@clawos-dev/clawd 0.2.524 → 0.2.526

package/dist/cli.cjs

@@ -6450,7 +6450,7 @@ var init_feishu_auth = __esm({
       // mirror peer sessions（远端会话镜像）
       "peerSession:upsert",
       "peerSession:remove",
-      // 设备目录 + 连接（决策 #15：daemon 代理中心 server，需要 owner 的 ttcJwt）
+      // 设备目录 + 连接（决策 #15：daemon 代理中心 server，需要 owner 的登录票）
       "device:list",
       "device:connect",
       // iOS TestFlight 意向登记（需要 owner unionId 上报中心 server）
@@ -6520,13 +6520,7 @@ var init_feishu_auth = __esm({
        * 设备属性，与登录态无关、登录登出不变。UI"我的设备标识"用它拼
        * clawos://device/<deviceId>（替代旧的 unionId——不再向外暴露人的身份标识）。
        */
-      deviceId: external_exports.string().min(1),
-      /**
-       * TTC JWT 过期时间（unix ms）。null = 登录回调未携带 expires_at；字段缺省 = 老 daemon。
-       * 仅时间戳——token 本体永不出 ws（spec §9 不变）。UI 据此派生 过期/临期 提示
-       * （见 spec 2026-08-17-ttc-jwt-expiry-ux-design §2）。
-       */
-      ttcTokenExpiresAt: external_exports.number().nullable().optional()
+      deviceId: external_exports.string().min(1)
     });
     AuthLogoutResponseSchema = external_exports.object({
       type: external_exports.literal("auth:logout:ok")
@@ -9309,7 +9303,7 @@ var init_methods = __esm({
         args: NO_ARGS
       },
       "auth:getIdentity": {
-        summary: "\u53D6\u672C\u673A owner \u7684\u98DE\u4E66\u8EAB\u4EFD\uFF08ownerId / provider / displayName / unionId\uFF09+ **\u672C\u673A deviceId**\uFF08\u8BBE\u5907\u5C5E\u6027\uFF0C\u4E0E\u767B\u5F55\u6001\u65E0\u5173\uFF1Bdevice:connect / contact:* / inbox:* \u7684\u4E3B\u952E\u90FD\u662F\u5B83\uFF09\uFF1B\u7EDD\u4E0D\u8FD4\u56DE ttcToken",
+        summary: "\u53D6\u672C\u673A owner \u7684\u98DE\u4E66\u8EAB\u4EFD\uFF08ownerId / provider / displayName / unionId\uFF09+ **\u672C\u673A deviceId**\uFF08\u8BBE\u5907\u5C5E\u6027\uFF0C\u4E0E\u767B\u5F55\u6001\u65E0\u5173\uFF1Bdevice:connect / contact:* / inbox:* \u7684\u4E3B\u952E\u90FD\u662F\u5B83\uFF09\uFF1B\u7EDD\u4E0D\u8FD4\u56DE\u767B\u5F55\u7968",
         args: NO_ARGS
       },
       "auth:logout": {
@@ -60156,8 +60150,7 @@ function buildLarkBotHandlers(deps) {
     const { personaId: personaId2 } = parseArgs2(LarkBotProvisionArgs, frame, "larkBot:provision");
     const tunnelUrl = deps.getTunnelUrl();
     if (!tunnelUrl) throw new Error("larkBot provision requires tunnel to be up");
-    const ownerId = deps.getOwnerId();
-    if (!ownerId) throw new Error("larkBot provision requires feishu login (owner identity)");
+    if (!deps.getOwnerId()) throw new Error("larkBot provision requires feishu login (owner identity)");
     if (deps.store.read(personaId2)) throw new Error(`larkBot already bound: ${personaId2}`);
     if (inFlight.has(personaId2)) throw new Error(`larkBot provision already in flight: ${personaId2}`);
     const botName = deps.getPersonaName(personaId2) ?? personaId2;
@@ -60166,12 +60159,7 @@ function buildLarkBotHandlers(deps) {
     let qrUrl;
     try {
       ;
-      ({ provisionId, qrUrl } = await deps.cloud.provisionBegin({
-        personaId: personaId2,
-        botName,
-        tunnelUrl,
-        ownerId
-      }));
+      ({ provisionId, qrUrl } = await deps.cloud.provisionBegin({ personaId: personaId2, botName, tunnelUrl }));
     } catch (err) {
       inFlight.delete(personaId2);
       throw err;
@@ -60340,11 +60328,10 @@ function buildLarkBotHandlers(deps) {
     if (inFlight.has(personaId2)) throw new Error(`larkBot provision already in flight: ${personaId2}`);
     const tunnelUrl = deps.getTunnelUrl();
     if (!tunnelUrl) throw new Error("larkBot bind requires tunnel to be up");
-    const ownerId = deps.getOwnerId();
-    if (!ownerId) throw new Error("larkBot bind requires feishu login (owner identity)");
+    if (!deps.getOwnerId()) throw new Error("larkBot bind requires feishu login (owner identity)");
     const name = botName ?? deps.getPersonaName(personaId2) ?? personaId2;
     upgradeInFlight.delete(personaId2);
-    await deps.cloud.bind({ personaId: personaId2, appId, appSecret, botName: name, tunnelUrl, ownerId });
+    await deps.cloud.bind({ personaId: personaId2, appId, appSecret, botName: name, tunnelUrl });
     deps.store.write(personaId2, { appId, botName: name, boundAt: now() });
     emit(personaId2, { state: "bound", appId, botName: name, groups: groupsOf(personaId2) });
     return { response: { type: "larkBot:bindManual:ok" } };
@@ -60510,21 +60497,22 @@ function createLarkBotCloudClient(opts) {
   const f2 = opts.fetchImpl ?? globalThis.fetch;
   if (!f2) throw new Error("fetch is not available (Node >= 18 required)");
   const base = opts.api.replace(/\/+$/, "");
+  function authHeaders() {
+    const pass = opts.getLoginPass();
+    if (!pass) throw new LarkBotCloudError("lark-bot cloud: no login pass (login / restart to obtain one)", 401);
+    return { authorization: `Bearer ${pass}` };
+  }
   async function request(method, pathname, body) {
+    const headers = authHeaders();
+    const url = `${base}${pathname}`;
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? 15e3);
     let res;
     try {
-      res = await f2(`${base}${pathname}`, {
+      res = await f2(url, {
         method,
         signal: ac.signal,
-        headers: {
-          authorization: `Bearer ${opts.apiKey}`,
-          "x-did": encodeURIComponent(opts.deviceId),
-          "x-name": encodeURIComponent(opts.displayName),
-          "x-scene": "daemon",
-          "content-type": "application/json"
-        },
+        headers: { ...headers, "content-type": "application/json" },
         body: body ? JSON.stringify(body) : void 0
       });
     } catch (err) {
@@ -60606,8 +60594,6 @@ function createLarkBotCloudClient(opts) {
       });
     },
     async fetchResource(appId, messageId, fileKey, maxBytes, type) {
-      const ac = new AbortController();
-      const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? 15e3);
       const qs = new URLSearchParams({
         appId,
         messageId,
@@ -60615,18 +60601,13 @@ function createLarkBotCloudClient(opts) {
         ...maxBytes ? { maxBytes: String(maxBytes) } : {},
         ...type ? { type } : {}
       }).toString();
+      const headers = authHeaders();
+      const url = `${base}/api/lark-bot/resource?${qs}`;
+      const ac = new AbortController();
+      const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? 15e3);
       let res;
       try {
-        res = await f2(`${base}/api/lark-bot/resource?${qs}`, {
-          method: "GET",
-          signal: ac.signal,
-          headers: {
-            authorization: `Bearer ${opts.apiKey}`,
-            "x-did": encodeURIComponent(opts.deviceId),
-            "x-name": encodeURIComponent(opts.displayName),
-            "x-scene": "daemon"
-          }
-        });
+        res = await f2(url, { method: "GET", signal: ac.signal, headers });
       } catch (err) {
         throw new LarkBotCloudError(`lark-bot cloud resource fetch failed: ${err.message}`);
       } finally {
@@ -62157,7 +62138,7 @@ async function centralRequest(opts, path101, init) {
   }
   clearTimeout(timer);
   if (res.status === 401) {
-    throw new CentralClientError("UNAUTHORIZED", "TTC JWT invalid or expired");
+    throw new CentralClientError("UNAUTHORIZED", "login pass rejected by center");
   }
   if (!res.ok) {
     let detail = "";
@@ -62177,12 +62158,8 @@ async function centralRequest(opts, path101, init) {
 async function centralExchange(opts) {
   const body = await centralRequest(opts, "/api/clawd-identity/exchange", {
     method: "POST",
-    body: {
-      jwt: opts.jwt,
-      provider: opts.provider,
-      deviceId: opts.deviceId,
-      selfDeviceId: opts.selfDeviceId
-    }
+    bearer: opts.loginPass,
+    body: { deviceId: opts.deviceId }
   });
   if (typeof body.token !== "string" || body.token.length === 0 || typeof body.ownerId !== "string" || typeof body.provider !== "string" || typeof body.displayName !== "string") {
     throw new CentralClientError("BAD_RESPONSE", "exchange: missing token/ownerId/provider/displayName");
@@ -62202,10 +62179,8 @@ async function centralGetPublicKey(opts) {
 async function centralUpsertDevice(opts) {
   const body = await centralRequest(opts, "/api/clawd-identity/devices/self", {
     method: "PUT",
-    bearer: opts.ttcJwt,
+    bearer: opts.loginPass,
     body: {
-      deviceId: opts.deviceId,
-      provider: opts.provider,
       ...opts.url ? { url: opts.url } : {},
       ...opts.name ? { name: opts.name } : {}
     }
@@ -62226,11 +62201,10 @@ async function centralPrincipalStatus(opts) {
   return { active: body.active };
 }
 async function centralGetApiKey(opts) {
-  const body = await centralRequest(
-    opts,
-    `/api/persona-cloud/api-key?provider=${encodeURIComponent(opts.provider)}`,
-    { method: "GET", bearer: opts.ttcJwt }
-  );
+  const body = await centralRequest(opts, "/api/persona-cloud/api-key", {
+    method: "GET",
+    bearer: opts.loginPass
+  });
   if (body.apiKey !== null && typeof body.apiKey !== "string") {
     throw new CentralClientError("BAD_RESPONSE", "api-key: apiKey must be string or null");
   }
@@ -62244,8 +62218,7 @@ async function centralGetApiKey(opts) {
 async function centralIssueApiKey(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/api-key", {
     method: "POST",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider }
+    bearer: opts.loginPass
   });
   if (typeof body.apiKey !== "string" || body.apiKey.length === 0) {
     throw new CentralClientError("BAD_RESPONSE", "api-key: missing apiKey");
@@ -62260,11 +62233,10 @@ async function centralIssueApiKey(opts) {
   };
 }
 async function centralListDevices(opts) {
-  const body = await centralRequest(
-    opts,
-    `/api/clawd-identity/devices?provider=${encodeURIComponent(opts.provider)}`,
-    { method: "GET", bearer: opts.ttcJwt }
-  );
+  const body = await centralRequest(opts, "/api/clawd-identity/devices", {
+    method: "GET",
+    bearer: opts.loginPass
+  });
   if (!Array.isArray(body.devices)) {
     throw new CentralClientError("BAD_RESPONSE", "devices: missing devices array");
   }
@@ -62281,8 +62253,8 @@ async function centralListDevices(opts) {
 async function centralConnectorsMine(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/connectors/mine", {
     method: "POST",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider, personaId: opts.personaId, connectors: opts.connectors }
+    bearer: opts.loginPass,
+    body: { personaId: opts.personaId, connectors: opts.connectors }
   });
   if (!Array.isArray(body.connectors)) throw new CentralClientError("BAD_RESPONSE", "connectors/mine: missing connectors array");
   return { connectors: body.connectors };
@@ -62290,16 +62262,16 @@ async function centralConnectorsMine(opts) {
 async function centralConnectorFill(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/connectors/fields", {
     method: "PUT",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider, connector: opts.connector, values: opts.values }
+    bearer: opts.loginPass,
+    body: { connector: opts.connector, values: opts.values }
   });
   if (body.ok !== true) throw new CentralClientError("BAD_RESPONSE", "connectors/fields: server did not ack ok");
 }
 async function centralGithubAuthOauthStart(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/github/oauth/start", {
     method: "POST",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider, ...opts.returnTo ? { returnTo: opts.returnTo } : {} }
+    bearer: opts.loginPass,
+    body: { ...opts.returnTo ? { returnTo: opts.returnTo } : {} }
   });
   if (typeof body.authUrl !== "string" || !body.authUrl) throw new CentralClientError("BAD_RESPONSE", "github/oauth/start: missing authUrl");
   return { authUrl: body.authUrl };
@@ -62307,8 +62279,8 @@ async function centralGithubAuthOauthStart(opts) {
 async function centralGithubAuthToken(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/github/oauth/token", {
     method: "POST",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider }
+    bearer: opts.loginPass,
+    body: {}
   });
   if (body.token === null || body.token === void 0) return void 0;
   if (typeof body.token !== "string" || !body.token) throw new CentralClientError("BAD_RESPONSE", "github/oauth/token: malformed token");
@@ -62347,10 +62319,10 @@ var CloudGatewayClient = class {
   deps;
   fetchImpl;
   async credentials() {
-    const rec5 = this.deps.readIdentity();
-    if (!rec5) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "\u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7528\u4E0D\u4E86");
+    const loginPass = this.deps.getLoginPass();
+    if (!loginPass) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "\u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7528\u4E0D\u4E86");
     const get = this.deps.getApiKey ?? ((args) => centralGetApiKey({ api: this.deps.centralApi ?? "", fetchImpl: this.fetchImpl, ...args }));
-    const { apiKey, gatewayUrl } = await get({ ttcJwt: rec5.ttcToken, provider: rec5.provider });
+    const { apiKey, gatewayUrl } = await get({ loginPass });
     if (!apiKey) throw new Error("\u8FD8\u6CA1\u751F\u6210\u4E91 persona \u7684\u8C03\u7528 key\uFF0C\u53BB\u300C\u8BBE\u7F6E \u2192 \u4E91\u4E0A persona\u300D\u751F\u6210\u4E00\u628A");
     if (!gatewayUrl) throw new Error("\u4E2D\u5FC3\u6CA1\u914D\u4E91 gateway \u5730\u5740\uFF08gatewayUrl \u4E3A\u7A7A\uFF09");
     return { apiKey, gatewayUrl: trimSlash(gatewayUrl) };
@@ -65906,8 +65878,7 @@ async function importZip(buf, root) {
 function parseLoginCallbackQuery(url) {
   return {
     token: url.searchParams.get("token") ?? "",
-    state: url.searchParams.get("state") ?? "",
-    expiresAt: url.searchParams.get("expires_at")
+    state: url.searchParams.get("state") ?? ""
   };
 }
 function escapeHtml(s2) {
@@ -67568,7 +67539,7 @@ var OwnerIdentityStore = class {
       return null;
     }
     const r2 = parsed;
-    if (!r2.identity || typeof r2.identity.ownerId !== "string" || r2.identity.ownerId.length === 0 || typeof r2.identity.provider !== "string" || r2.identity.provider.length === 0 || typeof r2.identity.displayName !== "string" || r2.identity.displayName.length === 0 || typeof r2.ttcToken !== "string" || r2.ttcToken.length === 0) {
+    if (!r2.identity || typeof r2.identity.ownerId !== "string" || r2.identity.ownerId.length === 0 || typeof r2.identity.provider !== "string" || r2.identity.provider.length === 0 || typeof r2.identity.displayName !== "string" || r2.identity.displayName.length === 0 || typeof r2.loginPass !== "string" || r2.loginPass.length === 0) {
       return null;
     }
     return {
@@ -67579,8 +67550,7 @@ var OwnerIdentityStore = class {
         ...typeof r2.identity.avatarUrl === "string" ? { avatarUrl: r2.identity.avatarUrl } : {},
         ...typeof r2.identity.unionId === "string" ? { unionId: r2.identity.unionId } : {}
       },
-      ttcToken: r2.ttcToken,
-      ttcTokenExpiresAt: typeof r2.ttcTokenExpiresAt === "number" ? r2.ttcTokenExpiresAt : null,
+      loginPass: r2.loginPass,
       loginAt: typeof r2.loginAt === "string" ? r2.loginAt : (/* @__PURE__ */ new Date(0)).toISOString()
     };
   }
@@ -67644,23 +67614,23 @@ var LoginFlow = class {
     if (!identity.unionId) {
       return { ok: false, reason: "union_id missing from TTC user_info" };
     }
+    let loginPass;
     try {
-      await this.deps.upsertBinding({
+      ;
+      ({ loginPass } = await this.deps.upsertBinding({
         deviceId: this.deps.getDeviceId(),
         ttcToken: params.token,
         identity
-      });
+      }));
     } catch (err) {
       return {
         ok: false,
         reason: `device_binding upsert failed: ${err.message}`
       };
     }
-    const expiresAtNum = params.expiresAt ? Number.parseInt(params.expiresAt, 10) : NaN;
     this.deps.store.write({
       identity,
-      ttcToken: params.token,
-      ttcTokenExpiresAt: Number.isFinite(expiresAtNum) ? expiresAtNum : null,
+      loginPass,
       loginAt: new Date(now).toISOString()
     });
     return { ok: true, identity };
@@ -67766,6 +67736,15 @@ async function upsertDeviceBinding(opts) {
     }
     throw new DeviceBindingClientError("API_ERROR", `HTTP ${res.status}: ${detail}`);
   }
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+  }
+  if (typeof body.loginPass !== "string" || body.loginPass.length === 0) {
+    throw new DeviceBindingClientError("BAD_RESPONSE", "center did not issue a login pass (api too old?)");
+  }
+  return { loginPass: body.loginPass };
 }
 
 // src/contact/org-mesh.ts
@@ -67789,12 +67768,7 @@ async function fetchOrgPeers(opts) {
     res = await doFetch(`${opts.apiUrl}/api/device-bindings/org-peers`, {
       method: "GET",
       signal: ac.signal,
-      headers: {
-        authorization: `Bearer ${opts.apiKey}`,
-        "x-did": encodeURIComponent(opts.deviceId),
-        "x-name": encodeURIComponent(opts.displayName),
-        "x-scene": "daemon"
-      }
+      headers: { authorization: `Bearer ${opts.loginPass}` }
     });
   } catch (err) {
     throw new OrgMeshClientError("NETWORK", `network error: ${err.message}`, err);
@@ -67877,7 +67851,7 @@ function rethrowLoginExpired(e) {
   if (e instanceof CentralClientError && e.code === "UNAUTHORIZED") {
     throw new ClawdError(
       ERROR_CODES.VALIDATION_ERROR,
-      `${LOGIN_EXPIRED_ERROR_MARKER}: \u767B\u5F55\u51ED\u8BC1\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55`
+      `${LOGIN_EXPIRED_ERROR_MARKER}: \u767B\u5F55\u7968\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55`
     );
   }
   throw e;
@@ -69979,9 +69953,7 @@ function buildFeishuAuthHandlers(deps) {
         type: "auth:getIdentity:ok",
         identity: record4 ? record4.identity : null,
         // 决策 #15：设备属性，与登录态无关——UI"分享我的 Hub 标识"用
-        deviceId: deps.deviceId,
-        // 过期时间戳（仅时间戳，token 本体永不出 ws）——UI 派生 过期/临期 提示
-        ttcTokenExpiresAt: record4 ? record4.ttcTokenExpiresAt : null
+        deviceId: deps.deviceId
       }
     };
   };
@@ -70001,7 +69973,7 @@ function buildFeishuAuthHandlers(deps) {
         "\u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u62FF\u4E0D\u5230\u4E91 persona \u7684\u8C03\u7528 key"
       );
     }
-    return { ttcJwt: record4.ttcToken, provider: record4.identity.provider };
+    return { loginPass: record4.loginPass };
   }
   const apiKeyGet = async () => {
     const { apiKey, createdAt, gatewayUrl } = await deps.apiKeyClient.get(requireLogin());
@@ -70034,9 +70006,9 @@ function ensureOwner6(ctx) {
 var invalid2 = (msg) => new ClawdError(ERROR_CODES.VALIDATION_ERROR, `VALIDATION_ERROR: ${msg}`);
 function buildCloudConnectorsHandlers(deps) {
   function requireLogin() {
-    const rec5 = deps.readIdentity();
-    if (!rec5) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "FEISHU_LOGIN_REQUIRED: \u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7684\u8FDE\u63A5\u5668\u7528\u4E0D\u4E86");
-    return rec5;
+    const loginPass = deps.getLoginPass();
+    if (!loginPass) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "FEISHU_LOGIN_REQUIRED: \u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7684\u8FDE\u63A5\u5668\u7528\u4E0D\u4E86");
+    return { loginPass };
   }
   async function personalConnectors(personaId2) {
     const persona = deps.getPersona(personaId2);
@@ -70322,7 +70294,7 @@ var METHOD_GRANT_MAP = {
   "auth:apiKey:get": ADMIN_ANY,
   "auth:apiKey:regenerate": ADMIN_ANY,
   // ---- device:* 设备目录 + 连接（决策 #15，owner-only） ----
-  // 设备目录 / 连接都是 owner 本机操作（用 owner 的 ttcJwt 找中心 server），guest 不可调
+  // 设备目录 / 连接都是 owner 本机操作（用本机登录票找中心 server），guest 不可调
   "device:list": ADMIN_ANY,
   "device:connect": ADMIN_ANY,
   "device:connections": ADMIN_ANY
@@ -70376,7 +70348,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.524".length > 0 ? "0.2.524" : "dev";
+var version = "0.2.526".length > 0 ? "0.2.526" : "dev";
 
 // src/cli-probe/probe.ts
 var fs77 = __toESM(require("fs"), 1);
@@ -72458,14 +72430,7 @@ async function submitIosInterest(opts) {
     res = await doFetch(`${opts.apiUrl}/api/ios-interest`, {
       method: "POST",
       signal: ac.signal,
-      headers: {
-        authorization: `Bearer ${opts.apiKey}`,
-        "x-did": encodeURIComponent(opts.deviceId),
-        "x-name": encodeURIComponent(opts.displayName),
-        "x-scene": "daemon",
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({ unionId: opts.unionId, displayName: opts.displayName })
+      headers: { authorization: `Bearer ${opts.loginPass}` }
     });
   } catch (err) {
     clearTimeout(timer);
@@ -72500,16 +72465,13 @@ function buildOnboardingHandlers(deps) {
   };
   const iosInterest = async (frame) => {
     parseArgs2(OnboardingIosInterestArgs, frame, "onboarding:iosInterest args");
-    const identity = deps.getOwnerIdentity();
-    if (!identity) {
-      throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "onboarding:iosInterest \u9700\u8981\u98DE\u4E66\u767B\u5F55");
+    const loginPass = deps.getLoginPass();
+    if (!loginPass) {
+      throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "onboarding:iosInterest \u9700\u8981\u98DE\u4E66\u767B\u5F55\uFF08\u5DF2\u767B\u5F55\u7684\u8BDD\u91CD\u542F\u4E00\u6B21 clawd \u9886\u767B\u5F55\u7968\uFF09");
     }
     await submitIosInterest({
       apiUrl: deps.apiUrl,
-      apiKey: deps.apiKey,
-      deviceId: deps.deviceId,
-      unionId: identity.unionId,
-      displayName: identity.displayName,
+      loginPass,
       ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
     });
     return { response: { registered: true } };
@@ -73047,8 +73009,8 @@ async function startDaemon(config) {
         });
       },
       // 验票第二段（spec 2026-08-28）：本地验签只证明"票是中心签的"，这一步问中心
-      // "持票人还在职吗"。token 不再过期，撤销全靠它。端点无鉴权——不带本机 ttcJwt，
-      // 否则飞书过期又会牵连互联。
+      // "持票人还在职吗"。token 不再过期，撤销全靠它。端点无鉴权——不带本机登录票，
+      // 本机没登录也能验别人的票。
       checkPrincipalActive: async (provider, ownerId2) => {
         const r2 = await centralPrincipalStatus({
           api: config.clawosApi ?? DEFAULT_CLAWOS_API,
@@ -73198,7 +73160,7 @@ async function startDaemon(config) {
         const r2 = ownerIdentityStore.read();
         if (!r2) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "FEISHU_LOGIN_REQUIRED: \u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u5173\u8054 GitHub \u8981\u7ECF\u4E2D\u5FC3\uFF1B\u5148\u767B\u5F55\uFF0C\u6216\u5728\u5361\u7247\u4E0A\u624B\u52A8\u7C98 token");
         try {
-          return await centralGithubAuthOauthStart({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ttcJwt: r2.ttcToken, provider: r2.identity.provider, ...returnTo ? { returnTo } : {} });
+          return await centralGithubAuthOauthStart({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, loginPass: r2.loginPass, ...returnTo ? { returnTo } : {} });
         } catch (err) {
           throw new ClawdError(ERROR_CODES.INTERNAL, `\u5411\u4E2D\u5FC3\u8981 GitHub \u6388\u6743\u94FE\u63A5\u6CA1\u6210\uFF1A${err instanceof Error ? err.message : String(err)}`);
         }
@@ -73206,7 +73168,7 @@ async function startDaemon(config) {
       token: async () => {
         const r2 = ownerIdentityStore.read();
         if (!r2) return void 0;
-        return centralGithubAuthToken({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ttcJwt: r2.ttcToken, provider: r2.identity.provider });
+        return centralGithubAuthToken({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, loginPass: r2.loginPass });
       }
     },
     now: () => Date.now(),
@@ -73608,10 +73570,7 @@ async function startDaemon(config) {
     screenIdleProbeLogger
   }) : new ClaudeAdapter({ logger, historyReader: new ClaudeHistoryReader() });
   const cloudGateway = new CloudGatewayClient({
-    readIdentity: () => {
-      const r2 = ownerIdentityStore.read();
-      return r2 ? { ttcToken: r2.ttcToken, provider: r2.identity.provider } : null;
-    },
+    getLoginPass: () => ownerIdentityStore.read()?.loginPass ?? null,
     centralApi: config.clawosApi ?? DEFAULT_CLAWOS_API,
     logger
   });
@@ -73718,9 +73677,7 @@ async function startDaemon(config) {
     try {
       await centralUpsertDevice({
         api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-        ttcJwt: record4.ttcToken,
-        provider: record4.identity.provider,
-        deviceId: authFile.deviceId,
+        loginPass: record4.loginPass,
         url: currentTunnelUrl ?? void 0,
         name: ownerDisplayName
       });
@@ -73737,15 +73694,14 @@ async function startDaemon(config) {
     if (!feishuActive || orgMeshInFlight) return;
     const record4 = ownerIdentityStore.read();
     if (!record4) return;
+    const loginPass = record4.loginPass;
     orgMeshInFlight = true;
     try {
       await syncOrgMesh({
         store: contactStore,
         fetchPeers: () => fetchOrgPeers({
           apiUrl: config.clawosApi ?? DEFAULT_CLAWOS_API,
-          apiKey: resolveClawdTicketsApiKey(),
-          deviceId: authFile.deviceId,
-          displayName: record4.identity.displayName || authFile.deviceId
+          loginPass
         }),
         connectToDevice: createConnectToDevice(feishuDeviceDeps),
         log: (msg, meta) => logger.info(msg, meta),
@@ -73785,10 +73741,8 @@ async function startDaemon(config) {
       }
       return centralExchange({
         api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-        jwt: record4.ttcToken,
-        provider: record4.identity.provider,
-        deviceId,
-        selfDeviceId: authFile.deviceId
+        loginPass: record4.loginPass,
+        deviceId
       });
     },
     listDevices: async () => {
@@ -73798,8 +73752,7 @@ async function startDaemon(config) {
       }
       return centralListDevices({
         api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-        ttcJwt: record4.ttcToken,
-        provider: record4.identity.provider
+        loginPass: record4.loginPass
       });
     },
     connectRemote,
@@ -73816,13 +73769,13 @@ async function startDaemon(config) {
     fetchUserInfo: (ttcToken) => fetchTtcUserInfo({ apiBase: TTC_HOSTS.api, token: ttcToken }),
     ttcAuthBase: TTC_HOSTS.auth,
     getCallbackUrl: () => `http://127.0.0.1:${config.port}/auth/callback`,
-    // device_bindings upsert（did ↔ 飞书 unionId 映射）：
-    // deviceId 从 auth.json 稳定读；apiUrl 走同一份 clawosApi；鉴权 = 刚登录拿到的 TTC JWT。
+    // 登录换票（design 2026-09-15-api-auth-tiers §2）：device_bindings upsert（did ↔ 飞书 unionId 映射）
+    // + 领登录票。deviceId 从 auth.json 稳定读；apiUrl 走同一份 clawosApi；鉴权 = 刚登录拿到的 TTC JWT。
     // 失败即登录失败（fail-hard，login-flow.spec §upsert 失败）。
     getDeviceId: () => authFile.deviceId,
     upsertBinding: async (opts) => {
       try {
-        await upsertDeviceBinding({
+        const r2 = await upsertDeviceBinding({
           apiUrl: config.clawosApi ?? DEFAULT_CLAWOS_API,
           ttcToken: opts.ttcToken,
           provider: opts.identity.provider,
@@ -73832,6 +73785,7 @@ async function startDaemon(config) {
           deviceId: opts.deviceId,
           unionId: opts.identity.unionId
         });
+        return r2;
       } catch (err) {
         logger.warn("device-binding upsert failed", {
           deviceId: opts.deviceId,
@@ -73971,8 +73925,8 @@ async function startDaemon(config) {
       // 联系人列表 store（device:connect 出站 / contact:handshake 入站落同一 store）
       contactStore,
       // contact:handshake 换票（spec 2026-07-22；2026-08-17 起硬失败，不再是回填）：
-      // 用 owner 当前 jwt 换 aud=对方设备 的票，现读 ownerIdentityStore（热切换后用新身份）。
-      // 契约（ContactHandlerDeps.exchangeToken）：null = 本机登录问题（未登录 / JWT 过期），
+      // 用本机登录票换 aud=对方设备 的票，现读 ownerIdentityStore（热切换后用新身份）。
+      // 契约（ContactHandlerDeps.exchangeToken）：null = 本机登录问题（未登录），
       // 其他失败原样抛给 handler——两种都会让握手硬失败，只是给对端的错误文案不同。
       exchangeToken: async (targetDeviceId) => {
         const record4 = ownerIdentityStore.read();
@@ -73980,10 +73934,8 @@ async function startDaemon(config) {
         try {
           const r2 = await centralExchange({
             api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-            jwt: record4.ttcToken,
-            provider: record4.identity.provider,
+            loginPass: record4.loginPass,
             deviceId: targetDeviceId,
-            selfDeviceId: authFile.deviceId,
             // 换票在握手关键路径上（硬失败），对端 connect-remote RPC_TIMEOUT_MS=5s：
             // 必须在其内失败/成功，否则对端先超时不落库、本机后换票成功落库 → 反向半连，
             // 破坏「两侧都不落库」不变量。4s 留 1s 余量给 ws 往返
@@ -74036,21 +73988,18 @@ async function startDaemon(config) {
         }
       },
       // 云 persona 卡片上的连接器区（design 2026-09-11-mcp-connector §3.8）：装了什么以 gateway 登记行为真源，
-      // 连没连上问中心。登录凭证只在 daemon 内部传给中心，与 apiKeyClient 同一条纪律。
+      // 连没连上问中心。登录票只在 daemon 内部传给中心，与 apiKeyClient 同一条纪律。
       cloudConnectors: {
         getPersona: (personaId2) => personaRegistry.get(personaId2),
         gatewayConnectors: (gatewayPersonaId) => cloudGateway.personaConnectors(gatewayPersonaId),
-        readIdentity: () => {
-          const r2 = ownerIdentityStore.read();
-          return r2 ? { ttcJwt: r2.ttcToken, provider: r2.identity.provider } : null;
-        },
+        getLoginPass: () => ownerIdentityStore.read()?.loginPass ?? null,
         central: {
           mine: (args) => centralConnectorsMine({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args }),
           fill: (args) => centralConnectorFill({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args })
         }
       },
       // 设备目录 + 连接（决策 #15：daemon 代理中心 server）。
-      // exchange/listDevices 包掉 owner ttcJwt（每次现读 store——热切换后立即用新身份）；
+      // exchange/listDevices 包掉本机登录票（每次现读 store——热切换后立即用新身份）；
       // dispatcher 的 FEISHU_GATED_METHODS gate 已保证未登录时这些 RPC 到不了 handler，
       // 这里的 FEISHU_LOGIN_REQUIRED 抛错只是防御纵深。
       feishuDevice: feishuDeviceDeps,
@@ -74238,9 +74187,7 @@ async function startDaemon(config) {
   const larkBotStore = createLarkBotBindingStore(import_node_path79.default.join(config.dataDir, "personas"));
   const larkBotCloud = createLarkBotCloudClient({
     api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-    apiKey: resolveClawdTicketsApiKey(),
-    deviceId: authFile.deviceId,
-    displayName: ownerDisplayName
+    getLoginPass: () => ownerIdentityStore.read()?.loginPass ?? null
   });
   let larkDraining = false;
   const larkChatRouter = createLarkChatRouter({
@@ -74280,17 +74227,8 @@ async function startDaemon(config) {
     buildOnboardingHandlers({
       dataDir: config.dataDir,
       // 现读（登录/登出热切换）；unionId 缺失时回落 ownerId（老登录记录无 unionId）
-      getOwnerIdentity: () => {
-        const rec5 = ownerIdentityStore.read();
-        if (!rec5) return null;
-        return {
-          unionId: rec5.identity.unionId ?? rec5.identity.ownerId,
-          displayName: rec5.identity.displayName
-        };
-      },
-      apiUrl: config.clawosApi ?? DEFAULT_CLAWOS_API,
-      apiKey: resolveClawdTicketsApiKey(),
-      deviceId: authFile.deviceId
+      getLoginPass: () => ownerIdentityStore.read()?.loginPass ?? null,
+      apiUrl: config.clawosApi ?? DEFAULT_CLAWOS_API
     })
   );
   const authResolver = new AuthContextResolver({
@@ -74533,21 +74471,6 @@ async function startDaemon(config) {
       stateMgr.write(stateSnapshot);
       currentTunnelUrl = r2.url;
       wss.broadcastAll({ type: "tunnel:ready", url: r2.url, subdomain: r2.subdomain });
-      void refreshTunnelUrlOnStartup(larkBotDeps);
-      void (async () => {
-        if (larkBotDeps.listBoundPersonaIds().length === 0) return;
-        try {
-          const items = await larkBotCloud.claimEvents();
-          routeClaimedEvents(items, {
-            router: larkChatRouter,
-            dedupe: larkEventDedupe,
-            nowSec: Math.floor(Date.now() / 1e3)
-          });
-          if (items.length > 0) logger.info("larkBot pending events claimed", { count: items.length });
-        } catch (err) {
-          logger.warn("larkBot pending events claim failed", { err: err.message });
-        }
-      })();
       const connectUrl = resolvedAuthToken ? `${r2.url}#token=${resolvedAuthToken}` : r2.url;
       const lines = [
         `Tunnel:      ${r2.url}`,
@@ -74592,9 +74515,23 @@ ${bar}
       logger.warn("tunnel unavailable, degraded to local mode", { reason: tunnelError });
     }
   }
-  void reportDevice();
+  void reportDevice().then(async () => {
+    void runOrgMesh();
+    if (!currentTunnelUrl || larkBotDeps.listBoundPersonaIds().length === 0) return;
+    void refreshTunnelUrlOnStartup(larkBotDeps);
+    try {
+      const items = await larkBotCloud.claimEvents();
+      routeClaimedEvents(items, {
+        router: larkChatRouter,
+        dedupe: larkEventDedupe,
+        nowSec: Math.floor(Date.now() / 1e3)
+      });
+      if (items.length > 0) logger.info("larkBot pending events claimed", { count: items.length });
+    } catch (err) {
+      logger.warn("larkBot pending events claim failed", { err: err.message });
+    }
+  });
   void fetchServerKey();
-  void runOrgMesh();
   const tickAttachmentGc = () => {
     try {
       runAttachmentGc({