKey，并写入 `data/.openclaw/openclaw.json`。打开 Config.html 就能看到这张「已绑定虾盘云」横幅（指纹来源、Key、余额）。
+
+- **不送 token**：余额初始为 0，需自行充值（[u-claw.org/cloud.html](https://u-claw.org/cloud.html)）
+- **指纹规则**：
+  - 从 U 盘根目录启动 → 绑定该 U 盘的硬件指纹（USB Serial + PNPDeviceID）
+  - 从硬盘启动（电脑安装版 / Electron App）→ 绑定主板 + 系统盘指纹
+  - Mac/Linux 走 Hardware UUID / `/etc/machine-id` + 启动盘 UUID
+- **换机 / 换盘**：换 U 盘或换电脑后，新的指纹会生成新的 Key；旧 Key 的余额仍归属原指纹（在 Config.html 点「解绑」可触发重新绑定）
+- **隐私**：指纹只用于本地生成 Key，不上传，无登录
+
 ### 一键安装（推荐）
 
 不需要 U 盘，一行命令直接装到电脑：
@@ -108,6 +120,19 @@ npm run build:mac-arm64  # 打包 → release/*.dmg
 npm run build:win        # 打包 → release/*.exe
 ```
 
+### 直接下载发行版
+
+[GitHub Releases](https://github.com/dongsheng123132/u-claw/releases) 提供四种打包好的产物：
+
+- `u-claw-portable-windows-vX.Y.Z.zip` — Windows 便携版（解压即用）
+- `u-claw-portable-mac-vX.Y.Z.zip` — Mac 便携版
+- `U-Claw Setup vX.Y.Z.exe` — Windows 桌面安装包
+- `U-Claw-vX.Y.Z-arm64.dmg` — Mac 桌面安装包
+
+> ⚠️ 安装包未签名：
+> - **Windows**：双击 `.exe` 时 SmartScreen 会拦，点「更多信息」→「仍要运行」
+> - **Mac**：首次启动如被 Gatekeeper 拦，执行 `xattr -rd com.apple.quarantine /Applications/U-Claw.app` 或在 Finder 里右键→打开
+
 ### 支持的 AI 模型
 
 **国产模型（无需翻墙）：**

install/install.sh

@@ -176,13 +176,14 @@ if [ -d "$CORE_DIR/node_modules/openclaw" ]; then
     echo -e "  ${GREEN}✓${NC} OpenClaw 已安装，跳过"
 else
     if [ ! -f "$CORE_DIR/package.json" ]; then
-        cat > "$CORE_DIR/package.json" << 'PKGJSON'
+        OPENCLAW_VERSION="2026.4.29"
+        cat > "$CORE_DIR/package.json" << PKGJSON
 {
   "name": "u-claw-core",
   "version": "1.0.0",
   "private": true,
   "dependencies": {
-    "openclaw": "latest"
+    "openclaw": "$OPENCLAW_VERSION"
   }
 }
 PKGJSON

portable/Config.html

@@ -151,6 +151,26 @@
     <h1><span class="lobster">🦞</span> U-Claw Pro</h1>
     <p class="subtitle">便携版 — 选择模型，填入 API Key，一键启动</p>
 
+    <!-- Xiapan Cloud bound banner: shown when bootstrap has injected uclaw-cloud -->
+    <div class="xp-banner" id="xpBanner" style="display:none; background:linear-gradient(135deg,#2a1f1f,#1f2a1f); border:1px solid #ff6b35; border-radius:10px; padding:16px 18px; margin-bottom:18px;">
+        <div style="display:flex; align-items:center; justify-content:space-between; gap:12px; flex-wrap:wrap;">
+            <div style="flex:1; min-width:240px;">
+                <div style="font-size:0.95em; color:#ff6b35; font-weight:600;">🔗 已绑定虾盘云 · 开箱即用</div>
+                <div style="font-size:0.82em; color:#bbb; margin-top:4px;">
+                    指纹来源: <span id="xpSource">—</span>
+                    · Key: <code id="xpKeyShort" style="background:#222; padding:2px 6px; border-radius:4px;">—</code>
+                    · 余额: <span id="xpBalance">—</span>
+                </div>
+                <div id="xpHint" style="font-size:0.75em; color:#888; margin-top:4px;">余额为 0 时无法调用 AI，请先充值</div>
+            </div>
+            <div style="display:flex; gap:8px;">
+                <button class="btn" id="xpRecharge" style="background:#ff6b35; color:#fff; padding:8px 16px; font-size:0.85em;">前往充值 →</button>
+                <button class="btn" id="xpRefresh" style="background:#333; color:#ccc; padding:8px 12px; font-size:0.85em;">刷新</button>
+                <button class="btn" id="xpRebind" style="background:#222; color:#888; padding:8px 12px; font-size:0.8em;" title="清除绑定后重启 U-Claw 即可重新生成 Key">解绑</button>
+            </div>
+        </div>
+    </div>
+
     <!-- Steps -->
     <div class="steps">
         <div class="step active" data-step="1"><span class="num">1</span>选模型</div>
@@ -388,6 +408,50 @@ <h4>data/ — 配置和聊天记录</h4>
 <div class="toast" id="toast"></div>
 
 <script>
+// --- Xiapan Cloud banner ---
+async function loadXiapanStatus() {
+    const banner = document.getElementById('xpBanner');
+    try {
+        const res = await fetch('/api/xiapan/status');
+        if (!res.ok) return;
+        const data = await res.json();
+        if (!data || !data.apiKey) return;
+
+        document.getElementById('xpSource').textContent = ({
+            usb: 'U 盘', disk: '硬盘', mac: 'Mac', linux: 'Linux', seed: '本机种子', test: '测试',
+        })[data.source] || data.source;
+        document.getElementById('xpKeyShort').textContent = data.apiKey.slice(0, 14) + '…';
+        const bal = data.balance || {};
+        if (bal.ok) {
+            const usd = bal.remainingUsd != null ? bal.remainingUsd.toFixed(2) : '0.00';
+            const tokens = (bal.remainingTokens || 0).toLocaleString();
+            document.getElementById('xpBalance').textContent = `$${usd} (${tokens} tokens)`;
+            document.getElementById('xpHint').textContent = bal.remainingUsd > 0
+                ? '可直接使用 deepseek-chat / qwen-plus / qwen-turbo'
+                : '余额为 0，点击右侧前往充值';
+        } else if (bal.reason && bal.reason.includes('401')) {
+            document.getElementById('xpBalance').textContent = '未注册';
+            document.getElementById('xpHint').textContent = '首次使用：点「前往充值」即可在虾盘云页面注册并充值，秒到账';
+        } else {
+            document.getElementById('xpBalance').textContent = '查询失败';
+            document.getElementById('xpHint').textContent = '请检查网络或 api.u-claw.org 服务状态';
+        }
+
+        document.getElementById('xpRecharge').onclick = () => window.open(data.rechargeUrl, '_blank');
+        document.getElementById('xpRefresh').onclick = () => loadXiapanStatus();
+        document.getElementById('xpRebind').onclick = async () => {
+            if (!confirm('解绑后下次启动 U-Claw 会重新生成 Key（基于当前设备指纹）。\n现有 Key 的余额仍归属当前指纹，更换 U 盘 / 电脑后才需要解绑。\n\n确认解绑？')) return;
+            await fetch('/api/xiapan/unbind', { method: 'POST' });
+            showToast('已解绑，请重启 U-Claw');
+        };
+
+        banner.style.display = 'block';
+    } catch (err) {
+        // network error or endpoint missing — leave banner hidden
+    }
+}
+loadXiapanStatus();
+
 // --- State ---
 let selectedProvider = null;
 let selectedBase = '';

portable/Mac-Start.command

@@ -106,6 +106,11 @@ if [ ! -d "$CORE_DIR/node_modules" ]; then
     echo ""
 fi
 
+# ---- 7b. Bind device fingerprint and inject Xiapan Cloud apiKey ----
+echo -e "  ${CYAN}Binding device fingerprint to Xiapan Cloud...${NC}"
+UCLAW_APP_ROOT="$UCLAW_DIR" "$NODE_BIN" "$UCLAW_DIR/lib/bootstrap-xiapan.mjs" "$CONFIG_FILE" || true
+echo ""
+
 # ---- 8. Find available port ----
 PORT=18789
 while lsof -i :$PORT >/dev/null 2>&1; do

portable/Windows-Start.bat

@@ -72,6 +72,12 @@ if not exist "%CORE_DIR%\node_modules" (
     echo.
 )
 
+REM Bind device fingerprint and inject Xiapan Cloud apiKey into openclaw.json
+echo   Binding device fingerprint to Xiapan Cloud...
+set "UCLAW_APP_ROOT=%UCLAW_DIR%"
+"%NODE_BIN%" "%UCLAW_DIR%lib\bootstrap-xiapan.mjs" "%STATE_DIR%\openclaw.json"
+echo.
+
 REM Auto-install WeChat plugin if available
 set "WECHAT_PLUGIN_SRC=%APP_DIR%\extensions\openclaw-weixin"
 set "WECHAT_PLUGIN_DST=%USERPROFILE%\.openclaw\extensions\openclaw-weixin"