@clawos-dev/clawd 0.2.231 → 0.2.233

package/dist/cli.cjs

@@ -5556,11 +5556,12 @@ var init_schemas = __esm({
 });
 
 // ../protocol/src/frames.ts
-var PROTOCOL_VERSION;
+var PROTOCOL_VERSION, DISPATCH_MCP_ID;
 var init_frames = __esm({
   "../protocol/src/frames.ts"() {
     "use strict";
     PROTOCOL_VERSION = 1;
+    DISPATCH_MCP_ID = "dispatch";
   }
 });
 
@@ -12148,17 +12149,8 @@ function buildSpawnArgs(ctx) {
   if (ctx.addDirs) {
     for (const dir of ctx.addDirs) args.push("--add-dir", dir);
   }
-  if (ctx.dispatchMcpConfigPath) {
-    args.push("--mcp-config", ctx.dispatchMcpConfigPath);
-  }
-  if (ctx.ticketMcpConfigPath) {
-    args.push("--mcp-config", ctx.ticketMcpConfigPath);
-  }
-  if (ctx.shiftMcpConfigPath) {
-    args.push("--mcp-config", ctx.shiftMcpConfigPath);
-  }
-  if (ctx.inboxMcpConfigPath) {
-    args.push("--mcp-config", ctx.inboxMcpConfigPath);
+  for (const mcp of ctx.mcpConfigs ?? []) {
+    args.push("--mcp-config", mcp.path);
   }
   args.push("--disallowed-tools", "CronCreate,CronDelete,CronList,ScheduleWakeup,RemoteTrigger");
   if (ctx.effort) args.push("--effort", ctx.effort);
@@ -41818,6 +41810,7 @@ var import_node_os4 = __toESM(require("os"), 1);
 var import_node_path7 = __toESM(require("path"), 1);
 
 // src/session/reducer.ts
+init_protocol();
 init_runtime();
 
 // src/permission/rules.ts
@@ -41953,10 +41946,10 @@ var CONTACT_SSH_SYSTEM_PROMPT_HINT = `## \u8DE8\u8BBE\u5907\u6587\u4EF6\u8BBF\u9
    # execPath+cliPath\uFF0C\u4FDD\u8BC1 relay \u8DDF daemon \u7248\u672C\u540C\u6B65\u3002\u4E0D\u8981\u7528\u88F8 \`clawd\`\uFF08\u8D70 $PATH \u4F1A\u6F02\uFF09\u3002
    \`\`\`
 
-**A \u6388\u6743\u54EA\u4E9B\u76EE\u5F55\u4E0D\u7528\u4F60\u63D0\u524D\u8BB0**\uFF1AA \u4FA7\u7684 sshd \u62E8\u53F7\u4F1A\u5F3A\u5236\u8D70 sandbox jail\uFF0C\u8FDB\u6C99\u7BB1\u524D\u4F1A\u628A\u6388\u6743\u76EE\u5F55\u5217\u8868\u5199\u5230 stderr\uFF08\u683C\u5F0F \`[clawd-ssh-jail] Access allowed to these directories: ...\`\uFF09\u3002\u4F60\u5373\u4F7F\u731C\u9519\u8DEF\u5F84\u4E5F\u4F1A\u88AB sandbox deny\uFF0C\u4F46 stderr \u91CC\u5C31\u81EA\u5E26\u7B54\u6848\uFF0C\u8BD5\u9519\u4E00\u6B21\u5C31\u5B66\u5230 A \u6388\u6743\u4E86\u54EA\u4E9B\u76EE\u5F55\uFF0C\u4E0B\u6B21\u76F4\u63A5\u7528\u5BF9\u7684\u8DEF\u5F84\u3002
+**A \u5EFA\u8BAE\u5728\u54EA\u4E9B\u76EE\u5F55\u5E72\u6D3B**\uFF1AA \u4FA7 jail \u8FDB shell \u524D\u4F1A\u628A\u5EFA\u8BAE\u76EE\u5F55\u5217\u8868\u5199\u5230 stderr\uFF08\u683C\u5F0F \`[clawd-ssh-jail] Suggested working directories for this contact: ...\`\uFF09\u4F5C\u4E3A\u53C2\u8003\u3002\u6CE8\u610F\uFF1A**\u6CA1\u6709\u76EE\u5F55\u7EA7\u5F3A\u5236\u9650\u5236**\u2014\u2014\u4F60\u8BBF\u95EE\u7684\u662F A \u673A\u5668\u4E0A\u8BE5 SSH \u7528\u6237\u6743\u9650\u5185\u7684\u6587\u4EF6\uFF0C\u8BF7\u53EA\u5728 A \u6388\u6743/\u9700\u8981\u7684\u8303\u56F4\u5185\u64CD\u4F5C\uFF0C\u4E0D\u8981\u8D8A\u754C\u7FFB\u770B\u65E0\u5173\u76EE\u5F55\u3002
 
 **\u6CE8\u610F**\uFF1A
-- \u6388\u6743\u76EE\u5F55\u6570\u636E\u6E90\u5B9E\u65F6\uFF08jail \u6BCF\u6B21\u8BFB A \u4FA7\u6700\u65B0\u914D\u7F6E\uFF09\uFF0CA \u6539\u4E86\u6388\u6743\u540E\u4F60\u4E0B\u4E00\u6B21\u62E8\u53F7\u7ACB\u5373\u611F\u77E5
+- \u5EFA\u8BAE\u76EE\u5F55\u6570\u636E\u6E90\u5B9E\u65F6\uFF08jail \u6BCF\u6B21\u8BFB A \u4FA7\u6700\u65B0\u914D\u7F6E\uFF09\uFF0CA \u6539\u4E86 exposedDirs \u540E\u4F60\u4E0B\u4E00\u6B21\u62E8\u53F7\u7ACB\u5373\u611F\u77E5
 - \u6392\u969C\uFF1A\u672C\u673A debug \u65E5\u5FD7\u5728 \`~/.clawd/log/contact-ssh.log\`\uFF08\u7528\u6237\u53EF \`tail -f\` \u770B\u6BCF\u4E00\u6B65\uFF09\uFF0C\u4F60\u51FA\u9519\u65F6\u544A\u8BC9\u7528\u6237\u67E5\u8FD9\u4E2A\u6587\u4EF6
 - \u5982\u679C \`ls ~/.clawd/contact-ssh-keys/\` \u4E3A\u7A7A\uFF0C\u8BF4\u660E\u8FD8\u6CA1\u6709\u5BF9\u7AEF\u6388\u6743\u4F60\u6216 key \u8FD8\u6CA1\u62C9\u5230\uFF08B \u4FA7 daemon \u6BCF 60s \u4E00\u6B21\u81EA\u52A8\u62C9\uFF09\uFF0C\u5982\u5B9E\u544A\u8BC9\u7528\u6237
 `;
@@ -42045,10 +42038,7 @@ function buildSpawnContext(state, deps) {
   if (dispatchId) env.CLAWD_DISPATCH_ID = dispatchId;
   const personaId = file.ownerPersonaId;
   if (personaId) env.CLAWD_PERSONA_ID = personaId;
-  const dispatchMcpConfigPath2 = deps.getDispatchMcpConfigPath?.() ?? null;
-  const ticketMcpConfigPath2 = deps.getTicketMcpConfigPath?.() ?? null;
-  const shiftMcpConfigPath2 = deps.getShiftMcpConfigPath?.() ?? null;
-  const inboxMcpConfigPath2 = deps.getInboxMcpConfigPath?.() ?? null;
+  const mcpConfigs = deps.getMcpConfigs?.() ?? [];
   const ctx = {
     cwd: file.cwd,
     toolSessionId: file.toolSessionId,
@@ -42059,12 +42049,7 @@ function buildSpawnContext(state, deps) {
     // Phase 2 capability platform (plan §3): personaRoot 透传给 buildSpawnArgs;
     // 内部 shouldSandbox(cwd, personaRoot) 决定是否注入 --settings sandbox-settings.
     personaRoot: deps.personaRoot,
-    // Persona dispatch：所有 session（A 和 B）都挂同一份 dispatch.mcp.json，让两边的 cc
-    // 都能看到 personaDispatch / personaDispatchComplete tool；按 env 区分实际行为。
-    dispatchMcpConfigPath: dispatchMcpConfigPath2 ?? void 0,
-    ticketMcpConfigPath: ticketMcpConfigPath2 ?? void 0,
-    shiftMcpConfigPath: shiftMcpConfigPath2 ?? void 0,
-    inboxMcpConfigPath: inboxMcpConfigPath2 ?? void 0,
+    ...mcpConfigs.length > 0 ? { mcpConfigs } : {},
     // shift v1：把 SessionFile.ownerPersonaId 透传到 SpawnContext；buildSpawnArgs 等下游
     // 不直接读这个字段（只读 env），但保留显式字段方便 daemon 内部诊断/日志。
     personaId
@@ -42092,7 +42077,7 @@ function buildSpawnContext(state, deps) {
     }
     ctx.extraSystemPrompt = buildConnectionPrompt(promptArgs);
   }
-  if (dispatchMcpConfigPath2) {
+  if (mcpConfigs.some((c) => c.id === DISPATCH_MCP_ID)) {
     ctx.extraSystemPrompt = (ctx.extraSystemPrompt ? ctx.extraSystemPrompt + "\n\n" : "") + DISPATCH_SYSTEM_PROMPT_HINT;
   }
   if (daemonUrl) {
@@ -42875,13 +42860,9 @@ var SessionRunner = class {
       // 单栏 refactor (spec 2026-06-02 §5.1): cc 子进程 env 注入 CLAWD_DAEMON_URL，让 assistant
       // curl daemon HTTP RPC adapter (/api/rpc/<method>) 触发管理操作。null = HTTP adapter 未启。
       getDaemonUrl: this.hooks.getDaemonUrl,
-      // Persona dispatch：透传 dispatch.mcp.json 路径闭包 + B→dispatchId 反查闭包。
-      // 见 reducer.buildSpawnContext 注 CLAWD_DISPATCH_ID env / 派生 SpawnContext.dispatchMcpConfigPath
-      getDispatchMcpConfigPath: this.hooks.getDispatchMcpConfigPath,
-      getShiftMcpConfigPath: this.hooks.getShiftMcpConfigPath,
-      getInboxMcpConfigPath: this.hooks.getInboxMcpConfigPath,
-      // Ticket MCP：透传 ticket.mcp.json 路径闭包（所有 persona session 都挂，无 gating）
-      getTicketMcpConfigPath: this.hooks.getTicketMcpConfigPath,
+      // daemon 级 MCP server 列表闭包透传；见 reducer.buildSpawnContext 派生
+      // SpawnContext.mcpConfigs + 按 DISPATCH_MCP_ID 判断 dispatch 教学注入
+      getMcpConfigs: this.hooks.getMcpConfigs,
       lookupDispatchByBSessionId: this.hooks.lookupDispatchByBSessionId,
       // ReadyGate v2：透传 mode 让 reducer send / ready-detected 分支决定走暂存队列还是直写
       mode: this.hooks.mode,
@@ -43711,12 +43692,9 @@ var SessionManager = class {
       // 单栏 refactor (spec 2026-06-02 §5.1): 透传 daemon HTTP RPC base URL 闭包,
       // reducer 把它注入 cc 子进程 env CLAWD_DAEMON_URL.
       getDaemonUrl: this.deps.getDaemonUrl,
-      // Persona dispatch (Task 7): dispatch.mcp.json 路径 + B sessionId → dispatchId 反查
-      // 闭包透传给 reducer，让 cc spawn 加 --mcp-config flag + B session 注 CLAWD_DISPATCH_ID env.
-      getDispatchMcpConfigPath: this.deps.dispatchMcpConfigPath ? () => this.deps.dispatchMcpConfigPath ?? null : void 0,
-      getTicketMcpConfigPath: this.deps.ticketMcpConfigPath ? () => this.deps.ticketMcpConfigPath ?? null : void 0,
-      getShiftMcpConfigPath: this.deps.shiftMcpConfigPath ? () => this.deps.shiftMcpConfigPath ?? null : void 0,
-      getInboxMcpConfigPath: this.deps.inboxMcpConfigPath ? () => this.deps.inboxMcpConfigPath ?? null : void 0,
+      // daemon 级 MCP server 列表闭包透传给 reducer，cc spawn 逐项加 --mcp-config flag；
+      // B session 的 CLAWD_DISPATCH_ID env 由下方 lookupDispatchByBSessionId 反查闭包负责。
+      getMcpConfigs: () => this.deps.mcpConfigs ?? [],
       lookupDispatchByBSessionId: this.deps.personaDispatchManager ? (bSid) => this.deps.personaDispatchManager?.lookupDispatchByBSessionId(bSid) : void 0,
       // file-sharing (spec §6 PR 3)：闭包 scope + sessionId，runner 只暴露 tool/relPath/cwd
       onFileEdit: attachmentGroup ? (input) => attachmentGroup.onFileEdit({
@@ -48169,17 +48147,8 @@ function buildTuiSpawnArgs(ctx, isResume = false) {
   if (ctx.addDirs) {
     for (const dir of ctx.addDirs) args.push("--add-dir", dir);
   }
-  if (ctx.dispatchMcpConfigPath) {
-    args.push("--mcp-config", ctx.dispatchMcpConfigPath);
-  }
-  if (ctx.ticketMcpConfigPath) {
-    args.push("--mcp-config", ctx.ticketMcpConfigPath);
-  }
-  if (ctx.shiftMcpConfigPath) {
-    args.push("--mcp-config", ctx.shiftMcpConfigPath);
-  }
-  if (ctx.inboxMcpConfigPath) {
-    args.push("--mcp-config", ctx.inboxMcpConfigPath);
+  for (const mcp of ctx.mcpConfigs ?? []) {
+    args.push("--mcp-config", mcp.path);
   }
   args.push("--disallowed-tools", "CronCreate,CronDelete,CronList,ScheduleWakeup,RemoteTrigger");
   if (ctx.effort) args.push("--effort", ctx.effort);
@@ -53495,9 +53464,8 @@ var CLAWD_SSH_JAIL_SCRIPT = String.raw`#!/usr/bin/env bash
 # 真实请求（interactive shell 时为空）。
 #
 # 职责:
-#   1. 读 ~/.clawd/contacts.json 找 contact.exposedDirs
-#   2. macOS 用 sandbox-exec + sbpl; Linux 用 bwrap
-#   3. exec 沙箱 shell
+#   1. 读 ~/.clawd/contacts.json 校验 contact.sshAllowed，读 exposedDirs 作为提示
+#   2. 直接 exec shell（去沙箱后无目录级限制；exposedDirs 仅 echo 给对端参考）
 
 set -euo pipefail
 
@@ -53544,33 +53512,19 @@ for c in data.get('contacts', []):
 sys.exit(3)
 ")
 
-if [ -z "$EXPOSED_JSON" ]; then
-  log_line ERROR jail.entered "contact ${"${DEVICE_ID}"} 不在 store 或 exposedDirs 为空"
-  echo "clawd-ssh-jail: contact not found or no exposed dirs" >&2
-  exit 1
+# exposedDirs 可能为空（sshAllowed=true 但未配目录）——去沙箱后不再因空目录拒绝，直接放行。
+if [ -n "$EXPOSED_JSON" ]; then
+  log_line INFO jail.entered "exposedDirs 提示已加载，放行 exec shell"
+  # 告知 SSH client 建议目录（发到 stderr）。去沙箱后这些只是建议，不做目录级强制限制；
+  # exposedDirs 仅供对端参考，运行时读，A 改后下次拨号即感知。
+  echo "[clawd-ssh-jail] Suggested working directories for this contact:" >&2
+  while IFS= read -r d; do
+    echo "  - $d" >&2
+  done <<< "$EXPOSED_JSON"
+  echo "[clawd-ssh-jail] Note: no directory-level restriction is enforced." >&2
+else
+  log_line INFO jail.entered "sshAllowed=true 且未配 exposedDirs，直接放行 exec shell"
 fi
-log_line INFO jail.entered "exposedDirs 白名单已加载，进沙箱 exec shell"
-
-# 进沙箱前告知 SSH client 授权目录列表（发到 stderr）—— CC 或其他 SSH client 试错一次就能
-# 学到 exposedDirs 具体值，无需 A 侧向 B 侧同步（授权数据实时的 single source of truth）。
-# 每次拨号运行时读，A 改 exposedDirs 后 B 侧下一次拨号立即感知。
-echo "[clawd-ssh-jail] Access allowed to these directories:" >&2
-while IFS= read -r d; do
-  echo "  - $d" >&2
-done <<< "$EXPOSED_JSON"
-echo "[clawd-ssh-jail] Anything outside these paths will be sandbox-denied." >&2
-
-# 校验路径安全（bash 侧二次防御）
-while IFS= read -r line; do
-  case "$line" in
-    /*) : ;;
-    *) echo "clawd-ssh-jail: bad path: $line" >&2; exit 1 ;;
-  esac
-  case "$line" in
-    *[\"\'\`\$\;\|\&\(\)\{\}\[\]\<\>\*\?]*)
-      echo "clawd-ssh-jail: unsafe path: $line" >&2; exit 1 ;;
-  esac
-done <<< "$EXPOSED_JSON"
 
 CMD="${"${SSH_ORIGINAL_COMMAND:-}"}"
 if [ -z "$CMD" ]; then
@@ -53579,48 +53533,11 @@ else
   SHELL_CMD=(bash -c "$CMD")
 fi
 
-case "$(uname -s)" in
-  Darwin)
-    POLICY="(version 1)
-(deny default)
-(allow process*)
-(allow signal (target self))
-(allow sysctl-read)
-(allow mach-lookup)
-(allow file-read-metadata)
-(allow network*)
-(allow file-read* (subpath \"/usr\"))
-(allow file-read* (subpath \"/bin\"))
-(allow file-read* (subpath \"/sbin\"))
-(allow file-read* (subpath \"/System\"))
-(allow file-read* (subpath \"/Library\"))
-(allow file-read* (subpath \"/etc\"))
-(allow file-read* (subpath \"/private/etc\"))"
-    while IFS= read -r d; do
-      POLICY+="
-(allow file-read* file-write* (subpath \"$d\"))"
-    done <<< "$EXPOSED_JSON"
-    exec sandbox-exec -p "$POLICY" "${"${SHELL_CMD[@]}"}"
-    ;;
-  Linux)
-    BWRAP_ARGS=(
-      --unshare-user --unshare-ipc --unshare-pid --unshare-uts
-      --die-with-parent
-      --proc /proc --dev /dev --tmpfs /tmp
-      --ro-bind /usr /usr --ro-bind /bin /bin --ro-bind /sbin /sbin
-      --ro-bind /lib /lib --ro-bind /etc /etc
-    )
-    if [ -d /lib64 ]; then BWRAP_ARGS+=(--ro-bind /lib64 /lib64); fi
-    while IFS= read -r d; do
-      BWRAP_ARGS+=(--bind "$d" "$d")
-    done <<< "$EXPOSED_JSON"
-    exec bwrap "${"${BWRAP_ARGS[@]}"}" "${"${SHELL_CMD[@]}"}"
-    ;;
-  *)
-    echo "clawd-ssh-jail: unsupported OS $(uname -s)" >&2
-    exit 1
-    ;;
-esac
+# 去掉 OS 沙箱层（原本 macOS Seatbelt 策略 / Linux 命名空间隔离）：SSH 进来即该用户
+# 权限内的 shell，直接 exec。沙箱只限制文件、拦不住网络/进程，隔离价值有限，且相关 API
+# 在 macOS 已 deprecated。授权即完全信任——sshAllowed 授权开关 + authorized_keys 即时
+# 踢行是唯一访问闸。要加回沙箱：从 git 历史（T-29 之前）恢复本段的 OS 分支即可。
+exec "${"${SHELL_CMD[@]}"}"
 `;
 function ensureJailScript(dataDir) {
   const binDir = import_node_path37.default.join(dataDir, "bin");
@@ -53667,6 +53584,8 @@ var SshdManager = class {
   stopping = false;
   exitHookInstalled = false;
   startupTimeoutMs;
+  // sshd stderr 按行嗌探 pubkey 认证结果时的半行缓冲（防关键字被 chunk 边界切断）
+  sniffBuf = "";
   get port() {
     return this.deps.port;
   }
@@ -53714,7 +53633,11 @@ var SshdManager = class {
       logStream.write(String(c));
     };
     proc.stdout?.on("data", tee);
-    proc.stderr?.on("data", tee);
+    proc.stderr?.on("data", (c) => {
+      const s = String(c);
+      logStream.write(s);
+      this.sniffSshdAuth(s);
+    });
     proc.once("exit", () => logStream.end());
     const ready = await waitForSshdReady(proc, this.startupTimeoutMs);
     if (!ready.ok) {
@@ -53801,7 +53724,36 @@ ${tail}` : ready.error;
     } catch {
     }
   }
+  // 把 sshd -e 输出里的 pubkey 认证结果转写一条到 contact-ssh.log，让 A 侧审计日志一处即可
+  // 看到"隧道连上但 sshd 拒了 key"（否则只有 tunnel.connected + tunnel.disconnected，为什么
+  // 被拒要翻另一个 sshd.log 对时间线）。按 \n 切行嗅探，半行留 sniffBuf 等下个 chunk 拼回。
+  sniffSshdAuth(chunk) {
+    const sshLog = this.deps.sshLog;
+    if (!sshLog) return;
+    this.sniffBuf += chunk;
+    const parts = this.sniffBuf.split("\n");
+    this.sniffBuf = parts.pop() ?? "";
+    for (const line of parts) {
+      if (/Accepted publickey/i.test(line)) {
+        sshLog.info(
+          "ssh.auth-ok",
+          "sshd \u63A5\u53D7\u4E86 pubkey \u8BA4\u8BC1\uFF08\u5BF9\u7AEF key \u547D\u4E2D authorized_keys\uFF09",
+          sshdAuthMeta(line)
+        );
+      } else if (/Failed publickey/i.test(line) || /Connection closed by (authenticating|invalid) user/i.test(line)) {
+        sshLog.warn(
+          "ssh.auth-rejected",
+          "sshd \u62D2\u7EDD\u4E86 pubkey \u8BA4\u8BC1\uFF08\u5BF9\u7AEF key \u4E0D\u5728 authorized_keys / \u672A\u6388\u6743 / key \u672A\u62C9\u5230\uFF09",
+          sshdAuthMeta(line)
+        );
+      }
+    }
+  }
 };
+function sshdAuthMeta(line) {
+  const m2 = /port (\d+)/.exec(line);
+  return m2 ? { clientPort: Number(m2[1]) } : {};
+}
 async function waitForSshdReady(proc, timeoutMs) {
   return new Promise((resolve6) => {
     let settled = false;
@@ -54192,6 +54144,11 @@ async function handleSshTunnelLocalUpgrade(req, socket, head, deps) {
     url: outboundUrl
   });
   deps.wss.handleUpgrade(req, socket, head, (clientWs) => {
+    sshLog.info(
+      "relay.client-connected",
+      "relay CLI \u5DF2\u8FDE\u4E0A\u672C\u5730 daemon\uFF08client WS \u5347\u7EA7\u6210\u529F\uFF09\uFF0C\u5F00\u59CB\u62E8 peer",
+      { peerDeviceId, peerDisplayName: contact.displayName }
+    );
     const makeOut = deps.makeOutboundWs ?? ((u, o) => new import_websocket.default(u, o));
     const outbound = makeOut(outboundUrl, {
       headers: { Authorization: `Bearer ${contact.connectToken}` }
@@ -59689,6 +59646,7 @@ async function startDaemon(config) {
   const groupFileStore = new GroupFileStore({ dataDir: config.dataDir, logger });
   const personaDispatchManager = new PersonaDispatchManager({ genId: () => v4_default() });
   const here = typeof __dirname === "string" ? __dirname : import_node_path64.default.dirname((0, import_node_url4.fileURLToPath)(import_meta6.url));
+  const mcpConfigs = [];
   const dispatchServerCandidates = [
     import_node_path64.default.join(here, "dispatch", "mcp-server.cjs"),
     // 生产 dist/index → dist/dispatch/mcp-server.cjs
@@ -59696,16 +59654,16 @@ async function startDaemon(config) {
     // dev tsx src/index → ../dist/dispatch/mcp-server.cjs
   ];
   const dispatchServerScriptPath = dispatchServerCandidates.find((p2) => import_node_fs52.default.existsSync(p2));
-  let dispatchMcpConfigPath2;
   if (dispatchServerScriptPath) {
     const dispatchLogPath = import_node_path64.default.join(logDir, "dispatch-mcp-server.log");
-    dispatchMcpConfigPath2 = writeDispatchMcpConfig({
+    const dispatchCfgPath = writeDispatchMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: dispatchServerScriptPath,
       logPath: dispatchLogPath
     });
+    mcpConfigs.push({ id: DISPATCH_MCP_ID, path: dispatchCfgPath });
     logger.info("dispatch.mcp.json written", {
-      path: dispatchMcpConfigPath2,
+      path: dispatchCfgPath,
       server: dispatchServerScriptPath,
       serverLog: dispatchLogPath
     });
@@ -59719,18 +59677,18 @@ async function startDaemon(config) {
     import_node_path64.default.join(here, "..", "dist", "ticket", "mcp-server.cjs")
   ];
   const ticketServerScriptPath = ticketServerCandidates.find((p2) => import_node_fs52.default.existsSync(p2));
-  let ticketMcpConfigPath2;
   if (ticketServerScriptPath) {
     const ticketLogPath = import_node_path64.default.join(logDir, "ticket-mcp-server.log");
-    ticketMcpConfigPath2 = writeTicketMcpConfig({
+    const ticketCfgPath = writeTicketMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: ticketServerScriptPath,
       apiBaseUrl: config.clawosApi ?? DEFAULT_CLAWOS_API,
       apiKey: resolveClawdTicketsApiKey(),
       logPath: ticketLogPath
     });
+    mcpConfigs.push({ id: "ticket", path: ticketCfgPath });
     logger.info("ticket.mcp.json written", {
-      path: ticketMcpConfigPath2,
+      path: ticketCfgPath,
       server: ticketServerScriptPath,
       serverLog: ticketLogPath
     });
@@ -59744,16 +59702,16 @@ async function startDaemon(config) {
     import_node_path64.default.join(here, "..", "dist", "shift", "mcp-server.cjs")
   ];
   const shiftServerScriptPath = shiftServerCandidates.find((p2) => import_node_fs52.default.existsSync(p2));
-  let shiftMcpConfigPath2;
   if (shiftServerScriptPath) {
     const shiftLogPath = import_node_path64.default.join(logDir, "shift-mcp-server.log");
-    shiftMcpConfigPath2 = await writeShiftMcpConfig({
+    const shiftCfgPath = await writeShiftMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: shiftServerScriptPath,
       logPath: shiftLogPath
     });
+    mcpConfigs.push({ id: "shift", path: shiftCfgPath });
     logger.info("shift.mcp.json written", {
-      path: shiftMcpConfigPath2,
+      path: shiftCfgPath,
       server: shiftServerScriptPath,
       serverLog: shiftLogPath
     });
@@ -59768,16 +59726,16 @@ async function startDaemon(config) {
     import_node_path64.default.join(here, "..", "dist", "inbox", "mcp-server.cjs")
   ];
   const inboxServerScriptPath = inboxServerCandidates.find((p2) => import_node_fs52.default.existsSync(p2));
-  let inboxMcpConfigPath2;
   if (inboxServerScriptPath) {
     const inboxLogPath = import_node_path64.default.join(logDir, "inbox-mcp-server.log");
-    inboxMcpConfigPath2 = await writeInboxMcpConfig({
+    const inboxCfgPath = await writeInboxMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: inboxServerScriptPath,
       logPath: inboxLogPath
     });
+    mcpConfigs.push({ id: "inbox", path: inboxCfgPath });
     logger.info("inbox.mcp.json written", {
-      path: inboxMcpConfigPath2,
+      path: inboxCfgPath,
       server: inboxServerScriptPath,
       serverLog: inboxLogPath
     });
@@ -59823,18 +59781,12 @@ async function startDaemon(config) {
     // 127.0.0.1（不是 config.host）—— cc 跑在本机，loopback 最稳；外部访问限制 + http-router
     // 的 isLoopback 兜底已确保安全。
     getDaemonUrl: () => `http://127.0.0.1:${config.port}`,
-    // Persona dispatch (Task 8): manager 通过这两个 deps 跟 PersonaDispatchManager 协作。
-    // - personaDispatchManager: manager.createDispatchedSession 用它 registerBSession；
-    //   reducer 通过闭包反查 dispatchId 注 CLAWD_DISPATCH_ID env。
-    // - dispatchMcpConfigPath: reducer 透传到 SpawnContext，cc spawn 加 --mcp-config flag。
+    // Persona dispatch (Task 8): manager.createDispatchedSession 用 personaDispatchManager
+    // registerBSession；reducer 通过闭包反查 dispatchId 注 CLAWD_DISPATCH_ID env。
     personaDispatchManager,
-    dispatchMcpConfigPath: dispatchMcpConfigPath2,
-    ticketMcpConfigPath: ticketMcpConfigPath2,
-    // shift v1：所有 persona session 都挂 shift.mcp.json（不做 persona gating）。
-    // 缺省 = shift-mcp-server.cjs 没 build 出来，cc 看不到 shift tool 但 scheduler 仍跑。
-    shiftMcpConfigPath: shiftMcpConfigPath2,
-    // sendDm MCP tool：所有 persona session 都挂 inbox.mcp.json（无 gating）。
-    inboxMcpConfigPath: inboxMcpConfigPath2,
+    // daemon 级 MCP server 登记表（dispatch / ticket / shift / inbox / ...，上方各 writer
+    // 块写盘成功即登记）；reducer 透传到 SpawnContext.mcpConfigs，cc spawn 逐项 --mcp-config。
+    mcpConfigs,
     broadcastFrame: (frame, target) => {
       if (target === "all") {
         transport?.broadcastAll(frame);
@@ -60656,7 +60608,9 @@ ${bar}
     port: config.sshdPort,
     logger,
     installProcessExitHandlers: true,
-    onSshdExit: (info) => logger.warn("sshd exited unexpectedly", info)
+    onSshdExit: (info) => logger.warn("sshd exited unexpectedly", info),
+    // sshd 的 pubkey 认证结果转写进 contact-ssh.log（补 A 侧「隧道连上但 sshd 拒了 key」盲区）
+    sshLog
   });
   try {
     await sshdMgr.start();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.231",
+  "version": "0.2.233",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",