@clawos-dev/clawd 0.2.233 → 0.2.235

package/dist/cli.cjs

@@ -4820,6 +4820,14 @@ var init_schemas = __esm({
        * 或 deps.ownerDisplayName（owner）。
        */
       creatorDisplayName: external_exports.string().min(1).optional(),
+      /**
+       * 创建该 session 的连接者飞书 union_id（一次性 stamp，T-31 persona prompt injection）。
+       * session:create / dispatch spawnB handler 从 ctx.principal.feishuUnionId（guest 场景来自
+       * connect token subOwner）或 deps.ownerFeishuUnionId（owner 场景）传入；newRunner 时读这个
+       * 字段派生 SubSessionMeta.callerFeishuUnionId 注入 cc system prompt「身份卡」的 union_id 行。
+       * Optional：老 SessionFile / owner 未登飞书路径缺省，缺省时 prompt 不渲染该行（向后兼容）。
+       */
+      creatorFeishuUnionId: external_exports.string().min(1).optional(),
       /**
        * Mirror peer sessions (2026-05-26): mirror 标识。**我在朋友 daemon 上创建的 session**，
        * 远端是 source of truth，本机是持久化副本，方便 sidebar 跨设备聚合。
@@ -5737,8 +5745,10 @@ var init_contact = __esm({
        */
       sshAllowed: external_exports.boolean().default(false),
       /**
-       * 授权访问的目录白名单（绝对路径）。空数组 + sshAllowed=true 意味 SSH 通道能拨到但无处可读，
-       * jail 会拒绝 shell 启动。由 clawd-ssh-jail 运行时读，生成 sbpl / bwrap policy 白名单。
+       * @deprecated T-29 去沙箱后废弃。原为授权访问的目录白名单（clawd-ssh-jail 生成 sbpl/bwrap
+       * policy 用）；去掉 OS 沙箱后不再有目录级限制，SSH 授权即 on/off（见 sshAllowed）。
+       * 字段仅为兼容老 contacts.json 保留（default [] 保证 strict parse 不炸），不再有代码读写它，
+       * 也不再进 setSshAccess RPC / ContactSettingsDrawer / jail。勿新增消费方。
        */
       exposedDirs: external_exports.array(external_exports.string()).default([])
     }).strict();
@@ -5787,14 +5797,12 @@ var init_contact_ssh = __esm({
     init_zod();
     ContactSetSshAccessArgsSchema = external_exports.object({
       deviceId: external_exports.string().min(1),
-      sshAllowed: external_exports.boolean(),
-      exposedDirs: external_exports.array(external_exports.string())
+      sshAllowed: external_exports.boolean()
     }).strict();
     ContactSetSshAccessOkSchema = external_exports.object({
       type: external_exports.literal("contact:setSshAccess:ok"),
       deviceId: external_exports.string().min(1),
-      sshAllowed: external_exports.boolean(),
-      exposedDirs: external_exports.array(external_exports.string())
+      sshAllowed: external_exports.boolean()
     }).strict();
     ContactSshKeyIssueArgsSchema = external_exports.object({
       deviceId: external_exports.string().min(1)
@@ -5807,8 +5815,7 @@ var init_contact_ssh = __esm({
     ContactSshAccessUpdatedFrameSchema = external_exports.object({
       type: external_exports.literal("contact:ssh-access-updated"),
       deviceId: external_exports.string().min(1),
-      sshAllowed: external_exports.boolean(),
-      exposedDirs: external_exports.array(external_exports.string())
+      sshAllowed: external_exports.boolean()
     }).strict();
   }
 });
@@ -41423,11 +41430,17 @@ function scopeSubPath(scope) {
   if (scope.mode === "guest") return [scope.personaId, "guests", scope.capId];
   return [scope.personaId, scope.mode];
 }
-function metaFromScope(scope, personaRoot, usersRoot, ownerPrincipalId, callerDisplayName) {
+function metaFromScope(scope, personaRoot, usersRoot, ownerPrincipalId, callerDisplayName, callerFeishuUnionId) {
   if (scope.kind === "default") return void 0;
   if (scope.mode === "owner") {
     if (!ownerPrincipalId || !usersRoot) {
-      return { idleKillEnabled: false, personaMode: "owner", callerDisplayName };
+      return {
+        idleKillEnabled: false,
+        personaMode: "owner",
+        callerDisplayName,
+        callerDeviceId: ownerPrincipalId,
+        callerFeishuUnionId
+      };
     }
     const userWorkDir2 = deriveUserWorkDir(ownerPrincipalId, usersRoot);
     return {
@@ -41435,7 +41448,9 @@ function metaFromScope(scope, personaRoot, usersRoot, ownerPrincipalId, callerDi
       personaMode: "owner",
       userWorkDir: userWorkDir2,
       addDirs: [userWorkDir2],
-      callerDisplayName
+      callerDisplayName,
+      callerDeviceId: ownerPrincipalId,
+      callerFeishuUnionId
     };
   }
   const userWorkDir = deriveUserWorkDir(scope.capId, usersRoot);
@@ -41444,7 +41459,9 @@ function metaFromScope(scope, personaRoot, usersRoot, ownerPrincipalId, callerDi
     personaMode: "guest",
     userWorkDir,
     addDirs: [userWorkDir],
-    callerDisplayName
+    callerDisplayName,
+    callerDeviceId: scope.capId,
+    callerFeishuUnionId
   };
 }
 function scopeForFile(file, ownerPrincipalId) {
@@ -41844,30 +41861,61 @@ function buildRule(tool, input) {
 }
 
 // src/persona/connection-prompt.ts
-var OWNER_TEMPLATE = `# \u8FDE\u63A5\u4E0A\u4E0B\u6587
-\u4F60\u73B0\u5728\u4EE5 Owner \u8EAB\u4EFD\u88AB\u8FDE\u63A5\uFF0C\u5BF9\u65B9\u5C31\u662F owner \u672C\u4EBA\uFF08{ownerLabel}\uFF09\u3002
-\u81EA\u6211\u4ECB\u7ECD\u65F6\u4F7F\u7528\u7B2C\u4E00/\u7B2C\u4E8C\u4EBA\u79F0\uFF0C\u4F8B\u5982\u300C\u6211\u662F\u60A8\u7684 xxx \u52A9\u624B\u300D\u3002`;
-var GUEST_TEMPLATE = `# \u8FDE\u63A5\u4E0A\u4E0B\u6587
-\u4F60\u73B0\u5728\u4EE5 Guest \u8EAB\u4EFD\u88AB\u8FDE\u63A5\uFF0C\u672C persona \u7684 owner \u662F\u300C{ownerLabel}\u300D\uFF0C\u5F53\u524D\u5BF9\u8BDD\u7684\u5BF9\u65B9\u662F\u300C{guestLabel}\u300D\uFF0C\u4E0D\u662F owner \u672C\u4EBA\u3002
-\u81EA\u6211\u4ECB\u7ECD\u65F6\u7B2C\u4E09\u4EBA\u79F0\u6307\u4EE3 owner\u3001\u7B2C\u4E8C\u4EBA\u79F0\u79F0\u547C\u5BF9\u65B9\uFF0C\u4F8B\u5982\u300C{guestLabel}\uFF0C\u6211\u662F {ownerLabel} \u7684 xxx \u52A9\u624B\uFF0C\u4F60\u53EF\u4EE5\u901A\u8FC7\u6211\u770B\u5230\u4ED6\u7684 xxx\u300D\u3002\u4E0D\u8981\u628A\u5BF9\u65B9\u5F53\u6210 owner\uFF0C\u4E0D\u8981\u66FF owner \u505A\u51FA\u627F\u8BFA\u3002`;
+function renderIdentityLines(fields) {
+  const lines = [`- \u663E\u793A\u540D\uFF1A${fields.label}`];
+  if (fields.feishuUnionId) lines.push(`- \u98DE\u4E66 union_id\uFF1A${fields.feishuUnionId}`);
+  if (fields.deviceId) lines.push(`- \u8BBE\u5907 id\uFF1A${fields.deviceId}`);
+  if (fields.extraLastLine) lines.push(fields.extraLastLine);
+  return lines.join("\n");
+}
 function buildConnectionPrompt(args) {
-  let result;
-  if (args.mode === "guest") {
-    result = GUEST_TEMPLATE.replace(/\{ownerLabel\}/g, args.ownerLabel).replace(
-      /\{guestLabel\}/g,
-      args.guestLabel
+  const parts = ["# \u8FDE\u63A5\u4E0A\u4E0B\u6587"];
+  if (args.mode === "owner") {
+    parts.push("\u5F53\u524D\u8FDE\u63A5\u65B9\uFF08\u5C31\u662F owner \u672C\u4EBA\uFF09\uFF1A");
+    parts.push(
+      renderIdentityLines({
+        label: args.ownerLabel,
+        feishuUnionId: args.ownerFeishuUnionId,
+        deviceId: args.ownerDeviceId
+      })
     );
   } else {
-    result = OWNER_TEMPLATE.replace(/\{ownerLabel\}/g, args.ownerLabel);
+    parts.push("\u5F53\u524D\u8FDE\u63A5\u65B9\uFF08\u4E0D\u662F owner \u672C\u4EBA\uFF09\uFF1A");
+    parts.push(
+      renderIdentityLines({
+        label: args.guestLabel,
+        feishuUnionId: args.guestFeishuUnionId,
+        deviceId: args.guestDeviceId,
+        extraLastLine: "- \u8EAB\u4EFD\uFF1AGuest\uFF08\u8FDC\u7A0B\u8FDE\u63A5\u8FDB\u6765\u7684\u8054\u7CFB\u4EBA\uFF09"
+      })
+    );
+    parts.push("");
+    parts.push("\u672C persona \u7684 owner\uFF1A");
+    parts.push(
+      renderIdentityLines({
+        label: args.ownerLabel,
+        feishuUnionId: args.ownerFeishuUnionId,
+        deviceId: args.ownerDeviceId
+      })
+    );
   }
   if (args.workDir) {
-    result += `
-\u4F60\u7684\u6587\u4EF6\u5DE5\u4F5C\u76EE\u5F55\u662F ${args.workDir}\uFF0C\u8FD9\u4E2A\u76EE\u5F55\u5BF9\u4F60\u53EF\u8BFB\u53EF\u5199\uFF0C\u6587\u4EF6\u7684\u8BFB\u53D6/\u521B\u5EFA/\u4FEE\u6539\u90FD\u5728\u8FD9\u91CC\u8FDB\u884C\u3002`;
+    parts.push("");
+    let line = `\u4F60\u7684\u6587\u4EF6\u5DE5\u4F5C\u76EE\u5F55\u662F ${args.workDir}\uFF0C\u8FD9\u4E2A\u76EE\u5F55\u5BF9\u4F60\u53EF\u8BFB\u53EF\u5199\uFF0C\u6587\u4EF6\u7684\u8BFB\u53D6/\u521B\u5EFA/\u4FEE\u6539\u90FD\u5728\u8FD9\u91CC\u8FDB\u884C\u3002`;
     if (args.mode === "guest") {
-      result += "persona \u76EE\u5F55\u5BF9\u4F60\u53EA\u8BFB\uFF0C\u4E0D\u8981\u5F80\u91CC\u5199\u3002";
+      line += "persona \u76EE\u5F55\u5BF9\u4F60\u53EA\u8BFB\uFF0C\u4E0D\u8981\u5F80\u91CC\u5199\u3002";
     }
+    parts.push(line);
   }
-  return result;
+  parts.push("");
+  if (args.mode === "owner") {
+    parts.push("\u81EA\u6211\u4ECB\u7ECD\u65F6\u4F7F\u7528\u7B2C\u4E00/\u7B2C\u4E8C\u4EBA\u79F0\uFF0C\u4F8B\u5982\u300C\u6211\u662F\u60A8\u7684 xxx \u52A9\u624B\u300D\u3002");
+  } else {
+    parts.push(
+      `\u81EA\u6211\u4ECB\u7ECD\u65F6\u7B2C\u4E09\u4EBA\u79F0\u6307\u4EE3 owner\u3001\u7B2C\u4E8C\u4EBA\u79F0\u79F0\u547C\u5BF9\u65B9\uFF0C\u4F8B\u5982\u300C${args.guestLabel}\uFF0C\u6211\u662F ${args.ownerLabel} \u7684 xxx \u52A9\u624B\uFF0C\u4F60\u53EF\u4EE5\u901A\u8FC7\u6211\u770B\u5230\u4ED6\u7684 xxx\u300D\u3002\u4E0D\u8981\u628A\u5BF9\u65B9\u5F53\u6210 owner\uFF0C\u4E0D\u8981\u66FF owner \u505A\u51FA\u627F\u8BFA\u3002`
+    );
+  }
+  return parts.join("\n");
 }
 
 // src/persona/sharing-prompt.ts
@@ -41946,10 +41994,10 @@ var CONTACT_SSH_SYSTEM_PROMPT_HINT = `## \u8DE8\u8BBE\u5907\u6587\u4EF6\u8BBF\u9
    # execPath+cliPath\uFF0C\u4FDD\u8BC1 relay \u8DDF daemon \u7248\u672C\u540C\u6B65\u3002\u4E0D\u8981\u7528\u88F8 \`clawd\`\uFF08\u8D70 $PATH \u4F1A\u6F02\uFF09\u3002
    \`\`\`
 
-**A \u5EFA\u8BAE\u5728\u54EA\u4E9B\u76EE\u5F55\u5E72\u6D3B**\uFF1AA \u4FA7 jail \u8FDB shell \u524D\u4F1A\u628A\u5EFA\u8BAE\u76EE\u5F55\u5217\u8868\u5199\u5230 stderr\uFF08\u683C\u5F0F \`[clawd-ssh-jail] Suggested working directories for this contact: ...\`\uFF09\u4F5C\u4E3A\u53C2\u8003\u3002\u6CE8\u610F\uFF1A**\u6CA1\u6709\u76EE\u5F55\u7EA7\u5F3A\u5236\u9650\u5236**\u2014\u2014\u4F60\u8BBF\u95EE\u7684\u662F A \u673A\u5668\u4E0A\u8BE5 SSH \u7528\u6237\u6743\u9650\u5185\u7684\u6587\u4EF6\uFF0C\u8BF7\u53EA\u5728 A \u6388\u6743/\u9700\u8981\u7684\u8303\u56F4\u5185\u64CD\u4F5C\uFF0C\u4E0D\u8981\u8D8A\u754C\u7FFB\u770B\u65E0\u5173\u76EE\u5F55\u3002
+**\u4F60\u80FD\u8BBF\u95EE\u4EC0\u4E48**\uFF1A**\u6CA1\u6709\u76EE\u5F55\u7EA7\u9650\u5236**\u2014\u2014\u4F60\u4EE5 A \u673A\u5668\u4E0A\u8BE5 SSH \u7528\u6237\u7684\u6743\u9650\u8BBF\u95EE\u6587\u4EF6\uFF08\u7B49\u540C\u4E8E A \u7ED9\u4F60\u5F00\u4E86\u4E00\u4E2A shell\uFF09\u3002\u8BF7\u53EA\u5728 A \u6388\u6743/\u9700\u8981\u7684\u8303\u56F4\u5185\u64CD\u4F5C\uFF0C\u4E0D\u8981\u8D8A\u754C\u7FFB\u770B\u65E0\u5173\u76EE\u5F55\u3002
 
 **\u6CE8\u610F**\uFF1A
-- \u5EFA\u8BAE\u76EE\u5F55\u6570\u636E\u6E90\u5B9E\u65F6\uFF08jail \u6BCF\u6B21\u8BFB A \u4FA7\u6700\u65B0\u914D\u7F6E\uFF09\uFF0CA \u6539\u4E86 exposedDirs \u540E\u4F60\u4E0B\u4E00\u6B21\u62E8\u53F7\u7ACB\u5373\u611F\u77E5
+- \u6388\u6743\u662F\u5B9E\u65F6\u7684\uFF1AA \u64A4\u9500 sshAllowed \u540E\u4F60\u4E0B\u4E00\u6B21\u62E8\u53F7\u7ACB\u5373\u5931\u6548\uFF08authorized_keys \u7ACB\u5373\u5237\uFF09
 - \u6392\u969C\uFF1A\u672C\u673A debug \u65E5\u5FD7\u5728 \`~/.clawd/log/contact-ssh.log\`\uFF08\u7528\u6237\u53EF \`tail -f\` \u770B\u6BCF\u4E00\u6B65\uFF09\uFF0C\u4F60\u51FA\u9519\u65F6\u544A\u8BC9\u7528\u6237\u67E5\u8FD9\u4E2A\u6587\u4EF6
 - \u5982\u679C \`ls ~/.clawd/contact-ssh-keys/\` \u4E3A\u7A7A\uFF0C\u8BF4\u660E\u8FD8\u6CA1\u6709\u5BF9\u7AEF\u6388\u6743\u4F60\u6216 key \u8FD8\u6CA1\u62C9\u5230\uFF08B \u4FA7 daemon \u6BCF 60s \u4E00\u6B21\u81EA\u52A8\u62C9\uFF09\uFF0C\u5982\u5B9E\u544A\u8BC9\u7528\u6237
 `;
@@ -42065,13 +42113,19 @@ function buildSpawnContext(state, deps) {
       promptArgs = {
         mode: "guest",
         ownerLabel: deps.ownerDisplayName,
+        ownerDeviceId: deps.ownerDeviceId,
+        ownerFeishuUnionId: deps.ownerFeishuUnionId,
         guestLabel: meta.callerDisplayName,
+        guestDeviceId: meta.callerDeviceId,
+        guestFeishuUnionId: meta.callerFeishuUnionId,
         workDir: meta.userWorkDir
       };
     } else {
       promptArgs = {
         mode: "owner",
         ownerLabel: meta.callerDisplayName ?? deps.ownerDisplayName,
+        ownerDeviceId: meta.callerDeviceId ?? deps.ownerDeviceId,
+        ownerFeishuUnionId: meta.callerFeishuUnionId ?? deps.ownerFeishuUnionId,
         workDir: meta.userWorkDir
       };
     }
@@ -42856,6 +42910,8 @@ var SessionRunner = class {
       resolveContextWindow: this.hooks.resolveContextWindow,
       genUuid: this.hooks.genUuid ?? v4_default,
       ownerDisplayName: this.hooks.ownerDisplayName,
+      ownerDeviceId: this.hooks.ownerDeviceId,
+      ownerFeishuUnionId: this.hooks.ownerFeishuUnionId,
       personaRoot: this.hooks.personaRoot,
       // 单栏 refactor (spec 2026-06-02 §5.1): cc 子进程 env 注入 CLAWD_DAEMON_URL，让 assistant
       // curl daemon HTTP RPC adapter (/api/rpc/<method>) 触发管理操作。null = HTTP adapter 未启。
@@ -43634,12 +43690,14 @@ var SessionManager = class {
     const adapter = this.deps.getAdapter(file.tool ?? "claude");
     const store = this.storeFor(scope);
     const callerDisplayName = file.creatorDisplayName ?? (scope.kind === "persona" ? scope.mode === "owner" ? this.deps.ownerDisplayName : this.deps.contactStore?.get(scope.capId)?.displayName : void 0);
+    const callerFeishuUnionId = file.creatorFeishuUnionId ?? (scope.kind === "persona" && scope.mode === "owner" ? this.deps.ownerFeishuUnionId : void 0);
     const subSessionMeta = metaFromScope(
       scope,
       this.deps.personaRoot ?? "",
       this.deps.usersRoot ?? "",
       this.deps.ownerPrincipalId,
-      callerDisplayName
+      callerDisplayName,
+      callerFeishuUnionId
     );
     if (subSessionMeta?.userWorkDir) {
       import_node_fs9.default.mkdirSync(subSessionMeta.userWorkDir, { recursive: true });
@@ -43686,6 +43744,11 @@ var SessionManager = class {
       // personaStore 不再透给 runner hooks（in-place mention 注入路径已删，runner 不用）；
       // manager 自身的 sandbox 派生仍直接读 this.deps.personaStore。
       ownerDisplayName: this.deps.ownerDisplayName,
+      // T-31 persona prompt injection：owner 设备 id（= ownerPrincipalId）+ 飞书 union_id
+      // 供 reducer 组 promptArgs 时作为「本 persona 的 owner」身份卡数据源（guest session 用）
+      // 或「当前连接方」身份卡的兜底源（owner session 老路径未 stamp caller 时）。
+      ownerDeviceId: this.deps.ownerPrincipalId,
+      ownerFeishuUnionId: this.deps.ownerFeishuUnionId,
       // Phase 2 capability platform (plan §3): 透传 personaRoot, buildSpawnArgs 据
       // cwd 是否在 personaRoot 下自动决定是否注入 --settings sandbox-settings.json.
       personaRoot: this.deps.personaRoot,
@@ -43801,7 +43864,7 @@ var SessionManager = class {
     }
   }
   // ---- 命令方法：均返回 { response, broadcast[] }，由 dispatcher 聚合 ----
-  create(args, creatorPrincipalId, creatorDisplayName) {
+  create(args, creatorPrincipalId, creatorDisplayName, creatorFeishuUnionId) {
     let cwd;
     if (args.ownerPersonaId) {
       cwd = derivePersonaSpawnCwd(
@@ -43846,6 +43909,7 @@ var SessionManager = class {
       ephemeral: args.ephemeral,
       creatorPrincipalId,
       creatorDisplayName,
+      ...creatorFeishuUnionId ? { creatorFeishuUnionId } : {},
       createdAt: iso,
       updatedAt: iso
     };
@@ -44616,7 +44680,9 @@ var SessionManager = class {
       // creatorDisplayName = A 的 displayName，供 guest meta callerDisplayName（reducer 要求）。
       ...args.guestPrincipalId ? {
         creatorPrincipalId: args.guestPrincipalId,
-        ...args.guestDisplayName ? { creatorDisplayName: args.guestDisplayName } : {}
+        ...args.guestDisplayName ? { creatorDisplayName: args.guestDisplayName } : {},
+        // T-31: A 的飞书 union_id stamp 到 B 的 SessionFile；guest meta 由 newRunner 派生
+        ...args.guestFeishuUnionId ? { creatorFeishuUnionId: args.guestFeishuUnionId } : {}
       } : {},
       // T-20：dispatch model override 落盘（reducer spawn 路径读 SessionFile.model 生成 --model flag）
       ...args.model ? { model: args.model } : {},
@@ -48890,6 +48956,8 @@ function buildPersonaDispatchHandlers(deps) {
         prompt: args.prompt,
         guestPrincipalId: ctx.principal.id,
         guestDisplayName: ctx.principal.displayName,
+        // T-31: 把 A 的飞书 union_id 透传给 B（connectGuestContext 已把它挂在 principal.feishuUnionId）
+        ...ctx.principal.feishuUnionId ? { guestFeishuUnionId: ctx.principal.feishuUnionId } : {},
         ...args.model ? { model: args.model } : {}
       }).then(() => logger?.info("dispatch.spawnB.ok", { dispatchId: dispatchId2 })).catch((err) => {
         const reason = err instanceof Error ? err.message : String(err);
@@ -50662,7 +50730,7 @@ function ownerContext(ownerPrincipalId, displayName, feishuUnionId) {
 }
 function connectGuestContext(subDevice, subOwner, provider, displayName) {
   return {
-    principal: { id: subDevice, kind: "guest", displayName },
+    principal: { id: subDevice, kind: "guest", displayName, feishuUnionId: subOwner },
     grants: PERSONAL_CAP_GRANTS.map((g2) => ({
       resource: { ...g2.resource },
       actions: [...g2.actions]
@@ -51144,9 +51212,8 @@ var ContactStore = class {
     return true;
   }
   /**
-   * 更新单条 contact 的 SSH 授权（PR: contact-ssh-sandbox）。对齐 setPin pattern：
-   * store 只做原始 mutation，不做业务校验（如"sshAllowed=false 时清空 exposedDirs"）——
-   * 那是 handler / UI 的责任。数组语义是完全替换（不 append）。
+   * 更新单条 contact 的 SSH 授权开关（对齐 setPin pattern）。T-29 去沙箱后只改 sshAllowed；
+   * exposedDirs 已废弃，本方法不再触碰它（保留 contact 原值不动）。
    * @returns 是否命中：deviceId 不存在返 false；命中即 flush.
    */
   setSshAccess(deviceId, opts) {
@@ -51154,8 +51221,7 @@ var ContactStore = class {
     if (!existing) return false;
     this.contacts.set(deviceId, {
       ...existing,
-      sshAllowed: opts.sshAllowed,
-      exposedDirs: opts.exposedDirs
+      sshAllowed: opts.sshAllowed
     });
     this.flush();
     return true;
@@ -53464,8 +53530,8 @@ var CLAWD_SSH_JAIL_SCRIPT = String.raw`#!/usr/bin/env bash
 # 真实请求（interactive shell 时为空）。
 #
 # 职责:
-#   1. 读 ~/.clawd/contacts.json 校验 contact.sshAllowed，读 exposedDirs 作为提示
-#   2. 直接 exec shell（去沙箱后无目录级限制；exposedDirs 仅 echo 给对端参考）
+#   1. 读 ~/.clawd/contacts.json 校验 contact.sshAllowed（不通过即拒）
+#   2. 直接 exec shell（去沙箱后无目录级限制）
 
 set -euo pipefail
 
@@ -53492,13 +53558,15 @@ log_line INFO jail.entered "clawd-ssh-jail 起来 device=${"${DEVICE_ID}"} cmd=$
 
 CONTACTS="${"${HOME}"}/.clawd/contacts.json"
 if [ ! -f "$CONTACTS" ]; then
-  log_line ERROR jail.entered "contacts.json 不存在，无法查 exposedDirs"
+  log_line ERROR jail.entered "contacts.json 不存在，无法校验 sshAllowed"
   echo "clawd-ssh-jail: contacts.json missing" >&2
   exit 1
 fi
 
-# 读 contact 的 exposedDirs (mac/linux 都自带 python3)
-EXPOSED_JSON=$(python3 -c "
+# 校验该 contact 的 sshAllowed（mac/linux 都自带 python3）。去沙箱后不再读目录白名单：
+#   sshAllowed=false → DENIED exit 2；deviceId 未命中 → NOT_FOUND exit 3；命中且允许 → exit 0。
+# set -e 下 python 非 0 退出即终止脚本（不进 exec），只有 exit 0 才继续 exec shell。
+python3 -c "
 import json, sys
 with open('$CONTACTS') as f:
     data = json.load(f)
@@ -53506,25 +53574,11 @@ for c in data.get('contacts', []):
     if c.get('deviceId') == '$DEVICE_ID':
         if not c.get('sshAllowed'):
             print('DENIED', file=sys.stderr); sys.exit(2)
-        for d in c.get('exposedDirs', []):
-            print(d)
         sys.exit(0)
-sys.exit(3)
-")
-
-# exposedDirs 可能为空（sshAllowed=true 但未配目录）——去沙箱后不再因空目录拒绝，直接放行。
-if [ -n "$EXPOSED_JSON" ]; then
-  log_line INFO jail.entered "exposedDirs 提示已加载，放行 exec shell"
-  # 告知 SSH client 建议目录（发到 stderr）。去沙箱后这些只是建议，不做目录级强制限制；
-  # exposedDirs 仅供对端参考，运行时读，A 改后下次拨号即感知。
-  echo "[clawd-ssh-jail] Suggested working directories for this contact:" >&2
-  while IFS= read -r d; do
-    echo "  - $d" >&2
-  done <<< "$EXPOSED_JSON"
-  echo "[clawd-ssh-jail] Note: no directory-level restriction is enforced." >&2
-else
-  log_line INFO jail.entered "sshAllowed=true 且未配 exposedDirs，直接放行 exec shell"
-fi
+print('NOT_FOUND', file=sys.stderr); sys.exit(3)
+"
+
+log_line INFO jail.entered "sshAllowed 校验通过，放行 exec shell"
 
 CMD="${"${SSH_ORIGINAL_COMMAND:-}"}"
 if [ -z "$CMD" ]; then
@@ -54920,10 +54974,12 @@ function buildSessionHandlers(deps) {
     ensurePersonaAccess(ctx, args.ownerPersonaId, "send");
     const creatorPrincipalId = ctx?.principal.id ?? ownerPrincipalId;
     const creatorDisplayName = ctx?.principal.displayName ?? "Owner";
+    const creatorFeishuUnionId = ctx?.principal.feishuUnionId;
     const { response, broadcast } = manager.create(
       { ...args, tool },
       creatorPrincipalId,
-      creatorDisplayName
+      creatorDisplayName,
+      creatorFeishuUnionId
     );
     return { response: { type: "session:info", ...response }, broadcast };
   };
@@ -55995,8 +56051,7 @@ function buildContactSshHandlers(deps) {
     const { type: _t, requestId: _r, ...rest } = frame;
     const args = ContactSetSshAccessArgsSchema.parse(rest);
     const hit = deps.store.setSshAccess(args.deviceId, {
-      sshAllowed: args.sshAllowed,
-      exposedDirs: args.exposedDirs
+      sshAllowed: args.sshAllowed
     });
     if (!hit) {
       sshLog.warn("authz.setSshAccess", "owner \u5C1D\u8BD5\u6539 SSH \u6388\u6743\u4F46 contact \u4E0D\u5728 store", {
@@ -56010,21 +56065,18 @@ function buildContactSshHandlers(deps) {
     rebuildAuthorizedKeys(deps.store, deps.sshdDir);
     sshLog.info("authz.setSshAccess", "owner \u6539\u4E86 SSH \u6388\u6743 \u2192 authorized_keys \u5DF2\u91CD\u5EFA", {
       peerDeviceId: args.deviceId,
-      sshAllowed: args.sshAllowed,
-      exposedDirs: args.exposedDirs
+      sshAllowed: args.sshAllowed
     });
     deps.broadcast({
       type: "contact:ssh-access-updated",
       deviceId: args.deviceId,
-      sshAllowed: args.sshAllowed,
-      exposedDirs: args.exposedDirs
+      sshAllowed: args.sshAllowed
     });
     return {
       response: {
         type: "contact:setSshAccess:ok",
         deviceId: args.deviceId,
-        sshAllowed: args.sshAllowed,
-        exposedDirs: args.exposedDirs
+        sshAllowed: args.sshAllowed
       }
     };
   };
@@ -60227,6 +60279,8 @@ async function startDaemon(config) {
         // B 角色（跨设备）：非空 → guest scope + creatorPrincipalId/creatorDisplayName = A。
         guestPrincipalId: args.guestPrincipalId,
         guestDisplayName: args.guestDisplayName,
+        // T-31: 把 A 的飞书 union_id stamp 到 B SessionFile，供 cc prompt 身份卡 union_id 行
+        guestFeishuUnionId: args.guestFeishuUnionId,
         // T-20: 可选 model override 透到 SessionFile.model
         ...args.model ? { model: args.model } : {}
       });

package/dist/dispatch/mcp-server.cjs

@@ -39876,6 +39876,14 @@ var SessionFileSchema = external_exports.object({
    * 或 deps.ownerDisplayName（owner）。
    */
   creatorDisplayName: external_exports.string().min(1).optional(),
+  /**
+   * 创建该 session 的连接者飞书 union_id（一次性 stamp，T-31 persona prompt injection）。
+   * session:create / dispatch spawnB handler 从 ctx.principal.feishuUnionId（guest 场景来自
+   * connect token subOwner）或 deps.ownerFeishuUnionId（owner 场景）传入；newRunner 时读这个
+   * 字段派生 SubSessionMeta.callerFeishuUnionId 注入 cc system prompt「身份卡」的 union_id 行。
+   * Optional：老 SessionFile / owner 未登飞书路径缺省，缺省时 prompt 不渲染该行（向后兼容）。
+   */
+  creatorFeishuUnionId: external_exports.string().min(1).optional(),
   /**
    * Mirror peer sessions (2026-05-26): mirror 标识。**我在朋友 daemon 上创建的 session**，
    * 远端是 source of truth，本机是持久化副本，方便 sidebar 跨设备聚合。
@@ -40747,8 +40755,10 @@ var ContactSchema = external_exports.object({
    */
   sshAllowed: external_exports.boolean().default(false),
   /**
-   * 授权访问的目录白名单（绝对路径）。空数组 + sshAllowed=true 意味 SSH 通道能拨到但无处可读，
-   * jail 会拒绝 shell 启动。由 clawd-ssh-jail 运行时读，生成 sbpl / bwrap policy 白名单。
+   * @deprecated T-29 去沙箱后废弃。原为授权访问的目录白名单（clawd-ssh-jail 生成 sbpl/bwrap
+   * policy 用）；去掉 OS 沙箱后不再有目录级限制，SSH 授权即 on/off（见 sshAllowed）。
+   * 字段仅为兼容老 contacts.json 保留（default [] 保证 strict parse 不炸），不再有代码读写它，
+   * 也不再进 setSshAccess RPC / ContactSettingsDrawer / jail。勿新增消费方。
    */
   exposedDirs: external_exports.array(external_exports.string()).default([])
 }).strict();
@@ -40790,14 +40800,12 @@ var ContactPinnedFrameSchema = external_exports.object({
 // ../protocol/src/contact-ssh.ts
 var ContactSetSshAccessArgsSchema = external_exports.object({
   deviceId: external_exports.string().min(1),
-  sshAllowed: external_exports.boolean(),
-  exposedDirs: external_exports.array(external_exports.string())
+  sshAllowed: external_exports.boolean()
 }).strict();
 var ContactSetSshAccessOkSchema = external_exports.object({
   type: external_exports.literal("contact:setSshAccess:ok"),
   deviceId: external_exports.string().min(1),
-  sshAllowed: external_exports.boolean(),
-  exposedDirs: external_exports.array(external_exports.string())
+  sshAllowed: external_exports.boolean()
 }).strict();
 var ContactSshKeyIssueArgsSchema = external_exports.object({
   deviceId: external_exports.string().min(1)
@@ -40810,8 +40818,7 @@ var ContactSshKeyIssueOkSchema = external_exports.object({
 var ContactSshAccessUpdatedFrameSchema = external_exports.object({
   type: external_exports.literal("contact:ssh-access-updated"),
   deviceId: external_exports.string().min(1),
-  sshAllowed: external_exports.boolean(),
-  exposedDirs: external_exports.array(external_exports.string())
+  sshAllowed: external_exports.boolean()
 }).strict();
 
 // ../protocol/src/extension.ts