@clawos-dev/clawd 0.2.199 → 0.2.201-beta.402.b896f3d

package/dist/cli.cjs

@@ -158,6 +158,11 @@ var init_methods = __esm({
       "contact:list",
       "contact:pin",
       "contact:remove",
+      // ---- contact:setSshAccess / contact:sshKey:issue (SSH 反向访问，PR: contact-ssh-sandbox) ----
+      // owner UI 授权 contact 通过 daemon 专用 sshd 反向 SSH 进本机；guest daemon 用 sshKey:issue 拉 privkey.
+      // 详见 protocol/src/contact-ssh.ts.
+      "contact:setSshAccess",
+      "contact:sshKey:issue",
       // ---- visitor:* (web 访客 · persona web 分享，spec 2026-06-24-persona-web-share-design) ----
       // owner-only：列出登录访问过本机 public persona 的 web 访客（零安装、飞书登录、daemon 自签
       // visitor token）。存储 ~/.clawd/visitors.json（VisitorStore），登录(exchange)即 upsert；
@@ -737,8 +742,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path68, errorMaps, issueData } = params;
-      const fullPath = [...path68, ...issueData.path || []];
+      const { data, path: path76, errorMaps, issueData } = params;
+      const fullPath = [...path76, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -1049,11 +1054,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path68, key) {
+      constructor(parent, value, path76, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path68;
+        this._path = path76;
         this._key = key;
       }
       get path() {
@@ -5678,7 +5683,19 @@ var init_contact = __esm({
        * 老 contacts.json 缺此字段 → zod default 补 null（无破坏性升级；不 orphan）。
        * 对齐 SessionFile.pinnedAt 语义（daemon 侧持久化，contact:pin RPC 更新 → contact:pinned push）。
        */
-      pinnedAt: external_exports.number().int().nullable().default(null)
+      pinnedAt: external_exports.number().int().nullable().default(null),
+      /**
+       * SSH 反向访问授权（PR: contact-ssh-sandbox）。owner 视角：允许该 contact 通过 daemon
+       * 专用 sshd 反向 SSH 进本机。default=false 保证老 contacts.json 兼容（zod default 补齐）。
+       * 授权粒度 per-people (per-contact)：借用别人 persona 本来就带信任对方本人的前提；
+       * 极端场景（区别对方多个 persona）留 per-persona override 演进空间。
+       */
+      sshAllowed: external_exports.boolean().default(false),
+      /**
+       * 授权访问的目录白名单（绝对路径）。空数组 + sshAllowed=true 意味 SSH 通道能拨到但无处可读，
+       * jail 会拒绝 shell 启动。由 clawd-ssh-jail 运行时读，生成 sbpl / bwrap policy 白名单。
+       */
+      exposedDirs: external_exports.array(external_exports.string()).default([])
     }).strict();
     ContactWireSchema = ContactSchema;
     ContactRemoveArgsSchema = external_exports.object({
@@ -5717,6 +5734,40 @@ var init_contact = __esm({
   }
 });
 
+// ../protocol/src/contact-ssh.ts
+var ContactSetSshAccessArgsSchema, ContactSetSshAccessOkSchema, ContactSshKeyIssueArgsSchema, ContactSshKeyIssueOkSchema, ContactSshAccessUpdatedFrameSchema;
+var init_contact_ssh = __esm({
+  "../protocol/src/contact-ssh.ts"() {
+    "use strict";
+    init_zod();
+    ContactSetSshAccessArgsSchema = external_exports.object({
+      deviceId: external_exports.string().min(1),
+      sshAllowed: external_exports.boolean(),
+      exposedDirs: external_exports.array(external_exports.string())
+    }).strict();
+    ContactSetSshAccessOkSchema = external_exports.object({
+      type: external_exports.literal("contact:setSshAccess:ok"),
+      deviceId: external_exports.string().min(1),
+      sshAllowed: external_exports.boolean(),
+      exposedDirs: external_exports.array(external_exports.string())
+    }).strict();
+    ContactSshKeyIssueArgsSchema = external_exports.object({
+      deviceId: external_exports.string().min(1)
+    }).strict();
+    ContactSshKeyIssueOkSchema = external_exports.object({
+      type: external_exports.literal("contact:sshKey:issue:ok"),
+      privateKeyPem: external_exports.string().min(1),
+      publicKeyLine: external_exports.string().min(1)
+    }).strict();
+    ContactSshAccessUpdatedFrameSchema = external_exports.object({
+      type: external_exports.literal("contact:ssh-access-updated"),
+      deviceId: external_exports.string().min(1),
+      sshAllowed: external_exports.boolean(),
+      exposedDirs: external_exports.array(external_exports.string())
+    }).strict();
+  }
+});
+
 // ../protocol/src/extension.ts
 function isAllowedHostedUrl(raw) {
   let u;
@@ -6118,6 +6169,7 @@ var init_runtime = __esm({
     init_capability();
     init_inbox();
     init_contact();
+    init_contact_ssh();
     init_extension();
     init_feishu_auth();
     init_dispatch();
@@ -6397,8 +6449,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path68 = req.path;
-        _req.url = typeof path68 === "string" ? path68 : req.url ? req.url.path || req.url : void 0;
+        const path76 = req.path;
+        _req.url = typeof path76 === "string" ? path76 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -6563,14 +6615,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path68) {
+    function parsePath(path76) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path68.length; i++) {
-        const char = path68[i];
+      for (let i = 0; i < path76.length; i++) {
+        const char = path76[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -6701,10 +6753,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path68 of paths) {
-        const parts = parsePath(path68);
+      for (const path76 of paths) {
+        const parts = parsePath(path76);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path68, remove);
+          redactWildcardPath(obj, parts, censor, path76, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -6789,8 +6841,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path68) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path68];
+            const wrappedCensor = typeof censor === "function" ? (value, path76) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path76];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -6825,8 +6877,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path68 of pathsToClone) {
-        const parts = parsePath(path68);
+      for (const path76 of pathsToClone) {
+        const parts = parsePath(path76);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -6878,24 +6930,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path68) {
-      if (typeof path68 !== "string") {
+    function validatePath(path76) {
+      if (typeof path76 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path68 === "") {
+      if (path76 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path68.includes("..")) {
-        throw new Error(`Invalid redaction path (${path68})`);
+      if (path76.includes("..")) {
+        throw new Error(`Invalid redaction path (${path76})`);
       }
-      if (path68.includes(",")) {
-        throw new Error(`Invalid redaction path (${path68})`);
+      if (path76.includes(",")) {
+        throw new Error(`Invalid redaction path (${path76})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path68.length; i++) {
-        const char = path68[i];
+      for (let i = 0; i < path76.length; i++) {
+        const char = path76[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -6909,20 +6961,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path68})`);
+            throw new Error(`Invalid redaction path (${path76})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path68})`);
+        throw new Error(`Invalid redaction path (${path76})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path68 of paths) {
-        validatePath(path68);
+      for (const path76 of paths) {
+        validatePath(path76);
       }
     }
     function slowRedact(options = {}) {
@@ -7090,8 +7142,8 @@ var require_redaction = __commonJS({
         if (shape[k2] === null) {
           o[k2] = (value) => topCensor(value, [k2]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path68) => {
-            return censor(value, [k2, ...path68]);
+          const wrappedCensor = typeof censor === "function" ? (value, path76) => {
+            return censor(value, [k2, ...path76]);
           } : censor;
           o[k2] = Redact({
             paths: shape[k2],
@@ -7309,10 +7361,10 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "../node_modules/.pnpm/sonic-boom@4.2.1/node_modules/sonic-boom/index.js"(exports2, module2) {
     "use strict";
-    var fs61 = require("fs");
+    var fs69 = require("fs");
     var EventEmitter3 = require("events");
     var inherits = require("util").inherits;
-    var path68 = require("path");
+    var path76 = require("path");
     var sleep2 = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -7366,20 +7418,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs61.mkdirSync(path68.dirname(file), { recursive: true });
-          const fd = fs61.openSync(file, flags, mode);
+          if (sonic.mkdir) fs69.mkdirSync(path76.dirname(file), { recursive: true });
+          const fd = fs69.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs61.mkdir(path68.dirname(file), { recursive: true }, (err) => {
+        fs69.mkdir(path76.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs61.open(file, flags, mode, fileOpened);
+          fs69.open(file, flags, mode, fileOpened);
         });
       } else {
-        fs61.open(file, flags, mode, fileOpened);
+        fs69.open(file, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -7420,8 +7472,8 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs61.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs61.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs69.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs69.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
@@ -7430,15 +7482,15 @@ var require_sonic_boom = __commonJS({
         this._actualWrite = actualWrite;
         fsWriteSync = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs61.writeSync(this.fd, this._writingBuf);
+            return fs69.writeSync(this.fd, this._writingBuf);
           }
-          return fs61.writeSync(this.fd, this._writingBuf, "utf8");
+          return fs69.writeSync(this.fd, this._writingBuf, "utf8");
         };
         fsWrite = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs61.write(this.fd, this._writingBuf, this.release);
+            return fs69.write(this.fd, this._writingBuf, this.release);
           }
-          return fs61.write(this.fd, this._writingBuf, "utf8", this.release);
+          return fs69.write(this.fd, this._writingBuf, "utf8", this.release);
         };
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
@@ -7495,7 +7547,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs61.fsyncSync(this.fd);
+          fs69.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -7609,7 +7661,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs61.fsync(this.fd, (err) => {
+            fs69.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -7711,7 +7763,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs61.close(fd, (err) => {
+          fs69.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -7760,7 +7812,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = Buffer.isBuffer(buf) ? fs61.writeSync(this.fd, buf) : fs61.writeSync(this.fd, buf, "utf8");
+          const n = Buffer.isBuffer(buf) ? fs69.writeSync(this.fd, buf) : fs69.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -7776,7 +7828,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs61.fsyncSync(this.fd);
+        fs69.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -7797,7 +7849,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs61.writeSync(this.fd, buf);
+          const n = fs69.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -7825,13 +7877,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = Buffer.isBuffer(this._writingBuf) ? fs61.writeSync(this.fd, this._writingBuf) : fs61.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = Buffer.isBuffer(this._writingBuf) ? fs69.writeSync(this.fd, this._writingBuf) : fs69.writeSync(this.fd, this._writingBuf, "utf8");
           release(null, written);
         } catch (err) {
           release(err);
         }
       } else {
-        fs61.write(this.fd, this._writingBuf, release);
+        fs69.write(this.fd, this._writingBuf, release);
       }
     }
     function actualWriteBuffer() {
@@ -7840,7 +7892,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs61.writeSync(this.fd, this._writingBuf);
+          const written = fs69.writeSync(this.fd, this._writingBuf);
           release(null, written);
         } catch (err) {
           release(err);
@@ -7849,7 +7901,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs61.write(this.fd, this._writingBuf, release);
+        fs69.write(this.fd, this._writingBuf, release);
       }
     }
     function actualClose(sonic) {
@@ -7865,12 +7917,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs61.fsync(sonic.fd, closeWrapped);
+        fs69.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs61.close(sonic.fd, done);
+          fs69.close(sonic.fd, done);
         } else {
           done();
         }
@@ -10234,7 +10286,7 @@ var require_multistream = __commonJS({
 var require_pino = __commonJS({
   "../node_modules/.pnpm/pino@9.14.0/node_modules/pino/pino.js"(exports2, module2) {
     "use strict";
-    var os23 = require("os");
+    var os24 = require("os");
     var stdSerializers = require_pino_std_serializers();
     var caller = require_caller();
     var redaction = require_redaction();
@@ -10281,7 +10333,7 @@ var require_pino = __commonJS({
     } = symbols;
     var { epochTime, nullTime } = time;
     var { pid } = process;
-    var hostname = os23.hostname();
+    var hostname = os24.hostname();
     var defaultErrorSerializer = stdSerializers.err;
     var defaultOptions = {
       level: "info",
@@ -11005,11 +11057,11 @@ var init_lib = __esm({
           }
         }
       },
-      addToPath: function addToPath(path68, added, removed, oldPosInc, options) {
-        var last = path68.lastComponent;
+      addToPath: function addToPath(path76, added, removed, oldPosInc, options) {
+        var last = path76.lastComponent;
         if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
           return {
-            oldPos: path68.oldPos + oldPosInc,
+            oldPos: path76.oldPos + oldPosInc,
             lastComponent: {
               count: last.count + 1,
               added,
@@ -11019,7 +11071,7 @@ var init_lib = __esm({
           };
         } else {
           return {
-            oldPos: path68.oldPos + oldPosInc,
+            oldPos: path76.oldPos + oldPosInc,
             lastComponent: {
               count: 1,
               added,
@@ -11485,10 +11537,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec3 = m2;
-      const path68 = typeof rec3.path === "string" ? rec3.path : null;
+      const path76 = typeof rec3.path === "string" ? rec3.path : null;
       const content = typeof rec3.content === "string" ? rec3.content : null;
-      if (!path68 || content == null) return null;
-      const entry = { path: path68, content };
+      if (!path76 || content == null) return null;
+      const entry = { path: path76, content };
       if (typeof rec3.mtimeMs === "number") entry.mtimeMs = rec3.mtimeMs;
       return entry;
     }).filter((m2) => m2 !== null);
@@ -11952,6 +12004,14 @@ var init_claude_history = __esm({
   }
 });
 
+// ../protocol/src/index.ts
+var init_src = __esm({
+  "../protocol/src/index.ts"() {
+    "use strict";
+    init_runtime();
+  }
+});
+
 // src/tools/claude.ts
 function probeViaWhich() {
   try {
@@ -12300,10 +12360,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec3 = m2;
-      const path68 = typeof rec3.path === "string" ? rec3.path : null;
+      const path76 = typeof rec3.path === "string" ? rec3.path : null;
       const content = typeof rec3.content === "string" ? rec3.content : null;
-      if (!path68 || content == null) return null;
-      const out = { path: path68, content };
+      if (!path76 || content == null) return null;
+      const out = { path: path76, content };
       if (typeof rec3.mtimeMs === "number") out.mtimeMs = rec3.mtimeMs;
       return out;
     }).filter((m2) => m2 !== null);
@@ -26775,6 +26835,121 @@ var require_dist = __commonJS({
   }
 });
 
+// src/dispatch/peer-forward.ts
+function wsUrlToHttp(url) {
+  if (url.startsWith("wss://")) return "https://" + url.slice("wss://".length);
+  if (url.startsWith("ws://")) return "http://" + url.slice("ws://".length);
+  return url;
+}
+async function forwardDispatchToPeer(args) {
+  const f = args.fetchImpl ?? fetch;
+  const base = wsUrlToHttp(args.contact.remoteUrl).replace(/\/+$/, "");
+  const url = `${base}/rpc/personaDispatch:run`;
+  let res;
+  try {
+    res = await f(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${args.contact.connectToken}`
+      },
+      // 注意：不带 targetDeviceId —— B 端据此判定为本地执行（B 角色）。
+      body: JSON.stringify({ targetPersona: args.targetPersona, prompt: args.prompt })
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { kind: "failure", reason: `forward to peer failed: ${msg}` };
+  }
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    return {
+      kind: "failure",
+      reason: `peer returned non-JSON response (HTTP ${res.status})`
+    };
+  }
+  if (json.ok === false) {
+    return { kind: "failure", reason: `peer rejected: ${json.error}: ${json.message}` };
+  }
+  return json.result.outcome;
+}
+async function forwardInboxPostToPeer(args) {
+  const f = args.fetchImpl ?? fetch;
+  const base = wsUrlToHttp(args.contact.remoteUrl).replace(/\/+$/, "");
+  const url = `${base}/rpc/inbox:postMessage`;
+  let res;
+  try {
+    res = await f(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${args.contact.connectToken}`
+      },
+      body: JSON.stringify({
+        id: args.id,
+        text: args.text,
+        createdAt: args.createdAt,
+        ...args.origin ? { origin: args.origin } : {}
+      })
+    });
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+  let json = null;
+  try {
+    json = await res.json();
+  } catch {
+    return { ok: false, error: `peer non-JSON (HTTP ${res.status})` };
+  }
+  if (res.status < 200 || res.status >= 300 || json?.ok === false) {
+    return { ok: false, error: json?.error ?? `HTTP ${res.status}` };
+  }
+  return { ok: true };
+}
+async function forwardContactSshKeyIssueToPeer(args) {
+  const f = args.fetchImpl ?? fetch;
+  const base = wsUrlToHttp(args.contact.remoteUrl).replace(/\/+$/, "");
+  const url = `${base}/rpc/contact:sshKey:issue`;
+  let res;
+  try {
+    res = await f(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${args.contact.connectToken}`
+      },
+      body: JSON.stringify({ deviceId: args.selfDeviceIdForRequest })
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      code: "NETWORK",
+      message: err instanceof Error ? err.message : String(err)
+    };
+  }
+  let json = null;
+  try {
+    json = await res.json();
+  } catch {
+    return { ok: false, code: "PROTOCOL", message: `peer non-JSON (HTTP ${res.status})` };
+  }
+  if (!json) {
+    return { ok: false, code: "PROTOCOL", message: `peer returned null (HTTP ${res.status})` };
+  }
+  if (json.ok === false) {
+    const j = json;
+    return { ok: false, code: j.error ?? "UNKNOWN", message: j.message ?? "" };
+  }
+  const r = json.result;
+  return { ok: true, privateKeyPem: r.privateKeyPem, publicKeyLine: r.publicKeyLine };
+}
+var init_peer_forward = __esm({
+  "src/dispatch/peer-forward.ts"() {
+    "use strict";
+  }
+});
+
 // ../node_modules/.pnpm/ws@8.20.0/node_modules/ws/lib/constants.js
 var require_constants2 = __commonJS({
   "../node_modules/.pnpm/ws@8.20.0/node_modules/ws/lib/constants.js"(exports2, module2) {
@@ -28976,9 +29151,9 @@ var require_websocket = __commonJS({
     var EventEmitter3 = require("events");
     var https = require("https");
     var http3 = require("http");
-    var net3 = require("net");
+    var net4 = require("net");
     var tls = require("tls");
-    var { randomBytes, createHash: createHash3 } = require("crypto");
+    var { randomBytes, createHash: createHash2 } = require("crypto");
     var { Duplex, Readable: Readable3 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -29638,7 +29813,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash2("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -29710,12 +29885,12 @@ var require_websocket = __commonJS({
     }
     function netConnect(options) {
       options.path = options.socketPath;
-      return net3.connect(options);
+      return net4.connect(options);
     }
     function tlsConnect(options) {
       options.path = void 0;
       if (!options.servername && options.servername !== "") {
-        options.servername = net3.isIP(options.host) ? "" : options.host;
+        options.servername = net4.isIP(options.host) ? "" : options.host;
       }
       return tls.connect(options);
     }
@@ -30005,7 +30180,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter3 = require("events");
     var http3 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash3 } = require("crypto");
+    var { createHash: createHash2 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -30306,7 +30481,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash2("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -30391,6 +30566,23 @@ var require_websocket_server = __commonJS({
   }
 });
 
+// ../node_modules/.pnpm/ws@8.20.0/node_modules/ws/wrapper.mjs
+var import_stream, import_extension, import_permessage_deflate, import_receiver, import_sender, import_subprotocol, import_websocket, import_websocket_server, wrapper_default;
+var init_wrapper = __esm({
+  "../node_modules/.pnpm/ws@8.20.0/node_modules/ws/wrapper.mjs"() {
+    "use strict";
+    import_stream = __toESM(require_stream(), 1);
+    import_extension = __toESM(require_extension(), 1);
+    import_permessage_deflate = __toESM(require_permessage_deflate(), 1);
+    import_receiver = __toESM(require_receiver(), 1);
+    import_sender = __toESM(require_sender(), 1);
+    import_subprotocol = __toESM(require_subprotocol(), 1);
+    import_websocket = __toESM(require_websocket(), 1);
+    import_websocket_server = __toESM(require_websocket_server(), 1);
+    wrapper_default = import_websocket.default;
+  }
+});
+
 // ../node_modules/.pnpm/process-nextick-args@2.0.1/node_modules/process-nextick-args/index.js
 var require_process_nextick_args = __commonJS({
   "../node_modules/.pnpm/process-nextick-args@2.0.1/node_modules/process-nextick-args/index.js"(exports2, module2) {
@@ -33268,8 +33460,8 @@ var require_utils = __commonJS({
       var result = transform[inputType][outputType](input);
       return result;
     };
-    exports2.resolve = function(path68) {
-      var parts = path68.split("/");
+    exports2.resolve = function(path76) {
+      var parts = path76.split("/");
       var result = [];
       for (var index = 0; index < parts.length; index++) {
         var part = parts[index];
@@ -39122,18 +39314,18 @@ var require_object = __commonJS({
       var object = new ZipObject(name, zipObjectContent, o);
       this.files[name] = object;
     };
-    var parentFolder = function(path68) {
-      if (path68.slice(-1) === "/") {
-        path68 = path68.substring(0, path68.length - 1);
+    var parentFolder = function(path76) {
+      if (path76.slice(-1) === "/") {
+        path76 = path76.substring(0, path76.length - 1);
       }
-      var lastSlash = path68.lastIndexOf("/");
-      return lastSlash > 0 ? path68.substring(0, lastSlash) : "";
+      var lastSlash = path76.lastIndexOf("/");
+      return lastSlash > 0 ? path76.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path68) {
-      if (path68.slice(-1) !== "/") {
-        path68 += "/";
+    var forceTrailingSlash = function(path76) {
+      if (path76.slice(-1) !== "/") {
+        path76 += "/";
       }
-      return path68;
+      return path76;
     };
     var folderAdd = function(name, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults.createFolders;
@@ -40135,7 +40327,7 @@ var require_lib3 = __commonJS({
 // src/run-case/recorder.ts
 function startRunCaseRecorder(opts) {
   const now = opts.now ?? Date.now;
-  const dir = import_node_path56.default.dirname(opts.recordPath);
+  const dir = import_node_path63.default.dirname(opts.recordPath);
   let stream = null;
   let closing = false;
   let closedSettled = false;
@@ -40149,8 +40341,8 @@ function startRunCaseRecorder(opts) {
   });
   const ensureStream = () => {
     if (stream) return stream;
-    import_node_fs43.default.mkdirSync(dir, { recursive: true });
-    stream = import_node_fs43.default.createWriteStream(opts.recordPath, { flags: "a" });
+    import_node_fs50.default.mkdirSync(dir, { recursive: true });
+    stream = import_node_fs50.default.createWriteStream(opts.recordPath, { flags: "a" });
     stream.on("close", () => closedResolve());
     return stream;
   };
@@ -40175,12 +40367,12 @@ function startRunCaseRecorder(opts) {
   };
   return { tap, close, closed };
 }
-var import_node_fs43, import_node_path56;
+var import_node_fs50, import_node_path63;
 var init_recorder = __esm({
   "src/run-case/recorder.ts"() {
     "use strict";
-    import_node_fs43 = __toESM(require("fs"), 1);
-    import_node_path56 = __toESM(require("path"), 1);
+    import_node_fs50 = __toESM(require("fs"), 1);
+    import_node_path63 = __toESM(require("path"), 1);
   }
 });
 
@@ -40223,7 +40415,7 @@ var init_wire = __esm({
 // src/run-case/controller.ts
 async function runController(opts) {
   const now = opts.now ?? Date.now;
-  const cwd = opts.cwd ?? (0, import_node_fs44.mkdtempSync)(import_node_path57.default.join(import_node_os22.default.tmpdir(), "clawd-runcase-"));
+  const cwd = opts.cwd ?? (0, import_node_fs51.mkdtempSync)(import_node_path64.default.join(import_node_os22.default.tmpdir(), "clawd-runcase-"));
   const ownsCwd = opts.cwd === void 0;
   const recorder = startRunCaseRecorder({ recordPath: opts.record, now });
   const spawnCtx = { cwd };
@@ -40384,19 +40576,19 @@ async function runController(opts) {
   if (sigintHandler) process.off("SIGINT", sigintHandler);
   if (ownsCwd) {
     try {
-      (0, import_node_fs44.rmSync)(cwd, { recursive: true, force: true });
+      (0, import_node_fs51.rmSync)(cwd, { recursive: true, force: true });
     } catch {
     }
   }
   return exitCode ?? 0;
 }
-var import_node_fs44, import_node_os22, import_node_path57;
+var import_node_fs51, import_node_os22, import_node_path64;
 var init_controller = __esm({
   "src/run-case/controller.ts"() {
     "use strict";
-    import_node_fs44 = require("fs");
+    import_node_fs51 = require("fs");
     import_node_os22 = __toESM(require("os"), 1);
-    import_node_path57 = __toESM(require("path"), 1);
+    import_node_path64 = __toESM(require("path"), 1);
     init_claude();
     init_stdout_splitter();
     init_permission_stdio();
@@ -40492,6 +40684,163 @@ stdout \u4E8B\u4EF6\uFF08\u884C JSON\uFF09\uFF1A
   }
 });
 
+// src/sshd/sshd-cli-relay.ts
+var sshd_cli_relay_exports = {};
+__export(sshd_cli_relay_exports, {
+  sshRelay: () => sshRelay
+});
+async function sshRelay(argv) {
+  const args = parseSshRelayArgs(argv);
+  if (args.help) {
+    process.stdout.write(SSH_RELAY_HELP);
+    return 0;
+  }
+  if (!args.peerDeviceId) {
+    process.stderr.write("clawd ssh-relay: missing <peer-device-id>\n" + SSH_RELAY_HELP);
+    return 2;
+  }
+  const dataDir = args.dataDir ?? import_node_path65.default.join(import_node_os23.default.homedir(), ".clawd");
+  const contact = findContact(dataDir, args.peerDeviceId);
+  if (!contact) {
+    process.stderr.write(`clawd ssh-relay: contact ${args.peerDeviceId} not found in ${dataDir}/contacts.json
+`);
+    return 2;
+  }
+  if (!contact.connectToken) {
+    process.stderr.write(
+      `clawd ssh-relay: contact ${args.peerDeviceId} has no connectToken (auto-reverse \u672A\u6362\u7968)
+`
+    );
+    return 2;
+  }
+  const baseHttp = wsUrlToHttp(contact.remoteUrl).replace(/\/+$/, "");
+  const wsBase = baseHttp.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
+  const url = `${wsBase}/rpc/ssh-tunnel`;
+  return new Promise((resolve6) => {
+    const ws = new import_websocket.default(url, {
+      headers: {
+        Authorization: `Bearer ${contact.connectToken}`
+      }
+    });
+    let exitCode = 0;
+    let settled = false;
+    const settle = (code) => {
+      if (settled) return;
+      settled = true;
+      exitCode = code;
+      try {
+        ws.close();
+      } catch {
+      }
+      resolve6(exitCode);
+    };
+    ws.on("open", () => {
+      process.stdin.on("data", (chunk) => {
+        if (ws.readyState === ws.OPEN) {
+          ws.send(chunk, { binary: true });
+        }
+      });
+      process.stdin.on("end", () => {
+        try {
+          ws.close(1e3, "stdin end");
+        } catch {
+        }
+      });
+      process.stdin.on("error", () => settle(1));
+    });
+    ws.on("message", (data, isBinary) => {
+      void isBinary;
+      if (Buffer.isBuffer(data)) {
+        process.stdout.write(data);
+      } else if (Array.isArray(data)) {
+        process.stdout.write(Buffer.concat(data));
+      } else if (data instanceof ArrayBuffer) {
+        process.stdout.write(Buffer.from(data));
+      }
+    });
+    ws.on("close", (code) => {
+      settle(code === 1e3 ? 0 : 1);
+    });
+    ws.on("error", (err) => {
+      process.stderr.write(`clawd ssh-relay: ws error ${err.message}
+`);
+      settle(1);
+    });
+    const onSignal = () => settle(0);
+    process.once("SIGINT", onSignal);
+    process.once("SIGTERM", onSignal);
+  });
+}
+function parseSshRelayArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--help" || a === "-h") {
+      out.help = true;
+      continue;
+    }
+    if (a === "--data-dir") {
+      out.dataDir = argv[++i];
+      continue;
+    }
+    if (a.startsWith("--")) {
+      throw new Error(`unknown flag: ${a}`);
+    }
+    if (!out.peerDeviceId) {
+      out.peerDeviceId = a;
+    }
+  }
+  return out;
+}
+function findContact(dataDir, deviceId) {
+  const file = import_node_path65.default.join(dataDir, "contacts.json");
+  let raw;
+  try {
+    raw = import_node_fs52.default.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const arr = json?.contacts;
+  if (!Array.isArray(arr)) return null;
+  for (const entry of arr) {
+    const r = ContactSchema.safeParse(entry);
+    if (r.success && r.data.deviceId === deviceId) return r.data;
+  }
+  return null;
+}
+var import_node_fs52, import_node_os23, import_node_path65, SSH_RELAY_HELP;
+var init_sshd_cli_relay = __esm({
+  "src/sshd/sshd-cli-relay.ts"() {
+    "use strict";
+    import_node_fs52 = __toESM(require("fs"), 1);
+    import_node_os23 = __toESM(require("os"), 1);
+    import_node_path65 = __toESM(require("path"), 1);
+    init_wrapper();
+    init_src();
+    init_peer_forward();
+    SSH_RELAY_HELP = `clawd ssh-relay <peer-device-id> [options]
+
+WebSocket relay to a peer daemon's /rpc/ssh-tunnel, exposing raw SSH bytes on
+stdio. Meant to be used as SSH ProxyCommand.
+
+Options:
+  --data-dir <path>   \u6570\u636E\u76EE\u5F55\uFF08\u9ED8\u8BA4 ~/.clawd\uFF09
+  --help / -h         \u663E\u793A\u5E2E\u52A9
+
+Example:
+  ssh -o ProxyCommand='clawd ssh-relay <peer-device-id>' \\
+      -i ~/.clawd/contact-ssh-keys/<peer-device-id>.ed25519 \\
+      $USER@127.0.0.1
+`;
+  }
+});
+
 // src/config.ts
 var import_node_fs = __toESM(require("fs"), 1);
 var import_node_os = __toESM(require("os"), 1);
@@ -40499,6 +40848,7 @@ var import_node_path = __toESM(require("path"), 1);
 init_protocol();
 var DEFAULT_PORT = 18790;
 var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_SSHD_PORT = 22422;
 var DEFAULT_CLAWOS_API = "https://api.clawos.chat";
 var DEFAULT_LOG_ENDPOINT = "https://clawd-prod.cn-hangzhou.log.aliyuncs.com/logstores/app-logs/track";
 function resolveLogShipping(raw, cliNoShipping) {
@@ -40566,6 +40916,14 @@ function parseArgs(argv) {
       case "--no-log-shipping":
         out.noLogShipping = true;
         break;
+      case "--sshd-port": {
+        const n = Number.parseInt(next() ?? "", 10);
+        if (!Number.isFinite(n) || n <= 0 || n > 65535) {
+          throw new Error(`invalid --sshd-port value: ${argv[i]}`);
+        }
+        out.sshdPort = n;
+        break;
+      }
       default:
         if (a.startsWith("--")) throw new Error(`unknown flag: ${a}`);
         break;
@@ -40615,6 +40973,7 @@ function resolveConfig(opts) {
     fileCfg.logShipping,
     args.noLogShipping ?? false
   );
+  const sshdPort = args.sshdPort ?? (typeof fileCfg.sshdPort === "number" ? fileCfg.sshdPort : DEFAULT_SSHD_PORT);
   return {
     port,
     host,
@@ -40628,7 +40987,8 @@ function resolveConfig(opts) {
     frpcBinary,
     mode,
     previewPorts,
-    logShipping
+    logShipping,
+    sshdPort
   };
 }
 var HELP_TEXT = `clawd [options]
@@ -40640,6 +41000,7 @@ var HELP_TEXT = `clawd [options]
   --clawos-api <url>      tunnel register \u63A5\u53E3\u7684 base url\uFF08\u9ED8\u8BA4 https://api.clawos.chat\uFF09
   --auth-token <s>        \u6307\u5B9A daemon auth token\uFF1B\u7F3A\u7701\u65F6 tunnel \u6A21\u5F0F\u4ECE ~/.clawd/auth.json \u590D\u7528\uFF0C\u6CA1\u6709\u5C31\u751F\u6210
   --no-log-shipping       \u7981\u7528 SLS \u65E5\u5FD7\u4E0A\u884C\uFF08\u8986\u76D6 config.json logShipping.mode=off\uFF09
+  --sshd-port <n>         Contact SSH \u53CD\u5411\u8BBF\u95EE loopback \u7AEF\u53E3\uFF0C\u9ED8\u8BA4 22422
   --help / -h             \u663E\u793A\u5E2E\u52A9
   --version / -v          \u663E\u793A\u7248\u672C
 
@@ -40648,6 +41009,10 @@ Subcommands:
                           \u72EC\u7ACB CC \u63A7\u5236\u5668\u8FDB\u7A0B\uFF1A\u5916\u90E8 AI \u901A\u8FC7 stdin/stdout \u884C JSON \u534F\u8BAE
                           \u9A71\u52A8 CC \u591A\u8F6E\u5BF9\u8BDD\u4E0E\u6743\u9650\u51B3\u7B56\uFF0CIPC \u5168\u7A0B\u5F55\u5230 --record JSONL\u3002
                           \u8BE6\u89C1 'clawd run-case --help'
+  ssh-relay <peer-device-id> [--data-dir <path>]
+                          WebSocket relay to peer daemon's /rpc/ssh-tunnel\uFF0C\u4F5C\u4E3A SSH
+                          ProxyCommand \u4F7F\u7528\uFF08Contact SSH tunnel\uFF0CPR#2\uFF09\u3002
+                          \u8BE6\u89C1 'clawd ssh-relay --help'
 
 Env (advanced):
   CLAWD_FRPC_BIN          \u81EA\u5E26 frpc \u4E8C\u8FDB\u5236\u8DEF\u5F84\uFF08\u9ED8\u8BA4\u6309\u9700\u4E0B\u8F7D\u5230 ~/.clawd/bin/frpc\uFF09
@@ -40658,8 +41023,8 @@ Env (advanced):
 `;
 
 // src/index.ts
-var import_node_path55 = __toESM(require("path"), 1);
-var import_node_fs42 = __toESM(require("fs"), 1);
+var import_node_path62 = __toESM(require("path"), 1);
+var import_node_fs49 = __toESM(require("fs"), 1);
 var import_node_os21 = __toESM(require("os"), 1);
 
 // ../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/stringify.js
@@ -40779,18 +41144,6 @@ function createLogger(opts = {}) {
   );
   return wrap(base);
 }
-function createFileOnlyLogger(opts) {
-  const level = opts.level ?? "debug";
-  try {
-    import_node_fs2.default.mkdirSync(import_node_path2.default.dirname(opts.file), { recursive: true });
-  } catch {
-  }
-  const base = (0, import_pino.default)(
-    { level, base: {} },
-    import_pino.default.destination({ dest: opts.file, mkdir: true, sync: true })
-  );
-  return wrap(base);
-}
 function pinoLevelToString(n) {
   if (typeof n !== "number") return null;
   if (n >= 50) return "error";
@@ -41370,6 +41723,7 @@ function composeGuestSandbox(base, userWorkDir, spawnCwd) {
   fsv.denyWrite = unionArr((fsv.denyWrite ?? []).filter((p2) => p2 !== "~/"), [spawnCwd]);
   fsv.allowRead = unionArr(fsv.allowRead, [userWorkDir]);
   fsv.allowWrite = unionArr(fsv.allowWrite, [userWorkDir]);
+  fsv.allowRead = unionArr(fsv.allowRead, ["~/.clawd/contact-ssh-keys"]);
   return s;
 }
 
@@ -41510,6 +41864,31 @@ deviceId \u76F4\u63A5\u53D6\u81EA token\uFF0C\u4E0D\u8981\u6539\u5199\u6216\u731
   - \u5931\u8D25\uFF1A\`{ isFailure: true, reason: "..." }\`
 - \u62A5\u544A\u5B8C\u540E\u4F60\u7684 session \u5C31\u7ED3\u675F\u4E86\uFF0C\u4E0D\u8981\u7EE7\u7EED\u8F93\u51FA`;
 
+// src/sshd/contact-ssh-prompt.ts
+var CONTACT_SSH_SYSTEM_PROMPT_HINT = `## \u8DE8\u8BBE\u5907\u6587\u4EF6\u8BBF\u95EE\uFF08Contact SSH\uFF09
+
+\u7528\u6237\u53EF\u80FD\u6709\u591A\u53F0 clawd \u8BBE\u5907\u4E92\u76F8\u6388\u6743\u3002\u4F60\u5728\u8FD9\u53F0\u673A\u5668\u4E0A\u8BBF\u95EE\u5DF2\u6388\u6743\u5BF9\u7AEF\uFF08\u4E0B\u79F0 A\uFF09\u7684\u65B9\u6CD5\uFF1A
+
+1. \u5217\u51FA\u53EF\u62E8\u7684\u5BF9\u7AEF deviceId\uFF1A\`ls ~/.clawd/contact-ssh-keys/\`
+   \uFF08\u6BCF\u4E2A \`<deviceId>.ed25519\` \u5C31\u662F\u4E00\u628A privkey\uFF0C\u53BB\u6389\u540E\u7F00\u5C31\u662F deviceId\uFF09
+2. \u7528 SSH \u62E8\u53F7\uFF08\u628A \`<A>\` \u6362\u6210\u5B9E\u9645 deviceId\uFF09\uFF1A
+   \`\`\`bash
+   ssh -o ProxyCommand='clawd ssh-relay <A>' \\
+       -i ~/.clawd/contact-ssh-keys/<A>.ed25519 \\
+       -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \\
+       $USER@127.0.0.1 <command>
+   # \u4F8B\u5982\uFF1A... $USER@127.0.0.1 cat /Users/xxx/some/file.md
+   #      ... $USER@127.0.0.1 ls -la /Users/xxx/proj
+   \`\`\`
+
+**A \u6388\u6743\u54EA\u4E9B\u76EE\u5F55\u4E0D\u7528\u4F60\u63D0\u524D\u8BB0**\uFF1AA \u4FA7\u7684 sshd \u62E8\u53F7\u4F1A\u5F3A\u5236\u8D70 sandbox jail\uFF0C\u8FDB\u6C99\u7BB1\u524D\u4F1A\u628A\u6388\u6743\u76EE\u5F55\u5217\u8868\u5199\u5230 stderr\uFF08\u683C\u5F0F \`[clawd-ssh-jail] Access allowed to these directories: ...\`\uFF09\u3002\u4F60\u5373\u4F7F\u731C\u9519\u8DEF\u5F84\u4E5F\u4F1A\u88AB sandbox deny\uFF0C\u4F46 stderr \u91CC\u5C31\u81EA\u5E26\u7B54\u6848\uFF0C\u8BD5\u9519\u4E00\u6B21\u5C31\u5B66\u5230 A \u6388\u6743\u4E86\u54EA\u4E9B\u76EE\u5F55\uFF0C\u4E0B\u6B21\u76F4\u63A5\u7528\u5BF9\u7684\u8DEF\u5F84\u3002
+
+**\u6CE8\u610F**\uFF1A
+- \u6388\u6743\u76EE\u5F55\u6570\u636E\u6E90\u5B9E\u65F6\uFF08jail \u6BCF\u6B21\u8BFB A \u4FA7\u6700\u65B0\u914D\u7F6E\uFF09\uFF0CA \u6539\u4E86\u6388\u6743\u540E\u4F60\u4E0B\u4E00\u6B21\u62E8\u53F7\u7ACB\u5373\u611F\u77E5
+- \u6392\u969C\uFF1A\u672C\u673A debug \u65E5\u5FD7\u5728 \`~/.clawd/contact-ssh.log\`\uFF08\u7528\u6237\u53EF \`tail -f\` \u770B\u6BCF\u4E00\u6B65\uFF09\uFF0C\u4F60\u51FA\u9519\u65F6\u544A\u8BC9\u7528\u6237\u67E5\u8FD9\u4E2A\u6587\u4EF6
+- \u5982\u679C \`ls ~/.clawd/contact-ssh-keys/\` \u4E3A\u7A7A\uFF0C\u8BF4\u660E\u8FD8\u6CA1\u6709\u5BF9\u7AEF\u6388\u6743\u4F60\u6216 key \u8FD8\u6CA1\u62C9\u5230\uFF08B \u4FA7 daemon \u6BCF 60s \u4E00\u6B21\u81EA\u52A8\u62C9\uFF09\uFF0C\u5982\u5B9E\u544A\u8BC9\u7528\u6237
+`;
+
 // src/session/reducer.ts
 function cloneState(s) {
   return {
@@ -41646,6 +42025,9 @@ function buildSpawnContext(state, deps) {
   if (daemonUrl) {
     ctx.extraSystemPrompt = (ctx.extraSystemPrompt ? ctx.extraSystemPrompt + "\n\n" : "") + ATTACHMENT_SHARING_HINT;
   }
+  if (meta?.personaMode === "guest") {
+    ctx.extraSystemPrompt = (ctx.extraSystemPrompt ? ctx.extraSystemPrompt + "\n\n" : "") + CONTACT_SSH_SYSTEM_PROMPT_HINT;
+  }
   if (meta?.extraSettings) {
     ctx.extraSettings = meta.extraSettings;
   }
@@ -42956,18 +43338,9 @@ var SessionManager = class {
   // 由 observer 监听 jsonl user 行后调 recordRealUserUuid 建立映射；rewind 系列 RPC 在
   // 入参 / 出参做转译，保证 UI 看到的 uuid 始终是 events 流里的 synth uuid
   realUuidBySynth = /* @__PURE__ */ new Map();
-  // observer 收到 `turn_duration` 信号但屏幕还没稳定 5s → 挂进 pending，等 `notifyScreenIdle`
-  // （屏幕 armed=true 触发点）flush 成真正的 turn_end 进 reducer。
-  //
-  // 语义澄清：`turn_duration` 是 CC 报的原始信号（"本轮 API 调用完了"），**不代表 turn 真的结束**
-  //（背景 agent 可能还在跑）。屏幕 5s 稳定 + 无 popup 才是"确认信号"。
-  // 两者 AND 后 daemon 才产生真正的 `turn_end` 事件送给 reducer。
-  //
-  // pending 不设截止时间：屏幕稳定的时机由 CC UI 决定，可能几秒也可能几分钟。观察者以
-  // "屏幕真的稳定"作为触发点，signal-driven 而非 timer-driven。
-  //
-  // 清理点：newSession / stop / session-delete / stopAll。
-  pendingTurnDurationSignals = /* @__PURE__ */ new Set();
+  // observeScreenIdle 复合条件闸用：sessionId → observer 上次喂出业务事件的时刻（deps.now()）。
+  // observerIdleWaitMs 据此判 observer 是否也静止 ≥ idleMs（屏幕静止 AND observer 静止才补 turn_end）。
+  lastObserverEventAt = /* @__PURE__ */ new Map();
   // SessionStore 按 scope 派生（root = <dataDir>/sessions/<scopeSubPath>/）。
   // default scope 直接复用 deps.store；persona scope（owner / listener）第一次访问时按需创建并缓存。
   // 取代旧的 storesByAgent —— agentId 概念由 SessionScope 取代，路径即身份，
@@ -43307,14 +43680,6 @@ var SessionManager = class {
   routeFromRunner(frame, target) {
     const compressed = compressFrameForWire(frame);
     if (!compressed) return;
-    if (compressed.type === "session:status") {
-      const s = compressed;
-      this.deps.screenIdleProbeLogger?.info("session:status wire emit", {
-        sessionId: s.sessionId,
-        status: s.status,
-        target
-      });
-    }
     if (compressed.type === "session:event" || compressed.type === "session:status") {
       const sid = compressed.sessionId;
       if (sid) {
@@ -43588,7 +43953,7 @@ var SessionManager = class {
       this.runners.delete(args.sessionId);
       this.realUuidBySynth.delete(args.sessionId);
       this.lastUiSizeBySessionId.delete(args.sessionId);
-      this.clearPendingTurnEnd(args.sessionId);
+      this.lastObserverEventAt.delete(args.sessionId);
       return { response: { sessionId: args.sessionId }, broadcast };
     }
     this.deleteOwned(args.sessionId);
@@ -43618,7 +43983,6 @@ var SessionManager = class {
   async stop(args) {
     const runner = this.runners.get(args.sessionId);
     if (!runner) return { response: { ok: true }, broadcast: [] };
-    this.clearPendingTurnEnd(args.sessionId);
     const { broadcast } = this.withCollector(() => {
       runner.input({ kind: "command", command: { kind: "stop" } });
     });
@@ -43752,7 +44116,6 @@ var SessionManager = class {
   newSession(args) {
     const existingFile = this.getFile(args.sessionId);
     const nextToolSessionId = this.deps.mode === "tui" && (existingFile.tool ?? "claude") === "claude" ? v4_default() : void 0;
-    this.clearPendingTurnEnd(args.sessionId);
     const runner = this.runners.get(args.sessionId);
     if (runner) {
       const { value, broadcast } = this.withCollector(() => {
@@ -43853,7 +44216,6 @@ var SessionManager = class {
     for (const r of this.runners.values()) {
       r.input({ kind: "command", command: { kind: "stop" } });
     }
-    this.pendingTurnDurationSignals.clear();
   }
   // 给 observer 用：拿已存在的 runner
   getActive(sessionId) {
@@ -44070,7 +44432,7 @@ var SessionManager = class {
       this.runners.delete(args.sessionId);
       this.realUuidBySynth.delete(args.sessionId);
       this.lastUiSizeBySessionId.delete(args.sessionId);
-      this.clearPendingTurnEnd(args.sessionId);
+      this.lastObserverEventAt.delete(args.sessionId);
       return { response: { sessionId: args.sessionId }, broadcast };
     }
     this.storeFor(args.scope).delete(args.sessionId);
@@ -44316,93 +44678,23 @@ var SessionManager = class {
         return;
       }
     }
+    this.lastObserverEventAt.set(sessionId, (this.deps.now ?? Date.now)());
     let feedEvents = outEvents;
     if (outEvents.some((e) => e.kind === "turn_end")) {
-      const runnerState = runner.getState();
-      const toolSessionId = runnerState.file.toolSessionId;
-      const adapter = this.deps.getAdapter(runnerState.file.tool ?? "claude");
-      const gateOpen = !adapter.canAcceptTurnEnd || !toolSessionId ? true : adapter.canAcceptTurnEnd(toolSessionId);
-      this.deps.screenIdleProbeLogger?.info("turn_duration signal received", {
-        sessionId,
-        toolSessionId,
-        batchKinds: outEvents.map((e) => e.kind),
-        gateOpen,
-        hasCanAcceptGate: !!adapter.canAcceptTurnEnd
-      });
-      if (gateOpen) {
-        this.deps.screenIdleProbeLogger?.info(
-          "turn_duration \u2192 turn_end confirmed (gate open) \u2192 fed to reducer",
-          { sessionId, toolSessionId }
-        );
-      } else {
+      const ev = this.peekTurnEvidence(runner);
+      if (!ev.turnHasContent) {
         feedEvents = outEvents.filter((e) => e.kind !== "turn_end");
-        if (this.pendingTurnDurationSignals.has(sessionId)) {
-          this.deps.screenIdleProbeLogger?.info(
-            "turn_duration dedup: pending already set (repeated observer signal)",
-            { sessionId, toolSessionId }
-          );
-        } else {
-          this.pendingTurnDurationSignals.add(sessionId);
-          this.deps.screenIdleProbeLogger?.info(
-            "turn_duration pending: gate closed \u2192 waiting for screen-idle signal",
-            { sessionId, toolSessionId }
-          );
-        }
+        this.deps.logger?.info("[TE-PROBE] drop spurious observer turn_end", {
+          sessionId,
+          src: "observer",
+          ...ev,
+          batchKinds: outEvents.map((e) => e.kind)
+        });
       }
     }
     if (feedEvents.length === 0) return;
     runner.feedObserverEvents(feedEvents);
   }
-  /**
-   * `ClaudeTuiAdapter.observeScreenIdle` fire triggered → armed=true 时调用（一次性触发点）。
-   *
-   * 语义：屏幕真的稳定了 5s。查有没有 pending 的 turn_duration 信号：
-   *   - 有 → 之前收到的 turn_duration 被屏幕稳定**确认**了，flush 成 turn_end 进 reducer
-   *   - 无 → 屏幕稳定但从没收到 turn_duration → noop（不生成 turn_end；补偿路径的错误做法）
-   *
-   * pending 集合是**必要前提**：turn_end 只能来自"observer 收 turn_duration + 屏幕后续稳定"
-   * 双源确认，任何一个缺少都不能 emit。这跟 PR #962 拆掉的 dispatchTurnIdle "屏幕静止就补
-   * turn_end" 语义不同。
-   *
-   * 仅 TUI 模式；SDK / codex 没有屏幕信号也就不会触发本方法。
-   */
-  notifyScreenIdle(toolSessionId) {
-    if (this.deps.mode !== "tui") return;
-    const sid = this.sessionIdByToolSid(toolSessionId);
-    if (!sid) {
-      this.deps.screenIdleProbeLogger?.warn("notifyScreenIdle: no session for toolSessionId", {
-        toolSessionId
-      });
-      return;
-    }
-    if (!this.pendingTurnDurationSignals.has(sid)) {
-      this.deps.screenIdleProbeLogger?.info(
-        "notifyScreenIdle: no pending turn_duration \u2192 noop",
-        { sessionId: sid, toolSessionId }
-      );
-      return;
-    }
-    const runner = this.runners.get(sid);
-    if (!runner) {
-      this.pendingTurnDurationSignals.delete(sid);
-      this.deps.screenIdleProbeLogger?.warn(
-        "notifyScreenIdle: pending but no runner \u2192 cleared without inject",
-        { sessionId: sid, toolSessionId }
-      );
-      return;
-    }
-    this.pendingTurnDurationSignals.delete(sid);
-    this.deps.screenIdleProbeLogger?.info(
-      "notifyScreenIdle: pending turn_duration + screen idle confirmed \u2192 inject turn_end",
-      { sessionId: sid, toolSessionId }
-    );
-    runner.input({ kind: "inject-events", events: [{ kind: "turn_end" }] });
-  }
-  clearPendingTurnEnd(sessionId) {
-    if (this.pendingTurnDurationSignals.delete(sessionId)) {
-      this.deps.screenIdleProbeLogger?.info("pending turn_duration cleared", { sessionId });
-    }
-  }
   // AskUserQuestion 表单回写（plan: clawd-ask-user-question）：UI 答完所有 question 后调用。
   // - session 不存在 / 无 runner → noop 幂等返回 ok（first-decider-wins）
   // - reducer noop（toolUseId 不存在或已答过）也保持幂等返回，handler 不抛
@@ -44661,6 +44953,70 @@ var SessionManager = class {
     if (!runner) return;
     runner.input({ kind: "ready-detected" });
   }
+  /**
+   * ClaudeTuiAdapter onTurnIdle callback：屏幕内容静止时**复发**本轮已出现过的权威 turn_end。
+   * 本意：turn_duration 写盘早于尾段正文 → observer 把尾随 text 推进 buffer 盖掉 lastEventKind →
+   * spinner 不熄；屏幕静止时再补一条 turn_end 排到尾随 text 之后。
+   *
+   * Fix A（修 bug1 "UI 还在变却显示结束" / bug2 "发消息后无 spinner"）：补偿**只复发不 originate**——
+   * 仅当本轮已出现过 turn_end（turnEndSeenThisTurn，即真有过尾随 text 覆盖场景）才补。turnEndSeenThisTurn
+   * ===false 说明本轮 CC 从未结束过（仍在工作 / 刚发消息没产出 / 漏检弹框等用户），屏幕静止 ≠ turn 结束，
+   * 凭空 inject turn_end 会误灭 spinner——故跳过，让真正的 turn_duration 来时再正常收。
+   * 仅 tui 模式；runner 缺失 noop。turn_end 无 uuid 不参与 dedup。
+   */
+  dispatchTurnIdle(toolSessionId) {
+    if (this.deps.mode !== "tui") return;
+    const sid = this.sessionIdByToolSid(toolSessionId);
+    const runner = sid ? this.runners.get(sid) : void 0;
+    if (!runner) return;
+    const ev = this.peekTurnEvidence(runner);
+    const willInject = ev.turnEndSeenThisTurn;
+    this.deps.logger?.info("[TE-PROBE] screen-idle compensation", {
+      sessionId: sid,
+      src: "screen-idle",
+      willInject,
+      ...ev
+    });
+    if (!willInject) return;
+    runner.input({ kind: "inject-events", events: [{ kind: "turn_end" }] });
+  }
+  /**
+   * 读 runner 当前 turn 态快照，供两个 turn_end 注入源（屏幕静止补偿 / observer turn_duration）
+   * 判断误发 + 打 [TE-PROBE] 日志。
+   *   turnEndSeenThisTurn：从 buffer 末尾回扫到最近 user_text 期间是否已出现过 turn_end
+   *     （已出现=本轮真结束过、合法尾随；未出现=本轮还没结束过）→ Fix A 复发闸。
+   *   turnHasContent：末条是否 assistant 产出（非 user_text/turn_end/空）→ Fix B 空 turn 守卫闸。
+   */
+  peekTurnEvidence(runner) {
+    const st = runner.getState();
+    const buf = st.buffer;
+    const lastEventKindBefore = buf.length > 0 ? buf[buf.length - 1].event.kind : null;
+    let turnEndSeenThisTurn = false;
+    for (let i = buf.length - 1; i >= 0; i--) {
+      const k2 = buf[i].event.kind;
+      if (k2 === "user_text") break;
+      if (k2 === "turn_end") {
+        turnEndSeenThisTurn = true;
+        break;
+      }
+    }
+    const turnHasContent = lastEventKindBefore !== null && lastEventKindBefore !== "user_text" && lastEventKindBefore !== "turn_end";
+    return { turnOpenBefore: st.turnOpen, lastEventKindBefore, turnEndSeenThisTurn, turnHasContent };
+  }
+  /**
+   * observer 还需静止多久（ms）才满 idleMs，0 = 已满。observeScreenIdle 复合条件闸：屏幕静止后
+   * 精确等这段剩余再补 turn_end —— turn_duration 写盘早于尾段正文，observer 把尾随 text poll 落盘
+   * 期间屏幕可能已静止，仅看屏幕会早 fire（补的 turn_end 盖不到尾随 text 之后）。
+   * 找不到 runner / 从无事件 → 0（不阻塞 fire）。idleMs 由装配处传 SCREEN_IDLE_MS。
+   */
+  observerIdleWaitMs(toolSessionId, idleMs) {
+    const sid = this.sessionIdByToolSid(toolSessionId);
+    if (!sid) return 0;
+    const last = this.lastObserverEventAt.get(sid);
+    if (last === void 0) return 0;
+    const elapsed = (this.deps.now ?? Date.now)() - last;
+    return Math.max(0, idleMs - elapsed);
+  }
   /** toolSessionId → sessionId 反查（遍历 runners）；session 数典型 < 10，O(n) 可接受 */
   sessionIdByToolSid(toolSessionId) {
     for (const [sid, runner] of this.runners) {
@@ -45809,11 +46165,7 @@ function tryLoadShareUi(logger) {
 
 // src/visitor/visitor-token.ts
 var import_node_crypto4 = __toESM(require("crypto"), 1);
-
-// ../protocol/src/index.ts
-init_runtime();
-
-// src/visitor/visitor-token.ts
+init_src();
 function hmac(secret, body) {
   return import_node_crypto4.default.createHmac("sha256", secret).update(body).digest("base64url");
 }
@@ -46170,8 +46522,8 @@ function turnStartInput(text) {
   const items = [];
   let leftover = text;
   for (const m2 of text.matchAll(SKILL_RE)) {
-    const [marker, name, path68] = m2;
-    items.push({ type: "skill", name, path: path68 });
+    const [marker, name, path76] = m2;
+    items.push({ type: "skill", name, path: path76 });
     leftover = leftover.replace(marker, "");
   }
   for (const m2 of text.matchAll(ATTACHMENT_RE2)) {
@@ -46403,7 +46755,6 @@ var CodexAdapter = class {
 };
 
 // src/tools/claude-tui.ts
-var import_node_crypto5 = require("crypto");
 var import_node_fs16 = __toESM(require("fs"), 1);
 var import_node_os7 = __toESM(require("os"), 1);
 var import_node_path14 = __toESM(require("path"), 1);
@@ -47214,56 +47565,22 @@ function observeScreenIdle(surface, opts) {
     timer = null;
     if (disposed) return;
     if (opts.getPopupVisible()) {
-      opts.probeLogger?.info("screen-idle fire suppressed: popup visible", {
-        label: opts.probeLabel
-      });
       timer = setTimeout(fire, opts.idleMs);
       return;
     }
     const obsWait = opts.getObserverWaitMs?.() ?? 0;
     if (obsWait > 0) {
-      opts.probeLogger?.info("screen-idle fire suppressed: observer not idle", {
-        label: opts.probeLabel,
-        obsWait
-      });
       timer = setTimeout(fire, Math.max(obsWait, REWAIT_MIN_MS));
       return;
     }
-    if (armed) {
-      opts.probeLogger?.debug("screen-idle fire noop: already armed", {
-        label: opts.probeLabel
-      });
-      return;
-    }
+    if (armed) return;
     armed = true;
-    opts.probeLogger?.info("screen-idle fire triggered \u2192 armed=true, calling onIdle", {
-      label: opts.probeLabel
-    });
     opts.onIdle();
   };
   const unsub = surface.onTick((lines) => {
     if (disposed) return;
     const snap = snapOf(lines);
     if (snap === lastSnap) return;
-    if (opts.probeLogger) {
-      const prev = lastSnap;
-      const meta = {
-        label: opts.probeLabel,
-        prevHash: prev === null ? null : shortHash(prev),
-        nextHash: shortHash(snap),
-        prevLen: prev?.length ?? 0,
-        nextLen: snap.length
-      };
-      if (prev !== null) {
-        const diff2 = firstLineDiff(prev, snap);
-        if (diff2) {
-          meta.diffRow = diff2.row;
-          meta.prevRow = diff2.prev;
-          meta.nextRow = diff2.next;
-        }
-      }
-      opts.probeLogger.info("screen-idle tick snap changed", meta);
-    }
     lastSnap = snap;
     armed = false;
     clear();
@@ -47274,38 +47591,9 @@ function observeScreenIdle(surface, opts) {
       disposed = true;
       unsub();
       clear();
-    },
-    isIdle() {
-      const popupVisible = opts.getPopupVisible();
-      const idle = armed && !popupVisible;
-      if (opts.probeLogger) {
-        opts.probeLogger.info("screen-idle isIdle check", {
-          label: opts.probeLabel,
-          idle,
-          armed,
-          popupVisible
-        });
-      }
-      return idle;
     }
   };
 }
-function shortHash(s) {
-  return (0, import_node_crypto5.createHash)("sha1").update(s).digest("hex").slice(0, 8);
-}
-function firstLineDiff(prev, next) {
-  const p2 = prev.split("\n");
-  const n = next.split("\n");
-  const rows = Math.max(p2.length, n.length);
-  for (let i = 0; i < rows; i++) {
-    const pl = p2[i] ?? "";
-    const nl = n[i] ?? "";
-    if (pl !== nl) {
-      return { row: i, prev: pl.slice(0, 60), next: nl.slice(0, 60) };
-    }
-  }
-  return null;
-}
 var BYPASS_SETTLE_MS = 300;
 var SCREEN_IDLE_MS = 5e3;
 function createBootGate(pty, logger) {
@@ -47380,42 +47668,11 @@ var ClaudeTuiAdapter = class extends ClaudeAdapter {
   // 用于 spawn / PtyChildProcess 链路打日志
   tuiLogger;
   tuiOpts;
-  /**
-   * per-toolSessionId 的 tui 观察者句柄，仅用于 turn_end gate 查询（`canAcceptTurnEnd`）。
-   * onIdle / onPopupTransition 等回调仍走原有闭包（不复用这份 map），本 map 只承担
-   * "manager 需要跨模块查屏幕/弹框状态"这单一职责。
-   */
-  tuiStates = /* @__PURE__ */ new Map();
   constructor(opts = {}) {
     super(opts);
     this.tuiLogger = opts.logger;
     this.tuiOpts = opts;
   }
-  /**
-   * TUI adapter 的 turn_end 权威判定：屏幕已 idle 且非弹框态才放行。
-   *
-   * `feedObserverEvents` 收到 observer 回灌 `turn_end` 时调用。屏幕仍在变（如后台 agent 在跑）
-   * 时 drop 掉 turn_end，避免 `system/turn_duration` JSONL 帧误触发 running-idle 状态转换。
-   *
-   * 未跟踪的 toolSessionId（spawn 前 / spawn 失败 / 已 dispose）视为 pass —— gate 只 drop
-   * "有证据判定为伪信号"的场景，不做 unknown → block。
-   */
-  canAcceptTurnEnd(toolSessionId) {
-    const state = this.tuiStates.get(toolSessionId);
-    if (!state) {
-      this.tuiOpts.screenIdleProbeLogger?.info(
-        "canAcceptTurnEnd: no tuiState \u2192 pass (\u672A\u8DDF\u8E2A)",
-        { toolSessionId }
-      );
-      return true;
-    }
-    const result = state.screenIdle.isIdle();
-    this.tuiOpts.screenIdleProbeLogger?.info("canAcceptTurnEnd", {
-      toolSessionId,
-      result
-    });
-    return result;
-  }
   spawn(ctx) {
     const args = buildTuiSpawnArgs(ctx, jsonlExistsForCtx(ctx));
     const cmd = process.env.CLAUDE_BIN ?? "claude";
@@ -47473,26 +47730,18 @@ var ClaudeTuiAdapter = class extends ClaudeAdapter {
     const screenIdleObserver = observeScreenIdle(surface, {
       idleMs: SCREEN_IDLE_MS,
       onIdle: () => {
-        if (!ctx.toolSessionId || !this.tuiOpts.onScreenIdle) return;
-        this.tuiLogger?.debug("screen-idle \u2192 notifyScreenIdle", { toolSessionId: ctx.toolSessionId });
-        this.tuiOpts.onScreenIdle(ctx.toolSessionId);
+        if (!ctx.toolSessionId || !this.tuiOpts.onTurnIdle) return;
+        this.tuiLogger?.debug("screen-idle \u2192 turn_end", { toolSessionId: ctx.toolSessionId });
+        this.tuiOpts.onTurnIdle(ctx.toolSessionId);
       },
       getPopupVisible: () => popupObserver.visibleKind !== null,
-      // 取证 probe（可选，装配处传独立 file-only logger，跟主 daemon.log 解耦）
-      ...this.tuiOpts.screenIdleProbeLogger ? {
-        probeLogger: this.tuiOpts.screenIdleProbeLogger,
-        probeLabel: ctx.toolSessionId ?? "<no-tsid>"
-      } : {}
+      // observer 还需静止多久才满 SCREEN_IDLE_MS（复合条件 AND）：屏幕静止后精确等这段剩余再补
+      // turn_end，确保它排在尾段 text + turn_duration 全部 poll 落盘之后 = buffer 末条。
+      getObserverWaitMs: () => ctx.toolSessionId ? this.tuiOpts.getObserverWaitMs?.(ctx.toolSessionId, SCREEN_IDLE_MS) ?? 0 : 0
     });
     if (ctx.toolSessionId && this.tuiOpts.onSurfaceRegister) {
       this.tuiOpts.onSurfaceRegister(ctx.toolSessionId, surface);
     }
-    if (ctx.toolSessionId) {
-      this.tuiStates.set(ctx.toolSessionId, {
-        screenIdle: screenIdleObserver,
-        popup: popupObserver
-      });
-    }
     let chunkSeq = 0;
     if (ctx.toolSessionId && this.tuiOpts.onPtyReplayRegister) {
       this.tuiOpts.onPtyReplayRegister(ctx.toolSessionId, async () => {
@@ -47538,9 +47787,6 @@ var ClaudeTuiAdapter = class extends ClaudeAdapter {
       readyObserver.dispose();
       popupObserver.dispose();
       screenIdleObserver.dispose();
-      if (ctx.toolSessionId) {
-        this.tuiStates.delete(ctx.toolSessionId);
-      }
       if (ctx.toolSessionId && this.tuiOpts.onSurfaceUnregister) {
         this.tuiOpts.onSurfaceUnregister(ctx.toolSessionId);
       }
@@ -47823,7 +48069,7 @@ async function writeInboxMcpConfig(args) {
 // src/shift/store.ts
 var import_promises = __toESM(require("fs/promises"), 1);
 var import_node_path19 = __toESM(require("path"), 1);
-var import_node_crypto6 = require("crypto");
+var import_node_crypto5 = require("crypto");
 
 // src/shift/constants.ts
 var MAX_RUNS_PER_SHIFT = 30;
@@ -47919,7 +48165,7 @@ function createShiftStore(deps) {
     const nextRunAtMs = computeNextRunAtMs(input.schedule, now) ?? void 0;
     const shift = {
       ...input,
-      id: (0, import_node_crypto6.randomUUID)(),
+      id: (0, import_node_crypto5.randomUUID)(),
       createdAtMs: now,
       updatedAtMs: now,
       state: { nextRunAtMs },
@@ -48436,78 +48682,8 @@ function buildPersonaDispatchHandlers(deps) {
   };
 }
 
-// src/dispatch/peer-forward.ts
-function wsUrlToHttp(url) {
-  if (url.startsWith("wss://")) return "https://" + url.slice("wss://".length);
-  if (url.startsWith("ws://")) return "http://" + url.slice("ws://".length);
-  return url;
-}
-async function forwardDispatchToPeer(args) {
-  const f = args.fetchImpl ?? fetch;
-  const base = wsUrlToHttp(args.contact.remoteUrl).replace(/\/+$/, "");
-  const url = `${base}/rpc/personaDispatch:run`;
-  let res;
-  try {
-    res = await f(url, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${args.contact.connectToken}`
-      },
-      // 注意：不带 targetDeviceId —— B 端据此判定为本地执行（B 角色）。
-      body: JSON.stringify({ targetPersona: args.targetPersona, prompt: args.prompt })
-    });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { kind: "failure", reason: `forward to peer failed: ${msg}` };
-  }
-  let json;
-  try {
-    json = await res.json();
-  } catch {
-    return {
-      kind: "failure",
-      reason: `peer returned non-JSON response (HTTP ${res.status})`
-    };
-  }
-  if (json.ok === false) {
-    return { kind: "failure", reason: `peer rejected: ${json.error}: ${json.message}` };
-  }
-  return json.result.outcome;
-}
-async function forwardInboxPostToPeer(args) {
-  const f = args.fetchImpl ?? fetch;
-  const base = wsUrlToHttp(args.contact.remoteUrl).replace(/\/+$/, "");
-  const url = `${base}/rpc/inbox:postMessage`;
-  let res;
-  try {
-    res = await f(url, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${args.contact.connectToken}`
-      },
-      body: JSON.stringify({
-        id: args.id,
-        text: args.text,
-        createdAt: args.createdAt,
-        ...args.origin ? { origin: args.origin } : {}
-      })
-    });
-  } catch (err) {
-    return { ok: false, error: err instanceof Error ? err.message : String(err) };
-  }
-  let json = null;
-  try {
-    json = await res.json();
-  } catch {
-    return { ok: false, error: `peer non-JSON (HTTP ${res.status})` };
-  }
-  if (res.status < 200 || res.status >= 300 || json?.ok === false) {
-    return { ok: false, error: json?.error ?? `HTTP ${res.status}` };
-  }
-  return { ok: true };
-}
+// src/index.ts
+init_peer_forward();
 
 // src/tools/codex-history.ts
 var import_node_child_process5 = require("child_process");
@@ -48695,13 +48871,13 @@ function mapSkillsListResponse(res) {
       const r = s ?? {};
       const name = str3(r.name);
       if (!name) continue;
-      const path68 = str3(r.path);
+      const path76 = str3(r.path);
       const description = str3(r.description);
       const isPlugin = name.includes(":");
       out.push({
         name,
         source: isPlugin ? "plugin" : "project",
-        ...path68 ? { path: path68 } : {},
+        ...path76 ? { path: path76 } : {},
         ...description ? { description } : {},
         ...isPlugin ? { plugin: name.split(":")[0] } : {}
       });
@@ -49350,18 +49526,8 @@ function listRegistered() {
   return [...registry.keys()];
 }
 
-// ../node_modules/.pnpm/ws@8.20.0/node_modules/ws/wrapper.mjs
-var import_stream = __toESM(require_stream(), 1);
-var import_extension = __toESM(require_extension(), 1);
-var import_permessage_deflate = __toESM(require_permessage_deflate(), 1);
-var import_receiver = __toESM(require_receiver(), 1);
-var import_sender = __toESM(require_sender(), 1);
-var import_subprotocol = __toESM(require_subprotocol(), 1);
-var import_websocket = __toESM(require_websocket(), 1);
-var import_websocket_server = __toESM(require_websocket_server(), 1);
-var wrapper_default = import_websocket.default;
-
 // src/transport/local-ws-server.ts
+init_wrapper();
 var import_node_http2 = __toESM(require("http"), 1);
 
 // src/transport/preview-proxy.ts
@@ -49437,6 +49603,18 @@ var LocalWsServer = class {
       const httpServer = import_node_http2.default.createServer((req, res) => this.handleHttpRequest(req, res));
       const wss = new import_websocket_server.default({ noServer: true, clientTracking: true });
       httpServer.on("upgrade", (req, socket, head) => {
+        if (this.opts.sshTunnelUpgradeHandler) {
+          const [urlPath] = (req.url ?? "").split("?");
+          if (urlPath === "/rpc/ssh-tunnel") {
+            void this.opts.sshTunnelUpgradeHandler(
+              req,
+              socket,
+              head,
+              wss
+            );
+            return;
+          }
+        }
         if (req.url?.startsWith("/preview/")) {
           const pathname = (() => {
             try {
@@ -50009,6 +50187,7 @@ function constantTimeEqual2(a, b2) {
 }
 
 // src/transport/connection-context.ts
+init_src();
 function ownerContext(ownerPrincipalId, displayName) {
   return {
     principal: makeOwnerPrincipal(ownerPrincipalId, displayName),
@@ -50062,6 +50241,7 @@ async function authenticate(token, deps) {
 // src/permission/capability-store.ts
 var fs28 = __toESM(require("fs"), 1);
 var path28 = __toESM(require("path"), 1);
+init_src();
 var CAPABILITIES_FILE_NAME = "capabilities.json";
 var FILE_VERSION = 1;
 var CapabilityStore = class {
@@ -50239,6 +50419,7 @@ function cleanupGuestSessionsForCapability(cap, factory) {
 // src/inbox/inbox-store.ts
 var fs30 = __toESM(require("fs"), 1);
 var path29 = __toESM(require("path"), 1);
+init_src();
 var INBOX_SUBDIR = "inbox";
 var InboxStore = class {
   constructor(dataDir) {
@@ -50429,6 +50610,7 @@ var InboxManager = class {
 // src/state/contact-store.ts
 var fs31 = __toESM(require("fs"), 1);
 var path30 = __toESM(require("path"), 1);
+init_src();
 var FILE_NAME = "contacts.json";
 var ContactStore = class {
   constructor(dataDir) {
@@ -50495,6 +50677,23 @@ var ContactStore = class {
     this.flush();
     return true;
   }
+  /**
+   * 更新单条 contact 的 SSH 授权（PR: contact-ssh-sandbox）。对齐 setPin pattern：
+   * store 只做原始 mutation，不做业务校验（如"sshAllowed=false 时清空 exposedDirs"）——
+   * 那是 handler / UI 的责任。数组语义是完全替换（不 append）。
+   * @returns 是否命中：deviceId 不存在返 false；命中即 flush.
+   */
+  setSshAccess(deviceId, opts) {
+    const existing = this.contacts.get(deviceId);
+    if (!existing) return false;
+    this.contacts.set(deviceId, {
+      ...existing,
+      sshAllowed: opts.sshAllowed,
+      exposedDirs: opts.exposedDirs
+    });
+    this.flush();
+    return true;
+  }
   flush() {
     const file = path30.join(this.dataDir, FILE_NAME);
     const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
@@ -50516,6 +50715,7 @@ var ContactStore = class {
 };
 
 // src/contact/connect-remote.ts
+init_wrapper();
 var crypto6 = __toESM(require("crypto"), 1);
 var HANDSHAKE_TIMEOUT_MS = 5e3;
 var RPC_TIMEOUT_MS = 5e3;
@@ -50642,7 +50842,9 @@ async function autoReverseContact(args) {
     connectToken: "",
     grants,
     addedAt: now(),
-    pinnedAt: null
+    pinnedAt: null,
+    sshAllowed: false,
+    exposedDirs: []
   };
   args.store.upsert(base);
   args.broadcast({ type: "contact:added", contact: base });
@@ -50659,6 +50861,9 @@ async function autoReverseContact(args) {
   args.broadcast({ type: "contact:added", contact: upgraded });
 }
 
+// src/index.ts
+init_src();
+
 // src/migrations/2026-05-20-flatten-sessions.ts
 var fs32 = __toESM(require("fs"), 1);
 var path31 = __toESM(require("path"), 1);
@@ -50871,7 +51076,7 @@ function lookupMime(filePathOrName) {
 }
 
 // src/attachment/sign-url.ts
-var import_node_crypto7 = __toESM(require("crypto"), 1);
+var import_node_crypto6 = __toESM(require("crypto"), 1);
 var HMAC_ALGO = "sha256";
 function base64urlEncode(buf) {
   const b2 = typeof buf === "string" ? Buffer.from(buf, "utf8") : buf;
@@ -50888,7 +51093,7 @@ function decodeAbsPathFromUrl(encoded) {
 }
 function computeSig(secret, absPath, e) {
   const msg = e === null ? absPath : `${absPath}|${e}`;
-  return import_node_crypto7.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
+  return import_node_crypto6.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
 }
 function signUrlParts(secret, absPath, ttlSeconds, now = Date.now) {
   const e = ttlSeconds === null ? null : Math.floor(now() / 1e3) + ttlSeconds;
@@ -50923,7 +51128,7 @@ function verifySignedUrl(secret, absPath, eRaw, s, now = Date.now) {
   if (provided.length !== expected.length) {
     return { ok: false, code: "BAD_SIG" };
   }
-  if (!import_node_crypto7.default.timingSafeEqual(provided, expected)) {
+  if (!import_node_crypto6.default.timingSafeEqual(provided, expected)) {
     return { ok: false, code: "BAD_SIG" };
   }
   if (e !== null && now() / 1e3 > e) {
@@ -50935,7 +51140,7 @@ function verifySignedUrl(secret, absPath, eRaw, s, now = Date.now) {
 // src/attachment/upload.ts
 var import_node_fs25 = __toESM(require("fs"), 1);
 var import_node_path25 = __toESM(require("path"), 1);
-var import_node_crypto8 = __toESM(require("crypto"), 1);
+var import_node_crypto7 = __toESM(require("crypto"), 1);
 var import_promises2 = require("stream/promises");
 var UploadError = class extends Error {
   constructor(code, message) {
@@ -50959,11 +51164,11 @@ async function writeUploadedAttachment(args) {
   } catch (err) {
     throw new UploadError("STORAGE_ERROR", `mkdir failed: ${err.message}`);
   }
-  const hasher = import_node_crypto8.default.createHash("sha256");
+  const hasher = import_node_crypto7.default.createHash("sha256");
   let actualSize = 0;
   const tmpPath = import_node_path25.default.join(
     attachmentsRoot,
-    `.upload-${process.pid}-${Date.now()}-${import_node_crypto8.default.randomBytes(4).toString("hex")}`
+    `.upload-${process.pid}-${Date.now()}-${import_node_crypto7.default.randomBytes(4).toString("hex")}`
   );
   try {
     await (0, import_promises2.pipeline)(
@@ -51041,6 +51246,7 @@ var import_promises3 = __toESM(require("fs/promises"), 1);
 var import_node_path26 = __toESM(require("path"), 1);
 var import_node_os12 = __toESM(require("os"), 1);
 var import_jszip = __toESM(require_lib3(), 1);
+init_src();
 var ImportError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -51839,7 +52045,7 @@ function runAttachmentGc(args) {
 // src/attachment/group.ts
 var import_node_fs28 = __toESM(require("fs"), 1);
 var import_node_path29 = __toESM(require("path"), 1);
-var import_node_crypto9 = __toESM(require("crypto"), 1);
+var import_node_crypto8 = __toESM(require("crypto"), 1);
 init_protocol();
 var GroupFileStore = class {
   dataDir;
@@ -51928,7 +52134,7 @@ var GroupFileStore = class {
       entries[idx] = next;
     } else {
       next = {
-        id: `gf-${import_node_crypto9.default.randomBytes(6).toString("base64url")}`,
+        id: `gf-${import_node_crypto8.default.randomBytes(6).toString("base64url")}`,
         relPath: input.relPath,
         from: input.from,
         label: input.label,
@@ -52047,7 +52253,7 @@ function readDaemonSourceFromEnv(env = process.env) {
 // src/tunnel/tunnel-manager.ts
 var import_node_fs33 = __toESM(require("fs"), 1);
 var import_node_path34 = __toESM(require("path"), 1);
-var import_node_crypto10 = __toESM(require("crypto"), 1);
+var import_node_crypto9 = __toESM(require("crypto"), 1);
 var import_node_child_process9 = require("child_process");
 
 // src/tunnel/tunnel-store.ts
@@ -52546,7 +52752,7 @@ var TunnelManager = class {
         override: this.deps.frpcBinaryOverride ?? void 0
       });
       const tomlPath = import_node_path34.default.join(this.deps.dataDir, "frpc.toml");
-      const proxyName = `clawd-${t.subdomain}-${localPort}-${import_node_crypto10.default.randomBytes(3).toString("hex")}`;
+      const proxyName = `clawd-${t.subdomain}-${localPort}-${import_node_crypto9.default.randomBytes(3).toString("hex")}`;
       const toml = buildFrpcToml({
         serverAddr: t.frpsHost,
         serverPort: t.frpsPort,
@@ -52642,29 +52848,795 @@ async function waitForFrpcReady(proc, timeoutMs) {
   });
 }
 
+// src/sshd/sshd-manager.ts
+var import_node_fs36 = __toESM(require("fs"), 1);
+var import_node_path37 = __toESM(require("path"), 1);
+var import_node_child_process11 = require("child_process");
+
+// src/sshd/sshd-config.ts
+function buildSshdConfig(input) {
+  const lines = [
+    `ListenAddress ${input.listenAddress}`,
+    `Port ${input.port}`,
+    `HostKey ${input.hostKeyPath}`,
+    `PidFile ${input.pidFilePath}`,
+    `AuthorizedKeysFile ${input.authorizedKeysFile}`,
+    `PubkeyAuthentication yes`,
+    `PasswordAuthentication no`,
+    `ChallengeResponseAuthentication no`,
+    `KbdInteractiveAuthentication no`,
+    `PermitRootLogin no`,
+    `StrictModes no`,
+    `UsePAM no`,
+    `LogLevel INFO`,
+    `Subsystem sftp internal-sftp`
+  ];
+  return lines.join("\n") + "\n";
+}
+
+// src/sshd/sshd-process.ts
+var import_node_fs34 = __toESM(require("fs"), 1);
+var import_node_path35 = __toESM(require("path"), 1);
+var import_node_child_process10 = require("child_process");
+function sshdPidFilePath(dataDir) {
+  return import_node_path35.default.join(dataDir, "sshd", "sshd.pid");
+}
+function writeSshdPid(dataDir, pid) {
+  try {
+    const p2 = sshdPidFilePath(dataDir);
+    import_node_fs34.default.mkdirSync(import_node_path35.default.dirname(p2), { recursive: true, mode: 448 });
+    import_node_fs34.default.writeFileSync(p2, String(pid), { mode: 384 });
+  } catch {
+  }
+}
+function clearSshdPid(dataDir) {
+  try {
+    import_node_fs34.default.unlinkSync(sshdPidFilePath(dataDir));
+  } catch {
+  }
+}
+function defaultIsPidAlive2(pid) {
+  if (!Number.isFinite(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    return code === "EPERM";
+  }
+}
+function defaultReadPidFile2(file) {
+  try {
+    return import_node_fs34.default.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+}
+function defaultKillPid2(pid, signal) {
+  try {
+    process.kill(pid, signal);
+  } catch {
+  }
+}
+function defaultSleep2(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+async function killStaleSshd(deps) {
+  const pidFile = sshdPidFilePath(deps.dataDir);
+  const configPath = import_node_path35.default.join(deps.dataDir, "sshd", "sshd_config");
+  const readPidFile = deps.readPidFileImpl ?? defaultReadPidFile2;
+  const isAlive = deps.isPidAliveImpl ?? defaultIsPidAlive2;
+  const killPid = deps.killPidImpl ?? defaultKillPid2;
+  const scanPids = deps.scanSshdPidsImpl ?? ((cp) => defaultScanSshdPidsByCmdline(cp, deps.logger));
+  const sleep2 = deps.sleepImpl ?? defaultSleep2;
+  const victims = /* @__PURE__ */ new Set();
+  const raw = readPidFile(pidFile);
+  if (raw) {
+    const pid = parseInt(raw.trim(), 10);
+    if (Number.isFinite(pid) && pid > 0 && pid !== deps.ownPid && isAlive(pid)) {
+      victims.add(pid);
+    }
+  }
+  try {
+    const scanned = await scanPids(configPath);
+    for (const pid of scanned) {
+      if (pid > 0 && pid !== deps.ownPid && isAlive(pid)) victims.add(pid);
+    }
+  } catch (e) {
+    deps.logger?.warn("sshd: stale-sshd cmdline scan failed", { err: e.message });
+  }
+  if (victims.size === 0) {
+    try {
+      import_node_fs34.default.unlinkSync(pidFile);
+    } catch {
+    }
+    return;
+  }
+  for (const pid of victims) {
+    deps.logger?.warn("sshd: killing stale sshd before respawn", { pid });
+    killPid(pid, "SIGKILL");
+  }
+  await sleep2(deps.reapWaitMs ?? 300);
+  try {
+    import_node_fs34.default.unlinkSync(pidFile);
+  } catch {
+  }
+}
+async function defaultScanSshdPidsByCmdline(configPath, logger) {
+  if (process.platform === "win32") return [];
+  return new Promise((resolve6) => {
+    const ps = (0, import_node_child_process10.spawn)("ps", ["-axo", "pid=,command="], { stdio: ["ignore", "pipe", "ignore"] });
+    let buf = "";
+    ps.stdout.on("data", (c) => {
+      buf += c.toString();
+    });
+    ps.on("exit", () => {
+      const pids = [];
+      for (const line of buf.split("\n")) {
+        const m2 = /^\s*(\d+)\s+(.*)$/.exec(line);
+        if (!m2) continue;
+        const cmd = m2[2];
+        if (!/\bsshd\b/.test(cmd)) continue;
+        if (!cmd.includes(configPath)) continue;
+        const pid = parseInt(m2[1], 10);
+        if (Number.isFinite(pid) && pid > 0) pids.push(pid);
+      }
+      resolve6(pids);
+    });
+    ps.on("error", (e) => {
+      logger?.warn("sshd: ps scan failed", { err: e.message });
+      resolve6([]);
+    });
+  });
+}
+
+// src/sshd/jail-script.ts
+var import_node_fs35 = __toESM(require("fs"), 1);
+var import_node_path36 = __toESM(require("path"), 1);
+var CLAWD_SSH_JAIL_SCRIPT = String.raw`#!/usr/bin/env bash
+# clawd-ssh-jail — SSH reverse access sandbox wrapper (managed by clawd; do not edit)
+#
+# 由 sshd authorized_keys 的 command= 强制入口调用。
+# 用法: sshd 会以 \`clawd-ssh-jail <deviceId>\` 起本脚本；$SSH_ORIGINAL_COMMAND = client
+# 真实请求（interactive shell 时为空）。
+#
+# 职责:
+#   1. 读 ~/.clawd/contacts.json 找 contact.exposedDirs
+#   2. macOS 用 sandbox-exec + sbpl; Linux 用 bwrap
+#   3. exec 沙箱 shell
+
+set -euo pipefail
+
+# 用户可读审计日志：追加到 ~/.clawd/contact-ssh.log（跟 daemon TS 侧 contact-ssh-log.ts 共写）
+CONTACT_SSH_LOG="\${HOME}/.clawd/contact-ssh.log"
+log_line() {
+  # 参数: level tag msg
+  local ts
+  ts=$(date -u +"%Y-%m-%dT%H:%M:%S.%3NZ" 2>/dev/null || date -u +"%Y-%m-%dT%H:%M:%SZ")
+  printf '[%s] [%s] [%s] %s\n' "$ts" "$1" "$2" "$3" >> "$CONTACT_SSH_LOG" 2>/dev/null || true
+}
+
+DEVICE_ID="\${1:-}"
+if [ -z "$DEVICE_ID" ]; then
+  log_line ERROR jail.entered "clawd-ssh-jail 缺 deviceId 参数"
+  echo "clawd-ssh-jail: missing deviceId" >&2
+  exit 1
+fi
+
+log_line INFO jail.entered "clawd-ssh-jail 起来 device=\${DEVICE_ID} cmd=\${SSH_ORIGINAL_COMMAND:-<interactive-shell>}"
+
+CONTACTS="\${HOME}/.clawd/contacts.json"
+if [ ! -f "$CONTACTS" ]; then
+  log_line ERROR jail.entered "contacts.json 不存在，无法查 exposedDirs"
+  echo "clawd-ssh-jail: contacts.json missing" >&2
+  exit 1
+fi
+
+# 读 contact 的 exposedDirs (mac/linux 都自带 python3)
+EXPOSED_JSON=$(python3 -c "
+import json, sys
+with open('$CONTACTS') as f:
+    data = json.load(f)
+for c in data.get('contacts', []):
+    if c.get('deviceId') == '$DEVICE_ID':
+        if not c.get('sshAllowed'):
+            print('DENIED', file=sys.stderr); sys.exit(2)
+        for d in c.get('exposedDirs', []):
+            print(d)
+        sys.exit(0)
+sys.exit(3)
+")
+
+if [ -z "$EXPOSED_JSON" ]; then
+  log_line ERROR jail.entered "contact \${DEVICE_ID} 不在 store 或 exposedDirs 为空"
+  echo "clawd-ssh-jail: contact not found or no exposed dirs" >&2
+  exit 1
+fi
+log_line INFO jail.entered "exposedDirs 白名单已加载，进沙箱 exec shell"
+
+# 进沙箱前告知 SSH client 授权目录列表（发到 stderr）—— CC 或其他 SSH client 试错一次就能
+# 学到 exposedDirs 具体值，无需 A 侧向 B 侧同步（授权数据实时的 single source of truth）。
+# 每次拨号运行时读，A 改 exposedDirs 后 B 侧下一次拨号立即感知。
+echo "[clawd-ssh-jail] Access allowed to these directories:" >&2
+while IFS= read -r d; do
+  echo "  - $d" >&2
+done <<< "$EXPOSED_JSON"
+echo "[clawd-ssh-jail] Anything outside these paths will be sandbox-denied." >&2
+
+# 校验路径安全（bash 侧二次防御）
+while IFS= read -r line; do
+  case "$line" in
+    /*) : ;;
+    *) echo "clawd-ssh-jail: bad path: $line" >&2; exit 1 ;;
+  esac
+  case "$line" in
+    *[\"\'\`\$\;\|\&\(\)\{\}\[\]\<\>\*\?]*)
+      echo "clawd-ssh-jail: unsafe path: $line" >&2; exit 1 ;;
+  esac
+done <<< "$EXPOSED_JSON"
+
+CMD="\${SSH_ORIGINAL_COMMAND:-}"
+if [ -z "$CMD" ]; then
+  SHELL_CMD=(bash --login)
+else
+  SHELL_CMD=(bash -c "$CMD")
+fi
+
+case "$(uname -s)" in
+  Darwin)
+    POLICY="(version 1)
+(deny default)
+(allow process*)
+(allow signal (target self))
+(allow sysctl-read)
+(allow mach-lookup)
+(allow file-read-metadata)
+(allow network*)
+(allow file-read* (subpath \"/usr\"))
+(allow file-read* (subpath \"/bin\"))
+(allow file-read* (subpath \"/sbin\"))
+(allow file-read* (subpath \"/System\"))
+(allow file-read* (subpath \"/Library\"))
+(allow file-read* (subpath \"/etc\"))
+(allow file-read* (subpath \"/private/etc\"))"
+    while IFS= read -r d; do
+      POLICY+="
+(allow file-read* file-write* (subpath \"$d\"))"
+    done <<< "$EXPOSED_JSON"
+    exec sandbox-exec -p "$POLICY" "\${SHELL_CMD[@]}"
+    ;;
+  Linux)
+    BWRAP_ARGS=(
+      --unshare-user --unshare-ipc --unshare-pid --unshare-uts
+      --die-with-parent
+      --proc /proc --dev /dev --tmpfs /tmp
+      --ro-bind /usr /usr --ro-bind /bin /bin --ro-bind /sbin /sbin
+      --ro-bind /lib /lib --ro-bind /etc /etc
+    )
+    if [ -d /lib64 ]; then BWRAP_ARGS+=(--ro-bind /lib64 /lib64); fi
+    while IFS= read -r d; do
+      BWRAP_ARGS+=(--bind "$d" "$d")
+    done <<< "$EXPOSED_JSON"
+    exec bwrap "\${BWRAP_ARGS[@]}" "\${SHELL_CMD[@]}"
+    ;;
+  *)
+    echo "clawd-ssh-jail: unsupported OS $(uname -s)" >&2
+    exit 1
+    ;;
+esac
+`;
+function ensureJailScript(dataDir) {
+  const binDir = import_node_path36.default.join(dataDir, "bin");
+  import_node_fs35.default.mkdirSync(binDir, { recursive: true, mode: 493 });
+  const target = import_node_path36.default.join(binDir, "clawd-ssh-jail");
+  import_node_fs35.default.writeFileSync(target, CLAWD_SSH_JAIL_SCRIPT, { mode: 493 });
+  return target;
+}
+
+// src/sshd/sshd-manager.ts
+var SshdManager = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.sshdDir = import_node_path37.default.join(deps.dataDir, "sshd");
+    this.startupTimeoutMs = deps.startupTimeoutMs ?? 15e3;
+  }
+  deps;
+  proc = null;
+  sshdDir;
+  stopping = false;
+  exitHookInstalled = false;
+  startupTimeoutMs;
+  get port() {
+    return this.deps.port;
+  }
+  async start() {
+    const { logger } = this.deps;
+    await (this.deps.killStaleImpl ?? killStaleSshd)({
+      dataDir: this.deps.dataDir,
+      ownPid: process.pid,
+      logger
+    });
+    import_node_fs36.default.mkdirSync(this.sshdDir, { recursive: true, mode: 448 });
+    import_node_fs36.default.mkdirSync(import_node_path37.default.join(this.sshdDir, "authorized_keys.d"), { recursive: true, mode: 448 });
+    ensureJailScript(this.deps.dataDir);
+    const hostKeyPath = import_node_path37.default.join(this.sshdDir, "host_key");
+    if (!import_node_fs36.default.existsSync(hostKeyPath)) {
+      await this.generateHostKey(hostKeyPath);
+    }
+    const akFile = import_node_path37.default.join(this.sshdDir, "authorized_keys.d", "clawd-contacts");
+    if (!import_node_fs36.default.existsSync(akFile)) {
+      import_node_fs36.default.writeFileSync(akFile, "", { mode: 384 });
+    }
+    const configPath = import_node_path37.default.join(this.sshdDir, "sshd_config");
+    const config = buildSshdConfig({
+      listenAddress: "127.0.0.1",
+      port: this.deps.port,
+      hostKeyPath,
+      authorizedKeysFile: akFile,
+      pidFilePath: import_node_path37.default.join(this.sshdDir, "sshd.pid")
+    });
+    import_node_fs36.default.writeFileSync(configPath, config, { mode: 384 });
+    const sshdBin = this.deps.sshdBin ?? "/usr/sbin/sshd";
+    const proc = (this.deps.spawnImpl ?? import_node_child_process11.spawn)(sshdBin, ["-D", "-e", "-f", configPath], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const logStream = import_node_fs36.default.createWriteStream(import_node_path37.default.join(this.sshdDir, "sshd.log"), {
+      flags: "a",
+      mode: 384
+    });
+    logStream.on("error", () => {
+    });
+    const tee = (c) => {
+      logStream.write(String(c));
+    };
+    proc.stdout?.on("data", tee);
+    proc.stderr?.on("data", tee);
+    proc.once("exit", () => logStream.end());
+    const ready = await waitForSshdReady(proc, this.startupTimeoutMs);
+    if (!ready.ok) {
+      try {
+        proc.kill("SIGTERM");
+      } catch {
+      }
+      const tail = ready.output.slice(-500);
+      const msg = tail ? `${ready.error}
+${tail}` : ready.error;
+      throw new Error(msg);
+    }
+    if (typeof proc.pid === "number") writeSshdPid(this.deps.dataDir, proc.pid);
+    this.proc = proc;
+    this.installProcessExitHandlersIfNeeded();
+    this.attachExitListener(proc);
+    logger?.info("sshd: up", { port: this.deps.port, pid: proc.pid ?? null });
+    return { port: this.deps.port };
+  }
+  async stop() {
+    this.stopping = true;
+    const proc = this.proc;
+    this.proc = null;
+    if (!proc) {
+      clearSshdPid(this.deps.dataDir);
+      return;
+    }
+    proc.kill("SIGTERM");
+    await new Promise((resolve6) => {
+      const t = setTimeout(() => {
+        try {
+          proc.kill("SIGKILL");
+        } catch {
+        }
+        resolve6();
+      }, 5e3);
+      proc.once("exit", () => {
+        clearTimeout(t);
+        resolve6();
+      });
+    });
+    clearSshdPid(this.deps.dataDir);
+  }
+  killSync() {
+    const proc = this.proc;
+    this.proc = null;
+    clearSshdPid(this.deps.dataDir);
+    if (!proc) return;
+    try {
+      proc.kill("SIGTERM");
+    } catch {
+    }
+  }
+  attachExitListener(proc) {
+    proc.on("exit", (code) => {
+      this.deps.logger?.warn("sshd exited", { code });
+      if (this.stopping) return;
+      this.proc = null;
+      this.deps.onSshdExit?.({ code });
+    });
+  }
+  installProcessExitHandlersIfNeeded() {
+    if (this.exitHookInstalled) return;
+    if (this.deps.installProcessExitHandlers !== true) return;
+    this.exitHookInstalled = true;
+    const sync = () => this.killSync();
+    process.once("exit", sync);
+    process.once("SIGHUP", sync);
+    process.once("uncaughtException", sync);
+  }
+  async generateHostKey(hostKeyPath) {
+    const keygenBin = this.deps.keygenBin ?? "/usr/bin/ssh-keygen";
+    await new Promise((resolve6, reject) => {
+      const p2 = (this.deps.spawnImpl ?? import_node_child_process11.spawn)(
+        keygenBin,
+        ["-t", "ed25519", "-f", hostKeyPath, "-N", "", "-q"],
+        { stdio: "ignore" }
+      );
+      p2.on("exit", (code) => code === 0 ? resolve6() : reject(new Error(`ssh-keygen exit ${code}`)));
+      p2.on("error", reject);
+    });
+    try {
+      import_node_fs36.default.chmodSync(hostKeyPath, 384);
+    } catch {
+    }
+  }
+};
+async function waitForSshdReady(proc, timeoutMs) {
+  return new Promise((resolve6) => {
+    let settled = false;
+    let buf = "";
+    const finish = (r) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve6(r);
+    };
+    const onData = (chunk) => {
+      buf += String(chunk);
+      if (/Server listening on/i.test(buf)) finish({ ok: true });
+      if (/fatal:/i.test(buf) || /error: Bind to port/i.test(buf)) {
+        finish({ ok: false, error: "sshd startup failed", output: buf });
+      }
+    };
+    const onExit = (code) => finish({ ok: false, error: `sshd exited before ready (code=${code})`, output: buf });
+    const onErr = (err) => finish({ ok: false, error: `sshd spawn error: ${err.message}`, output: buf });
+    const cleanup = () => {
+      proc.stdout?.off("data", onData);
+      proc.stderr?.off("data", onData);
+      proc.off("exit", onExit);
+      proc.off("error", onErr);
+      clearTimeout(timer);
+    };
+    proc.stdout?.on("data", onData);
+    proc.stderr?.on("data", onData);
+    proc.on("exit", onExit);
+    proc.on("error", onErr);
+    const timer = setTimeout(
+      () => finish({ ok: false, error: `sshd startup timeout after ${timeoutMs}ms`, output: buf }),
+      timeoutMs
+    );
+  });
+}
+
+// src/sshd/authorized-keys.ts
+var import_node_fs37 = __toESM(require("fs"), 1);
+var import_node_path38 = __toESM(require("path"), 1);
+var JAIL_BIN_PATH_ENV = "CLAWD_JAIL_BIN_PATH";
+var AUTHORIZED_KEYS_FILE = "clawd-contacts";
+function jailBinPath() {
+  return process.env[JAIL_BIN_PATH_ENV] ?? import_node_path38.default.join(process.env.HOME ?? "", ".clawd", "bin", "clawd-ssh-jail");
+}
+function rebuildAuthorizedKeys(store, sshdDir) {
+  const akDir = import_node_path38.default.join(sshdDir, "authorized_keys.d");
+  const target = import_node_path38.default.join(akDir, AUTHORIZED_KEYS_FILE);
+  import_node_fs37.default.mkdirSync(akDir, { recursive: true, mode: 448 });
+  const lines = ["# managed by clawd; do not edit", ""];
+  for (const c of store.list()) {
+    if (!c.sshAllowed) continue;
+    const safe = /^[A-Za-z0-9_.-]+$/.test(c.deviceId);
+    if (!safe) continue;
+    const pubkey = readIssuedPubkey(sshdDir, c.deviceId);
+    if (!pubkey) continue;
+    const bin = jailBinPath();
+    lines.push(`command="${bin} ${c.deviceId}",restrict ${pubkey.trim()}`);
+    lines.push(`# contact:${c.deviceId}`);
+  }
+  const body = lines.join("\n") + "\n";
+  const tmp = `${target}.tmp-${process.pid}-${Date.now()}`;
+  import_node_fs37.default.writeFileSync(tmp, body, { mode: 384 });
+  import_node_fs37.default.renameSync(tmp, target);
+}
+function readIssuedPubkey(sshdDir, deviceId) {
+  const safeId = deviceId.replace(/[\/\\]/g, "_");
+  const p2 = import_node_path38.default.join(sshdDir, "keys", `${safeId}.ed25519.pub`);
+  try {
+    return import_node_fs37.default.readFileSync(p2, "utf8");
+  } catch {
+    return null;
+  }
+}
+
+// src/sshd/contact-key-puller.ts
+var import_node_fs39 = __toESM(require("fs"), 1);
+var import_node_path40 = __toESM(require("path"), 1);
+init_peer_forward();
+
+// src/sshd/contact-ssh-log.ts
+var import_node_fs38 = __toESM(require("fs"), 1);
+var import_node_path39 = __toESM(require("path"), 1);
+function createContactSshLog(dataDir) {
+  const file = import_node_path39.default.join(dataDir, "contact-ssh.log");
+  function append(level, tag, message, meta) {
+    const time = (/* @__PURE__ */ new Date()).toISOString();
+    let line = `[${time}] [${level}] [${tag}] ${message}`;
+    if (meta && Object.keys(meta).length > 0) {
+      try {
+        line += " " + JSON.stringify(meta);
+      } catch {
+        line += " [meta-serialize-failed]";
+      }
+    }
+    line += "\n";
+    try {
+      import_node_fs38.default.mkdirSync(import_node_path39.default.dirname(file), { recursive: true });
+      import_node_fs38.default.appendFileSync(file, line, { mode: 384 });
+    } catch {
+    }
+  }
+  return {
+    info: (tag, message, meta) => append("INFO", tag, message, meta),
+    warn: (tag, message, meta) => append("WARN", tag, message, meta),
+    error: (tag, message, meta) => append("ERROR", tag, message, meta)
+  };
+}
+var nullContactSshLog = {
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: () => {
+  }
+};
+
+// src/sshd/contact-key-puller.ts
+var CONTACT_KEYS_DIR = "contact-ssh-keys";
+function safeContactKeyPath(dataDir, deviceId) {
+  const safeId = deviceId.replace(/[\/\\]/g, "_");
+  return import_node_path40.default.join(dataDir, CONTACT_KEYS_DIR, `${safeId}.ed25519`);
+}
+async function pullContactSshKeyOnce(deps) {
+  const forward = deps.forwardImpl ?? ((c) => forwardContactSshKeyIssueToPeer({
+    contact: { remoteUrl: c.remoteUrl, connectToken: c.connectToken },
+    selfDeviceIdForRequest: c.deviceId
+  }));
+  const contacts = deps.store.list().filter((c) => c.connectToken.length > 0);
+  const results = await Promise.all(
+    contacts.map(async (c) => {
+      try {
+        const r = await forward(c);
+        return { contact: c, result: r };
+      } catch (err) {
+        return {
+          contact: c,
+          result: {
+            ok: false,
+            code: "NETWORK",
+            message: err instanceof Error ? err.message : String(err)
+          }
+        };
+      }
+    })
+  );
+  const errors = [];
+  let pulled = 0;
+  const sshLog = deps.sshLog ?? nullContactSshLog;
+  for (const { contact, result } of results) {
+    if (result.ok) {
+      writeKeyFile(deps.dataDir, contact.deviceId, result.privateKeyPem);
+      pulled++;
+      deps.logger?.info("contact-key-puller: pulled", { deviceId: contact.deviceId });
+      sshLog.info("key.pull.success", "B \u4FA7\u4ECE A \u62C9\u5230 privkey \u5E76\u843D\u76D8", {
+        peerDeviceId: contact.deviceId,
+        peerDisplayName: contact.displayName
+      });
+    } else if (result.code === "UNAUTHORIZED" || result.code === "FORBIDDEN") {
+      const hadStale = removeKeyFile(deps.dataDir, contact.deviceId);
+      sshLog.info("key.pull.rejected", "A \u4FA7\u672A\u6388\u6743\u6211 SSH\uFF08\u6B63\u5E38\u72B6\u6001\uFF1B\u8F6E\u8BE2\u7EE7\u7EED\uFF09", {
+        peerDeviceId: contact.deviceId,
+        peerDisplayName: contact.displayName,
+        clearedStalePrivkey: hadStale
+      });
+    } else {
+      errors.push({
+        deviceId: contact.deviceId,
+        code: result.code,
+        message: result.message
+      });
+      deps.logger?.warn("contact-key-puller: pull failed", {
+        deviceId: contact.deviceId,
+        code: result.code,
+        message: result.message
+      });
+      sshLog.warn("key.pull.error", "\u62C9 privkey \u65F6\u7F51\u7EDC/\u534F\u8BAE\u9519\u8BEF", {
+        peerDeviceId: contact.deviceId,
+        code: result.code,
+        message: result.message
+      });
+    }
+  }
+  return { pulled, errors };
+}
+function writeKeyFile(dataDir, deviceId, pem) {
+  const p2 = safeContactKeyPath(dataDir, deviceId);
+  import_node_fs39.default.mkdirSync(import_node_path40.default.dirname(p2), { recursive: true, mode: 448 });
+  import_node_fs39.default.writeFileSync(p2, pem, { mode: 384 });
+}
+function removeKeyFile(dataDir, deviceId) {
+  try {
+    import_node_fs39.default.unlinkSync(safeContactKeyPath(dataDir, deviceId));
+    return true;
+  } catch {
+    return false;
+  }
+}
+var ContactKeyPuller = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  timer = null;
+  async start() {
+    const interval = this.deps.intervalMs ?? 6e4;
+    void this.tick();
+    this.timer = setInterval(() => void this.tick(), interval);
+    this.timer.unref();
+  }
+  stop() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+  }
+  async tick() {
+    try {
+      await pullContactSshKeyOnce(this.deps);
+    } catch (err) {
+      this.deps.logger?.warn("contact-key-puller: tick failed", {
+        err: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+};
+
+// src/sshd/ssh-tunnel-relay.ts
+var import_node_net2 = __toESM(require("net"), 1);
+async function handleSshTunnelUpgrade(req, socket, head, deps) {
+  const sshLog = deps.sshLog ?? nullContactSshLog;
+  const clientAddr = (req.socket && "remoteAddress" in req.socket ? req.socket.remoteAddress : null) ?? "unknown";
+  const auth = req.headers.authorization ?? "";
+  const m2 = /^Bearer\s+(.+)$/i.exec(auth);
+  if (!m2) {
+    sshLog.warn("tunnel.auth-failed", "/rpc/ssh-tunnel \u8BF7\u6C42\u7F3A Bearer token", {
+      clientAddr
+    });
+    socket.write(
+      "HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\n\r\n"
+    );
+    socket.destroy();
+    return;
+  }
+  const token = m2[1].trim();
+  let ok = false;
+  try {
+    ok = await deps.authorize(token);
+  } catch (err) {
+    deps.logger?.warn("ssh-tunnel: authorize threw", {
+      err: err instanceof Error ? err.message : String(err)
+    });
+  }
+  if (!ok) {
+    sshLog.warn("tunnel.auth-failed", "/rpc/ssh-tunnel Bearer token \u9A8C\u8BC1\u5931\u8D25", {
+      clientAddr
+    });
+    socket.write(
+      "HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\n\r\n"
+    );
+    socket.destroy();
+    return;
+  }
+  sshLog.info("tunnel.auth-ok", "/rpc/ssh-tunnel \u8BA4\u8BC1\u901A\u8FC7\uFF0C\u5347\u7EA7 WS", {
+    clientAddr
+  });
+  deps.wss.handleUpgrade(req, socket, head, (ws) => {
+    pumpWsToSshd(ws, deps, clientAddr);
+  });
+}
+function pumpWsToSshd(ws, deps, clientAddr) {
+  const sshLog = deps.sshLog ?? nullContactSshLog;
+  const tcp = import_node_net2.default.connect(deps.sshdPort, "127.0.0.1");
+  let tcpConnected = false;
+  let bytesFromWs = 0;
+  let bytesToWs = 0;
+  const startedAt = Date.now();
+  const cleanup = (reason) => {
+    try {
+      ws.close(1e3, reason);
+    } catch {
+    }
+    try {
+      tcp.destroy();
+    } catch {
+    }
+    sshLog.info("tunnel.disconnected", "SSH tunnel \u4F1A\u8BDD\u7ED3\u675F", {
+      clientAddr,
+      reason,
+      bytesFromWs,
+      bytesToWs,
+      durationMs: Date.now() - startedAt
+    });
+  };
+  tcp.once("connect", () => {
+    tcpConnected = true;
+    deps.logger?.info("ssh-tunnel: tcp connected to sshd", { port: deps.sshdPort });
+    sshLog.info("tunnel.connected", "WS \u2194 \u672C\u673A sshd raw byte relay \u5DF2\u5C31\u7EEA", {
+      clientAddr,
+      sshdPort: deps.sshdPort
+    });
+  });
+  tcp.on("data", (chunk) => {
+    if (ws.readyState === ws.OPEN) {
+      bytesToWs += chunk.length;
+      ws.send(chunk, { binary: true });
+    }
+  });
+  tcp.on("error", (err) => {
+    deps.logger?.warn("ssh-tunnel: tcp error", { err: err.message, tcpConnected });
+    sshLog.error(
+      tcpConnected ? "tunnel.tcp-error" : "tunnel.tcp-connect-failed",
+      tcpConnected ? "WS \u2194 sshd relay \u671F\u95F4 TCP \u4FA7\u51FA\u9519" : "\u65E0\u6CD5\u8FDE\u5230\u672C\u673A sshd\uFF08sshd \u672A\u8D77\uFF1F\u7AEF\u53E3\u9519\uFF1F\uFF09",
+      { clientAddr, sshdPort: deps.sshdPort, err: err.message }
+    );
+    cleanup("tcp error");
+  });
+  tcp.on("end", () => cleanup("tcp end"));
+  tcp.on("close", () => cleanup("tcp close"));
+  ws.on("message", (data) => {
+    let buf = null;
+    if (Buffer.isBuffer(data)) buf = data;
+    else if (Array.isArray(data)) buf = Buffer.concat(data);
+    else if (data instanceof ArrayBuffer) buf = Buffer.from(data);
+    if (buf) {
+      bytesFromWs += buf.length;
+      tcp.write(buf);
+    }
+  });
+  ws.on("close", () => cleanup("ws close"));
+  ws.on("error", (err) => {
+    deps.logger?.warn("ssh-tunnel: ws error", { err: err.message });
+    cleanup("ws error");
+  });
+}
+
 // src/tunnel/device-key.ts
 var import_node_os14 = __toESM(require("os"), 1);
-var import_node_path35 = __toESM(require("path"), 1);
-var import_node_crypto11 = __toESM(require("crypto"), 1);
+var import_node_path41 = __toESM(require("path"), 1);
+var import_node_crypto10 = __toESM(require("crypto"), 1);
 var DERIVE_SALT = "clawd-tunnel-device-v1";
 function deriveStableDeviceKey(opts = {}) {
   const hostname = opts.hostname ?? import_node_os14.default.hostname();
   const uid = opts.uid ?? (typeof import_node_os14.default.userInfo === "function" ? import_node_os14.default.userInfo().uid : 0);
   const home = opts.home ?? import_node_os14.default.homedir();
-  const defaultDataDir = import_node_path35.default.resolve(import_node_path35.default.join(home, ".clawd"));
-  const normalizedDataDir = opts.dataDir ? import_node_path35.default.resolve(opts.dataDir) : null;
+  const defaultDataDir = import_node_path41.default.resolve(import_node_path41.default.join(home, ".clawd"));
+  const normalizedDataDir = opts.dataDir ? import_node_path41.default.resolve(opts.dataDir) : null;
   const isDefaultDir = normalizedDataDir == null || normalizedDataDir === defaultDataDir;
   const input = isDefaultDir ? `${hostname}::${uid}` : `${hostname}::${uid}::${normalizedDataDir}`;
-  return import_node_crypto11.default.createHmac("sha256", DERIVE_SALT).update(input).digest("hex").slice(0, 32);
+  return import_node_crypto10.default.createHmac("sha256", DERIVE_SALT).update(input).digest("hex").slice(0, 32);
 }
 
 // src/auth-store.ts
-var import_node_fs34 = __toESM(require("fs"), 1);
-var import_node_path36 = __toESM(require("path"), 1);
-var import_node_crypto12 = __toESM(require("crypto"), 1);
+var import_node_fs40 = __toESM(require("fs"), 1);
+var import_node_path42 = __toESM(require("path"), 1);
+var import_node_crypto11 = __toESM(require("crypto"), 1);
 var AUTH_FILE_NAME = "auth.json";
 function authFilePath(dataDir) {
-  return import_node_path36.default.join(dataDir, AUTH_FILE_NAME);
+  return import_node_path42.default.join(dataDir, AUTH_FILE_NAME);
 }
 function loadOrCreateAuthFile(opts) {
   const file = authFilePath(opts.dataDir);
@@ -52693,14 +53665,14 @@ function loadOrCreateAuthFile(opts) {
   return next;
 }
 function defaultGenerateToken() {
-  return import_node_crypto12.default.randomBytes(32).toString("base64url");
+  return import_node_crypto11.default.randomBytes(32).toString("base64url");
 }
 function defaultGenerateOwnerPrincipalId() {
-  return `owner-${import_node_crypto12.default.randomUUID()}`;
+  return `owner-${import_node_crypto11.default.randomUUID()}`;
 }
 function readAuthFile(file) {
   try {
-    const raw = import_node_fs34.default.readFileSync(file, "utf8");
+    const raw = import_node_fs40.default.readFileSync(file, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.token !== "string" || parsed.token.length === 0) {
       return null;
@@ -52720,25 +53692,25 @@ function readAuthFile(file) {
   }
 }
 function writeAuthFile(file, content) {
-  import_node_fs34.default.mkdirSync(import_node_path36.default.dirname(file), { recursive: true });
-  import_node_fs34.default.writeFileSync(file, JSON.stringify(content, null, 2), { mode: 384 });
+  import_node_fs40.default.mkdirSync(import_node_path42.default.dirname(file), { recursive: true });
+  import_node_fs40.default.writeFileSync(file, JSON.stringify(content, null, 2), { mode: 384 });
   try {
-    import_node_fs34.default.chmodSync(file, 384);
+    import_node_fs40.default.chmodSync(file, 384);
   } catch {
   }
 }
 
 // src/owner-profile.ts
-var import_node_fs35 = __toESM(require("fs"), 1);
+var import_node_fs41 = __toESM(require("fs"), 1);
 var import_node_os15 = __toESM(require("os"), 1);
-var import_node_path37 = __toESM(require("path"), 1);
+var import_node_path43 = __toESM(require("path"), 1);
 var PROFILE_FILENAME = "profile.json";
 function loadOwnerDisplayName(dataDir) {
   const fallback = import_node_os15.default.userInfo().username;
-  const profilePath = import_node_path37.default.join(dataDir, PROFILE_FILENAME);
+  const profilePath = import_node_path43.default.join(dataDir, PROFILE_FILENAME);
   let raw;
   try {
-    raw = import_node_fs35.default.readFileSync(profilePath, "utf8");
+    raw = import_node_fs41.default.readFileSync(profilePath, "utf8");
   } catch {
     return fallback;
   }
@@ -52761,18 +53733,18 @@ function loadOwnerDisplayName(dataDir) {
 }
 
 // src/feishu-auth/owner-identity-store.ts
-var import_node_fs36 = __toESM(require("fs"), 1);
-var import_node_path38 = __toESM(require("path"), 1);
+var import_node_fs42 = __toESM(require("fs"), 1);
+var import_node_path44 = __toESM(require("path"), 1);
 var OWNER_IDENTITY_FILE_NAME = "owner-identity.json";
 var OwnerIdentityStore = class {
   file;
   constructor(dataDir) {
-    this.file = import_node_path38.default.join(dataDir, OWNER_IDENTITY_FILE_NAME);
+    this.file = import_node_path44.default.join(dataDir, OWNER_IDENTITY_FILE_NAME);
   }
   read() {
     let raw;
     try {
-      raw = import_node_fs36.default.readFileSync(this.file, "utf8");
+      raw = import_node_fs42.default.readFileSync(this.file, "utf8");
     } catch {
       return null;
     }
@@ -52800,16 +53772,16 @@ var OwnerIdentityStore = class {
     };
   }
   write(record) {
-    import_node_fs36.default.mkdirSync(import_node_path38.default.dirname(this.file), { recursive: true });
-    import_node_fs36.default.writeFileSync(this.file, JSON.stringify(record, null, 2), { mode: 384 });
+    import_node_fs42.default.mkdirSync(import_node_path44.default.dirname(this.file), { recursive: true });
+    import_node_fs42.default.writeFileSync(this.file, JSON.stringify(record, null, 2), { mode: 384 });
     try {
-      import_node_fs36.default.chmodSync(this.file, 384);
+      import_node_fs42.default.chmodSync(this.file, 384);
     } catch {
     }
   }
   clear() {
     try {
-      import_node_fs36.default.unlinkSync(this.file);
+      import_node_fs42.default.unlinkSync(this.file);
     } catch (err) {
       const code = err?.code;
       if (code !== "ENOENT") throw err;
@@ -52818,7 +53790,7 @@ var OwnerIdentityStore = class {
 };
 
 // src/feishu-auth/login-flow.ts
-var import_node_crypto13 = __toESM(require("crypto"), 1);
+var import_node_crypto12 = __toESM(require("crypto"), 1);
 var STATE_TTL_MS = 5 * 60 * 1e3;
 var LoginFlow = class {
   constructor(deps) {
@@ -52827,7 +53799,7 @@ var LoginFlow = class {
   deps;
   pendingStates = /* @__PURE__ */ new Map();
   start() {
-    const state = import_node_crypto13.default.randomBytes(16).toString("base64url");
+    const state = import_node_crypto12.default.randomBytes(16).toString("base64url");
     const now = (this.deps.now ?? Date.now)();
     this.pendingStates.set(state, now);
     this.gcExpired(now);
@@ -52930,9 +53902,9 @@ var CentralClientError = class extends Error {
   code;
   cause;
 };
-async function centralRequest(opts, path68, init) {
+async function centralRequest(opts, path76, init) {
   const f = opts.fetchImpl ?? globalThis.fetch;
-  const url = `${opts.api.replace(/\/+$/, "")}${path68}`;
+  const url = `${opts.api.replace(/\/+$/, "")}${path76}`;
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? 15e3);
   let res;
@@ -53074,8 +54046,8 @@ function verifyConnectToken(args) {
 }
 
 // src/feishu-auth/server-key.ts
-var fs46 = __toESM(require("fs"), 1);
-var path47 = __toESM(require("path"), 1);
+var fs52 = __toESM(require("fs"), 1);
+var path53 = __toESM(require("path"), 1);
 var FILE_NAME2 = "server-signing-key.json";
 var ServerKeyStore = class {
   constructor(dataDir) {
@@ -53083,12 +54055,12 @@ var ServerKeyStore = class {
   }
   dataDir;
   filePath() {
-    return path47.join(this.dataDir, FILE_NAME2);
+    return path53.join(this.dataDir, FILE_NAME2);
   }
   /** 读缓存的公钥；无缓存 / 损坏 → null（调用方决定是否触发拉取） */
   read() {
     try {
-      const raw = fs46.readFileSync(this.filePath(), "utf8");
+      const raw = fs52.readFileSync(this.filePath(), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.publicKeyPem === "string" && parsed.publicKeyPem.includes("PUBLIC KEY")) {
         return parsed.publicKeyPem;
@@ -53103,12 +54075,12 @@ var ServerKeyStore = class {
       publicKeyPem,
       fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    fs46.mkdirSync(this.dataDir, { recursive: true });
-    fs46.writeFileSync(this.filePath(), JSON.stringify(content, null, 2), { mode: 384 });
+    fs52.mkdirSync(this.dataDir, { recursive: true });
+    fs52.writeFileSync(this.filePath(), JSON.stringify(content, null, 2), { mode: 384 });
   }
   clear() {
     try {
-      fs46.unlinkSync(this.filePath());
+      fs52.unlinkSync(this.filePath());
     } catch {
     }
   }
@@ -53121,12 +54093,12 @@ init_protocol();
 init_protocol();
 
 // src/session/fork.ts
-var import_node_fs37 = __toESM(require("fs"), 1);
+var import_node_fs43 = __toESM(require("fs"), 1);
 var import_node_os16 = __toESM(require("os"), 1);
-var import_node_path39 = __toESM(require("path"), 1);
+var import_node_path45 = __toESM(require("path"), 1);
 init_claude_history();
 function readJsonlEntries(file) {
-  const raw = import_node_fs37.default.readFileSync(file, "utf8");
+  const raw = import_node_fs43.default.readFileSync(file, "utf8");
   const out = [];
   for (const line of raw.split("\n")) {
     const t = line.trim();
@@ -53139,10 +54111,10 @@ function readJsonlEntries(file) {
   return out;
 }
 function forkSession(input) {
-  const baseDir = input.baseDir ?? import_node_path39.default.join(import_node_os16.default.homedir(), ".claude");
-  const projectDir = import_node_path39.default.join(baseDir, "projects", cwdToHashDir(input.cwd));
-  const sourceFile = import_node_path39.default.join(projectDir, `${input.toolSessionId}.jsonl`);
-  if (!import_node_fs37.default.existsSync(sourceFile)) {
+  const baseDir = input.baseDir ?? import_node_path45.default.join(import_node_os16.default.homedir(), ".claude");
+  const projectDir = import_node_path45.default.join(baseDir, "projects", cwdToHashDir(input.cwd));
+  const sourceFile = import_node_path45.default.join(projectDir, `${input.toolSessionId}.jsonl`);
+  if (!import_node_fs43.default.existsSync(sourceFile)) {
     throw new Error(`fork: source transcript not found: ${sourceFile}`);
   }
   const entries = readJsonlEntries(sourceFile);
@@ -53172,9 +54144,9 @@ function forkSession(input) {
     }
     forkedLines.push(JSON.stringify(forked));
   }
-  const forkedFilePath = import_node_path39.default.join(projectDir, `${forkedToolSessionId}.jsonl`);
-  import_node_fs37.default.mkdirSync(projectDir, { recursive: true });
-  import_node_fs37.default.writeFileSync(forkedFilePath, forkedLines.join("\n") + "\n", { mode: 384 });
+  const forkedFilePath = import_node_path45.default.join(projectDir, `${forkedToolSessionId}.jsonl`);
+  import_node_fs43.default.mkdirSync(projectDir, { recursive: true });
+  import_node_fs43.default.writeFileSync(forkedFilePath, forkedLines.join("\n") + "\n", { mode: 384 });
   return { forkedToolSessionId, forkedFilePath };
 }
 
@@ -53526,7 +54498,7 @@ function buildPermissionHandlers(deps) {
 }
 
 // src/handlers/history.ts
-var path50 = __toESM(require("path"), 1);
+var path56 = __toESM(require("path"), 1);
 init_protocol();
 
 // src/session/recent-dirs.ts
@@ -53544,7 +54516,7 @@ function listRecentDirs(store, limit = 50) {
 }
 
 // src/permission/persona-paths.ts
-var path49 = __toESM(require("path"), 1);
+var path55 = __toESM(require("path"), 1);
 function getAllowedPersonaIds(grants, action) {
   const ids = /* @__PURE__ */ new Set();
   for (const g2 of grants) {
@@ -53557,42 +54529,42 @@ function getAllowedPersonaIds(grants, action) {
   return ids;
 }
 function isGuestPathAllowed(grants, absPath, personaRoot, action = "read", userWorkDir) {
-  const target = path49.resolve(absPath);
+  const target = path55.resolve(absPath);
   if (userWorkDir) {
-    const u = path49.resolve(userWorkDir);
-    const usep = u.endsWith(path49.sep) ? "" : path49.sep;
+    const u = path55.resolve(userWorkDir);
+    const usep = u.endsWith(path55.sep) ? "" : path55.sep;
     if (target === u || target.startsWith(u + usep)) return true;
   }
-  const root = path49.resolve(personaRoot);
-  const sep3 = root.endsWith(path49.sep) ? "" : path49.sep;
+  const root = path55.resolve(personaRoot);
+  const sep3 = root.endsWith(path55.sep) ? "" : path55.sep;
   if (!target.startsWith(root + sep3)) return false;
-  const rel = path49.relative(root, target);
+  const rel = path55.relative(root, target);
   if (!rel || rel.startsWith("..")) return false;
-  const personaId = rel.split(path49.sep)[0];
+  const personaId = rel.split(path55.sep)[0];
   if (!personaId) return false;
   const allowed = getAllowedPersonaIds(grants, action);
   if (allowed === "*") return true;
   return allowed.has(personaId);
 }
 function personaIdFromPath(absPath, personaRoot) {
-  const root = path49.resolve(personaRoot);
-  const target = path49.resolve(absPath);
-  const sep3 = root.endsWith(path49.sep) ? "" : path49.sep;
+  const root = path55.resolve(personaRoot);
+  const target = path55.resolve(absPath);
+  const sep3 = root.endsWith(path55.sep) ? "" : path55.sep;
   if (!target.startsWith(root + sep3)) return null;
-  const rel = path49.relative(root, target);
+  const rel = path55.relative(root, target);
   if (!rel || rel.startsWith("..")) return null;
-  const id = rel.split(path49.sep)[0];
+  const id = rel.split(path55.sep)[0];
   return id || null;
 }
 function isPathWithin(dir, absPath) {
-  const d = path49.resolve(dir);
-  const t = path49.resolve(absPath);
-  const sep3 = d.endsWith(path49.sep) ? "" : path49.sep;
+  const d = path55.resolve(dir);
+  const t = path55.resolve(absPath);
+  const sep3 = d.endsWith(path55.sep) ? "" : path55.sep;
   return t === d || t.startsWith(d + sep3);
 }
 function isPathInGuestBoundary(personaRoot, personaId, userWorkDir, absPath) {
   if (userWorkDir && isPathWithin(userWorkDir, absPath)) return true;
-  return personaIdFromPath(path49.resolve(absPath), personaRoot) === personaId;
+  return personaIdFromPath(path55.resolve(absPath), personaRoot) === personaId;
 }
 
 // src/handlers/history.ts
@@ -53618,7 +54590,7 @@ function buildHistoryHandlers(deps) {
         if (!pid) return false;
         return isGuestPathAllowed(
           ctx.grants,
-          path50.join(personaRoot, pid),
+          path56.join(personaRoot, pid),
           personaRoot,
           "read",
           userWorkDir
@@ -53630,7 +54602,7 @@ function buildHistoryHandlers(deps) {
   };
   const list = async (frame, _client, ctx) => {
     const args = HistoryListArgs.parse(frame);
-    assertGuestPath(ctx, path50.resolve(args.projectPath), personaRoot, "history:list");
+    assertGuestPath(ctx, path56.resolve(args.projectPath), personaRoot, "history:list");
     const sessions = await history.listSessions(args);
     return { response: { type: "history:list", sessions } };
   };
@@ -53662,13 +54634,13 @@ function buildHistoryHandlers(deps) {
   };
   const subagents = async (frame, _client, ctx) => {
     const args = HistorySubagentsArgs.parse(frame);
-    assertGuestPath(ctx, path50.resolve(args.cwd), personaRoot, "history:subagents", usersRoot);
+    assertGuestPath(ctx, path56.resolve(args.cwd), personaRoot, "history:subagents", usersRoot);
     const subs = await history.listSubagents(args);
     return { response: { type: "history:subagents", subagents: subs } };
   };
   const subagentRead = async (frame, _client, ctx) => {
     const args = HistorySubagentReadArgs.parse(frame);
-    assertGuestPath(ctx, path50.resolve(args.cwd), personaRoot, "history:subagent-read", usersRoot);
+    assertGuestPath(ctx, path56.resolve(args.cwd), personaRoot, "history:subagent-read", usersRoot);
     const res = await history.readSubagent(args);
     return { response: { type: "history:subagent-read", ...res } };
   };
@@ -53677,7 +54649,7 @@ function buildHistoryHandlers(deps) {
     if (ctx?.principal.kind === "guest" && personaRoot) {
       const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
       const filtered = dirs.filter(
-        (d) => isGuestPathAllowed(ctx.grants, path50.resolve(d.cwd), personaRoot, "read", userWorkDir)
+        (d) => isGuestPathAllowed(ctx.grants, path56.resolve(d.cwd), personaRoot, "read", userWorkDir)
       );
       return { response: { type: "history:recentDirs", dirs: filtered } };
     }
@@ -53694,7 +54666,7 @@ function buildHistoryHandlers(deps) {
 }
 
 // src/handlers/workspace.ts
-var path51 = __toESM(require("path"), 1);
+var path57 = __toESM(require("path"), 1);
 var os16 = __toESM(require("os"), 1);
 init_protocol();
 init_protocol();
@@ -53736,22 +54708,22 @@ function buildWorkspaceHandlers(deps) {
     const args = WorkspaceListArgs.parse(frame);
     const isGuest = ctx?.principal.kind === "guest";
     const fallbackCwd = isGuest && personaRoot ? personaRoot : os16.homedir();
-    const resolvedCwd = path51.resolve(args.cwd ?? fallbackCwd);
-    const target = args.path ? path51.resolve(resolvedCwd, args.path) : resolvedCwd;
+    const resolvedCwd = path57.resolve(args.cwd ?? fallbackCwd);
+    const target = args.path ? path57.resolve(resolvedCwd, args.path) : resolvedCwd;
     assertGuestPath2(ctx, target, personaRoot, "workspace:list", usersRoot);
     const res = workspace.list({ ...args, cwd: resolvedCwd });
     return { response: { type: "workspace:list", ...res } };
   };
   const read = async (frame, _client, ctx) => {
     const args = WorkspaceReadArgs.parse(frame);
-    const target = path51.isAbsolute(args.path) ? path51.resolve(args.path) : path51.resolve(args.cwd, args.path);
+    const target = path57.isAbsolute(args.path) ? path57.resolve(args.path) : path57.resolve(args.cwd, args.path);
     assertGuestPath2(ctx, target, personaRoot, "workspace:read", usersRoot);
     const res = workspace.read(args);
     return { response: { type: "workspace:read", ...res } };
   };
   const skillsList = async (frame, _client, ctx) => {
     const args = SkillsListArgs.parse(frame);
-    const cwdAbs = path51.resolve(args.cwd);
+    const cwdAbs = path57.resolve(args.cwd);
     assertGuestPath2(ctx, cwdAbs, personaRoot, "skills:list", usersRoot);
     const list2 = await getSkillsForTool(args.tool ?? "claude", cwdAbs);
     if (ctx?.principal.kind === "guest" && personaRoot) {
@@ -53763,7 +54735,7 @@ function buildWorkspaceHandlers(deps) {
   };
   const agentsList = async (frame, _client, ctx) => {
     const args = AgentsListArgs.parse(frame);
-    const cwdAbs = path51.resolve(args.cwd);
+    const cwdAbs = path57.resolve(args.cwd);
     assertGuestPath2(ctx, cwdAbs, personaRoot, "agents:list", usersRoot);
     if (args.tool === "codex") {
       return { response: { type: "agents:list", agents: [] } };
@@ -53785,20 +54757,20 @@ function buildWorkspaceHandlers(deps) {
 }
 
 // src/handlers/git.ts
-var path53 = __toESM(require("path"), 1);
+var path59 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 
 // src/workspace/git.ts
-var import_node_child_process10 = require("child_process");
-var import_node_fs38 = __toESM(require("fs"), 1);
-var import_node_path40 = __toESM(require("path"), 1);
+var import_node_child_process12 = require("child_process");
+var import_node_fs44 = __toESM(require("fs"), 1);
+var import_node_path46 = __toESM(require("path"), 1);
 var import_node_util = require("util");
-var pexec = (0, import_node_util.promisify)(import_node_child_process10.execFile);
+var pexec = (0, import_node_util.promisify)(import_node_child_process12.execFile);
 function normalizePath(p2) {
-  const resolved = import_node_path40.default.resolve(p2);
+  const resolved = import_node_path46.default.resolve(p2);
   try {
-    return import_node_fs38.default.realpathSync(resolved);
+    return import_node_fs44.default.realpathSync(resolved);
   } catch {
     return resolved;
   }
@@ -53872,7 +54844,7 @@ async function listGitBranches(cwd) {
 function assertGuestCwd(ctx, cwd, personaRoot, method, usersRoot) {
   if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
   const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
-  if (!isGuestPathAllowed(ctx.grants, path53.resolve(cwd), personaRoot, "read", userWorkDir)) {
+  if (!isGuestPathAllowed(ctx.grants, path59.resolve(cwd), personaRoot, "read", userWorkDir)) {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
       `guest ${ctx.principal.id} cannot ${method} cwd ${cwd}`
@@ -53922,6 +54894,7 @@ function buildCapabilitiesHandlers(deps) {
 
 // src/handlers/capability.ts
 init_zod();
+init_src();
 init_protocol();
 var DeleteArgsSchema = external_exports.object({
   capabilityId: external_exports.string().min(1)
@@ -53960,6 +54933,7 @@ function buildCapabilityHandlers(deps) {
 }
 
 // src/handlers/inbox.ts
+init_src();
 init_protocol();
 function resolvePeerDeviceId(ctx, argsPeerDeviceId) {
   if (ctx.principal.kind === "owner") {
@@ -54138,6 +55112,7 @@ function buildInboxHandlers(deps) {
 }
 
 // src/handlers/contact.ts
+init_src();
 init_protocol();
 function ensureOwner(ctx) {
   if (!ctx || ctx.principal.kind !== "owner") {
@@ -54205,7 +55180,157 @@ function buildContactHandlers(deps) {
   };
 }
 
+// src/handlers/contact-ssh.ts
+init_src();
+init_protocol();
+
+// src/sshd/key-issue.ts
+var import_node_fs45 = __toESM(require("fs"), 1);
+var import_node_path47 = __toESM(require("path"), 1);
+var import_node_child_process13 = require("child_process");
+function safeDeviceId(deviceId) {
+  return deviceId.replace(/[\/\\]/g, "_");
+}
+async function issueContactSshKey(deviceId, sshdDir, opts = {}) {
+  const safeId = safeDeviceId(deviceId);
+  const keysDir = import_node_path47.default.join(sshdDir, "keys");
+  import_node_fs45.default.mkdirSync(keysDir, { recursive: true, mode: 448 });
+  const privPath = import_node_path47.default.join(keysDir, `${safeId}.ed25519`);
+  const pubPath = `${privPath}.pub`;
+  if (import_node_fs45.default.existsSync(privPath) && import_node_fs45.default.existsSync(pubPath)) {
+    return {
+      privateKeyPem: import_node_fs45.default.readFileSync(privPath, "utf8"),
+      publicKeyLine: import_node_fs45.default.readFileSync(pubPath, "utf8").trim()
+    };
+  }
+  const bin = opts.keygenBin ?? "/usr/bin/ssh-keygen";
+  await new Promise((resolve6, reject) => {
+    const p2 = (opts.spawnImpl ?? import_node_child_process13.spawn)(
+      bin,
+      ["-t", "ed25519", "-f", privPath, "-N", "", "-q", "-C", `clawd-contact-${safeId}`],
+      { stdio: "ignore" }
+    );
+    p2.on("exit", (code) => code === 0 ? resolve6() : reject(new Error(`ssh-keygen exit ${code}`)));
+    p2.on("error", reject);
+  });
+  try {
+    import_node_fs45.default.chmodSync(privPath, 384);
+  } catch {
+  }
+  try {
+    import_node_fs45.default.chmodSync(pubPath, 420);
+  } catch {
+  }
+  return {
+    privateKeyPem: import_node_fs45.default.readFileSync(privPath, "utf8"),
+    publicKeyLine: import_node_fs45.default.readFileSync(pubPath, "utf8").trim()
+  };
+}
+
+// src/handlers/contact-ssh.ts
+function ensureOwner2(ctx) {
+  if (!ctx || ctx.principal.kind !== "owner") {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      "UNAUTHORIZED: contact:setSshAccess requires owner ctx"
+    );
+  }
+}
+function ensureGuest(ctx) {
+  if (!ctx || ctx.principal.kind !== "guest") {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      "UNAUTHORIZED: contact:sshKey:issue requires guest ctx"
+    );
+  }
+  return ctx.principal.id;
+}
+function buildContactSshHandlers(deps) {
+  const sshLog = deps.sshLog ?? nullContactSshLog;
+  const setSshAccess = async (frame, _client, ctx) => {
+    ensureOwner2(ctx);
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = ContactSetSshAccessArgsSchema.parse(rest);
+    const hit = deps.store.setSshAccess(args.deviceId, {
+      sshAllowed: args.sshAllowed,
+      exposedDirs: args.exposedDirs
+    });
+    if (!hit) {
+      sshLog.warn("authz.setSshAccess", "owner \u5C1D\u8BD5\u6539 SSH \u6388\u6743\u4F46 contact \u4E0D\u5728 store", {
+        peerDeviceId: args.deviceId
+      });
+      throw new ClawdError(
+        ERROR_CODES.CONTACT_NOT_FOUND,
+        `CONTACT_NOT_FOUND: contact ${args.deviceId} not in store`
+      );
+    }
+    rebuildAuthorizedKeys(deps.store, deps.sshdDir);
+    sshLog.info("authz.setSshAccess", "owner \u6539\u4E86 SSH \u6388\u6743 \u2192 authorized_keys \u5DF2\u91CD\u5EFA", {
+      peerDeviceId: args.deviceId,
+      sshAllowed: args.sshAllowed,
+      exposedDirs: args.exposedDirs
+    });
+    deps.broadcast({
+      type: "contact:ssh-access-updated",
+      deviceId: args.deviceId,
+      sshAllowed: args.sshAllowed,
+      exposedDirs: args.exposedDirs
+    });
+    return {
+      response: {
+        type: "contact:setSshAccess:ok",
+        deviceId: args.deviceId,
+        sshAllowed: args.sshAllowed,
+        exposedDirs: args.exposedDirs
+      }
+    };
+  };
+  const sshKeyIssue = async (frame, _client, ctx) => {
+    const callerDeviceId = ensureGuest(ctx);
+    const { type: _t, requestId: _r, ...rest } = frame;
+    ContactSshKeyIssueArgsSchema.parse(rest);
+    const contact = deps.store.get(callerDeviceId);
+    if (!contact || !contact.sshAllowed) {
+      sshLog.info(
+        "key.issue.rejected",
+        contact ? "guest \u8BF7\u6C42 SSH key \u4F46 owner \u672A\u6388\u6743" : "guest \u8BF7\u6C42 SSH key \u4F46\u4E0D\u5728\u6211\u7684 contactStore",
+        {
+          peerDeviceId: callerDeviceId,
+          peerDisplayName: contact?.displayName
+        }
+      );
+      throw new ClawdError(
+        ERROR_CODES.UNAUTHORIZED,
+        `UNAUTHORIZED: contact ${callerDeviceId} not authorized for SSH`
+      );
+    }
+    const { privateKeyPem, publicKeyLine } = await issueContactSshKey(callerDeviceId, deps.sshdDir);
+    rebuildAuthorizedKeys(deps.store, deps.sshdDir);
+    sshLog.info(
+      "key.issue.success",
+      "A \u4FA7\u53D1 privkey \u7ED9 guest\uFF08\u5E42\u7B49\uFF09\uFF0Cauthorized_keys \u5DF2\u91CD\u5EFA",
+      {
+        peerDeviceId: callerDeviceId,
+        peerDisplayName: contact.displayName,
+        publicKeyFingerprint: publicKeyLine.slice(0, 32) + "..."
+      }
+    );
+    return {
+      response: {
+        type: "contact:sshKey:issue:ok",
+        privateKeyPem,
+        publicKeyLine
+      }
+    };
+  };
+  return {
+    "contact:setSshAccess": setSshAccess,
+    "contact:sshKey:issue": sshKeyIssue
+  };
+}
+
 // src/handlers/whoami.ts
+init_src();
 init_protocol();
 function buildWhoamiHandler(deps) {
   return async (_frame, _client, ctx) => {
@@ -54299,8 +55424,9 @@ function buildFeishuAuthHandlers(deps) {
 }
 
 // src/handlers/device.ts
+init_src();
 init_protocol();
-function ensureOwner2(ctx) {
+function ensureOwner3(ctx) {
   if (!ctx || ctx.principal.kind !== "owner") {
     throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "UNAUTHORIZED: device:* requires owner ctx");
   }
@@ -54308,14 +55434,14 @@ function ensureOwner2(ctx) {
 function buildDeviceHandlers(deps) {
   const now = deps.now ?? Date.now;
   const list = async (_frame, _client, ctx) => {
-    ensureOwner2(ctx);
+    ensureOwner3(ctx);
     const devices = await deps.listDevices();
     return {
       response: { type: "device:list:ok", devices }
     };
   };
   const connect = async (frame, _client, ctx) => {
-    ensureOwner2(ctx);
+    ensureOwner3(ctx);
     const { type: _t, requestId: _r, ...rest } = frame;
     const args = DeviceConnectArgsSchema.parse(rest);
     const exchanged = await deps.exchange(args.deviceId);
@@ -54358,7 +55484,9 @@ function buildDeviceHandlers(deps) {
         connectToken: exchanged.token,
         grants: wh.grants,
         addedAt: now(),
-        pinnedAt: null
+        pinnedAt: null,
+        sshAllowed: false,
+        exposedDirs: []
       };
       deps.store.upsert(contact);
       deps.broadcast({ type: "contact:added", contact });
@@ -54514,7 +55642,7 @@ function buildPersonaHandlers(deps) {
 }
 
 // src/handlers/attachment.ts
-var import_node_path41 = __toESM(require("path"), 1);
+var import_node_path48 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 var DEFAULT_TTL_SECONDS = 24 * 3600;
@@ -54594,12 +55722,12 @@ function buildAttachmentHandlers(deps) {
         `session ${args.sessionId} scope unresolved`
       );
     }
-    const cwdAbs = import_node_path41.default.resolve(sessionFile.cwd);
-    const candidateAbs = import_node_path41.default.isAbsolute(args.relPath) ? import_node_path41.default.resolve(args.relPath) : import_node_path41.default.resolve(cwdAbs, args.relPath);
+    const cwdAbs = import_node_path48.default.resolve(sessionFile.cwd);
+    const candidateAbs = import_node_path48.default.isAbsolute(args.relPath) ? import_node_path48.default.resolve(args.relPath) : import_node_path48.default.resolve(cwdAbs, args.relPath);
     guardAttachmentPath(ctx, args.sessionId, candidateAbs, "attachment.signUrl", "group-acl");
     const entries = deps.groupFileStore.list(scope, args.sessionId);
     const entry = entries.find((e) => {
-      const storedAbs = import_node_path41.default.isAbsolute(e.relPath) ? import_node_path41.default.resolve(e.relPath) : import_node_path41.default.resolve(cwdAbs, e.relPath);
+      const storedAbs = import_node_path48.default.isAbsolute(e.relPath) ? import_node_path48.default.resolve(e.relPath) : import_node_path48.default.resolve(cwdAbs, e.relPath);
       return storedAbs === candidateAbs && !e.stale;
     });
     if (!entry) {
@@ -54624,7 +55752,7 @@ function buildAttachmentHandlers(deps) {
     if (!ctx || ctx.principal.kind !== "guest" || !deps.personaRoot || !deps.sessionStore) return;
     const f = deps.sessionStore.read(sessionId);
     if (!f) return;
-    assertGuestAttachmentPath(ctx, import_node_path41.default.resolve(f.cwd), deps.personaRoot, method, deps.usersRoot);
+    assertGuestAttachmentPath(ctx, import_node_path48.default.resolve(f.cwd), deps.personaRoot, method, deps.usersRoot);
   }
   const groupAdd = async (frame, _client, ctx) => {
     if (!deps.groupFileStore || !deps.getSessionScope) {
@@ -54639,8 +55767,8 @@ function buildAttachmentHandlers(deps) {
     if (!scope) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, `session ${args.sessionId} not found`);
     }
-    const cwdAbs = import_node_path41.default.resolve(deps.sessionStore?.read(args.sessionId)?.cwd ?? ".");
-    const candidateAbs = import_node_path41.default.isAbsolute(args.relPath) ? import_node_path41.default.resolve(args.relPath) : import_node_path41.default.resolve(cwdAbs, args.relPath);
+    const cwdAbs = import_node_path48.default.resolve(deps.sessionStore?.read(args.sessionId)?.cwd ?? ".");
+    const candidateAbs = import_node_path48.default.isAbsolute(args.relPath) ? import_node_path48.default.resolve(args.relPath) : import_node_path48.default.resolve(cwdAbs, args.relPath);
     guardAttachmentPath(ctx, args.sessionId, candidateAbs, "attachment.groupAdd", "cwd-subtree");
     const from = ctx?.principal.kind === "owner" ? "owner" : "agent";
     const size = 0;
@@ -54699,19 +55827,20 @@ function buildAttachmentHandlers(deps) {
 
 // src/handlers/extension.ts
 var import_promises8 = __toESM(require("fs/promises"), 1);
-var import_node_path46 = __toESM(require("path"), 1);
+var import_node_path53 = __toESM(require("path"), 1);
 init_protocol();
+init_src();
 
 // src/extension/bundle-zip.ts
 var import_promises5 = __toESM(require("fs/promises"), 1);
-var import_node_path42 = __toESM(require("path"), 1);
-var import_node_crypto14 = __toESM(require("crypto"), 1);
+var import_node_path49 = __toESM(require("path"), 1);
+var import_node_crypto13 = __toESM(require("crypto"), 1);
 var import_jszip2 = __toESM(require_lib3(), 1);
 async function bundleExtensionDir(dir) {
   const entries = await listFilesSorted(dir);
   const zip = new import_jszip2.default();
   for (const rel of entries) {
-    const abs = import_node_path42.default.join(dir, rel);
+    const abs = import_node_path49.default.join(dir, rel);
     const content = await import_promises5.default.readFile(abs);
     zip.file(rel, content, { date: FIXED_DATE });
   }
@@ -54720,7 +55849,7 @@ async function bundleExtensionDir(dir) {
     compression: "DEFLATE",
     compressionOptions: { level: 6 }
   });
-  const sha256 = import_node_crypto14.default.createHash("sha256").update(buffer).digest("hex");
+  const sha256 = import_node_crypto13.default.createHash("sha256").update(buffer).digest("hex");
   return { buffer, sha256 };
 }
 var FIXED_DATE = /* @__PURE__ */ new Date("2020-01-01T00:00:00.000Z");
@@ -54732,7 +55861,7 @@ async function listFilesSorted(rootDir) {
   return out;
 }
 async function walk(absRoot, relPrefix, out) {
-  const dirAbs = import_node_path42.default.join(absRoot, relPrefix);
+  const dirAbs = import_node_path49.default.join(absRoot, relPrefix);
   const entries = await import_promises5.default.readdir(dirAbs, { withFileTypes: true });
   for (const e of entries) {
     if (IGNORE_BASENAMES.has(e.name)) continue;
@@ -54746,6 +55875,8 @@ async function walk(absRoot, relPrefix, out) {
 }
 
 // src/extension/publish-check.ts
+init_src();
+init_src();
 function computePublishCheck(args) {
   const { localHash, localVersion, head } = args;
   if (head === null) {
@@ -54786,25 +55917,27 @@ function computePublishCheck(args) {
 
 // src/extension/install-flow.ts
 var import_promises6 = __toESM(require("fs/promises"), 1);
-var import_node_path44 = __toESM(require("path"), 1);
+var import_node_path51 = __toESM(require("path"), 1);
 var import_node_os19 = __toESM(require("os"), 1);
-var import_node_crypto15 = __toESM(require("crypto"), 1);
+var import_node_crypto14 = __toESM(require("crypto"), 1);
 var import_jszip3 = __toESM(require_lib3(), 1);
+init_src();
 
 // src/extension/paths.ts
 var import_node_os18 = __toESM(require("os"), 1);
-var import_node_path43 = __toESM(require("path"), 1);
+var import_node_path50 = __toESM(require("path"), 1);
+init_src();
 function clawdHomeRoot(override) {
-  return override ?? process.env.CLAWD_HOME ?? import_node_path43.default.join(import_node_os18.default.homedir(), ".clawd");
+  return override ?? process.env.CLAWD_HOME ?? import_node_path50.default.join(import_node_os18.default.homedir(), ".clawd");
 }
 function extensionsRoot(override) {
-  return import_node_path43.default.join(clawdHomeRoot(override), "extensions");
+  return import_node_path50.default.join(clawdHomeRoot(override), "extensions");
 }
 function publishedChannelsFile(override) {
-  return import_node_path43.default.join(clawdHomeRoot(override), "extensions-published.json");
+  return import_node_path50.default.join(clawdHomeRoot(override), "extensions-published.json");
 }
 function bundleCacheRoot(override) {
-  return import_node_path43.default.join(clawdHomeRoot(override), "extension-bundles");
+  return import_node_path50.default.join(clawdHomeRoot(override), "extension-bundles");
 }
 
 // src/extension/install-flow.ts
@@ -54817,7 +55950,7 @@ var InstallError = class extends Error {
 };
 async function installFromChannel(args, deps) {
   const { channelRef, snapshotHash, bundleZip } = args;
-  const computed = import_node_crypto15.default.createHash("sha256").update(bundleZip).digest("hex");
+  const computed = import_node_crypto14.default.createHash("sha256").update(bundleZip).digest("hex");
   if (computed !== snapshotHash) {
     throw new InstallError(
       "HASH_MISMATCH",
@@ -54831,7 +55964,7 @@ async function installFromChannel(args, deps) {
     throw new InstallError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path44.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path51.default.isAbsolute(name)) {
       throw new InstallError("ZIP_INVALID", `unsafe zip entry: ${name}`);
     }
   }
@@ -54863,7 +55996,7 @@ async function installFromChannel(args, deps) {
     );
   }
   const localExtId = namespacedExtId(ownerSlug, channelRef.ownerPrincipalId);
-  const destDir = import_node_path44.default.join(deps.extensionsRoot, localExtId);
+  const destDir = import_node_path51.default.join(deps.extensionsRoot, localExtId);
   let destExists = false;
   try {
     await import_promises6.default.access(destDir);
@@ -54877,16 +56010,16 @@ async function installFromChannel(args, deps) {
     );
   }
   const stage = await import_promises6.default.mkdtemp(
-    import_node_path44.default.join(import_node_os19.default.tmpdir(), `clawd-ext-install-${localExtId}-`)
+    import_node_path51.default.join(import_node_os19.default.tmpdir(), `clawd-ext-install-${localExtId}-`)
   );
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path44.default.join(stage, name);
+      const dest = import_node_path51.default.join(stage, name);
       if (entry.dir) {
         await import_promises6.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises6.default.mkdir(import_node_path44.default.dirname(dest), { recursive: true });
+      await import_promises6.default.mkdir(import_node_path51.default.dirname(dest), { recursive: true });
       if (name === "manifest.json") {
         const rewritten = { ...parsed.data, id: localExtId };
         await import_promises6.default.writeFile(dest, JSON.stringify(rewritten, null, 2));
@@ -54907,10 +56040,11 @@ async function installFromChannel(args, deps) {
 
 // src/extension/update-flow.ts
 var import_promises7 = __toESM(require("fs/promises"), 1);
-var import_node_path45 = __toESM(require("path"), 1);
+var import_node_path52 = __toESM(require("path"), 1);
 var import_node_os20 = __toESM(require("os"), 1);
-var import_node_crypto16 = __toESM(require("crypto"), 1);
+var import_node_crypto15 = __toESM(require("crypto"), 1);
 var import_jszip4 = __toESM(require_lib3(), 1);
+init_src();
 var UpdateError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -54924,11 +56058,11 @@ async function updateFromChannel(args, deps) {
     channelRef.extId,
     channelRef.ownerPrincipalId
   );
-  const liveDir = import_node_path45.default.join(deps.extensionsRoot, localExtId);
+  const liveDir = import_node_path52.default.join(deps.extensionsRoot, localExtId);
   const prevDir = `${liveDir}.prev`;
   let existingVersion;
   try {
-    const raw = await import_promises7.default.readFile(import_node_path45.default.join(liveDir, "manifest.json"), "utf8");
+    const raw = await import_promises7.default.readFile(import_node_path52.default.join(liveDir, "manifest.json"), "utf8");
     const parsed2 = ExtensionManifestSchema.safeParse(JSON.parse(raw));
     if (!parsed2.success) {
       throw new UpdateError(
@@ -54947,7 +56081,7 @@ async function updateFromChannel(args, deps) {
     if (e instanceof UpdateError) throw e;
     throw e;
   }
-  const computed = import_node_crypto16.default.createHash("sha256").update(bundleZip).digest("hex");
+  const computed = import_node_crypto15.default.createHash("sha256").update(bundleZip).digest("hex");
   if (computed !== snapshotHash) {
     throw new UpdateError(
       "HASH_MISMATCH",
@@ -54961,7 +56095,7 @@ async function updateFromChannel(args, deps) {
     throw new UpdateError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path45.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path52.default.isAbsolute(name)) {
       throw new UpdateError("ZIP_INVALID", `unsafe zip entry: ${name}`);
     }
   }
@@ -54996,16 +56130,16 @@ async function updateFromChannel(args, deps) {
   await import_promises7.default.rm(prevDir, { recursive: true, force: true });
   await import_promises7.default.rename(liveDir, prevDir);
   const stage = await import_promises7.default.mkdtemp(
-    import_node_path45.default.join(import_node_os20.default.tmpdir(), `clawd-ext-update-${localExtId}-`)
+    import_node_path52.default.join(import_node_os20.default.tmpdir(), `clawd-ext-update-${localExtId}-`)
   );
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path45.default.join(stage, name);
+      const dest = import_node_path52.default.join(stage, name);
       if (entry.dir) {
         await import_promises7.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises7.default.mkdir(import_node_path45.default.dirname(dest), { recursive: true });
+      await import_promises7.default.mkdir(import_node_path52.default.dirname(dest), { recursive: true });
       if (name === "manifest.json") {
         const rewritten = { ...parsed.data, id: localExtId };
         await import_promises7.default.writeFile(dest, JSON.stringify(rewritten, null, 2));
@@ -55056,6 +56190,7 @@ async function rollback(deps, localExtId, liveDir, prevDir) {
 }
 
 // src/handlers/extension.ts
+init_src();
 function pickChannelRef(frame) {
   const ref = frame.channelRef;
   const parsed = ChannelRefSchema.safeParse(ref);
@@ -55098,7 +56233,7 @@ async function rewriteManifestVersion(root, extId, newVersion, previousPublished
       );
     }
   }
-  const manifestPath = import_node_path46.default.join(root, extId, "manifest.json");
+  const manifestPath = import_node_path53.default.join(root, extId, "manifest.json");
   const manifest = await readManifest(root, extId);
   const next = { ...manifest, version: newVersion };
   const tmp = `${manifestPath}.tmp`;
@@ -55106,7 +56241,7 @@ async function rewriteManifestVersion(root, extId, newVersion, previousPublished
   await import_promises8.default.rename(tmp, manifestPath);
 }
 async function readManifest(root, extId) {
-  const file = import_node_path46.default.join(root, extId, "manifest.json");
+  const file = import_node_path53.default.join(root, extId, "manifest.json");
   let raw;
   try {
     raw = await import_promises8.default.readFile(file, "utf8");
@@ -55197,7 +56332,7 @@ function buildExtensionHandlers(deps) {
   };
   async function buildSnapshotMeta(extId) {
     const manifest = await readManifest(deps.root, extId);
-    const { sha256, buffer } = await bundleExtensionDir(import_node_path46.default.join(deps.root, extId));
+    const { sha256, buffer } = await bundleExtensionDir(import_node_path53.default.join(deps.root, extId));
     return { manifest, contentHash: sha256, buffer };
   }
   const publish = async (frame, _client, ctx) => {
@@ -55378,9 +56513,9 @@ function buildExtensionHandlers(deps) {
 }
 
 // src/app-builder/project-store.ts
-var import_node_fs39 = require("fs");
-var import_node_child_process11 = require("child_process");
-var import_node_path47 = require("path");
+var import_node_fs46 = require("fs");
+var import_node_child_process14 = require("child_process");
+var import_node_path54 = require("path");
 init_protocol();
 var PROJECTS_DIR = "projects";
 var META_FILE = ".clawd-project.json";
@@ -55394,19 +56529,19 @@ var ProjectStore = class {
   root;
   /** projects/<name>/.clawd-project.json 路径 */
   metaPath(name) {
-    return (0, import_node_path47.join)(this.projectsRoot(), name, META_FILE);
+    return (0, import_node_path54.join)(this.projectsRoot(), name, META_FILE);
   }
   /** projects/<name>/ 目录路径（cwd 用） */
   projectDir(name) {
-    return (0, import_node_path47.join)(this.projectsRoot(), name);
+    return (0, import_node_path54.join)(this.projectsRoot(), name);
   }
   projectsRoot() {
-    return (0, import_node_path47.join)(this.root, PROJECTS_DIR);
+    return (0, import_node_path54.join)(this.root, PROJECTS_DIR);
   }
   async list() {
     let entries;
     try {
-      entries = await import_node_fs39.promises.readdir(this.projectsRoot());
+      entries = await import_node_fs46.promises.readdir(this.projectsRoot());
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw err;
@@ -55414,7 +56549,7 @@ var ProjectStore = class {
     const out = [];
     for (const name of entries) {
       try {
-        const raw = await import_node_fs39.promises.readFile(this.metaPath(name), "utf8");
+        const raw = await import_node_fs46.promises.readFile(this.metaPath(name), "utf8");
         const json = JSON.parse(raw);
         let migrated = false;
         if (typeof json.devCommand !== "string" || json.devCommand.length === 0) {
@@ -55425,7 +56560,7 @@ var ProjectStore = class {
         if (parsed.success) {
           out.push(parsed.data);
           if (migrated) {
-            void import_node_fs39.promises.writeFile(this.metaPath(name), JSON.stringify(parsed.data, null, 2) + "\n", "utf8").catch(() => {
+            void import_node_fs46.promises.writeFile(this.metaPath(name), JSON.stringify(parsed.data, null, 2) + "\n", "utf8").catch(() => {
             });
           }
         }
@@ -55469,8 +56604,8 @@ var ProjectStore = class {
       throw new Error(`invalid name "${name}": ${validated.error.message}`);
     }
     const dir = this.projectDir(name);
-    await import_node_fs39.promises.mkdir(dir, { recursive: true });
-    await import_node_fs39.promises.writeFile(this.metaPath(name), JSON.stringify(meta, null, 2) + "\n", "utf8");
+    await import_node_fs46.promises.mkdir(dir, { recursive: true });
+    await import_node_fs46.promises.writeFile(this.metaPath(name), JSON.stringify(meta, null, 2) + "\n", "utf8");
     return meta;
   }
   /**
@@ -55484,7 +56619,7 @@ var ProjectStore = class {
   async scaffold(name, templateSrcDir, scaffoldScriptPath) {
     const destDir = this.projectDir(name);
     return await new Promise((resolve6, reject) => {
-      const child = (0, import_node_child_process11.spawn)("bash", [scaffoldScriptPath, name, templateSrcDir, destDir], {
+      const child = (0, import_node_child_process14.spawn)("bash", [scaffoldScriptPath, name, templateSrcDir, destDir], {
         env: { ...process.env, PATH: process.env.PATH ?? "" },
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -55513,7 +56648,7 @@ var ProjectStore = class {
   }
   async delete(name) {
     const dir = this.projectDir(name);
-    await import_node_fs39.promises.rm(dir, { recursive: true, force: true });
+    await import_node_fs46.promises.rm(dir, { recursive: true, force: true });
   }
   async updatePort(name, newPort) {
     if (newPort < PROJECT_PORT_MIN || newPort > PROJECT_PORT_MAX) {
@@ -55529,7 +56664,7 @@ var ProjectStore = class {
       throw new Error(`port ${newPort} already used / \u5DF2\u88AB project "${conflict.name}" \u5360\u7528`);
     }
     const updated = { ...target, port: newPort };
-    await import_node_fs39.promises.writeFile(this.metaPath(name), JSON.stringify(updated, null, 2) + "\n", "utf8");
+    await import_node_fs46.promises.writeFile(this.metaPath(name), JSON.stringify(updated, null, 2) + "\n", "utf8");
     return updated;
   }
   /**
@@ -55546,7 +56681,7 @@ var ProjectStore = class {
     if (!validated.success) {
       throw new Error(`invalid prodUrl "${url}": ${validated.error.message}`);
     }
-    await import_node_fs39.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    await import_node_fs46.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
     return validated.data;
   }
   /**
@@ -55567,7 +56702,7 @@ var ProjectStore = class {
     if (!validated.success) {
       throw new Error(`invalid publishJob: ${validated.error.message}`);
     }
-    await import_node_fs39.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    await import_node_fs46.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
     return validated.data;
   }
   /** 清掉 .clawd-project.json.publishJob 字段。其他字段保持原样。 */
@@ -55582,13 +56717,13 @@ var ProjectStore = class {
     if (!validated.success) {
       throw new Error(`failed to clear publishJob: ${validated.error.message}`);
     }
-    await import_node_fs39.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    await import_node_fs46.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
     return validated.data;
   }
 };
 
 // src/app-builder/kill-port.ts
-var import_node_child_process12 = require("child_process");
+var import_node_child_process15 = require("child_process");
 async function killPortOccupants(port, ownedPids, logger) {
   let pids;
   try {
@@ -55630,7 +56765,7 @@ async function killPortOccupants(port, ownedPids, logger) {
 }
 function listPidsOnPort(port) {
   return new Promise((resolve6, reject) => {
-    (0, import_node_child_process12.execFile)(
+    (0, import_node_child_process15.execFile)(
       "lsof",
       ["-ti", `:${port}`],
       { timeout: 3e3 },
@@ -55652,7 +56787,7 @@ function listPidsOnPort(port) {
 }
 
 // src/app-builder/publish-registry.ts
-var import_node_crypto17 = require("crypto");
+var import_node_crypto16 = require("crypto");
 var PublishJobRegistry = class {
   jobs = /* @__PURE__ */ new Map();
   has(name) {
@@ -55669,7 +56804,7 @@ var PublishJobRegistry = class {
     if (this.jobs.has(args.name)) {
       throw new Error(`already publishing: ${args.name}`);
     }
-    const jobId = args.jobId ?? `job-${(0, import_node_crypto17.randomUUID)()}`;
+    const jobId = args.jobId ?? `job-${(0, import_node_crypto16.randomUUID)()}`;
     this.jobs.set(args.name, {
       jobId,
       name: args.name,
@@ -55702,9 +56837,9 @@ var PublishJobRegistry = class {
 };
 
 // src/app-builder/publish-job-runner.ts
-var import_node_child_process13 = require("child_process");
-var import_node_fs40 = require("fs");
-var import_node_path48 = require("path");
+var import_node_child_process16 = require("child_process");
+var import_node_fs47 = require("fs");
+var import_node_path55 = require("path");
 
 // src/app-builder/publish-stage-parser.ts
 var STAGE_RE = /^\s*::stage::(build|deploy|verify)\s*$/;
@@ -55731,19 +56866,19 @@ function tailStderrLines(buf, n) {
 // src/app-builder/publish-job-runner.ts
 async function startPublishJob(deps, args) {
   const { registry: registry2, projectDir } = deps;
-  const spawn12 = deps.spawnImpl ?? import_node_child_process13.spawn;
+  const spawn15 = deps.spawnImpl ?? import_node_child_process16.spawn;
   if (registry2.has(args.name)) {
     return { jobId: registry2.get(args.name).jobId, status: "already-publishing" };
   }
   const projDir = projectDir(args.name);
-  const logPath = (0, import_node_path48.join)(projDir, ".publish.log");
+  const logPath = (0, import_node_path55.join)(projDir, ".publish.log");
   let logStream = null;
   try {
-    logStream = (0, import_node_fs40.createWriteStream)(logPath, { flags: "w" });
+    logStream = (0, import_node_fs47.createWriteStream)(logPath, { flags: "w" });
   } catch {
     logStream = null;
   }
-  const child = spawn12("bash", [args.scriptPath, projDir, args.personaRoot ?? ""], {
+  const child = spawn15("bash", [args.scriptPath, projDir, args.personaRoot ?? ""], {
     cwd: projDir,
     env: process.env,
     stdio: ["ignore", "pipe", "pipe"]
@@ -55996,8 +57131,8 @@ async function recoverInterruptedJobs(deps) {
 
 // src/handlers/app-builder.ts
 init_protocol();
-var import_node_path49 = require("path");
-var import_node_fs41 = require("fs");
+var import_node_path56 = require("path");
+var import_node_fs48 = require("fs");
 var APP_BUILDER_PERSONAS = ["persona-app-builder", "persona-dataclaw-builder"];
 var DEV_SERVER_READY_TIMEOUT_MS = 3e4;
 async function recoverInterruptedPublishJobs(store, logger) {
@@ -56078,7 +57213,7 @@ function buildAppBuilderHandlers(deps) {
   async function listAllUsersProjects() {
     if (!deps.usersRoot || !deps.getStore) return [];
     const getStore = deps.getStore;
-    const userIds = await import_node_fs41.promises.readdir(deps.usersRoot).catch(() => []);
+    const userIds = await import_node_fs48.promises.readdir(deps.usersRoot).catch(() => []);
     const perUser = await Promise.all(
       userIds.map((uid) => getStore(uid).list().catch(() => []))
     );
@@ -56154,8 +57289,8 @@ function buildAppBuilderHandlers(deps) {
     const project = await userStore.create(f.name, reservedPorts);
     try {
       const personaRoot = deps.resolvePersonaRoot ? deps.resolvePersonaRoot(session.ownerPersonaId ?? "") : deps.personaRoot;
-      const templateSrcDir = (0, import_node_path49.join)(personaRoot, "extension-kit", "examples", DEFAULT_TEMPLATE);
-      const scaffoldScript = (0, import_node_path49.join)(deps.deployKitRoot, "scripts", "new-extension.sh");
+      const templateSrcDir = (0, import_node_path56.join)(personaRoot, "extension-kit", "examples", DEFAULT_TEMPLATE);
+      const scaffoldScript = (0, import_node_path56.join)(deps.deployKitRoot, "scripts", "new-extension.sh");
       const scaffoldResult = await userStore.scaffold(project.name, templateSrcDir, scaffoldScript);
       deps.logger?.info("app-builder.scaffold.done", {
         name: project.name,
@@ -56376,7 +57511,7 @@ function buildAppBuilderHandlers(deps) {
       await userStore.clearPublishJob(args.name);
     }
     const personaRoot = deps.resolvePersonaRoot ? deps.resolvePersonaRoot(boundSession.ownerPersonaId ?? "") : deps.personaRoot;
-    const scriptPath = (0, import_node_path49.join)(deps.deployKitRoot, "scripts", "publish.sh");
+    const scriptPath = (0, import_node_path56.join)(deps.deployKitRoot, "scripts", "publish.sh");
     deps.logger?.info("app-builder.publish.start", {
       name: args.name,
       sessionId: boundSession.sessionId,
@@ -56520,7 +57655,7 @@ function buildShiftHandlers(deps) {
 
 // src/handlers/visitor.ts
 init_protocol();
-function ensureOwner3(ctx) {
+function ensureOwner4(ctx) {
   if (!ctx || ctx.principal.kind !== "owner") {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
@@ -56530,7 +57665,7 @@ function ensureOwner3(ctx) {
 }
 function buildVisitorHandlers(deps) {
   const list = async (_frame, _client, ctx) => {
-    ensureOwner3(ctx);
+    ensureOwner4(ctx);
     return {
       response: {
         type: "visitor:list",
@@ -56545,7 +57680,8 @@ function buildVisitorHandlers(deps) {
 
 // src/extension/registry.ts
 var import_promises9 = __toESM(require("fs/promises"), 1);
-var import_node_path50 = __toESM(require("path"), 1);
+var import_node_path57 = __toESM(require("path"), 1);
+init_src();
 async function loadAll(root) {
   let entries;
   try {
@@ -56558,13 +57694,13 @@ async function loadAll(root) {
   for (const ent of entries) {
     if (!ent.isDirectory()) continue;
     if (ent.name.startsWith(".")) continue;
-    records.push(await loadOne(import_node_path50.default.join(root, ent.name), ent.name));
+    records.push(await loadOne(import_node_path57.default.join(root, ent.name), ent.name));
   }
   records.sort((a, b2) => a.extId < b2.extId ? -1 : a.extId > b2.extId ? 1 : 0);
   return records;
 }
 async function loadOne(dir, dirName) {
-  const manifestPath = import_node_path50.default.join(dir, "manifest.json");
+  const manifestPath = import_node_path57.default.join(dir, "manifest.json");
   let raw;
   try {
     raw = await import_promises9.default.readFile(manifestPath, "utf8");
@@ -56609,7 +57745,7 @@ async function loadOne(dir, dirName) {
 
 // src/extension/uninstall.ts
 var import_promises10 = __toESM(require("fs/promises"), 1);
-var import_node_path51 = __toESM(require("path"), 1);
+var import_node_path58 = __toESM(require("path"), 1);
 var UninstallError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -56618,7 +57754,7 @@ var UninstallError = class extends Error {
   code;
 };
 async function uninstall(deps) {
-  const dir = import_node_path51.default.join(deps.root, deps.extId);
+  const dir = import_node_path58.default.join(deps.root, deps.extId);
   try {
     await import_promises10.default.access(dir);
   } catch {
@@ -56629,7 +57765,8 @@ async function uninstall(deps) {
 }
 
 // src/handlers/index.ts
-var import_node_crypto18 = require("crypto");
+var import_node_crypto17 = require("crypto");
+init_peer_forward();
 function buildMethodHandlers(deps) {
   return {
     ...buildSessionHandlers({
@@ -56662,7 +57799,7 @@ function buildMethodHandlers(deps) {
           const c = deps.contactStore.get(deviceId);
           return c ? { deviceId: c.deviceId, remoteUrl: c.remoteUrl, connectToken: c.connectToken } : null;
         },
-        genId: () => (0, import_node_crypto18.randomUUID)(),
+        genId: () => (0, import_node_crypto17.randomUUID)(),
         now: () => Date.now(),
         forwardInboxPostToPeer,
         logger: deps.logger
@@ -56673,6 +57810,12 @@ function buildMethodHandlers(deps) {
       broadcast: deps.broadcastToOwners,
       now: () => Date.now()
     }),
+    ...buildContactSshHandlers({
+      store: deps.contactStore,
+      broadcast: deps.broadcastToOwners,
+      sshdDir: deps.sshdDir,
+      sshLog: deps.contactSshLog
+    }),
     whoami: buildWhoamiHandler({
       ownerDisplayName: deps.ownerDisplayName,
       ownerPrincipalId: deps.ownerPrincipalId,
@@ -56719,7 +57862,7 @@ function buildMethodHandlers(deps) {
 }
 
 // src/app-builder/dev-server-supervisor.ts
-var import_node_child_process14 = require("child_process");
+var import_node_child_process17 = require("child_process");
 var import_node_events2 = require("events");
 var DEFAULT_READY_PATTERN = /Local:\s+https?:\/\/|Nest application successfully started|server listening on/i;
 var DevServerSupervisor = class extends import_node_events2.EventEmitter {
@@ -56756,7 +57899,7 @@ var DevServerSupervisor = class extends import_node_events2.EventEmitter {
       tunnelHost: args.tunnelHost,
       devCommand: cmd
     });
-    const child = (0, import_node_child_process14.spawn)("sh", ["-c", cmd], {
+    const child = (0, import_node_child_process17.spawn)("sh", ["-c", cmd], {
       cwd: args.cwd,
       env,
       stdio: "pipe",
@@ -57008,6 +58151,12 @@ var METHOD_GRANT_MAP = {
   "contact:list": ADMIN_ANY,
   "contact:pin": ADMIN_ANY,
   "contact:remove": ADMIN_ANY,
+  // contact:setSshAccess (owner UI 配 SSH 授权)：ADMIN_ANY
+  // contact:sshKey:issue (guest daemon 拉自己的 privkey)：public — handler 内校
+  // ctx.principal.kind==='guest' + store.get(callerId).sshAllowed
+  //   (对齐 inbox:postMessage 的"能连上=有 auth，业务在 handler 校"模式)
+  "contact:setSshAccess": ADMIN_ANY,
+  "contact:sshKey:issue": { kind: "public" },
   // ---- visitor:* (访客名单，owner-only) ----
   // owner 看完整访客名单（含没开会话的）；guest 不可调（handler 内再 assertOwner 兜底）。
   "visitor:list": ADMIN_ANY,
@@ -57188,12 +58337,13 @@ async function dispatchRpc(method, frame, client, ctx, deps) {
 }
 
 // src/extension/runtime.ts
-var import_node_child_process15 = require("child_process");
-var import_node_path52 = __toESM(require("path"), 1);
+var import_node_child_process18 = require("child_process");
+var import_node_path59 = __toESM(require("path"), 1);
 var import_promises11 = require("timers/promises");
+init_src();
 
 // src/extension/port-allocator.ts
-var import_node_net2 = __toESM(require("net"), 1);
+var import_node_net3 = __toESM(require("net"), 1);
 var PortExhaustedError = class extends Error {
   constructor(min, max) {
     super(`no free port in [${min},${max}]`);
@@ -57206,7 +58356,7 @@ var PortExhaustedError = class extends Error {
 };
 function probe(port) {
   return new Promise((resolve6) => {
-    const srv = import_node_net2.default.createServer();
+    const srv = import_node_net3.default.createServer();
     srv.once("error", () => resolve6(false));
     srv.once("listening", () => {
       srv.close(() => resolve6(true));
@@ -57290,13 +58440,13 @@ var Runtime = class {
       /\$CLAWOS_EXT_PORT/g,
       String(port)
     );
-    const dir = import_node_path52.default.join(this.root, extId);
+    const dir = import_node_path59.default.join(this.root, extId);
     const env = {
       ...process.env,
       CLAWOS_EXT_PORT: String(port),
       CLAWOS_EXT_ID: extId
     };
-    const child = (0, import_node_child_process15.spawn)("sh", ["-c", cmd], {
+    const child = (0, import_node_child_process18.spawn)("sh", ["-c", cmd], {
       cwd: dir,
       env,
       stdio: ["ignore", "pipe", "pipe"],
@@ -57402,7 +58552,8 @@ ${handle.stderrTail}`
 
 // src/extension/published-channels.ts
 var import_promises12 = __toESM(require("fs/promises"), 1);
-var import_node_path53 = __toESM(require("path"), 1);
+var import_node_path60 = __toESM(require("path"), 1);
+init_src();
 init_zod();
 var PublishedChannelsError = class extends Error {
   constructor(code, message) {
@@ -57501,7 +58652,7 @@ var PublishedChannelStore = class {
       )
     };
     const tmp = `${this.filePath}.tmp`;
-    await import_promises12.default.mkdir(import_node_path53.default.dirname(this.filePath), { recursive: true });
+    await import_promises12.default.mkdir(import_node_path60.default.dirname(this.filePath), { recursive: true });
     await import_promises12.default.writeFile(tmp, JSON.stringify(data, null, 2), { mode: 384 });
     await import_promises12.default.rename(tmp, this.filePath);
   }
@@ -57509,7 +58660,7 @@ var PublishedChannelStore = class {
 
 // src/extension/bundle-cache.ts
 var import_promises13 = __toESM(require("fs/promises"), 1);
-var import_node_path54 = __toESM(require("path"), 1);
+var import_node_path61 = __toESM(require("path"), 1);
 var BundleCache = class {
   constructor(rootDir) {
     this.rootDir = rootDir;
@@ -57518,14 +58669,14 @@ var BundleCache = class {
   /** Atomic write: stage tmp → rename. Caller passes the hex sha256. */
   async write(snapshotHash, buffer) {
     await import_promises13.default.mkdir(this.rootDir, { recursive: true });
-    const file = import_node_path54.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path61.default.join(this.rootDir, `${snapshotHash}.zip`);
     const tmp = `${file}.tmp`;
     await import_promises13.default.writeFile(tmp, buffer, { mode: 384 });
     await import_promises13.default.rename(tmp, file);
   }
   /** Returns the bundle bytes, or null when the file doesn't exist. */
   async read(snapshotHash) {
-    const file = import_node_path54.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path61.default.join(this.rootDir, `${snapshotHash}.zip`);
     try {
       return await import_promises13.default.readFile(file);
     } catch (e) {
@@ -57535,7 +58686,7 @@ var BundleCache = class {
   }
   /** Idempotent — missing file is not an error. */
   async delete(snapshotHash) {
-    const file = import_node_path54.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path61.default.join(this.rootDir, `${snapshotHash}.zip`);
     await import_promises13.default.rm(file, { force: true });
   }
 };
@@ -57560,17 +58711,10 @@ async function startDaemon(config) {
   });
   const logger = createLogger({
     level: config.logLevel,
-    file: import_node_path55.default.join(config.dataDir, "clawd.log"),
+    file: import_node_path62.default.join(config.dataDir, "clawd.log"),
     logClient
   });
   logger.info("starting clawd", { version, config: { port: config.port, host: config.host, dataDir: config.dataDir } });
-  const screenIdleProbeLogger = createFileOnlyLogger({
-    file: import_node_path55.default.join(config.dataDir, "screen-idle-probe.log"),
-    level: "debug"
-  });
-  logger.info("screen-idle probe logger enabled", {
-    file: import_node_path55.default.join(config.dataDir, "screen-idle-probe.log")
-  });
   const stateMgr = new StateFileManager({ dataDir: config.dataDir });
   const pre = stateMgr.preflight();
   if (pre.status === "active") {
@@ -57707,8 +58851,8 @@ async function startDaemon(config) {
   const agents = new AgentsScanner();
   const history = new ClaudeHistoryReader();
   let transport = null;
-  const personaStore = new PersonaStore(import_node_path55.default.join(config.dataDir, "personas"));
-  const usersRoot = import_node_path55.default.join(config.dataDir, "users");
+  const personaStore = new PersonaStore(import_node_path62.default.join(config.dataDir, "personas"));
+  const usersRoot = import_node_path62.default.join(config.dataDir, "users");
   const defaultsRoot = findDefaultsRoot(logger);
   if (defaultsRoot) {
     seedDefaultPersonas({ store: personaStore, defaultsRoot, logger });
@@ -57728,17 +58872,17 @@ async function startDaemon(config) {
   migrateCodexSandbox({ store: personaStore, logger });
   const groupFileStore = new GroupFileStore({ dataDir: config.dataDir, logger });
   const personaDispatchManager = new PersonaDispatchManager({ genId: () => v4_default() });
-  const here = typeof __dirname === "string" ? __dirname : import_node_path55.default.dirname((0, import_node_url4.fileURLToPath)(import_meta6.url));
+  const here = typeof __dirname === "string" ? __dirname : import_node_path62.default.dirname((0, import_node_url4.fileURLToPath)(import_meta6.url));
   const dispatchServerCandidates = [
-    import_node_path55.default.join(here, "dispatch", "mcp-server.cjs"),
+    import_node_path62.default.join(here, "dispatch", "mcp-server.cjs"),
     // 生产 dist/index → dist/dispatch/mcp-server.cjs
-    import_node_path55.default.join(here, "..", "dist", "dispatch", "mcp-server.cjs")
+    import_node_path62.default.join(here, "..", "dist", "dispatch", "mcp-server.cjs")
     // dev tsx src/index → ../dist/dispatch/mcp-server.cjs
   ];
-  const dispatchServerScriptPath = dispatchServerCandidates.find((p2) => import_node_fs42.default.existsSync(p2));
+  const dispatchServerScriptPath = dispatchServerCandidates.find((p2) => import_node_fs49.default.existsSync(p2));
   let dispatchMcpConfigPath2;
   if (dispatchServerScriptPath) {
-    const dispatchLogPath = import_node_path55.default.join(config.dataDir, "dispatch-mcp-server.log");
+    const dispatchLogPath = import_node_path62.default.join(config.dataDir, "dispatch-mcp-server.log");
     dispatchMcpConfigPath2 = writeDispatchMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: dispatchServerScriptPath,
@@ -57755,15 +58899,15 @@ async function startDaemon(config) {
     });
   }
   const ticketServerCandidates = [
-    import_node_path55.default.join(here, "ticket", "mcp-server.cjs"),
-    import_node_path55.default.join(here, "..", "dist", "ticket", "mcp-server.cjs")
+    import_node_path62.default.join(here, "ticket", "mcp-server.cjs"),
+    import_node_path62.default.join(here, "..", "dist", "ticket", "mcp-server.cjs")
   ];
-  const ticketServerScriptPath = ticketServerCandidates.find((p2) => import_node_fs42.default.existsSync(p2));
+  const ticketServerScriptPath = ticketServerCandidates.find((p2) => import_node_fs49.default.existsSync(p2));
   const ticketOwnerUnionId = feishuIdentity?.identity.unionId ?? "";
   const ticketOwnerName = feishuIdentity?.identity.displayName ?? "";
   let ticketMcpConfigPath2;
   if (ticketServerScriptPath && ticketOwnerUnionId) {
-    const ticketLogPath = import_node_path55.default.join(config.dataDir, "ticket-mcp-server.log");
+    const ticketLogPath = import_node_path62.default.join(config.dataDir, "ticket-mcp-server.log");
     ticketMcpConfigPath2 = writeTicketMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: ticketServerScriptPath,
@@ -57784,13 +58928,13 @@ async function startDaemon(config) {
     });
   }
   const shiftServerCandidates = [
-    import_node_path55.default.join(here, "shift", "mcp-server.cjs"),
-    import_node_path55.default.join(here, "..", "dist", "shift", "mcp-server.cjs")
+    import_node_path62.default.join(here, "shift", "mcp-server.cjs"),
+    import_node_path62.default.join(here, "..", "dist", "shift", "mcp-server.cjs")
   ];
-  const shiftServerScriptPath = shiftServerCandidates.find((p2) => import_node_fs42.default.existsSync(p2));
+  const shiftServerScriptPath = shiftServerCandidates.find((p2) => import_node_fs49.default.existsSync(p2));
   let shiftMcpConfigPath2;
   if (shiftServerScriptPath) {
-    const shiftLogPath = import_node_path55.default.join(config.dataDir, "shift-mcp-server.log");
+    const shiftLogPath = import_node_path62.default.join(config.dataDir, "shift-mcp-server.log");
     shiftMcpConfigPath2 = await writeShiftMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: shiftServerScriptPath,
@@ -57808,13 +58952,13 @@ async function startDaemon(config) {
     );
   }
   const inboxServerCandidates = [
-    import_node_path55.default.join(here, "inbox", "mcp-server.cjs"),
-    import_node_path55.default.join(here, "..", "dist", "inbox", "mcp-server.cjs")
+    import_node_path62.default.join(here, "inbox", "mcp-server.cjs"),
+    import_node_path62.default.join(here, "..", "dist", "inbox", "mcp-server.cjs")
   ];
-  const inboxServerScriptPath = inboxServerCandidates.find((p2) => import_node_fs42.default.existsSync(p2));
+  const inboxServerScriptPath = inboxServerCandidates.find((p2) => import_node_fs49.default.existsSync(p2));
   let inboxMcpConfigPath2;
   if (inboxServerScriptPath) {
-    const inboxLogPath = import_node_path55.default.join(config.dataDir, "inbox-mcp-server.log");
+    const inboxLogPath = import_node_path62.default.join(config.dataDir, "inbox-mcp-server.log");
     inboxMcpConfigPath2 = await writeInboxMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: inboxServerScriptPath,
@@ -57832,7 +58976,7 @@ async function startDaemon(config) {
     );
   }
   const shiftStore = createShiftStore({
-    filePath: import_node_path55.default.join(config.dataDir, "shift.json"),
+    filePath: import_node_path62.default.join(config.dataDir, "shift.json"),
     ownerIdProvider: () => ownerPrincipalId,
     now: () => Date.now()
   });
@@ -57847,14 +58991,10 @@ async function startDaemon(config) {
     // 新布局派生 (sessions/* + personas/<pid>/.clawd/sessions/owner/*)
     storeFactory: sessionStoreFactory,
     logger,
-    // 取证 probe（可选，CLAWD_SCREEN_IDLE_PROBE=1 时启用）：manager turn_end 判定链
-    // 的所有决策点打到独立文件，跟 adapter 的 observeScreenIdle probe 共用同一份 file logger，
-    // 便于 grep sessionId 时 tui 层 + manager 层交叉时序都在同一文件里
-    ...screenIdleProbeLogger ? { screenIdleProbeLogger } : {},
     getAdapter,
     historyReader: history,
     dataDir: config.dataDir,
-    personaRoot: import_node_path55.default.join(config.dataDir, "personas"),
+    personaRoot: import_node_path62.default.join(config.dataDir, "personas"),
     usersRoot,
     personaStore,
     ownerDisplayName,
@@ -57897,10 +59037,10 @@ async function startDaemon(config) {
     // 文件可能 agent 写完又被自己删（罕见），用 size=0 / fallback mime 兜底。
     attachmentGroup: {
       onFileEdit: (input) => {
-        const absPath = import_node_path55.default.isAbsolute(input.relPath) ? input.relPath : import_node_path55.default.join(input.cwd, input.relPath);
+        const absPath = import_node_path62.default.isAbsolute(input.relPath) ? input.relPath : import_node_path62.default.join(input.cwd, input.relPath);
         let size = 0;
         try {
-          size = import_node_fs42.default.statSync(absPath).size;
+          size = import_node_fs49.default.statSync(absPath).size;
         } catch (err) {
           logger.warn("attachment.onFileEdit stat failed", {
             sessionId: input.sessionId,
@@ -57968,10 +59108,10 @@ async function startDaemon(config) {
     onSurfaceUnregister: (tsid) => manager.unregisterSurface(tsid),
     // ReadyGate v2：ReadyDetector emit ready 时投递 reducer 'ready-detected' input
     onReady: (tsid) => manager.dispatchReadyDetected(tsid),
-    // 屏幕真稳定 5s 的一次性信号 → manager 查 pending turn_duration 并 flush 成 turn_end
-    onScreenIdle: (tsid) => manager.notifyScreenIdle(tsid),
-    // 取证 probe（默认无条件启用；见 createFileOnlyLogger）
-    screenIdleProbeLogger
+    // 屏幕静止 → 补权威 turn_end（修 turn_duration 尾随 text 覆盖 lastEventKind）
+    onTurnIdle: (tsid) => manager.dispatchTurnIdle(tsid),
+    // 复合条件闸：observer 还需静止多久才满 idleMs（屏幕静止后精确等这段剩余再补 turn_end）
+    getObserverWaitMs: (tsid, idleMs) => manager.observerIdleWaitMs(tsid, idleMs)
   }) : new ClaudeAdapter({ logger, historyReader: new ClaudeHistoryReader() });
   registerAdapter("claude", claudeAdapter);
   registerAdapter("codex", new CodexAdapter({ logger, historyReader: new CodexHistoryReader() }));
@@ -58055,6 +59195,7 @@ async function startDaemon(config) {
   const effectivePreviewPorts = Array.from(
     /* @__PURE__ */ new Set([...config.previewPorts ?? [], ...appBuilderPortRange])
   );
+  const sshLog = createContactSshLog(config.dataDir);
   const makeHandlers = () => buildMethodHandlers({
     manager,
     workspace,
@@ -58098,11 +59239,11 @@ async function startDaemon(config) {
       // 'persona/<pid>/owner'，default 走 'default'。
       getSessionScope: (sid) => manager.findOwnedSessionScope(sid),
       // guest path guard：candidate 必须在 personaRoot 子树或调用者自己的 user-dir 下
-      personaRoot: import_node_path55.default.join(config.dataDir, "personas"),
+      personaRoot: import_node_path62.default.join(config.dataDir, "personas"),
       usersRoot
     },
     // workspace/git/history/skills/agents handler 共用的 guest path guard 锚点
-    personaRoot: import_node_path55.default.join(config.dataDir, "personas"),
+    personaRoot: import_node_path62.default.join(config.dataDir, "personas"),
     // v2 多人 persona 隔离：handler 派生 guest user-dir 放行
     usersRoot,
     // capability:list / delete handler 依赖
@@ -58122,6 +59263,10 @@ async function startDaemon(config) {
     inboxStore,
     // 联系人列表 store（device:connect / 自动反向落同一 store）
     contactStore,
+    // <dataDir>/sshd 绝对路径 —— contact-ssh handlers 用它拼 authorized_keys / keys/ 子路径
+    // Task 10 会加 SshdManager 起 sshd；handlers wire 提前挂 sshdDir 让 typecheck 过
+    sshdDir: import_node_path62.default.join(config.dataDir, "sshd"),
+    contactSshLog: sshLog,
     // inbox:sendDm 用：sessionId → session 出身（复用 attachment 同款 findOwnedSessionScope）
     getSessionScope: (sid) => manager.findOwnedSessionScope(sid),
     // contact:removed broadcast；复用 capability:tokenIssued 同款通路
@@ -58211,11 +59356,11 @@ async function startDaemon(config) {
     // 发布上线脚手架化 (spec 2026-06-03 §5.2):
     // appBuilderPersonaRoot 用于拼 publish.sh 绝对路径（persona-app-builder 安装在
     // dataDir/personas/persona-app-builder 之下，extension-kit/scripts/publish.sh 是相对路径）。
-    appBuilderPersonaRoot: import_node_path55.default.join(config.dataDir, "personas", "persona-app-builder"),
+    appBuilderPersonaRoot: import_node_path62.default.join(config.dataDir, "personas", "persona-app-builder"),
     // 共享 deploy-kit 根：scaffold/publish 脚本骨架 + 阿里云凭证单一真源。
-    deployKitRoot: import_node_path55.default.join(config.dataDir, "deploy-kit"),
+    deployKitRoot: import_node_path62.default.join(config.dataDir, "deploy-kit"),
     // scaffold/publish 按当前 session 的 persona 解析其安装根，让每个 persona 用自己的模板/注入配置。
-    resolvePersonaRoot: (personaId) => import_node_path55.default.join(config.dataDir, "personas", personaId),
+    resolvePersonaRoot: (personaId) => import_node_path62.default.join(config.dataDir, "personas", personaId),
     // 发布上线脚手架化 (spec 2026-06-03 §5.2.2):
     // 复用 SessionManagerDeps.broadcastFrame 同款 dispatch 逻辑 —— runner 调 manager.send
     // 取回 broadcast 帧后逐帧 push 到 transport，跟 manager 自身的 deps 一致。
@@ -58258,7 +59403,7 @@ async function startDaemon(config) {
       }
       let sourceJsonlPath = "(no transcript yet \u2014 operate from the task description alone)";
       if (sourceFile && sourceFile.toolSessionId) {
-        sourceJsonlPath = import_node_path55.default.join(
+        sourceJsonlPath = import_node_path62.default.join(
           import_node_os21.default.homedir(),
           ".claude",
           "projects",
@@ -58447,6 +59592,36 @@ async function startDaemon(config) {
     httpRequestHandler: httpRouter,
     // app-builder build 模式：/preview/<port>/ HMR websocket upgrade 转发的端口白名单（同 http-router 配置）
     previewPorts: effectivePreviewPorts,
+    // Contact SSH tunnel (PR: contact-ssh-tunnel): /rpc/ssh-tunnel WS 前置拦截 →
+    // Bearer auth (owner token / connect token / capability token 三选一) → net.connect 到本机 sshd →
+    // raw byte relay. 用于 B 侧 `clawd ssh-relay` CLI 拨号（SSH ProxyCommand）
+    sshTunnelUpgradeHandler: async (req, socket, head, wss2) => {
+      await handleSshTunnelUpgrade(req, socket, head, {
+        wss: wss2,
+        sshdPort: config.sshdPort,
+        logger,
+        sshLog,
+        authorize: async (token) => {
+          if (!token) return false;
+          if (resolvedAuthToken && token === resolvedAuthToken) return true;
+          const cap = capabilityRegistry.verifyToken(token);
+          if (cap.ok) return true;
+          const vis = verifyVisitorToken(authFile.visitorTokenSecret, token, Math.floor(Date.now() / 1e3));
+          if (vis.ok) return true;
+          const publicKeyPem = serverKeyStore.read();
+          if (publicKeyPem) {
+            const r = verifyConnectToken({
+              token,
+              publicKeyPem,
+              expectedDeviceId: authFile.deviceId
+            });
+            if (r.ok) return true;
+          }
+          return false;
+        }
+      });
+      return true;
+    },
     // 订阅成功后给该 client 重放 in-flight pendingQuestions（plan: clawd-question-server-truth）。
     // daemon 是 pendingQuestions 的唯一 source of truth；新 client 接入 / 刷新页面时
     // 把当前所有未决 question 以 session:question 帧定向回放，让 UI 不再误显示 Ended。
@@ -58558,8 +59733,8 @@ async function startDaemon(config) {
       const lines = [
         `Tunnel:      ${r.url}`,
         ...resolvedAuthToken ? [`Connect:     ${connectUrl}`] : [],
-        `Frpc config: ${import_node_path55.default.join(config.dataDir, "frpc.toml")}`,
-        `Frpc log:    ${import_node_path55.default.join(config.dataDir, "frpc.log")}`
+        `Frpc config: ${import_node_path62.default.join(config.dataDir, "frpc.toml")}`,
+        `Frpc log:    ${import_node_path62.default.join(config.dataDir, "frpc.log")}`
       ];
       const width = Math.max(...lines.map((l) => l.length));
       const bar = "\u2550".repeat(width + 4);
@@ -58572,8 +59747,8 @@ ${bar}
 
 `);
       try {
-        const connectPath = import_node_path55.default.join(config.dataDir, "connect.txt");
-        import_node_fs42.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
+        const connectPath = import_node_path62.default.join(config.dataDir, "connect.txt");
+        import_node_fs49.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
       } catch {
       }
     } catch (err) {
@@ -58598,6 +59773,30 @@ ${bar}
       logger.warn("tunnel unavailable, degraded to local mode", { reason: tunnelError });
     }
   }
+  const sshdMgr = new SshdManager({
+    dataDir: config.dataDir,
+    port: config.sshdPort,
+    logger,
+    installProcessExitHandlers: true,
+    onSshdExit: (info) => logger.warn("sshd exited unexpectedly", info)
+  });
+  try {
+    await sshdMgr.start();
+    rebuildAuthorizedKeys(contactStore, import_node_path62.default.join(config.dataDir, "sshd"));
+    logger.info("sshd: contact-ssh sandbox ready", { port: config.sshdPort });
+  } catch (err) {
+    logger.warn("sshd start failed; contact SSH grant will not work until fixed", {
+      err: err.message
+    });
+  }
+  const contactKeyPuller = new ContactKeyPuller({
+    store: contactStore,
+    dataDir: config.dataDir,
+    logger,
+    intervalMs: 6e4,
+    sshLog
+  });
+  void contactKeyPuller.start();
   void reportDevice();
   void fetchServerKey();
   const tickAttachmentGc = () => {
@@ -58632,6 +59831,12 @@ ${bar}
     if (tunnelMgr) {
       await tunnelMgr.stop();
     }
+    contactKeyPuller.stop();
+    await sshdMgr.stop().catch((err) => {
+      logger.warn("shutdown.sshd-stop-failed", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    });
     await wss.stop();
     stateMgr.delete();
     if (logClient) await logClient.dispose();
@@ -58645,9 +59850,9 @@ ${bar}
   };
 }
 function migrateDropPersonsDir(dataDir) {
-  const dir = import_node_path55.default.join(dataDir, "persons");
+  const dir = import_node_path62.default.join(dataDir, "persons");
   try {
-    import_node_fs42.default.rmSync(dir, { recursive: true, force: true });
+    import_node_fs49.default.rmSync(dir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -58660,6 +59865,11 @@ async function main() {
     const code = await runCase2(argv.slice(1));
     process.exit(code);
   }
+  if (argv[0] === "ssh-relay") {
+    const { sshRelay: sshRelay2 } = await Promise.resolve().then(() => (init_sshd_cli_relay(), sshd_cli_relay_exports));
+    const code = await sshRelay2(argv.slice(1));
+    process.exit(code);
+  }
   const parsed = parseArgs(argv);
   if (parsed.help) {
     process.stdout.write(HELP_TEXT);