@clawos-dev/clawd 0.2.232 → 0.2.234

package/dist/cli.cjs

@@ -4820,6 +4820,14 @@ var init_schemas = __esm({
        * 或 deps.ownerDisplayName（owner）。
        */
       creatorDisplayName: external_exports.string().min(1).optional(),
+      /**
+       * 创建该 session 的连接者飞书 union_id（一次性 stamp，T-31 persona prompt injection）。
+       * session:create / dispatch spawnB handler 从 ctx.principal.feishuUnionId（guest 场景来自
+       * connect token subOwner）或 deps.ownerFeishuUnionId（owner 场景）传入；newRunner 时读这个
+       * 字段派生 SubSessionMeta.callerFeishuUnionId 注入 cc system prompt「身份卡」的 union_id 行。
+       * Optional：老 SessionFile / owner 未登飞书路径缺省，缺省时 prompt 不渲染该行（向后兼容）。
+       */
+      creatorFeishuUnionId: external_exports.string().min(1).optional(),
       /**
        * Mirror peer sessions (2026-05-26): mirror 标识。**我在朋友 daemon 上创建的 session**，
        * 远端是 source of truth，本机是持久化副本，方便 sidebar 跨设备聚合。
@@ -41423,11 +41431,17 @@ function scopeSubPath(scope) {
   if (scope.mode === "guest") return [scope.personaId, "guests", scope.capId];
   return [scope.personaId, scope.mode];
 }
-function metaFromScope(scope, personaRoot, usersRoot, ownerPrincipalId, callerDisplayName) {
+function metaFromScope(scope, personaRoot, usersRoot, ownerPrincipalId, callerDisplayName, callerFeishuUnionId) {
   if (scope.kind === "default") return void 0;
   if (scope.mode === "owner") {
     if (!ownerPrincipalId || !usersRoot) {
-      return { idleKillEnabled: false, personaMode: "owner", callerDisplayName };
+      return {
+        idleKillEnabled: false,
+        personaMode: "owner",
+        callerDisplayName,
+        callerDeviceId: ownerPrincipalId,
+        callerFeishuUnionId
+      };
     }
     const userWorkDir2 = deriveUserWorkDir(ownerPrincipalId, usersRoot);
     return {
@@ -41435,7 +41449,9 @@ function metaFromScope(scope, personaRoot, usersRoot, ownerPrincipalId, callerDi
       personaMode: "owner",
       userWorkDir: userWorkDir2,
       addDirs: [userWorkDir2],
-      callerDisplayName
+      callerDisplayName,
+      callerDeviceId: ownerPrincipalId,
+      callerFeishuUnionId
     };
   }
   const userWorkDir = deriveUserWorkDir(scope.capId, usersRoot);
@@ -41444,7 +41460,9 @@ function metaFromScope(scope, personaRoot, usersRoot, ownerPrincipalId, callerDi
     personaMode: "guest",
     userWorkDir,
     addDirs: [userWorkDir],
-    callerDisplayName
+    callerDisplayName,
+    callerDeviceId: scope.capId,
+    callerFeishuUnionId
   };
 }
 function scopeForFile(file, ownerPrincipalId) {
@@ -41844,30 +41862,61 @@ function buildRule(tool, input) {
 }
 
 // src/persona/connection-prompt.ts
-var OWNER_TEMPLATE = `# \u8FDE\u63A5\u4E0A\u4E0B\u6587
-\u4F60\u73B0\u5728\u4EE5 Owner \u8EAB\u4EFD\u88AB\u8FDE\u63A5\uFF0C\u5BF9\u65B9\u5C31\u662F owner \u672C\u4EBA\uFF08{ownerLabel}\uFF09\u3002
-\u81EA\u6211\u4ECB\u7ECD\u65F6\u4F7F\u7528\u7B2C\u4E00/\u7B2C\u4E8C\u4EBA\u79F0\uFF0C\u4F8B\u5982\u300C\u6211\u662F\u60A8\u7684 xxx \u52A9\u624B\u300D\u3002`;
-var GUEST_TEMPLATE = `# \u8FDE\u63A5\u4E0A\u4E0B\u6587
-\u4F60\u73B0\u5728\u4EE5 Guest \u8EAB\u4EFD\u88AB\u8FDE\u63A5\uFF0C\u672C persona \u7684 owner \u662F\u300C{ownerLabel}\u300D\uFF0C\u5F53\u524D\u5BF9\u8BDD\u7684\u5BF9\u65B9\u662F\u300C{guestLabel}\u300D\uFF0C\u4E0D\u662F owner \u672C\u4EBA\u3002
-\u81EA\u6211\u4ECB\u7ECD\u65F6\u7B2C\u4E09\u4EBA\u79F0\u6307\u4EE3 owner\u3001\u7B2C\u4E8C\u4EBA\u79F0\u79F0\u547C\u5BF9\u65B9\uFF0C\u4F8B\u5982\u300C{guestLabel}\uFF0C\u6211\u662F {ownerLabel} \u7684 xxx \u52A9\u624B\uFF0C\u4F60\u53EF\u4EE5\u901A\u8FC7\u6211\u770B\u5230\u4ED6\u7684 xxx\u300D\u3002\u4E0D\u8981\u628A\u5BF9\u65B9\u5F53\u6210 owner\uFF0C\u4E0D\u8981\u66FF owner \u505A\u51FA\u627F\u8BFA\u3002`;
+function renderIdentityLines(fields) {
+  const lines = [`- \u663E\u793A\u540D\uFF1A${fields.label}`];
+  if (fields.feishuUnionId) lines.push(`- \u98DE\u4E66 union_id\uFF1A${fields.feishuUnionId}`);
+  if (fields.deviceId) lines.push(`- \u8BBE\u5907 id\uFF1A${fields.deviceId}`);
+  if (fields.extraLastLine) lines.push(fields.extraLastLine);
+  return lines.join("\n");
+}
 function buildConnectionPrompt(args) {
-  let result;
-  if (args.mode === "guest") {
-    result = GUEST_TEMPLATE.replace(/\{ownerLabel\}/g, args.ownerLabel).replace(
-      /\{guestLabel\}/g,
-      args.guestLabel
+  const parts = ["# \u8FDE\u63A5\u4E0A\u4E0B\u6587"];
+  if (args.mode === "owner") {
+    parts.push("\u5F53\u524D\u8FDE\u63A5\u65B9\uFF08\u5C31\u662F owner \u672C\u4EBA\uFF09\uFF1A");
+    parts.push(
+      renderIdentityLines({
+        label: args.ownerLabel,
+        feishuUnionId: args.ownerFeishuUnionId,
+        deviceId: args.ownerDeviceId
+      })
     );
   } else {
-    result = OWNER_TEMPLATE.replace(/\{ownerLabel\}/g, args.ownerLabel);
+    parts.push("\u5F53\u524D\u8FDE\u63A5\u65B9\uFF08\u4E0D\u662F owner \u672C\u4EBA\uFF09\uFF1A");
+    parts.push(
+      renderIdentityLines({
+        label: args.guestLabel,
+        feishuUnionId: args.guestFeishuUnionId,
+        deviceId: args.guestDeviceId,
+        extraLastLine: "- \u8EAB\u4EFD\uFF1AGuest\uFF08\u8FDC\u7A0B\u8FDE\u63A5\u8FDB\u6765\u7684\u8054\u7CFB\u4EBA\uFF09"
+      })
+    );
+    parts.push("");
+    parts.push("\u672C persona \u7684 owner\uFF1A");
+    parts.push(
+      renderIdentityLines({
+        label: args.ownerLabel,
+        feishuUnionId: args.ownerFeishuUnionId,
+        deviceId: args.ownerDeviceId
+      })
+    );
   }
   if (args.workDir) {
-    result += `
-\u4F60\u7684\u6587\u4EF6\u5DE5\u4F5C\u76EE\u5F55\u662F ${args.workDir}\uFF0C\u8FD9\u4E2A\u76EE\u5F55\u5BF9\u4F60\u53EF\u8BFB\u53EF\u5199\uFF0C\u6587\u4EF6\u7684\u8BFB\u53D6/\u521B\u5EFA/\u4FEE\u6539\u90FD\u5728\u8FD9\u91CC\u8FDB\u884C\u3002`;
+    parts.push("");
+    let line = `\u4F60\u7684\u6587\u4EF6\u5DE5\u4F5C\u76EE\u5F55\u662F ${args.workDir}\uFF0C\u8FD9\u4E2A\u76EE\u5F55\u5BF9\u4F60\u53EF\u8BFB\u53EF\u5199\uFF0C\u6587\u4EF6\u7684\u8BFB\u53D6/\u521B\u5EFA/\u4FEE\u6539\u90FD\u5728\u8FD9\u91CC\u8FDB\u884C\u3002`;
     if (args.mode === "guest") {
-      result += "persona \u76EE\u5F55\u5BF9\u4F60\u53EA\u8BFB\uFF0C\u4E0D\u8981\u5F80\u91CC\u5199\u3002";
+      line += "persona \u76EE\u5F55\u5BF9\u4F60\u53EA\u8BFB\uFF0C\u4E0D\u8981\u5F80\u91CC\u5199\u3002";
     }
+    parts.push(line);
   }
-  return result;
+  parts.push("");
+  if (args.mode === "owner") {
+    parts.push("\u81EA\u6211\u4ECB\u7ECD\u65F6\u4F7F\u7528\u7B2C\u4E00/\u7B2C\u4E8C\u4EBA\u79F0\uFF0C\u4F8B\u5982\u300C\u6211\u662F\u60A8\u7684 xxx \u52A9\u624B\u300D\u3002");
+  } else {
+    parts.push(
+      `\u81EA\u6211\u4ECB\u7ECD\u65F6\u7B2C\u4E09\u4EBA\u79F0\u6307\u4EE3 owner\u3001\u7B2C\u4E8C\u4EBA\u79F0\u79F0\u547C\u5BF9\u65B9\uFF0C\u4F8B\u5982\u300C${args.guestLabel}\uFF0C\u6211\u662F ${args.ownerLabel} \u7684 xxx \u52A9\u624B\uFF0C\u4F60\u53EF\u4EE5\u901A\u8FC7\u6211\u770B\u5230\u4ED6\u7684 xxx\u300D\u3002\u4E0D\u8981\u628A\u5BF9\u65B9\u5F53\u6210 owner\uFF0C\u4E0D\u8981\u66FF owner \u505A\u51FA\u627F\u8BFA\u3002`
+    );
+  }
+  return parts.join("\n");
 }
 
 // src/persona/sharing-prompt.ts
@@ -41946,10 +41995,10 @@ var CONTACT_SSH_SYSTEM_PROMPT_HINT = `## \u8DE8\u8BBE\u5907\u6587\u4EF6\u8BBF\u9
    # execPath+cliPath\uFF0C\u4FDD\u8BC1 relay \u8DDF daemon \u7248\u672C\u540C\u6B65\u3002\u4E0D\u8981\u7528\u88F8 \`clawd\`\uFF08\u8D70 $PATH \u4F1A\u6F02\uFF09\u3002
    \`\`\`
 
-**A \u6388\u6743\u54EA\u4E9B\u76EE\u5F55\u4E0D\u7528\u4F60\u63D0\u524D\u8BB0**\uFF1AA \u4FA7\u7684 sshd \u62E8\u53F7\u4F1A\u5F3A\u5236\u8D70 sandbox jail\uFF0C\u8FDB\u6C99\u7BB1\u524D\u4F1A\u628A\u6388\u6743\u76EE\u5F55\u5217\u8868\u5199\u5230 stderr\uFF08\u683C\u5F0F \`[clawd-ssh-jail] Access allowed to these directories: ...\`\uFF09\u3002\u4F60\u5373\u4F7F\u731C\u9519\u8DEF\u5F84\u4E5F\u4F1A\u88AB sandbox deny\uFF0C\u4F46 stderr \u91CC\u5C31\u81EA\u5E26\u7B54\u6848\uFF0C\u8BD5\u9519\u4E00\u6B21\u5C31\u5B66\u5230 A \u6388\u6743\u4E86\u54EA\u4E9B\u76EE\u5F55\uFF0C\u4E0B\u6B21\u76F4\u63A5\u7528\u5BF9\u7684\u8DEF\u5F84\u3002
+**A \u5EFA\u8BAE\u5728\u54EA\u4E9B\u76EE\u5F55\u5E72\u6D3B**\uFF1AA \u4FA7 jail \u8FDB shell \u524D\u4F1A\u628A\u5EFA\u8BAE\u76EE\u5F55\u5217\u8868\u5199\u5230 stderr\uFF08\u683C\u5F0F \`[clawd-ssh-jail] Suggested working directories for this contact: ...\`\uFF09\u4F5C\u4E3A\u53C2\u8003\u3002\u6CE8\u610F\uFF1A**\u6CA1\u6709\u76EE\u5F55\u7EA7\u5F3A\u5236\u9650\u5236**\u2014\u2014\u4F60\u8BBF\u95EE\u7684\u662F A \u673A\u5668\u4E0A\u8BE5 SSH \u7528\u6237\u6743\u9650\u5185\u7684\u6587\u4EF6\uFF0C\u8BF7\u53EA\u5728 A \u6388\u6743/\u9700\u8981\u7684\u8303\u56F4\u5185\u64CD\u4F5C\uFF0C\u4E0D\u8981\u8D8A\u754C\u7FFB\u770B\u65E0\u5173\u76EE\u5F55\u3002
 
 **\u6CE8\u610F**\uFF1A
-- \u6388\u6743\u76EE\u5F55\u6570\u636E\u6E90\u5B9E\u65F6\uFF08jail \u6BCF\u6B21\u8BFB A \u4FA7\u6700\u65B0\u914D\u7F6E\uFF09\uFF0CA \u6539\u4E86\u6388\u6743\u540E\u4F60\u4E0B\u4E00\u6B21\u62E8\u53F7\u7ACB\u5373\u611F\u77E5
+- \u5EFA\u8BAE\u76EE\u5F55\u6570\u636E\u6E90\u5B9E\u65F6\uFF08jail \u6BCF\u6B21\u8BFB A \u4FA7\u6700\u65B0\u914D\u7F6E\uFF09\uFF0CA \u6539\u4E86 exposedDirs \u540E\u4F60\u4E0B\u4E00\u6B21\u62E8\u53F7\u7ACB\u5373\u611F\u77E5
 - \u6392\u969C\uFF1A\u672C\u673A debug \u65E5\u5FD7\u5728 \`~/.clawd/log/contact-ssh.log\`\uFF08\u7528\u6237\u53EF \`tail -f\` \u770B\u6BCF\u4E00\u6B65\uFF09\uFF0C\u4F60\u51FA\u9519\u65F6\u544A\u8BC9\u7528\u6237\u67E5\u8FD9\u4E2A\u6587\u4EF6
 - \u5982\u679C \`ls ~/.clawd/contact-ssh-keys/\` \u4E3A\u7A7A\uFF0C\u8BF4\u660E\u8FD8\u6CA1\u6709\u5BF9\u7AEF\u6388\u6743\u4F60\u6216 key \u8FD8\u6CA1\u62C9\u5230\uFF08B \u4FA7 daemon \u6BCF 60s \u4E00\u6B21\u81EA\u52A8\u62C9\uFF09\uFF0C\u5982\u5B9E\u544A\u8BC9\u7528\u6237
 `;
@@ -42065,13 +42114,19 @@ function buildSpawnContext(state, deps) {
       promptArgs = {
         mode: "guest",
         ownerLabel: deps.ownerDisplayName,
+        ownerDeviceId: deps.ownerDeviceId,
+        ownerFeishuUnionId: deps.ownerFeishuUnionId,
         guestLabel: meta.callerDisplayName,
+        guestDeviceId: meta.callerDeviceId,
+        guestFeishuUnionId: meta.callerFeishuUnionId,
         workDir: meta.userWorkDir
       };
     } else {
       promptArgs = {
         mode: "owner",
         ownerLabel: meta.callerDisplayName ?? deps.ownerDisplayName,
+        ownerDeviceId: meta.callerDeviceId ?? deps.ownerDeviceId,
+        ownerFeishuUnionId: meta.callerFeishuUnionId ?? deps.ownerFeishuUnionId,
         workDir: meta.userWorkDir
       };
     }
@@ -42856,6 +42911,8 @@ var SessionRunner = class {
       resolveContextWindow: this.hooks.resolveContextWindow,
       genUuid: this.hooks.genUuid ?? v4_default,
       ownerDisplayName: this.hooks.ownerDisplayName,
+      ownerDeviceId: this.hooks.ownerDeviceId,
+      ownerFeishuUnionId: this.hooks.ownerFeishuUnionId,
       personaRoot: this.hooks.personaRoot,
       // 单栏 refactor (spec 2026-06-02 §5.1): cc 子进程 env 注入 CLAWD_DAEMON_URL，让 assistant
       // curl daemon HTTP RPC adapter (/api/rpc/<method>) 触发管理操作。null = HTTP adapter 未启。
@@ -43634,12 +43691,14 @@ var SessionManager = class {
     const adapter = this.deps.getAdapter(file.tool ?? "claude");
     const store = this.storeFor(scope);
     const callerDisplayName = file.creatorDisplayName ?? (scope.kind === "persona" ? scope.mode === "owner" ? this.deps.ownerDisplayName : this.deps.contactStore?.get(scope.capId)?.displayName : void 0);
+    const callerFeishuUnionId = file.creatorFeishuUnionId ?? (scope.kind === "persona" && scope.mode === "owner" ? this.deps.ownerFeishuUnionId : void 0);
     const subSessionMeta = metaFromScope(
       scope,
       this.deps.personaRoot ?? "",
       this.deps.usersRoot ?? "",
       this.deps.ownerPrincipalId,
-      callerDisplayName
+      callerDisplayName,
+      callerFeishuUnionId
     );
     if (subSessionMeta?.userWorkDir) {
       import_node_fs9.default.mkdirSync(subSessionMeta.userWorkDir, { recursive: true });
@@ -43686,6 +43745,11 @@ var SessionManager = class {
       // personaStore 不再透给 runner hooks（in-place mention 注入路径已删，runner 不用）；
       // manager 自身的 sandbox 派生仍直接读 this.deps.personaStore。
       ownerDisplayName: this.deps.ownerDisplayName,
+      // T-31 persona prompt injection：owner 设备 id（= ownerPrincipalId）+ 飞书 union_id
+      // 供 reducer 组 promptArgs 时作为「本 persona 的 owner」身份卡数据源（guest session 用）
+      // 或「当前连接方」身份卡的兜底源（owner session 老路径未 stamp caller 时）。
+      ownerDeviceId: this.deps.ownerPrincipalId,
+      ownerFeishuUnionId: this.deps.ownerFeishuUnionId,
       // Phase 2 capability platform (plan §3): 透传 personaRoot, buildSpawnArgs 据
       // cwd 是否在 personaRoot 下自动决定是否注入 --settings sandbox-settings.json.
       personaRoot: this.deps.personaRoot,
@@ -43801,7 +43865,7 @@ var SessionManager = class {
     }
   }
   // ---- 命令方法：均返回 { response, broadcast[] }，由 dispatcher 聚合 ----
-  create(args, creatorPrincipalId, creatorDisplayName) {
+  create(args, creatorPrincipalId, creatorDisplayName, creatorFeishuUnionId) {
     let cwd;
     if (args.ownerPersonaId) {
       cwd = derivePersonaSpawnCwd(
@@ -43846,6 +43910,7 @@ var SessionManager = class {
       ephemeral: args.ephemeral,
       creatorPrincipalId,
       creatorDisplayName,
+      ...creatorFeishuUnionId ? { creatorFeishuUnionId } : {},
       createdAt: iso,
       updatedAt: iso
     };
@@ -44616,7 +44681,9 @@ var SessionManager = class {
       // creatorDisplayName = A 的 displayName，供 guest meta callerDisplayName（reducer 要求）。
       ...args.guestPrincipalId ? {
         creatorPrincipalId: args.guestPrincipalId,
-        ...args.guestDisplayName ? { creatorDisplayName: args.guestDisplayName } : {}
+        ...args.guestDisplayName ? { creatorDisplayName: args.guestDisplayName } : {},
+        // T-31: A 的飞书 union_id stamp 到 B 的 SessionFile；guest meta 由 newRunner 派生
+        ...args.guestFeishuUnionId ? { creatorFeishuUnionId: args.guestFeishuUnionId } : {}
       } : {},
       // T-20：dispatch model override 落盘（reducer spawn 路径读 SessionFile.model 生成 --model flag）
       ...args.model ? { model: args.model } : {},
@@ -48890,6 +48957,8 @@ function buildPersonaDispatchHandlers(deps) {
         prompt: args.prompt,
         guestPrincipalId: ctx.principal.id,
         guestDisplayName: ctx.principal.displayName,
+        // T-31: 把 A 的飞书 union_id 透传给 B（connectGuestContext 已把它挂在 principal.feishuUnionId）
+        ...ctx.principal.feishuUnionId ? { guestFeishuUnionId: ctx.principal.feishuUnionId } : {},
         ...args.model ? { model: args.model } : {}
       }).then(() => logger?.info("dispatch.spawnB.ok", { dispatchId: dispatchId2 })).catch((err) => {
         const reason = err instanceof Error ? err.message : String(err);
@@ -50662,7 +50731,7 @@ function ownerContext(ownerPrincipalId, displayName, feishuUnionId) {
 }
 function connectGuestContext(subDevice, subOwner, provider, displayName) {
   return {
-    principal: { id: subDevice, kind: "guest", displayName },
+    principal: { id: subDevice, kind: "guest", displayName, feishuUnionId: subOwner },
     grants: PERSONAL_CAP_GRANTS.map((g2) => ({
       resource: { ...g2.resource },
       actions: [...g2.actions]
@@ -53464,9 +53533,8 @@ var CLAWD_SSH_JAIL_SCRIPT = String.raw`#!/usr/bin/env bash
 # 真实请求（interactive shell 时为空）。
 #
 # 职责:
-#   1. 读 ~/.clawd/contacts.json 找 contact.exposedDirs
-#   2. macOS 用 sandbox-exec + sbpl; Linux 用 bwrap
-#   3. exec 沙箱 shell
+#   1. 读 ~/.clawd/contacts.json 校验 contact.sshAllowed，读 exposedDirs 作为提示
+#   2. 直接 exec shell（去沙箱后无目录级限制；exposedDirs 仅 echo 给对端参考）
 
 set -euo pipefail
 
@@ -53513,33 +53581,19 @@ for c in data.get('contacts', []):
 sys.exit(3)
 ")
 
-if [ -z "$EXPOSED_JSON" ]; then
-  log_line ERROR jail.entered "contact ${"${DEVICE_ID}"} 不在 store 或 exposedDirs 为空"
-  echo "clawd-ssh-jail: contact not found or no exposed dirs" >&2
-  exit 1
+# exposedDirs 可能为空（sshAllowed=true 但未配目录）——去沙箱后不再因空目录拒绝，直接放行。
+if [ -n "$EXPOSED_JSON" ]; then
+  log_line INFO jail.entered "exposedDirs 提示已加载，放行 exec shell"
+  # 告知 SSH client 建议目录（发到 stderr）。去沙箱后这些只是建议，不做目录级强制限制；
+  # exposedDirs 仅供对端参考，运行时读，A 改后下次拨号即感知。
+  echo "[clawd-ssh-jail] Suggested working directories for this contact:" >&2
+  while IFS= read -r d; do
+    echo "  - $d" >&2
+  done <<< "$EXPOSED_JSON"
+  echo "[clawd-ssh-jail] Note: no directory-level restriction is enforced." >&2
+else
+  log_line INFO jail.entered "sshAllowed=true 且未配 exposedDirs，直接放行 exec shell"
 fi
-log_line INFO jail.entered "exposedDirs 白名单已加载，进沙箱 exec shell"
-
-# 进沙箱前告知 SSH client 授权目录列表（发到 stderr）—— CC 或其他 SSH client 试错一次就能
-# 学到 exposedDirs 具体值，无需 A 侧向 B 侧同步（授权数据实时的 single source of truth）。
-# 每次拨号运行时读，A 改 exposedDirs 后 B 侧下一次拨号立即感知。
-echo "[clawd-ssh-jail] Access allowed to these directories:" >&2
-while IFS= read -r d; do
-  echo "  - $d" >&2
-done <<< "$EXPOSED_JSON"
-echo "[clawd-ssh-jail] Anything outside these paths will be sandbox-denied." >&2
-
-# 校验路径安全（bash 侧二次防御）
-while IFS= read -r line; do
-  case "$line" in
-    /*) : ;;
-    *) echo "clawd-ssh-jail: bad path: $line" >&2; exit 1 ;;
-  esac
-  case "$line" in
-    *[\"\'\`\$\;\|\&\(\)\{\}\[\]\<\>\*\?]*)
-      echo "clawd-ssh-jail: unsafe path: $line" >&2; exit 1 ;;
-  esac
-done <<< "$EXPOSED_JSON"
 
 CMD="${"${SSH_ORIGINAL_COMMAND:-}"}"
 if [ -z "$CMD" ]; then
@@ -53548,48 +53602,11 @@ else
   SHELL_CMD=(bash -c "$CMD")
 fi
 
-case "$(uname -s)" in
-  Darwin)
-    POLICY="(version 1)
-(deny default)
-(allow process*)
-(allow signal (target self))
-(allow sysctl-read)
-(allow mach-lookup)
-(allow file-read-metadata)
-(allow network*)
-(allow file-read* (subpath \"/usr\"))
-(allow file-read* (subpath \"/bin\"))
-(allow file-read* (subpath \"/sbin\"))
-(allow file-read* (subpath \"/System\"))
-(allow file-read* (subpath \"/Library\"))
-(allow file-read* (subpath \"/etc\"))
-(allow file-read* (subpath \"/private/etc\"))"
-    while IFS= read -r d; do
-      POLICY+="
-(allow file-read* file-write* (subpath \"$d\"))"
-    done <<< "$EXPOSED_JSON"
-    exec sandbox-exec -p "$POLICY" "${"${SHELL_CMD[@]}"}"
-    ;;
-  Linux)
-    BWRAP_ARGS=(
-      --unshare-user --unshare-ipc --unshare-pid --unshare-uts
-      --die-with-parent
-      --proc /proc --dev /dev --tmpfs /tmp
-      --ro-bind /usr /usr --ro-bind /bin /bin --ro-bind /sbin /sbin
-      --ro-bind /lib /lib --ro-bind /etc /etc
-    )
-    if [ -d /lib64 ]; then BWRAP_ARGS+=(--ro-bind /lib64 /lib64); fi
-    while IFS= read -r d; do
-      BWRAP_ARGS+=(--bind "$d" "$d")
-    done <<< "$EXPOSED_JSON"
-    exec bwrap "${"${BWRAP_ARGS[@]}"}" "${"${SHELL_CMD[@]}"}"
-    ;;
-  *)
-    echo "clawd-ssh-jail: unsupported OS $(uname -s)" >&2
-    exit 1
-    ;;
-esac
+# 去掉 OS 沙箱层（原本 macOS Seatbelt 策略 / Linux 命名空间隔离）：SSH 进来即该用户
+# 权限内的 shell，直接 exec。沙箱只限制文件、拦不住网络/进程，隔离价值有限，且相关 API
+# 在 macOS 已 deprecated。授权即完全信任——sshAllowed 授权开关 + authorized_keys 即时
+# 踢行是唯一访问闸。要加回沙箱：从 git 历史（T-29 之前）恢复本段的 OS 分支即可。
+exec "${"${SHELL_CMD[@]}"}"
 `;
 function ensureJailScript(dataDir) {
   const binDir = import_node_path37.default.join(dataDir, "bin");
@@ -53636,6 +53653,8 @@ var SshdManager = class {
   stopping = false;
   exitHookInstalled = false;
   startupTimeoutMs;
+  // sshd stderr 按行嗌探 pubkey 认证结果时的半行缓冲（防关键字被 chunk 边界切断）
+  sniffBuf = "";
   get port() {
     return this.deps.port;
   }
@@ -53683,7 +53702,11 @@ var SshdManager = class {
       logStream.write(String(c));
     };
     proc.stdout?.on("data", tee);
-    proc.stderr?.on("data", tee);
+    proc.stderr?.on("data", (c) => {
+      const s = String(c);
+      logStream.write(s);
+      this.sniffSshdAuth(s);
+    });
     proc.once("exit", () => logStream.end());
     const ready = await waitForSshdReady(proc, this.startupTimeoutMs);
     if (!ready.ok) {
@@ -53770,7 +53793,36 @@ ${tail}` : ready.error;
     } catch {
     }
   }
+  // 把 sshd -e 输出里的 pubkey 认证结果转写一条到 contact-ssh.log，让 A 侧审计日志一处即可
+  // 看到"隧道连上但 sshd 拒了 key"（否则只有 tunnel.connected + tunnel.disconnected，为什么
+  // 被拒要翻另一个 sshd.log 对时间线）。按 \n 切行嗅探，半行留 sniffBuf 等下个 chunk 拼回。
+  sniffSshdAuth(chunk) {
+    const sshLog = this.deps.sshLog;
+    if (!sshLog) return;
+    this.sniffBuf += chunk;
+    const parts = this.sniffBuf.split("\n");
+    this.sniffBuf = parts.pop() ?? "";
+    for (const line of parts) {
+      if (/Accepted publickey/i.test(line)) {
+        sshLog.info(
+          "ssh.auth-ok",
+          "sshd \u63A5\u53D7\u4E86 pubkey \u8BA4\u8BC1\uFF08\u5BF9\u7AEF key \u547D\u4E2D authorized_keys\uFF09",
+          sshdAuthMeta(line)
+        );
+      } else if (/Failed publickey/i.test(line) || /Connection closed by (authenticating|invalid) user/i.test(line)) {
+        sshLog.warn(
+          "ssh.auth-rejected",
+          "sshd \u62D2\u7EDD\u4E86 pubkey \u8BA4\u8BC1\uFF08\u5BF9\u7AEF key \u4E0D\u5728 authorized_keys / \u672A\u6388\u6743 / key \u672A\u62C9\u5230\uFF09",
+          sshdAuthMeta(line)
+        );
+      }
+    }
+  }
 };
+function sshdAuthMeta(line) {
+  const m2 = /port (\d+)/.exec(line);
+  return m2 ? { clientPort: Number(m2[1]) } : {};
+}
 async function waitForSshdReady(proc, timeoutMs) {
   return new Promise((resolve6) => {
     let settled = false;
@@ -54161,6 +54213,11 @@ async function handleSshTunnelLocalUpgrade(req, socket, head, deps) {
     url: outboundUrl
   });
   deps.wss.handleUpgrade(req, socket, head, (clientWs) => {
+    sshLog.info(
+      "relay.client-connected",
+      "relay CLI \u5DF2\u8FDE\u4E0A\u672C\u5730 daemon\uFF08client WS \u5347\u7EA7\u6210\u529F\uFF09\uFF0C\u5F00\u59CB\u62E8 peer",
+      { peerDeviceId, peerDisplayName: contact.displayName }
+    );
     const makeOut = deps.makeOutboundWs ?? ((u, o) => new import_websocket.default(u, o));
     const outbound = makeOut(outboundUrl, {
       headers: { Authorization: `Bearer ${contact.connectToken}` }
@@ -54932,10 +54989,12 @@ function buildSessionHandlers(deps) {
     ensurePersonaAccess(ctx, args.ownerPersonaId, "send");
     const creatorPrincipalId = ctx?.principal.id ?? ownerPrincipalId;
     const creatorDisplayName = ctx?.principal.displayName ?? "Owner";
+    const creatorFeishuUnionId = ctx?.principal.feishuUnionId;
     const { response, broadcast } = manager.create(
       { ...args, tool },
       creatorPrincipalId,
-      creatorDisplayName
+      creatorDisplayName,
+      creatorFeishuUnionId
     );
     return { response: { type: "session:info", ...response }, broadcast };
   };
@@ -60239,6 +60298,8 @@ async function startDaemon(config) {
         // B 角色（跨设备）：非空 → guest scope + creatorPrincipalId/creatorDisplayName = A。
         guestPrincipalId: args.guestPrincipalId,
         guestDisplayName: args.guestDisplayName,
+        // T-31: 把 A 的飞书 union_id stamp 到 B SessionFile，供 cc prompt 身份卡 union_id 行
+        guestFeishuUnionId: args.guestFeishuUnionId,
         // T-20: 可选 model override 透到 SessionFile.model
         ...args.model ? { model: args.model } : {}
       });
@@ -60620,7 +60681,9 @@ ${bar}
     port: config.sshdPort,
     logger,
     installProcessExitHandlers: true,
-    onSshdExit: (info) => logger.warn("sshd exited unexpectedly", info)
+    onSshdExit: (info) => logger.warn("sshd exited unexpectedly", info),
+    // sshd 的 pubkey 认证结果转写进 contact-ssh.log（补 A 侧「隧道连上但 sshd 拒了 key」盲区）
+    sshLog
   });
   try {
     await sshdMgr.start();

package/dist/dispatch/mcp-server.cjs

@@ -39876,6 +39876,14 @@ var SessionFileSchema = external_exports.object({
    * 或 deps.ownerDisplayName（owner）。
    */
   creatorDisplayName: external_exports.string().min(1).optional(),
+  /**
+   * 创建该 session 的连接者飞书 union_id（一次性 stamp，T-31 persona prompt injection）。
+   * session:create / dispatch spawnB handler 从 ctx.principal.feishuUnionId（guest 场景来自
+   * connect token subOwner）或 deps.ownerFeishuUnionId（owner 场景）传入；newRunner 时读这个
+   * 字段派生 SubSessionMeta.callerFeishuUnionId 注入 cc system prompt「身份卡」的 union_id 行。
+   * Optional：老 SessionFile / owner 未登飞书路径缺省，缺省时 prompt 不渲染该行（向后兼容）。
+   */
+  creatorFeishuUnionId: external_exports.string().min(1).optional(),
   /**
    * Mirror peer sessions (2026-05-26): mirror 标识。**我在朋友 daemon 上创建的 session**，
    * 远端是 source of truth，本机是持久化副本，方便 sidebar 跨设备聚合。