@clawos-dev/clawd 0.2.525 → 0.2.526

package/dist/app-builder-plugin/mcp-server.cjs

@@ -21929,13 +21929,7 @@ var AuthGetIdentityResponseSchema = external_exports.object({
    * 设备属性，与登录态无关、登录登出不变。UI"我的设备标识"用它拼
    * clawos://device/<deviceId>（替代旧的 unionId——不再向外暴露人的身份标识）。
    */
-  deviceId: external_exports.string().min(1),
-  /**
-   * TTC JWT 过期时间（unix ms）。null = 登录回调未携带 expires_at；字段缺省 = 老 daemon。
-   * 仅时间戳——token 本体永不出 ws（spec §9 不变）。UI 据此派生 过期/临期 提示
-   * （见 spec 2026-08-17-ttc-jwt-expiry-ux-design §2）。
-   */
-  ttcTokenExpiresAt: external_exports.number().nullable().optional()
+  deviceId: external_exports.string().min(1)
 });
 var AuthLogoutResponseSchema = external_exports.object({
   type: external_exports.literal("auth:logout:ok")
@@ -24492,7 +24486,7 @@ var METHOD_DOCS = {
     args: NO_ARGS
   },
   "auth:getIdentity": {
-    summary: "\u53D6\u672C\u673A owner \u7684\u98DE\u4E66\u8EAB\u4EFD\uFF08ownerId / provider / displayName / unionId\uFF09+ **\u672C\u673A deviceId**\uFF08\u8BBE\u5907\u5C5E\u6027\uFF0C\u4E0E\u767B\u5F55\u6001\u65E0\u5173\uFF1Bdevice:connect / contact:* / inbox:* \u7684\u4E3B\u952E\u90FD\u662F\u5B83\uFF09\uFF1B\u7EDD\u4E0D\u8FD4\u56DE ttcToken",
+    summary: "\u53D6\u672C\u673A owner \u7684\u98DE\u4E66\u8EAB\u4EFD\uFF08ownerId / provider / displayName / unionId\uFF09+ **\u672C\u673A deviceId**\uFF08\u8BBE\u5907\u5C5E\u6027\uFF0C\u4E0E\u767B\u5F55\u6001\u65E0\u5173\uFF1Bdevice:connect / contact:* / inbox:* \u7684\u4E3B\u952E\u90FD\u662F\u5B83\uFF09\uFF1B\u7EDD\u4E0D\u8FD4\u56DE\u767B\u5F55\u7968",
     args: NO_ARGS
   },
   "auth:logout": {

package/dist/cli.cjs

@@ -6450,7 +6450,7 @@ var init_feishu_auth = __esm({
       // mirror peer sessions（远端会话镜像）
       "peerSession:upsert",
       "peerSession:remove",
-      // 设备目录 + 连接（决策 #15：daemon 代理中心 server，需要 owner 的 ttcJwt）
+      // 设备目录 + 连接（决策 #15：daemon 代理中心 server，需要 owner 的登录票）
       "device:list",
       "device:connect",
       // iOS TestFlight 意向登记（需要 owner unionId 上报中心 server）
@@ -6520,13 +6520,7 @@ var init_feishu_auth = __esm({
        * 设备属性，与登录态无关、登录登出不变。UI"我的设备标识"用它拼
        * clawos://device/<deviceId>（替代旧的 unionId——不再向外暴露人的身份标识）。
        */
-      deviceId: external_exports.string().min(1),
-      /**
-       * TTC JWT 过期时间（unix ms）。null = 登录回调未携带 expires_at；字段缺省 = 老 daemon。
-       * 仅时间戳——token 本体永不出 ws（spec §9 不变）。UI 据此派生 过期/临期 提示
-       * （见 spec 2026-08-17-ttc-jwt-expiry-ux-design §2）。
-       */
-      ttcTokenExpiresAt: external_exports.number().nullable().optional()
+      deviceId: external_exports.string().min(1)
     });
     AuthLogoutResponseSchema = external_exports.object({
       type: external_exports.literal("auth:logout:ok")
@@ -9309,7 +9303,7 @@ var init_methods = __esm({
         args: NO_ARGS
       },
       "auth:getIdentity": {
-        summary: "\u53D6\u672C\u673A owner \u7684\u98DE\u4E66\u8EAB\u4EFD\uFF08ownerId / provider / displayName / unionId\uFF09+ **\u672C\u673A deviceId**\uFF08\u8BBE\u5907\u5C5E\u6027\uFF0C\u4E0E\u767B\u5F55\u6001\u65E0\u5173\uFF1Bdevice:connect / contact:* / inbox:* \u7684\u4E3B\u952E\u90FD\u662F\u5B83\uFF09\uFF1B\u7EDD\u4E0D\u8FD4\u56DE ttcToken",
+        summary: "\u53D6\u672C\u673A owner \u7684\u98DE\u4E66\u8EAB\u4EFD\uFF08ownerId / provider / displayName / unionId\uFF09+ **\u672C\u673A deviceId**\uFF08\u8BBE\u5907\u5C5E\u6027\uFF0C\u4E0E\u767B\u5F55\u6001\u65E0\u5173\uFF1Bdevice:connect / contact:* / inbox:* \u7684\u4E3B\u952E\u90FD\u662F\u5B83\uFF09\uFF1B\u7EDD\u4E0D\u8FD4\u56DE\u767B\u5F55\u7968",
         args: NO_ARGS
       },
       "auth:logout": {
@@ -62144,7 +62138,7 @@ async function centralRequest(opts, path101, init) {
   }
   clearTimeout(timer);
   if (res.status === 401) {
-    throw new CentralClientError("UNAUTHORIZED", "TTC JWT invalid or expired");
+    throw new CentralClientError("UNAUTHORIZED", "login pass rejected by center");
   }
   if (!res.ok) {
     let detail = "";
@@ -62164,12 +62158,8 @@ async function centralRequest(opts, path101, init) {
 async function centralExchange(opts) {
   const body = await centralRequest(opts, "/api/clawd-identity/exchange", {
     method: "POST",
-    body: {
-      jwt: opts.jwt,
-      provider: opts.provider,
-      deviceId: opts.deviceId,
-      selfDeviceId: opts.selfDeviceId
-    }
+    bearer: opts.loginPass,
+    body: { deviceId: opts.deviceId }
   });
   if (typeof body.token !== "string" || body.token.length === 0 || typeof body.ownerId !== "string" || typeof body.provider !== "string" || typeof body.displayName !== "string") {
     throw new CentralClientError("BAD_RESPONSE", "exchange: missing token/ownerId/provider/displayName");
@@ -62189,10 +62179,8 @@ async function centralGetPublicKey(opts) {
 async function centralUpsertDevice(opts) {
   const body = await centralRequest(opts, "/api/clawd-identity/devices/self", {
     method: "PUT",
-    bearer: opts.ttcJwt,
+    bearer: opts.loginPass,
     body: {
-      deviceId: opts.deviceId,
-      provider: opts.provider,
       ...opts.url ? { url: opts.url } : {},
       ...opts.name ? { name: opts.name } : {}
     }
@@ -62200,10 +62188,7 @@ async function centralUpsertDevice(opts) {
   if (body.ok !== true) {
     throw new CentralClientError("BAD_RESPONSE", "upsertDevice: server did not ack ok");
   }
-  return {
-    ok: true,
-    ...typeof body.loginPass === "string" && body.loginPass.length > 0 ? { loginPass: body.loginPass } : {}
-  };
+  return { ok: true };
 }
 async function centralPrincipalStatus(opts) {
   const query = `provider=${encodeURIComponent(opts.provider)}&ownerId=${encodeURIComponent(opts.ownerId)}`;
@@ -62216,11 +62201,10 @@ async function centralPrincipalStatus(opts) {
   return { active: body.active };
 }
 async function centralGetApiKey(opts) {
-  const body = await centralRequest(
-    opts,
-    `/api/persona-cloud/api-key?provider=${encodeURIComponent(opts.provider)}`,
-    { method: "GET", bearer: opts.ttcJwt }
-  );
+  const body = await centralRequest(opts, "/api/persona-cloud/api-key", {
+    method: "GET",
+    bearer: opts.loginPass
+  });
   if (body.apiKey !== null && typeof body.apiKey !== "string") {
     throw new CentralClientError("BAD_RESPONSE", "api-key: apiKey must be string or null");
   }
@@ -62234,8 +62218,7 @@ async function centralGetApiKey(opts) {
 async function centralIssueApiKey(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/api-key", {
     method: "POST",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider }
+    bearer: opts.loginPass
   });
   if (typeof body.apiKey !== "string" || body.apiKey.length === 0) {
     throw new CentralClientError("BAD_RESPONSE", "api-key: missing apiKey");
@@ -62250,11 +62233,10 @@ async function centralIssueApiKey(opts) {
   };
 }
 async function centralListDevices(opts) {
-  const body = await centralRequest(
-    opts,
-    `/api/clawd-identity/devices?provider=${encodeURIComponent(opts.provider)}`,
-    { method: "GET", bearer: opts.ttcJwt }
-  );
+  const body = await centralRequest(opts, "/api/clawd-identity/devices", {
+    method: "GET",
+    bearer: opts.loginPass
+  });
   if (!Array.isArray(body.devices)) {
     throw new CentralClientError("BAD_RESPONSE", "devices: missing devices array");
   }
@@ -62271,8 +62253,8 @@ async function centralListDevices(opts) {
 async function centralConnectorsMine(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/connectors/mine", {
     method: "POST",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider, personaId: opts.personaId, connectors: opts.connectors }
+    bearer: opts.loginPass,
+    body: { personaId: opts.personaId, connectors: opts.connectors }
   });
   if (!Array.isArray(body.connectors)) throw new CentralClientError("BAD_RESPONSE", "connectors/mine: missing connectors array");
   return { connectors: body.connectors };
@@ -62280,16 +62262,16 @@ async function centralConnectorsMine(opts) {
 async function centralConnectorFill(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/connectors/fields", {
     method: "PUT",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider, connector: opts.connector, values: opts.values }
+    bearer: opts.loginPass,
+    body: { connector: opts.connector, values: opts.values }
   });
   if (body.ok !== true) throw new CentralClientError("BAD_RESPONSE", "connectors/fields: server did not ack ok");
 }
 async function centralGithubAuthOauthStart(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/github/oauth/start", {
     method: "POST",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider, ...opts.returnTo ? { returnTo: opts.returnTo } : {} }
+    bearer: opts.loginPass,
+    body: { ...opts.returnTo ? { returnTo: opts.returnTo } : {} }
   });
   if (typeof body.authUrl !== "string" || !body.authUrl) throw new CentralClientError("BAD_RESPONSE", "github/oauth/start: missing authUrl");
   return { authUrl: body.authUrl };
@@ -62297,8 +62279,8 @@ async function centralGithubAuthOauthStart(opts) {
 async function centralGithubAuthToken(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/github/oauth/token", {
     method: "POST",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider }
+    bearer: opts.loginPass,
+    body: {}
   });
   if (body.token === null || body.token === void 0) return void 0;
   if (typeof body.token !== "string" || !body.token) throw new CentralClientError("BAD_RESPONSE", "github/oauth/token: malformed token");
@@ -62337,10 +62319,10 @@ var CloudGatewayClient = class {
   deps;
   fetchImpl;
   async credentials() {
-    const rec5 = this.deps.readIdentity();
-    if (!rec5) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "\u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7528\u4E0D\u4E86");
+    const loginPass = this.deps.getLoginPass();
+    if (!loginPass) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "\u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7528\u4E0D\u4E86");
     const get = this.deps.getApiKey ?? ((args) => centralGetApiKey({ api: this.deps.centralApi ?? "", fetchImpl: this.fetchImpl, ...args }));
-    const { apiKey, gatewayUrl } = await get({ ttcJwt: rec5.ttcToken, provider: rec5.provider });
+    const { apiKey, gatewayUrl } = await get({ loginPass });
     if (!apiKey) throw new Error("\u8FD8\u6CA1\u751F\u6210\u4E91 persona \u7684\u8C03\u7528 key\uFF0C\u53BB\u300C\u8BBE\u7F6E \u2192 \u4E91\u4E0A persona\u300D\u751F\u6210\u4E00\u628A");
     if (!gatewayUrl) throw new Error("\u4E2D\u5FC3\u6CA1\u914D\u4E91 gateway \u5730\u5740\uFF08gatewayUrl \u4E3A\u7A7A\uFF09");
     return { apiKey, gatewayUrl: trimSlash(gatewayUrl) };
@@ -65896,8 +65878,7 @@ async function importZip(buf, root) {
 function parseLoginCallbackQuery(url) {
   return {
     token: url.searchParams.get("token") ?? "",
-    state: url.searchParams.get("state") ?? "",
-    expiresAt: url.searchParams.get("expires_at")
+    state: url.searchParams.get("state") ?? ""
   };
 }
 function escapeHtml(s2) {
@@ -67558,7 +67539,7 @@ var OwnerIdentityStore = class {
       return null;
     }
     const r2 = parsed;
-    if (!r2.identity || typeof r2.identity.ownerId !== "string" || r2.identity.ownerId.length === 0 || typeof r2.identity.provider !== "string" || r2.identity.provider.length === 0 || typeof r2.identity.displayName !== "string" || r2.identity.displayName.length === 0 || typeof r2.ttcToken !== "string" || r2.ttcToken.length === 0) {
+    if (!r2.identity || typeof r2.identity.ownerId !== "string" || r2.identity.ownerId.length === 0 || typeof r2.identity.provider !== "string" || r2.identity.provider.length === 0 || typeof r2.identity.displayName !== "string" || r2.identity.displayName.length === 0 || typeof r2.loginPass !== "string" || r2.loginPass.length === 0) {
       return null;
     }
     return {
@@ -67569,10 +67550,8 @@ var OwnerIdentityStore = class {
         ...typeof r2.identity.avatarUrl === "string" ? { avatarUrl: r2.identity.avatarUrl } : {},
         ...typeof r2.identity.unionId === "string" ? { unionId: r2.identity.unionId } : {}
       },
-      ttcToken: r2.ttcToken,
-      ttcTokenExpiresAt: typeof r2.ttcTokenExpiresAt === "number" ? r2.ttcTokenExpiresAt : null,
-      loginAt: typeof r2.loginAt === "string" ? r2.loginAt : (/* @__PURE__ */ new Date(0)).toISOString(),
-      ...typeof r2.loginPass === "string" && r2.loginPass.length > 0 ? { loginPass: r2.loginPass } : {}
+      loginPass: r2.loginPass,
+      loginAt: typeof r2.loginAt === "string" ? r2.loginAt : (/* @__PURE__ */ new Date(0)).toISOString()
     };
   }
   write(record4) {
@@ -67649,13 +67628,10 @@ var LoginFlow = class {
         reason: `device_binding upsert failed: ${err.message}`
       };
     }
-    const expiresAtNum = params.expiresAt ? Number.parseInt(params.expiresAt, 10) : NaN;
     this.deps.store.write({
       identity,
-      ttcToken: params.token,
-      ttcTokenExpiresAt: Number.isFinite(expiresAtNum) ? expiresAtNum : null,
-      loginAt: new Date(now).toISOString(),
-      ...loginPass ? { loginPass } : {}
+      loginPass,
+      loginAt: new Date(now).toISOString()
     });
     return { ok: true, identity };
   }
@@ -67765,7 +67741,10 @@ async function upsertDeviceBinding(opts) {
     body = await res.json();
   } catch {
   }
-  return typeof body.loginPass === "string" && body.loginPass.length > 0 ? { loginPass: body.loginPass } : {};
+  if (typeof body.loginPass !== "string" || body.loginPass.length === 0) {
+    throw new DeviceBindingClientError("BAD_RESPONSE", "center did not issue a login pass (api too old?)");
+  }
+  return { loginPass: body.loginPass };
 }
 
 // src/contact/org-mesh.ts
@@ -67872,7 +67851,7 @@ function rethrowLoginExpired(e) {
   if (e instanceof CentralClientError && e.code === "UNAUTHORIZED") {
     throw new ClawdError(
       ERROR_CODES.VALIDATION_ERROR,
-      `${LOGIN_EXPIRED_ERROR_MARKER}: \u767B\u5F55\u51ED\u8BC1\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55`
+      `${LOGIN_EXPIRED_ERROR_MARKER}: \u767B\u5F55\u7968\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55`
     );
   }
   throw e;
@@ -69974,9 +69953,7 @@ function buildFeishuAuthHandlers(deps) {
         type: "auth:getIdentity:ok",
         identity: record4 ? record4.identity : null,
         // 决策 #15：设备属性，与登录态无关——UI"分享我的 Hub 标识"用
-        deviceId: deps.deviceId,
-        // 过期时间戳（仅时间戳，token 本体永不出 ws）——UI 派生 过期/临期 提示
-        ttcTokenExpiresAt: record4 ? record4.ttcTokenExpiresAt : null
+        deviceId: deps.deviceId
       }
     };
   };
@@ -69996,7 +69973,7 @@ function buildFeishuAuthHandlers(deps) {
         "\u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u62FF\u4E0D\u5230\u4E91 persona \u7684\u8C03\u7528 key"
       );
     }
-    return { ttcJwt: record4.ttcToken, provider: record4.identity.provider };
+    return { loginPass: record4.loginPass };
   }
   const apiKeyGet = async () => {
     const { apiKey, createdAt, gatewayUrl } = await deps.apiKeyClient.get(requireLogin());
@@ -70029,9 +70006,9 @@ function ensureOwner6(ctx) {
 var invalid2 = (msg) => new ClawdError(ERROR_CODES.VALIDATION_ERROR, `VALIDATION_ERROR: ${msg}`);
 function buildCloudConnectorsHandlers(deps) {
   function requireLogin() {
-    const rec5 = deps.readIdentity();
-    if (!rec5) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "FEISHU_LOGIN_REQUIRED: \u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7684\u8FDE\u63A5\u5668\u7528\u4E0D\u4E86");
-    return rec5;
+    const loginPass = deps.getLoginPass();
+    if (!loginPass) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "FEISHU_LOGIN_REQUIRED: \u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7684\u8FDE\u63A5\u5668\u7528\u4E0D\u4E86");
+    return { loginPass };
   }
   async function personalConnectors(personaId2) {
     const persona = deps.getPersona(personaId2);
@@ -70317,7 +70294,7 @@ var METHOD_GRANT_MAP = {
   "auth:apiKey:get": ADMIN_ANY,
   "auth:apiKey:regenerate": ADMIN_ANY,
   // ---- device:* 设备目录 + 连接（决策 #15，owner-only） ----
-  // 设备目录 / 连接都是 owner 本机操作（用 owner 的 ttcJwt 找中心 server），guest 不可调
+  // 设备目录 / 连接都是 owner 本机操作（用本机登录票找中心 server），guest 不可调
   "device:list": ADMIN_ANY,
   "device:connect": ADMIN_ANY,
   "device:connections": ADMIN_ANY
@@ -70371,7 +70348,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.525".length > 0 ? "0.2.525" : "dev";
+var version = "0.2.526".length > 0 ? "0.2.526" : "dev";
 
 // src/cli-probe/probe.ts
 var fs77 = __toESM(require("fs"), 1);
@@ -73032,8 +73009,8 @@ async function startDaemon(config) {
         });
       },
       // 验票第二段（spec 2026-08-28）：本地验签只证明"票是中心签的"，这一步问中心
-      // "持票人还在职吗"。token 不再过期，撤销全靠它。端点无鉴权——不带本机 ttcJwt，
-      // 否则飞书过期又会牵连互联。
+      // "持票人还在职吗"。token 不再过期，撤销全靠它。端点无鉴权——不带本机登录票，
+      // 本机没登录也能验别人的票。
       checkPrincipalActive: async (provider, ownerId2) => {
         const r2 = await centralPrincipalStatus({
           api: config.clawosApi ?? DEFAULT_CLAWOS_API,
@@ -73183,7 +73160,7 @@ async function startDaemon(config) {
         const r2 = ownerIdentityStore.read();
         if (!r2) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "FEISHU_LOGIN_REQUIRED: \u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u5173\u8054 GitHub \u8981\u7ECF\u4E2D\u5FC3\uFF1B\u5148\u767B\u5F55\uFF0C\u6216\u5728\u5361\u7247\u4E0A\u624B\u52A8\u7C98 token");
         try {
-          return await centralGithubAuthOauthStart({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ttcJwt: r2.ttcToken, provider: r2.identity.provider, ...returnTo ? { returnTo } : {} });
+          return await centralGithubAuthOauthStart({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, loginPass: r2.loginPass, ...returnTo ? { returnTo } : {} });
         } catch (err) {
           throw new ClawdError(ERROR_CODES.INTERNAL, `\u5411\u4E2D\u5FC3\u8981 GitHub \u6388\u6743\u94FE\u63A5\u6CA1\u6210\uFF1A${err instanceof Error ? err.message : String(err)}`);
         }
@@ -73191,7 +73168,7 @@ async function startDaemon(config) {
       token: async () => {
         const r2 = ownerIdentityStore.read();
         if (!r2) return void 0;
-        return centralGithubAuthToken({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ttcJwt: r2.ttcToken, provider: r2.identity.provider });
+        return centralGithubAuthToken({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, loginPass: r2.loginPass });
       }
     },
     now: () => Date.now(),
@@ -73593,10 +73570,7 @@ async function startDaemon(config) {
     screenIdleProbeLogger
   }) : new ClaudeAdapter({ logger, historyReader: new ClaudeHistoryReader() });
   const cloudGateway = new CloudGatewayClient({
-    readIdentity: () => {
-      const r2 = ownerIdentityStore.read();
-      return r2 ? { ttcToken: r2.ttcToken, provider: r2.identity.provider } : null;
-    },
+    getLoginPass: () => ownerIdentityStore.read()?.loginPass ?? null,
     centralApi: config.clawosApi ?? DEFAULT_CLAWOS_API,
     logger
   });
@@ -73701,24 +73675,15 @@ async function startDaemon(config) {
     const record4 = ownerIdentityStore.read();
     if (!record4) return;
     try {
-      const r2 = await centralUpsertDevice({
+      await centralUpsertDevice({
         api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-        ttcJwt: record4.ttcToken,
-        provider: record4.identity.provider,
-        deviceId: authFile.deviceId,
+        loginPass: record4.loginPass,
         url: currentTunnelUrl ?? void 0,
         name: ownerDisplayName
       });
-      if (r2.loginPass) {
-        const latest = ownerIdentityStore.read();
-        if (latest && latest.ttcToken === record4.ttcToken && latest.loginPass !== r2.loginPass) {
-          ownerIdentityStore.write({ ...latest, loginPass: r2.loginPass });
-        }
-      }
       logger.info("device registered to central server", {
         deviceId: authFile.deviceId,
-        url: currentTunnelUrl ?? "(none)",
-        loginPass: r2.loginPass ? "issued" : "absent"
+        url: currentTunnelUrl ?? "(none)"
       });
     } catch (err) {
       logger.warn("device register failed (best-effort)", { err: err.message });
@@ -73728,7 +73693,7 @@ async function startDaemon(config) {
   const runOrgMesh = async () => {
     if (!feishuActive || orgMeshInFlight) return;
     const record4 = ownerIdentityStore.read();
-    if (!record4?.loginPass) return;
+    if (!record4) return;
     const loginPass = record4.loginPass;
     orgMeshInFlight = true;
     try {
@@ -73776,10 +73741,8 @@ async function startDaemon(config) {
       }
       return centralExchange({
         api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-        jwt: record4.ttcToken,
-        provider: record4.identity.provider,
-        deviceId,
-        selfDeviceId: authFile.deviceId
+        loginPass: record4.loginPass,
+        deviceId
       });
     },
     listDevices: async () => {
@@ -73789,8 +73752,7 @@ async function startDaemon(config) {
       }
       return centralListDevices({
         api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-        ttcJwt: record4.ttcToken,
-        provider: record4.identity.provider
+        loginPass: record4.loginPass
       });
     },
     connectRemote,
@@ -73821,8 +73783,7 @@ async function startDaemon(config) {
         });
         logger.info("device-binding upsert succeeded", {
           deviceId: opts.deviceId,
-          unionId: opts.identity.unionId,
-          loginPass: r2.loginPass ? "issued" : "absent"
+          unionId: opts.identity.unionId
         });
         return r2;
       } catch (err) {
@@ -73964,8 +73925,8 @@ async function startDaemon(config) {
       // 联系人列表 store（device:connect 出站 / contact:handshake 入站落同一 store）
       contactStore,
       // contact:handshake 换票（spec 2026-07-22；2026-08-17 起硬失败，不再是回填）：
-      // 用 owner 当前 jwt 换 aud=对方设备 的票，现读 ownerIdentityStore（热切换后用新身份）。
-      // 契约（ContactHandlerDeps.exchangeToken）：null = 本机登录问题（未登录 / JWT 过期），
+      // 用本机登录票换 aud=对方设备 的票，现读 ownerIdentityStore（热切换后用新身份）。
+      // 契约（ContactHandlerDeps.exchangeToken）：null = 本机登录问题（未登录），
       // 其他失败原样抛给 handler——两种都会让握手硬失败，只是给对端的错误文案不同。
       exchangeToken: async (targetDeviceId) => {
         const record4 = ownerIdentityStore.read();
@@ -73973,10 +73934,8 @@ async function startDaemon(config) {
         try {
           const r2 = await centralExchange({
             api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-            jwt: record4.ttcToken,
-            provider: record4.identity.provider,
+            loginPass: record4.loginPass,
             deviceId: targetDeviceId,
-            selfDeviceId: authFile.deviceId,
             // 换票在握手关键路径上（硬失败），对端 connect-remote RPC_TIMEOUT_MS=5s：
             // 必须在其内失败/成功，否则对端先超时不落库、本机后换票成功落库 → 反向半连，
             // 破坏「两侧都不落库」不变量。4s 留 1s 余量给 ws 往返
@@ -74029,21 +73988,18 @@ async function startDaemon(config) {
         }
       },
       // 云 persona 卡片上的连接器区（design 2026-09-11-mcp-connector §3.8）：装了什么以 gateway 登记行为真源，
-      // 连没连上问中心。登录凭证只在 daemon 内部传给中心，与 apiKeyClient 同一条纪律。
+      // 连没连上问中心。登录票只在 daemon 内部传给中心，与 apiKeyClient 同一条纪律。
       cloudConnectors: {
         getPersona: (personaId2) => personaRegistry.get(personaId2),
         gatewayConnectors: (gatewayPersonaId) => cloudGateway.personaConnectors(gatewayPersonaId),
-        readIdentity: () => {
-          const r2 = ownerIdentityStore.read();
-          return r2 ? { ttcJwt: r2.ttcToken, provider: r2.identity.provider } : null;
-        },
+        getLoginPass: () => ownerIdentityStore.read()?.loginPass ?? null,
         central: {
           mine: (args) => centralConnectorsMine({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args }),
           fill: (args) => centralConnectorFill({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args })
         }
       },
       // 设备目录 + 连接（决策 #15：daemon 代理中心 server）。
-      // exchange/listDevices 包掉 owner ttcJwt（每次现读 store——热切换后立即用新身份）；
+      // exchange/listDevices 包掉本机登录票（每次现读 store——热切换后立即用新身份）；
       // dispatcher 的 FEISHU_GATED_METHODS gate 已保证未登录时这些 RPC 到不了 handler，
       // 这里的 FEISHU_LOGIN_REQUIRED 抛错只是防御纵深。
       feishuDevice: feishuDeviceDeps,

package/dist/dispatch/mcp-server.cjs

@@ -21744,13 +21744,7 @@ var AuthGetIdentityResponseSchema = external_exports.object({
    * 设备属性，与登录态无关、登录登出不变。UI"我的设备标识"用它拼
    * clawos://device/<deviceId>（替代旧的 unionId——不再向外暴露人的身份标识）。
    */
-  deviceId: external_exports.string().min(1),
-  /**
-   * TTC JWT 过期时间（unix ms）。null = 登录回调未携带 expires_at；字段缺省 = 老 daemon。
-   * 仅时间戳——token 本体永不出 ws（spec §9 不变）。UI 据此派生 过期/临期 提示
-   * （见 spec 2026-08-17-ttc-jwt-expiry-ux-design §2）。
-   */
-  ttcTokenExpiresAt: external_exports.number().nullable().optional()
+  deviceId: external_exports.string().min(1)
 });
 var AuthLogoutResponseSchema = external_exports.object({
   type: external_exports.literal("auth:logout:ok")
@@ -24307,7 +24301,7 @@ var METHOD_DOCS = {
     args: NO_ARGS
   },
   "auth:getIdentity": {
-    summary: "\u53D6\u672C\u673A owner \u7684\u98DE\u4E66\u8EAB\u4EFD\uFF08ownerId / provider / displayName / unionId\uFF09+ **\u672C\u673A deviceId**\uFF08\u8BBE\u5907\u5C5E\u6027\uFF0C\u4E0E\u767B\u5F55\u6001\u65E0\u5173\uFF1Bdevice:connect / contact:* / inbox:* \u7684\u4E3B\u952E\u90FD\u662F\u5B83\uFF09\uFF1B\u7EDD\u4E0D\u8FD4\u56DE ttcToken",
+    summary: "\u53D6\u672C\u673A owner \u7684\u98DE\u4E66\u8EAB\u4EFD\uFF08ownerId / provider / displayName / unionId\uFF09+ **\u672C\u673A deviceId**\uFF08\u8BBE\u5907\u5C5E\u6027\uFF0C\u4E0E\u767B\u5F55\u6001\u65E0\u5173\uFF1Bdevice:connect / contact:* / inbox:* \u7684\u4E3B\u952E\u90FD\u662F\u5B83\uFF09\uFF1B\u7EDD\u4E0D\u8FD4\u56DE\u767B\u5F55\u7968",
     args: NO_ARGS
   },
   "auth:logout": {