@clawos-dev/clawd 0.2.525 → 0.2.527

package/dist/cli.cjs

@@ -6098,7 +6098,7 @@ function cloudEngineOk(tool) {
 function repoSlug(url) {
   return url.trim().replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
 }
-var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployRepoSchema, DeploySecretPresenceSchema, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, DeployStateSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployStartArgsSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
+var DeployFileSchema, SCAN_BASE_KINDS, ScanBaseKindSchema, DeployScanStatusSchema, DeployScanSchema, DeployRepoSchema, DeploySecretPresenceSchema, DEPLOY_STAGE_STATUSES, DeployStageStatusSchema, DEPLOY_STAGE_KEYS, DeployStageKeySchema, DeployJobSchema, DeployRunSchema, DeployStateSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeployRerunJobArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
 var init_deploy_schemas = __esm({
   "../protocol/src/deploy-schemas.ts"() {
     "use strict";
@@ -6121,8 +6121,8 @@ var init_deploy_schemas = __esm({
       /** 扫描时被告知的共享资产名单（判「扫描器后来长了新本事」用） */
       scannedAssets: external_exports.array(external_exports.string()).default([]),
       /**
-       * 这次扫描是**对哪个 commit 的断言**。`deploy:start` 在起扫描之前会先把 persona 目录
-       * 提交并推上去，所以这个值一定是仓库里真实存在的一版。
+       * 这次扫描是**对哪个 commit 的断言**。`deploy:release` 在起扫描之前会先把 persona 目录
+       * 提交（只提交不推，推是发布末尾那一下的事），所以这个值一定是仓库里真实存在的一版。
        *
        * 有了它，「清单过没过时」才是个可判定的等式（`head === repo.head`），
        * 而不是从 `dirty` / `ahead` 里猜——那两个字段判不出「清单是好几版之前扫的」。
@@ -6141,8 +6141,8 @@ var init_deploy_schemas = __esm({
        */
       releasedHead: external_exports.string().min(1).optional(),
       /**
-       * 这次**实际**怎么扫的。是结果不是入参——`deploy:start` 收到的 mode 可能因为没有可比的
-       * 基准而退成硬扫，页面要显示的是真正发生的那个。
+       * 这次**实际**怎么扫的。档位由 daemon 定（有线上版本可比 + 有跑完的清单 → 软扫，否则硬扫），
+       * 页面要显示的是真正发生的那个。
        *
        * `.default('hard')` 而不是必填：这个文件是 strict 解析的，存量记录没有这个字段，
        * 定成必填会让 `readScan` 当场抛、上云页面直接打不开。而老记录确实都是从零扫的。
@@ -6217,20 +6217,17 @@ var init_deploy_schemas = __esm({
        */
       fileError: external_exports.string().optional()
     }).strict();
-    DeployReleaseResultSchema = external_exports.object({
-      sha: external_exports.string().min(1),
-      actionsUrl: external_exports.string().min(1)
-    }).strict();
+    DeployReleaseResultSchema = external_exports.discriminatedUnion("outcome", [
+      external_exports.object({
+        outcome: external_exports.literal("pushed"),
+        sha: external_exports.string().min(1),
+        actionsUrl: external_exports.string().min(1)
+      }).strict(),
+      external_exports.object({ outcome: external_exports.literal("scanning") }).strict()
+    ]);
     DeployPersonaArgsSchema = external_exports.object({
       personaId: external_exports.string().min(1)
     }).strict();
-    DeployStartArgsSchema = DeployPersonaArgsSchema.extend({
-      /**
-       * 缺省 soft。真正用哪一档由 daemon 定（软扫比不了时会退硬扫），结果看 `DeployScan.baseKind`。
-       * 复用上面那个中央定义的字面量，不在这里手抄一份。
-       */
-      mode: ScanBaseKindSchema.optional()
-    }).strict();
     DeployPatchArgsSchema = external_exports.object({
       personaId: external_exports.string().min(1),
       patch: external_exports.object({
@@ -6450,7 +6447,7 @@ var init_feishu_auth = __esm({
       // mirror peer sessions（远端会话镜像）
       "peerSession:upsert",
       "peerSession:remove",
-      // 设备目录 + 连接（决策 #15：daemon 代理中心 server，需要 owner 的 ttcJwt）
+      // 设备目录 + 连接（决策 #15：daemon 代理中心 server，需要 owner 的登录票）
       "device:list",
       "device:connect",
       // iOS TestFlight 意向登记（需要 owner unionId 上报中心 server）
@@ -6520,13 +6517,7 @@ var init_feishu_auth = __esm({
        * 设备属性，与登录态无关、登录登出不变。UI"我的设备标识"用它拼
        * clawos://device/<deviceId>（替代旧的 unionId——不再向外暴露人的身份标识）。
        */
-      deviceId: external_exports.string().min(1),
-      /**
-       * TTC JWT 过期时间（unix ms）。null = 登录回调未携带 expires_at；字段缺省 = 老 daemon。
-       * 仅时间戳——token 本体永不出 ws（spec §9 不变）。UI 据此派生 过期/临期 提示
-       * （见 spec 2026-08-17-ttc-jwt-expiry-ux-design §2）。
-       */
-      ttcTokenExpiresAt: external_exports.number().nullable().optional()
+      deviceId: external_exports.string().min(1)
     });
     AuthLogoutResponseSchema = external_exports.object({
       type: external_exports.literal("auth:logout:ok")
@@ -8886,10 +8877,6 @@ var init_methods = __esm({
         args: WorkspaceReadArgs
       },
       // ---- deploy:*（persona 上云：persona 目录 = git 仓库工作树，发布 = 推送触发仓库流水线）----
-      "deploy:start": {
-        summary: "\u5BF9\u67D0\u4E2A persona \u8D77\u4E00\u6B21\u4E0A\u4E91\u626B\u63CF\u3002**\u6CA1\u4ED3\u5E93\u5148\u5EFA\u4ED3**\uFF08GitHub REST \u5EFA\u5728\u7EC4\u7EC7\u4E0B\u3001\u79C1\u6709\uFF0Cgit \u63A8\u9996\u4E2A\u63D0\u4EA4\uFF1Btoken \u6765\u81EA\u672C\u673A git \u7684\u8EAB\u4EFD\uFF0C\u6CA1\u6388\u6743\u5148\u62D2\uFF09\uFF0C\u518D\u8D77 persona-butler \u7684\u626B\u63CF\u4F1A\u8BDD\uFF0C\u7ED3\u679C\u5199\u8FDB persona \u76EE\u5F55\u7684 .clawd/deploy.json \uFF08\u73AF\u5883\u6E05\u5355\uFF0C\u8FDB\u4ED3\u5E93\uFF09\u4E0E .clawd/deploy-scan.json\uFF08\u8BC1\u636E\uFF0C\u4E0D\u8FDB\u4ED3\u5E93\uFF09\u3002\u5DF2\u7ECF\u5728\u626B\u7684\u8BDD\u539F\u6837\u8FD4\u56DE\u3001\u4E0D\u8D77\u7B2C\u4E8C\u4E2A\u626B\u63CF\u4F1A\u8BDD\uFF1Bowner-only",
-        args: DeployPersonaArgsSchema
-      },
       "deploy:get": {
         summary: "\u4E0A\u4E91\u9875\u9762\u8981\u7684\u5168\u90E8\uFF1A\u4ED3\u5E93\u7ED1\u5B9A\u72B6\u6001\uFF08git \u73B0\u7B97\uFF09\u3001\u90E8\u7F72\u6587\u4EF6\u3001\u626B\u63CF\u8BB0\u5F55\u3001\u4ED3\u5E93 Secrets \u91CC\u5404\u53D8\u91CF\u540D\u586B\u8FC7\u6CA1\u6709\uFF08**\u53EA\u6709\u540D\u5B57\u548C\u65F6\u95F4\uFF0C\u6CA1\u6709\u503C**\uFF09\uFF1Bowner-only",
         args: DeployPersonaArgsSchema
@@ -8911,7 +8898,7 @@ var init_methods = __esm({
         args: DeployFinishScanArgsSchema
       },
       "deploy:release": {
-        summary: "\u53D1\u5E03 = \u63D0\u4EA4\u5E76\u63A8\u9001\u5230\u4ED3\u5E93\uFF1A\u91CD\u5199 workflow \u6A21\u677F \u2192 git add -A \u2192 \u7A7A\u63D0\u4EA4\u4E5F\u5141\u8BB8 \u2192 push\u3002\u4ED3\u5E93\u91CC\u7684\u6D41\u6C34\u7EBF\u63A5\u7740\u6784\u955C\u50CF\u3001\u5728\u96C6\u7FA4\u4E0A\u771F\u8D77\u4E00\u6B21\u3001\u767B\u8BB0\u6210\u6B63\u5F0F\uFF0C\u8FDB\u5EA6\u5728 GitHub Actions \u770B\u3002\u524D\u7F6E\uFF1A\u5DF2\u7ED1\u5B9A\u4ED3\u5E93\u3001\u6709\u6E05\u5355\u3001\u6BCF\u4E2A\u53D8\u91CF\u540D\u90FD\u5728 Secrets \u91CC\uFF1Bowner-only",
+        summary: "\u53D1\u5E03\u2014\u2014\u4E0A\u4E91\u552F\u4E00\u7684\u52A8\u4F5C\uFF0C\u626B\u63CF\u662F\u5B83\u7684\u7B2C\u4E00\u6BB5\u3002**\u6CA1\u4ED3\u5E93\u5148\u5EFA\u4ED3**\uFF08GitHub REST \u5EFA\u5728\u7EC4\u7EC7\u4E0B\u3001\u79C1\u6709\uFF0Cgit \u63A8\u9996\u4E2A\u63D0\u4EA4\uFF1Btoken \u6765\u81EA\u672C\u673A git \u7684\u8EAB\u4EFD\uFF0C\u6CA1\u6388\u6743\u5148\u62D2\uFF09\u3002\u6E05\u5355\u8FC7\u65F6\uFF08persona \u6539\u8FC7 / \u6CA1\u626B\u8FC7 / \u4E0A\u6B21\u626B\u5931\u8D25\uFF09\uFF1A\u5148\u628A persona \u76EE\u5F55\u63D0\u4EA4\u5230\u672C\u5730\uFF08\u4E0D\u63A8\uFF09\uFF0C\u8D77 persona-butler \u7684\u626B\u63CF\u4F1A\u8BDD\uFF0C\u56DE outcome=scanning\u2014\u2014\u7ED3\u679C\u5199\u8FDB .clawd/deploy.json\uFF08\u6E05\u5355\uFF0C\u8FDB\u4ED3\u5E93\uFF09\u4E0E .clawd/deploy-scan.json\uFF08\u8BC1\u636E\uFF0C\u4E0D\u8FDB\u4ED3\u5E93\uFF09\uFF0C\u6B63\u5728\u626B\u7684\u8BDD\u539F\u6837\u8FD4\u56DE\u4E0D\u8D77\u7B2C\u4E8C\u4E2A\u4F1A\u8BDD\u3002\u6E05\u5355\u65B0\u9C9C\uFF1A\u8FC7\u95F8\uFF08\u6BCF\u4E2A\u53D8\u91CF\u540D\u90FD\u5728 Secrets \u91CC\u3001\u8FDE\u63A5\u5668\u6765\u6E90\u70B9\u8FC7\u3001\u9009\u4E86\u6A21\u578B\uFF09\u2192 \u91CD\u5199 workflow \u6A21\u677F \u2192 git add -A \u2192 \u7A7A\u63D0\u4EA4\u4E5F\u5141\u8BB8 \u2192 push\uFF0C\u56DE outcome=pushed \u5E26 commit \u4E0E Actions \u5730\u5740\uFF1B\u4ED3\u5E93\u91CC\u7684\u6D41\u6C34\u7EBF\u63A5\u7740\u6784\u955C\u50CF\u3001\u8BD5\u8DD1\u3001\u767B\u8BB0\u3002owner-only",
         args: DeployPersonaArgsSchema
       },
       "deploy:rerunJob": {
@@ -9309,7 +9296,7 @@ var init_methods = __esm({
         args: NO_ARGS
       },
       "auth:getIdentity": {
-        summary: "\u53D6\u672C\u673A owner \u7684\u98DE\u4E66\u8EAB\u4EFD\uFF08ownerId / provider / displayName / unionId\uFF09+ **\u672C\u673A deviceId**\uFF08\u8BBE\u5907\u5C5E\u6027\uFF0C\u4E0E\u767B\u5F55\u6001\u65E0\u5173\uFF1Bdevice:connect / contact:* / inbox:* \u7684\u4E3B\u952E\u90FD\u662F\u5B83\uFF09\uFF1B\u7EDD\u4E0D\u8FD4\u56DE ttcToken",
+        summary: "\u53D6\u672C\u673A owner \u7684\u98DE\u4E66\u8EAB\u4EFD\uFF08ownerId / provider / displayName / unionId\uFF09+ **\u672C\u673A deviceId**\uFF08\u8BBE\u5907\u5C5E\u6027\uFF0C\u4E0E\u767B\u5F55\u6001\u65E0\u5173\uFF1Bdevice:connect / contact:* / inbox:* \u7684\u4E3B\u952E\u90FD\u662F\u5B83\uFF09\uFF1B\u7EDD\u4E0D\u8FD4\u56DE\u767B\u5F55\u7968",
         args: NO_ARGS
       },
       "auth:logout": {
@@ -55209,7 +55196,7 @@ function fieldsOf(name, where, placeholders, warnings) {
   const ok = [];
   for (const p3 of uniq(placeholders)) {
     if (ConnectorFieldSchema.safeParse(p3).success) ok.push(p3);
-    else warnings.push(`MCP server\u300C${name}\u300D\u7684 ${where} \u91CC\u6709\u5360\u4F4D \${${p3}}\uFF0C\u53D8\u91CF\u540D\u4E0D\u5408\u5F62\u72B6\uFF08\u53EA\u80FD\u5927\u5199\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\uFF0C\u5B57\u6BCD\u5F00\u5934\uFF09\uFF0C\u6CA1\u7B97\u8FDB\u8981\u586B\u7684\u53D8\u91CF\uFF1B\u6539\u540D\u540E\u91CD\u65B0\u626B\u63CF`);
+    else warnings.push(`MCP server\u300C${name}\u300D\u7684 ${where} \u91CC\u6709\u5360\u4F4D \${${p3}}\uFF0C\u53D8\u91CF\u540D\u4E0D\u5408\u5F62\u72B6\uFF08\u53EA\u80FD\u5927\u5199\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\uFF0C\u5B57\u6BCD\u5F00\u5934\uFF09\uFF0C\u6CA1\u7B97\u8FDB\u8981\u586B\u7684\u53D8\u91CF\uFF1B\u6539\u540D\u540E\u518D\u53D1\u5E03\u4E00\u6B21\uFF08\u4F1A\u91CD\u65B0\u626B\u63CF\uFF09`);
   }
   return ok;
 }
@@ -55250,7 +55237,7 @@ function scanMcpConnectors(personaDir) {
   for (const [name, raw] of Object.entries(servers)) {
     const def = raw && typeof raw === "object" ? raw : {};
     if (!ConnectorNameSchema.safeParse(name).success) {
-      out.warnings.push(`MCP server\u300C${name}\u300D\u7684\u540D\u5B57\u4E0D\u5408\u5F62\u72B6\uFF08\u53EA\u80FD\u5C0F\u5199\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u77ED\u6A2A\u7EBF\uFF09\uFF0C\u6CA1\u5217\u8FDB\u6E05\u5355\uFF1B\u6539\u540D\u540E\u91CD\u65B0\u626B\u63CF`);
+      out.warnings.push(`MCP server\u300C${name}\u300D\u7684\u540D\u5B57\u4E0D\u5408\u5F62\u72B6\uFF08\u53EA\u80FD\u5C0F\u5199\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u77ED\u6A2A\u7EBF\uFF09\uFF0C\u6CA1\u5217\u8FDB\u6E05\u5355\uFF1B\u6539\u540D\u540E\u518D\u53D1\u5E03\u4E00\u6B21\uFF08\u4F1A\u91CD\u65B0\u626B\u63CF\uFF09`);
       continue;
     }
     const type = typeof def.type === "string" ? def.type.toLowerCase() : typeof def.url === "string" ? "http" : "stdio";
@@ -59358,7 +59345,7 @@ async function identityArgs(exec, dir) {
   if (has(email) && has(name)) return [];
   return ["-c", "user.name=clawd", "-c", "user.email=clawd@clawos.local"];
 }
-async function writeTemplates(dir) {
+async function writeGitignore(dir) {
   const gi = import_node_path34.default.join(dir, ".gitignore");
   let existing;
   try {
@@ -59367,6 +59354,8 @@ async function writeTemplates(dir) {
     existing = void 0;
   }
   await import_promises5.default.writeFile(gi, mergeGitignore(existing));
+}
+async function writeWorkflow(dir) {
   const wf = import_node_path34.default.join(dir, WORKFLOW_PATH);
   await import_promises5.default.mkdir(import_node_path34.default.dirname(wf), { recursive: true });
   await import_promises5.default.writeFile(wf, WORKFLOW_TEMPLATE);
@@ -59405,7 +59394,8 @@ async function ensureRepo(exec, api, args) {
   const { dir, org, personaId: personaId2 } = args;
   const existing = await repoInfo(exec, dir);
   if (existing) return { created: false, url: existing.url };
-  await writeTemplates(dir);
+  await writeGitignore(dir);
+  await import_promises5.default.rm(import_node_path34.default.join(dir, WORKFLOW_PATH), { force: true });
   let created;
   try {
     created = await createOrgRepo(exec, api, { dir, org, repoName: personaId2, message: "clawd: \u4E0A\u4E91", auth: args.auth });
@@ -59443,33 +59433,32 @@ async function hasCommit(exec, dir, sha) {
   const r2 = await git(exec, dir, ["cat-file", "-e", `${sha}^{commit}`]);
   return !r2.spawnError && r2.code === 0;
 }
-async function commitAndPush(exec, args) {
+async function commitAll(exec, args) {
   await mustGit(exec, args.dir, ["add", "-A"], "\u6682\u5B58\u6587\u4EF6");
   const staged = await git(exec, args.dir, ["diff", "--cached", "--quiet"]);
   if (staged.code === 1) {
     const identity = await identityArgs(exec, args.dir);
     await mustGit(exec, args.dir, [...identity, "commit", "-m", args.message], "\u63D0\u4EA4");
   }
-  await gitPush(exec, args.dir, args.auth);
   return mustGit(exec, args.dir, ["rev-parse", "HEAD"], "\u8BFB\u63D0\u4EA4");
 }
 async function release(exec, api, args) {
   const info = await repoInfo(exec, args.dir);
   if (!info) throw new RepoError("\u8FD8\u6CA1\u6709\u4ED3\u5E93\uFF0C\u5148\u70B9\u4E00\u6B21\u300C\u53D1\u5E03\u5230\u4E91\u4E0A\u300D\u5EFA\u4ED3");
   await api.enableActions(repoSlug(info.url));
-  await writeTemplates(args.dir);
+  await writeGitignore(args.dir);
+  await writeWorkflow(args.dir);
   const identity = await identityArgs(exec, args.dir);
   await mustGit(exec, args.dir, ["add", "-A"], "\u6682\u5B58\u6587\u4EF6");
   const stamp = new Date(args.now()).toISOString();
   await mustGit(exec, args.dir, [...identity, "commit", "--allow-empty", "-m", `clawd: \u53D1\u5E03 ${stamp}`], "\u63D0\u4EA4");
   await gitPush(exec, args.dir, args.auth);
   const sha = await mustGit(exec, args.dir, ["rev-parse", "HEAD"], "\u8BFB\u63D0\u4EA4");
-  return { sha, actionsUrl: `https://github.com/${repoSlug(info.url)}/actions` };
+  return { outcome: "pushed", sha, actionsUrl: `https://github.com/${repoSlug(info.url)}/actions` };
 }
 
 // src/deploy/scan-base.ts
 function pickScanBase(args) {
-  if (args.mode === "hard") return { kind: "hard" };
   if (!args.hasUsableManifest || !args.releasedHead) return { kind: "hard" };
   return { kind: "soft", base: args.releasedHead };
 }
@@ -59563,7 +59552,7 @@ var STALE_ASSETS_NOTE_PREFIX = "\u3010\u4E0A\u4E91\u626B\u63CF\u3011";
 function describeStaleAssets(stale) {
   if (stale.length === 0) return void 0;
   const plain = (s2) => s2.replace(/\*\*/g, "").replace(/\s+/g, " ").trim();
-  return `${STALE_ASSETS_NOTE_PREFIX}\u8FD9\u6B21\u626B\u63CF\u7684\u65F6\u5019\uFF0C\u626B\u63CF\u5668\u8FD8\u4E0D\u77E5\u9053\u6709${stale.map((a2) => `\u300C${a2.name}\u300D`).join("\u3001")}\u8FD9${stale.length > 1 ? "\u51E0" : ""}\u9879\u5171\u4EAB\u8D44\u4EA7\uFF0C\u6240\u4EE5\u6E05\u5355\u91CC\u53EF\u80FD\u6F0F\u4E86\u58F0\u660E\u3002${stale.map((a2) => ` ${a2.name} \u662F\uFF1A${plain(a2.what)}`).join("")} \u7528\u5F97\u4E0A\u7684\u8BDD\uFF0C\u5728\u6E05\u5355\u91CC\u8865\u4E00\u6761 asset\uFF0C\u6216\u8005\u91CD\u65B0\u626B\u63CF\u4E00\u904D\u3002`;
+  return `${STALE_ASSETS_NOTE_PREFIX}\u8FD9\u6B21\u626B\u63CF\u7684\u65F6\u5019\uFF0C\u626B\u63CF\u5668\u8FD8\u4E0D\u77E5\u9053\u6709${stale.map((a2) => `\u300C${a2.name}\u300D`).join("\u3001")}\u8FD9${stale.length > 1 ? "\u51E0" : ""}\u9879\u5171\u4EAB\u8D44\u4EA7\uFF0C\u6240\u4EE5\u6E05\u5355\u91CC\u53EF\u80FD\u6F0F\u4E86\u58F0\u660E\u3002${stale.map((a2) => ` ${a2.name} \u662F\uFF1A${plain(a2.what)}`).join("")} \u7528\u5F97\u4E0A\u7684\u8BDD\uFF0C\u5728\u6E05\u5355\u91CC\u8865\u4E00\u6761 asset\u3002`;
 }
 function settleEndedScan(outcome, current, now) {
   if (current?.status !== "scanning") return void 0;
@@ -59582,7 +59571,7 @@ function reconcileInterruptedScans(deps) {
       ...scan,
       status: "failed",
       finishedAt: deps.now,
-      error: "daemon \u91CD\u542F\uFF0C\u626B\u63CF\u4F1A\u8BDD\u5DF2\u4E2D\u65AD\u2014\u2014\u8BF7\u91CD\u65B0\u626B\u63CF"
+      error: "daemon \u91CD\u542F\uFF0C\u626B\u63CF\u4F1A\u8BDD\u5DF2\u4E2D\u65AD\u2014\u2014\u518D\u70B9\u4E00\u6B21\u300C\u53D1\u5E03\u300D\u4F1A\u91CD\u65B0\u626B\u63CF"
     });
     flipped.push(personaId2);
   }
@@ -59685,33 +59674,9 @@ function buildDeployHandlers(deps) {
   const view = async (personaId2) => ({
     response: { type: "deploy:state", ...await stateOf(personaId2) }
   });
-  const start = async (frame, _client, ctx) => {
-    ensureOwner(ctx);
-    const { personaId: personaId2, mode } = parseArgs2(DeployStartArgsSchema, frame, "deploy:start");
-    const dir = mustPersona(personaId2);
-    const wrong = wrongEngine(deps.personaEngine(personaId2)?.tool);
-    if (wrong) throw invalid(wrong);
-    const current = await readScan(dir);
-    if (current?.status === "scanning") return view(personaId2);
-    const { auth, api } = await requireGithub();
-    if (!await repoInfo(deps.exec, dir)) {
-      try {
-        await ensureRepo(deps.exec, api, { dir, org: deps.org, personaId: personaId2, auth });
-      } catch (err) {
-        throw toClawdError(err);
-      }
-      secretsCache.delete(personaId2);
-    }
-    let head;
-    try {
-      head = await commitAndPush(deps.exec, { dir, message: `clawd: \u626B\u63CF\u524D\u843D\u5B58 ${new Date(deps.now()).toISOString()}`, auth });
-    } catch (err) {
-      throw toClawdError(err);
-    }
-    runCache.delete(personaId2);
+  async function beginScan(personaId2, dir, current, head) {
     const prevManifest = await readDeployFile(dir).catch(() => void 0);
     const scanBase = pickScanBase({
-      mode,
       // **文件在 ≠ 清单能用**：硬扫一开头就写了一份空清单，那一轮没跑完（OTA 重启 / butler 崩，
       // 见 scan-task.ts 的收尾判定）的话文件在、内容是空的。所以判据连上「上一轮扫完了」。
       hasUsableManifest: prevManifest !== void 0 && current?.status === "done",
@@ -59762,8 +59727,7 @@ function buildDeployHandlers(deps) {
         error: `\u8D77\u626B\u63CF\u4F1A\u8BDD\u5931\u8D25\uFF1A${started.error}`
       });
     }
-    return view(personaId2);
-  };
+  }
   const get = async (frame, _client, ctx) => {
     ensureOwner(ctx);
     const { personaId: personaId2 } = parseArgs2(DeployPersonaArgsSchema, frame, "deploy:get");
@@ -59848,20 +59812,37 @@ function buildDeployHandlers(deps) {
     ensureOwner(ctx);
     const { personaId: personaId2 } = parseArgs2(DeployPersonaArgsSchema, frame, "deploy:release");
     const dir = mustPersona(personaId2);
-    const repo2 = await repoInfo(deps.exec, dir);
-    if (!repo2) throw invalid("\u8FD8\u6CA1\u6709\u4ED3\u5E93\uFF0C\u5148\u70B9\u4E00\u6B21\u300C\u53D1\u5E03\u5230\u4E91\u4E0A\u300D\u5EFA\u4ED3");
+    const wrong = wrongEngine(deps.personaEngine(personaId2)?.tool);
+    if (wrong) throw invalid(wrong);
+    const { auth, api } = await requireGithub();
+    let repo2 = await repoInfo(deps.exec, dir);
+    if (!repo2) {
+      try {
+        await ensureRepo(deps.exec, api, { dir, org: deps.org, personaId: personaId2, auth });
+      } catch (err) {
+        throw toClawdError(err);
+      }
+      secretsCache.delete(personaId2);
+      repo2 = await repoInfo(deps.exec, dir);
+      if (!repo2) throw new ClawdError(ERROR_CODES.INTERNAL, "\u4ED3\u5E93\u5EFA\u597D\u4E86\u4F46\u8BFB\u4E0D\u5230 origin");
+    }
     if (repo2.branch !== "main") throw invalid(`\u5F53\u524D\u5728\u5206\u652F ${repo2.branch}\uFF0C\u4ED3\u5E93\u91CC\u7684\u6D41\u6C34\u7EBF\u53EA\u8BA4 main\uFF1B\u5207\u56DE main \u518D\u53D1\u5E03`);
+    const current = await readScan(dir);
+    if (current?.status === "scanning") return { response: { type: "deploy:release", outcome: "scanning" } };
+    const fileUsable = await readDeployFile(dir).then((f2) => f2 !== void 0).catch(() => false);
+    if (!fileUsable || !isScanFresh(current, repo2)) {
+      let head;
+      try {
+        head = await commitAll(deps.exec, { dir, message: `clawd: \u626B\u63CF\u524D\u843D\u5B58 ${new Date(deps.now()).toISOString()}` });
+      } catch (err) {
+        throw toClawdError(err);
+      }
+      runCache.delete(personaId2);
+      await beginScan(personaId2, dir, current, head);
+      return { response: { type: "deploy:release", outcome: "scanning" } };
+    }
     const file = await readDeployFile(dir);
     if (!file) throw invalid("\u8FD8\u6CA1\u626B\u63CF\u51FA\u6E05\u5355");
-    const scan = await readScan(dir);
-    if (scan?.status === "scanning") throw invalid("\u626B\u63CF\u8FD8\u6CA1\u7ED3\u675F");
-    if (scan?.status !== "done") throw invalid(scan?.status === "failed" ? "\u4E0A\u6B21\u626B\u63CF\u5931\u8D25\u4E86\uFF0C\u5148\u91CD\u65B0\u626B\u63CF" : "\u8FD8\u6CA1\u626B\u63CF\u8FC7\uFF0C\u5148\u626B\u63CF");
-    if (!isScanFresh(scan, repo2)) {
-      throw invalid(
-        repo2.dirty ? "persona \u76EE\u5F55\u6709\u6539\u52A8\u8FD8\u6CA1\u626B\u8FC7\uFF0C\u5148\u91CD\u65B0\u626B\u63CF\u4E00\u6B21\uFF08\u6E05\u5355\u8981\u8DDF\u7740\u6539\u52A8\u8D70\uFF09" : "\u6E05\u5355\u662F\u66F4\u65E9\u90A3\u4E00\u7248\u626B\u51FA\u6765\u7684\uFF0C\u5148\u91CD\u65B0\u626B\u63CF\u4E00\u6B21"
-      );
-    }
-    const { auth, api } = await requireGithub();
     const blockers = [];
     let present;
     try {
@@ -59872,11 +59853,7 @@ function buildDeployHandlers(deps) {
     const missing = requiredEnvNames(file).filter((e) => !present.has(e));
     if (missing.length > 0) blockers.push(`${missing.join(" / ")} \u8FD8\u6CA1\u586B`);
     for (const c2 of file.manifest.connectors) blockers.push(...connectorBlockers(c2));
-    const engine = deps.personaEngine(personaId2);
-    const wrongTool = wrongEngine(engine?.tool);
-    if (wrongTool) {
-      blockers.push(wrongTool);
-    } else if (!engine?.model) {
+    if (!deps.personaEngine(personaId2)?.model) {
       blockers.push("\u8FD8\u6CA1\u9009\u6A21\u578B\uFF08\u5207\u5F15\u64CE\u65F6\u4F1A\u6E05\u7A7A\uFF09\u2014\u2014\u53BB persona \u8BBE\u7F6E\u91CC\u9009\u4E00\u4E2A");
     }
     if (blockers.length > 0) throw invalid(`\u8FD8\u5DEE\uFF1A${blockers.join("\uFF1B")}`);
@@ -59912,7 +59889,6 @@ function buildDeployHandlers(deps) {
     return view(personaId2);
   };
   return {
-    "deploy:start": start,
     "deploy:get": get,
     "deploy:patch": patch,
     "deploy:putSecret": putSecret,
@@ -62144,7 +62120,7 @@ async function centralRequest(opts, path101, init) {
   }
   clearTimeout(timer);
   if (res.status === 401) {
-    throw new CentralClientError("UNAUTHORIZED", "TTC JWT invalid or expired");
+    throw new CentralClientError("UNAUTHORIZED", "login pass rejected by center");
   }
   if (!res.ok) {
     let detail = "";
@@ -62164,12 +62140,8 @@ async function centralRequest(opts, path101, init) {
 async function centralExchange(opts) {
   const body = await centralRequest(opts, "/api/clawd-identity/exchange", {
     method: "POST",
-    body: {
-      jwt: opts.jwt,
-      provider: opts.provider,
-      deviceId: opts.deviceId,
-      selfDeviceId: opts.selfDeviceId
-    }
+    bearer: opts.loginPass,
+    body: { deviceId: opts.deviceId }
   });
   if (typeof body.token !== "string" || body.token.length === 0 || typeof body.ownerId !== "string" || typeof body.provider !== "string" || typeof body.displayName !== "string") {
     throw new CentralClientError("BAD_RESPONSE", "exchange: missing token/ownerId/provider/displayName");
@@ -62189,10 +62161,8 @@ async function centralGetPublicKey(opts) {
 async function centralUpsertDevice(opts) {
   const body = await centralRequest(opts, "/api/clawd-identity/devices/self", {
     method: "PUT",
-    bearer: opts.ttcJwt,
+    bearer: opts.loginPass,
     body: {
-      deviceId: opts.deviceId,
-      provider: opts.provider,
       ...opts.url ? { url: opts.url } : {},
       ...opts.name ? { name: opts.name } : {}
     }
@@ -62200,10 +62170,7 @@ async function centralUpsertDevice(opts) {
   if (body.ok !== true) {
     throw new CentralClientError("BAD_RESPONSE", "upsertDevice: server did not ack ok");
   }
-  return {
-    ok: true,
-    ...typeof body.loginPass === "string" && body.loginPass.length > 0 ? { loginPass: body.loginPass } : {}
-  };
+  return { ok: true };
 }
 async function centralPrincipalStatus(opts) {
   const query = `provider=${encodeURIComponent(opts.provider)}&ownerId=${encodeURIComponent(opts.ownerId)}`;
@@ -62216,11 +62183,10 @@ async function centralPrincipalStatus(opts) {
   return { active: body.active };
 }
 async function centralGetApiKey(opts) {
-  const body = await centralRequest(
-    opts,
-    `/api/persona-cloud/api-key?provider=${encodeURIComponent(opts.provider)}`,
-    { method: "GET", bearer: opts.ttcJwt }
-  );
+  const body = await centralRequest(opts, "/api/persona-cloud/api-key", {
+    method: "GET",
+    bearer: opts.loginPass
+  });
   if (body.apiKey !== null && typeof body.apiKey !== "string") {
     throw new CentralClientError("BAD_RESPONSE", "api-key: apiKey must be string or null");
   }
@@ -62234,8 +62200,7 @@ async function centralGetApiKey(opts) {
 async function centralIssueApiKey(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/api-key", {
     method: "POST",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider }
+    bearer: opts.loginPass
   });
   if (typeof body.apiKey !== "string" || body.apiKey.length === 0) {
     throw new CentralClientError("BAD_RESPONSE", "api-key: missing apiKey");
@@ -62250,11 +62215,10 @@ async function centralIssueApiKey(opts) {
   };
 }
 async function centralListDevices(opts) {
-  const body = await centralRequest(
-    opts,
-    `/api/clawd-identity/devices?provider=${encodeURIComponent(opts.provider)}`,
-    { method: "GET", bearer: opts.ttcJwt }
-  );
+  const body = await centralRequest(opts, "/api/clawd-identity/devices", {
+    method: "GET",
+    bearer: opts.loginPass
+  });
   if (!Array.isArray(body.devices)) {
     throw new CentralClientError("BAD_RESPONSE", "devices: missing devices array");
   }
@@ -62271,8 +62235,8 @@ async function centralListDevices(opts) {
 async function centralConnectorsMine(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/connectors/mine", {
     method: "POST",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider, personaId: opts.personaId, connectors: opts.connectors }
+    bearer: opts.loginPass,
+    body: { personaId: opts.personaId, connectors: opts.connectors }
   });
   if (!Array.isArray(body.connectors)) throw new CentralClientError("BAD_RESPONSE", "connectors/mine: missing connectors array");
   return { connectors: body.connectors };
@@ -62280,16 +62244,16 @@ async function centralConnectorsMine(opts) {
 async function centralConnectorFill(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/connectors/fields", {
     method: "PUT",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider, connector: opts.connector, values: opts.values }
+    bearer: opts.loginPass,
+    body: { connector: opts.connector, values: opts.values }
   });
   if (body.ok !== true) throw new CentralClientError("BAD_RESPONSE", "connectors/fields: server did not ack ok");
 }
 async function centralGithubAuthOauthStart(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/github/oauth/start", {
     method: "POST",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider, ...opts.returnTo ? { returnTo: opts.returnTo } : {} }
+    bearer: opts.loginPass,
+    body: { ...opts.returnTo ? { returnTo: opts.returnTo } : {} }
   });
   if (typeof body.authUrl !== "string" || !body.authUrl) throw new CentralClientError("BAD_RESPONSE", "github/oauth/start: missing authUrl");
   return { authUrl: body.authUrl };
@@ -62297,8 +62261,8 @@ async function centralGithubAuthOauthStart(opts) {
 async function centralGithubAuthToken(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/github/oauth/token", {
     method: "POST",
-    bearer: opts.ttcJwt,
-    body: { provider: opts.provider }
+    bearer: opts.loginPass,
+    body: {}
   });
   if (body.token === null || body.token === void 0) return void 0;
   if (typeof body.token !== "string" || !body.token) throw new CentralClientError("BAD_RESPONSE", "github/oauth/token: malformed token");
@@ -62337,10 +62301,10 @@ var CloudGatewayClient = class {
   deps;
   fetchImpl;
   async credentials() {
-    const rec5 = this.deps.readIdentity();
-    if (!rec5) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "\u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7528\u4E0D\u4E86");
+    const loginPass = this.deps.getLoginPass();
+    if (!loginPass) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "\u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7528\u4E0D\u4E86");
     const get = this.deps.getApiKey ?? ((args) => centralGetApiKey({ api: this.deps.centralApi ?? "", fetchImpl: this.fetchImpl, ...args }));
-    const { apiKey, gatewayUrl } = await get({ ttcJwt: rec5.ttcToken, provider: rec5.provider });
+    const { apiKey, gatewayUrl } = await get({ loginPass });
     if (!apiKey) throw new Error("\u8FD8\u6CA1\u751F\u6210\u4E91 persona \u7684\u8C03\u7528 key\uFF0C\u53BB\u300C\u8BBE\u7F6E \u2192 \u4E91\u4E0A persona\u300D\u751F\u6210\u4E00\u628A");
     if (!gatewayUrl) throw new Error("\u4E2D\u5FC3\u6CA1\u914D\u4E91 gateway \u5730\u5740\uFF08gatewayUrl \u4E3A\u7A7A\uFF09");
     return { apiKey, gatewayUrl: trimSlash(gatewayUrl) };
@@ -65896,8 +65860,7 @@ async function importZip(buf, root) {
 function parseLoginCallbackQuery(url) {
   return {
     token: url.searchParams.get("token") ?? "",
-    state: url.searchParams.get("state") ?? "",
-    expiresAt: url.searchParams.get("expires_at")
+    state: url.searchParams.get("state") ?? ""
   };
 }
 function escapeHtml(s2) {
@@ -67558,7 +67521,7 @@ var OwnerIdentityStore = class {
       return null;
     }
     const r2 = parsed;
-    if (!r2.identity || typeof r2.identity.ownerId !== "string" || r2.identity.ownerId.length === 0 || typeof r2.identity.provider !== "string" || r2.identity.provider.length === 0 || typeof r2.identity.displayName !== "string" || r2.identity.displayName.length === 0 || typeof r2.ttcToken !== "string" || r2.ttcToken.length === 0) {
+    if (!r2.identity || typeof r2.identity.ownerId !== "string" || r2.identity.ownerId.length === 0 || typeof r2.identity.provider !== "string" || r2.identity.provider.length === 0 || typeof r2.identity.displayName !== "string" || r2.identity.displayName.length === 0 || typeof r2.loginPass !== "string" || r2.loginPass.length === 0) {
       return null;
     }
     return {
@@ -67569,10 +67532,8 @@ var OwnerIdentityStore = class {
         ...typeof r2.identity.avatarUrl === "string" ? { avatarUrl: r2.identity.avatarUrl } : {},
         ...typeof r2.identity.unionId === "string" ? { unionId: r2.identity.unionId } : {}
       },
-      ttcToken: r2.ttcToken,
-      ttcTokenExpiresAt: typeof r2.ttcTokenExpiresAt === "number" ? r2.ttcTokenExpiresAt : null,
-      loginAt: typeof r2.loginAt === "string" ? r2.loginAt : (/* @__PURE__ */ new Date(0)).toISOString(),
-      ...typeof r2.loginPass === "string" && r2.loginPass.length > 0 ? { loginPass: r2.loginPass } : {}
+      loginPass: r2.loginPass,
+      loginAt: typeof r2.loginAt === "string" ? r2.loginAt : (/* @__PURE__ */ new Date(0)).toISOString()
     };
   }
   write(record4) {
@@ -67649,13 +67610,10 @@ var LoginFlow = class {
         reason: `device_binding upsert failed: ${err.message}`
       };
     }
-    const expiresAtNum = params.expiresAt ? Number.parseInt(params.expiresAt, 10) : NaN;
     this.deps.store.write({
       identity,
-      ttcToken: params.token,
-      ttcTokenExpiresAt: Number.isFinite(expiresAtNum) ? expiresAtNum : null,
-      loginAt: new Date(now).toISOString(),
-      ...loginPass ? { loginPass } : {}
+      loginPass,
+      loginAt: new Date(now).toISOString()
     });
     return { ok: true, identity };
   }
@@ -67765,7 +67723,10 @@ async function upsertDeviceBinding(opts) {
     body = await res.json();
   } catch {
   }
-  return typeof body.loginPass === "string" && body.loginPass.length > 0 ? { loginPass: body.loginPass } : {};
+  if (typeof body.loginPass !== "string" || body.loginPass.length === 0) {
+    throw new DeviceBindingClientError("BAD_RESPONSE", "center did not issue a login pass (api too old?)");
+  }
+  return { loginPass: body.loginPass };
 }
 
 // src/contact/org-mesh.ts
@@ -67872,7 +67833,7 @@ function rethrowLoginExpired(e) {
   if (e instanceof CentralClientError && e.code === "UNAUTHORIZED") {
     throw new ClawdError(
       ERROR_CODES.VALIDATION_ERROR,
-      `${LOGIN_EXPIRED_ERROR_MARKER}: \u767B\u5F55\u51ED\u8BC1\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55`
+      `${LOGIN_EXPIRED_ERROR_MARKER}: \u767B\u5F55\u7968\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55`
     );
   }
   throw e;
@@ -69974,9 +69935,7 @@ function buildFeishuAuthHandlers(deps) {
         type: "auth:getIdentity:ok",
         identity: record4 ? record4.identity : null,
         // 决策 #15：设备属性，与登录态无关——UI"分享我的 Hub 标识"用
-        deviceId: deps.deviceId,
-        // 过期时间戳（仅时间戳，token 本体永不出 ws）——UI 派生 过期/临期 提示
-        ttcTokenExpiresAt: record4 ? record4.ttcTokenExpiresAt : null
+        deviceId: deps.deviceId
       }
     };
   };
@@ -69996,7 +69955,7 @@ function buildFeishuAuthHandlers(deps) {
         "\u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u62FF\u4E0D\u5230\u4E91 persona \u7684\u8C03\u7528 key"
       );
     }
-    return { ttcJwt: record4.ttcToken, provider: record4.identity.provider };
+    return { loginPass: record4.loginPass };
   }
   const apiKeyGet = async () => {
     const { apiKey, createdAt, gatewayUrl } = await deps.apiKeyClient.get(requireLogin());
@@ -70029,9 +69988,9 @@ function ensureOwner6(ctx) {
 var invalid2 = (msg) => new ClawdError(ERROR_CODES.VALIDATION_ERROR, `VALIDATION_ERROR: ${msg}`);
 function buildCloudConnectorsHandlers(deps) {
   function requireLogin() {
-    const rec5 = deps.readIdentity();
-    if (!rec5) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "FEISHU_LOGIN_REQUIRED: \u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7684\u8FDE\u63A5\u5668\u7528\u4E0D\u4E86");
-    return rec5;
+    const loginPass = deps.getLoginPass();
+    if (!loginPass) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "FEISHU_LOGIN_REQUIRED: \u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7684\u8FDE\u63A5\u5668\u7528\u4E0D\u4E86");
+    return { loginPass };
   }
   async function personalConnectors(personaId2) {
     const persona = deps.getPersona(personaId2);
@@ -70115,7 +70074,6 @@ var METHOD_GRANT_MAP = {
   "visitor:list": ADMIN_ANY,
   // deploy:*（persona 上云）：全部 owner-only。里面有凭据录入口、建仓和推送，
   // guest 不该看见更不该动。
-  "deploy:start": ADMIN_ANY,
   "deploy:get": ADMIN_ANY,
   "deploy:patch": ADMIN_ANY,
   "deploy:putSecret": ADMIN_ANY,
@@ -70317,13 +70275,12 @@ var METHOD_GRANT_MAP = {
   "auth:apiKey:get": ADMIN_ANY,
   "auth:apiKey:regenerate": ADMIN_ANY,
   // ---- device:* 设备目录 + 连接（决策 #15，owner-only） ----
-  // 设备目录 / 连接都是 owner 本机操作（用 owner 的 ttcJwt 找中心 server），guest 不可调
+  // 设备目录 / 连接都是 owner 本机操作（用本机登录票找中心 server），guest 不可调
   "device:list": ADMIN_ANY,
   "device:connect": ADMIN_ANY,
   "device:connections": ADMIN_ANY
 };
 var HUMAN_ONLY_METHODS = [
-  "deploy:start",
   "deploy:release",
   "deploy:putSecret",
   "deploy:rerunJob",
@@ -70371,7 +70328,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.525".length > 0 ? "0.2.525" : "dev";
+var version = "0.2.527".length > 0 ? "0.2.527" : "dev";
 
 // src/cli-probe/probe.ts
 var fs77 = __toESM(require("fs"), 1);
@@ -73032,8 +72989,8 @@ async function startDaemon(config) {
         });
       },
       // 验票第二段（spec 2026-08-28）：本地验签只证明"票是中心签的"，这一步问中心
-      // "持票人还在职吗"。token 不再过期，撤销全靠它。端点无鉴权——不带本机 ttcJwt，
-      // 否则飞书过期又会牵连互联。
+      // "持票人还在职吗"。token 不再过期，撤销全靠它。端点无鉴权——不带本机登录票，
+      // 本机没登录也能验别人的票。
       checkPrincipalActive: async (provider, ownerId2) => {
         const r2 = await centralPrincipalStatus({
           api: config.clawosApi ?? DEFAULT_CLAWOS_API,
@@ -73183,7 +73140,7 @@ async function startDaemon(config) {
         const r2 = ownerIdentityStore.read();
         if (!r2) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "FEISHU_LOGIN_REQUIRED: \u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u5173\u8054 GitHub \u8981\u7ECF\u4E2D\u5FC3\uFF1B\u5148\u767B\u5F55\uFF0C\u6216\u5728\u5361\u7247\u4E0A\u624B\u52A8\u7C98 token");
         try {
-          return await centralGithubAuthOauthStart({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ttcJwt: r2.ttcToken, provider: r2.identity.provider, ...returnTo ? { returnTo } : {} });
+          return await centralGithubAuthOauthStart({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, loginPass: r2.loginPass, ...returnTo ? { returnTo } : {} });
         } catch (err) {
           throw new ClawdError(ERROR_CODES.INTERNAL, `\u5411\u4E2D\u5FC3\u8981 GitHub \u6388\u6743\u94FE\u63A5\u6CA1\u6210\uFF1A${err instanceof Error ? err.message : String(err)}`);
         }
@@ -73191,7 +73148,7 @@ async function startDaemon(config) {
       token: async () => {
         const r2 = ownerIdentityStore.read();
         if (!r2) return void 0;
-        return centralGithubAuthToken({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ttcJwt: r2.ttcToken, provider: r2.identity.provider });
+        return centralGithubAuthToken({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, loginPass: r2.loginPass });
       }
     },
     now: () => Date.now(),
@@ -73593,10 +73550,7 @@ async function startDaemon(config) {
     screenIdleProbeLogger
   }) : new ClaudeAdapter({ logger, historyReader: new ClaudeHistoryReader() });
   const cloudGateway = new CloudGatewayClient({
-    readIdentity: () => {
-      const r2 = ownerIdentityStore.read();
-      return r2 ? { ttcToken: r2.ttcToken, provider: r2.identity.provider } : null;
-    },
+    getLoginPass: () => ownerIdentityStore.read()?.loginPass ?? null,
     centralApi: config.clawosApi ?? DEFAULT_CLAWOS_API,
     logger
   });
@@ -73701,24 +73655,15 @@ async function startDaemon(config) {
     const record4 = ownerIdentityStore.read();
     if (!record4) return;
     try {
-      const r2 = await centralUpsertDevice({
+      await centralUpsertDevice({
         api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-        ttcJwt: record4.ttcToken,
-        provider: record4.identity.provider,
-        deviceId: authFile.deviceId,
+        loginPass: record4.loginPass,
         url: currentTunnelUrl ?? void 0,
         name: ownerDisplayName
       });
-      if (r2.loginPass) {
-        const latest = ownerIdentityStore.read();
-        if (latest && latest.ttcToken === record4.ttcToken && latest.loginPass !== r2.loginPass) {
-          ownerIdentityStore.write({ ...latest, loginPass: r2.loginPass });
-        }
-      }
       logger.info("device registered to central server", {
         deviceId: authFile.deviceId,
-        url: currentTunnelUrl ?? "(none)",
-        loginPass: r2.loginPass ? "issued" : "absent"
+        url: currentTunnelUrl ?? "(none)"
       });
     } catch (err) {
       logger.warn("device register failed (best-effort)", { err: err.message });
@@ -73728,7 +73673,7 @@ async function startDaemon(config) {
   const runOrgMesh = async () => {
     if (!feishuActive || orgMeshInFlight) return;
     const record4 = ownerIdentityStore.read();
-    if (!record4?.loginPass) return;
+    if (!record4) return;
     const loginPass = record4.loginPass;
     orgMeshInFlight = true;
     try {
@@ -73776,10 +73721,8 @@ async function startDaemon(config) {
       }
       return centralExchange({
         api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-        jwt: record4.ttcToken,
-        provider: record4.identity.provider,
-        deviceId,
-        selfDeviceId: authFile.deviceId
+        loginPass: record4.loginPass,
+        deviceId
       });
     },
     listDevices: async () => {
@@ -73789,8 +73732,7 @@ async function startDaemon(config) {
       }
       return centralListDevices({
         api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-        ttcJwt: record4.ttcToken,
-        provider: record4.identity.provider
+        loginPass: record4.loginPass
       });
     },
     connectRemote,
@@ -73821,8 +73763,7 @@ async function startDaemon(config) {
         });
         logger.info("device-binding upsert succeeded", {
           deviceId: opts.deviceId,
-          unionId: opts.identity.unionId,
-          loginPass: r2.loginPass ? "issued" : "absent"
+          unionId: opts.identity.unionId
         });
         return r2;
       } catch (err) {
@@ -73964,8 +73905,8 @@ async function startDaemon(config) {
       // 联系人列表 store（device:connect 出站 / contact:handshake 入站落同一 store）
       contactStore,
       // contact:handshake 换票（spec 2026-07-22；2026-08-17 起硬失败，不再是回填）：
-      // 用 owner 当前 jwt 换 aud=对方设备 的票，现读 ownerIdentityStore（热切换后用新身份）。
-      // 契约（ContactHandlerDeps.exchangeToken）：null = 本机登录问题（未登录 / JWT 过期），
+      // 用本机登录票换 aud=对方设备 的票，现读 ownerIdentityStore（热切换后用新身份）。
+      // 契约（ContactHandlerDeps.exchangeToken）：null = 本机登录问题（未登录），
       // 其他失败原样抛给 handler——两种都会让握手硬失败，只是给对端的错误文案不同。
       exchangeToken: async (targetDeviceId) => {
         const record4 = ownerIdentityStore.read();
@@ -73973,10 +73914,8 @@ async function startDaemon(config) {
         try {
           const r2 = await centralExchange({
             api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-            jwt: record4.ttcToken,
-            provider: record4.identity.provider,
+            loginPass: record4.loginPass,
             deviceId: targetDeviceId,
-            selfDeviceId: authFile.deviceId,
             // 换票在握手关键路径上（硬失败），对端 connect-remote RPC_TIMEOUT_MS=5s：
             // 必须在其内失败/成功，否则对端先超时不落库、本机后换票成功落库 → 反向半连，
             // 破坏「两侧都不落库」不变量。4s 留 1s 余量给 ws 往返
@@ -74029,21 +73968,18 @@ async function startDaemon(config) {
         }
       },
       // 云 persona 卡片上的连接器区（design 2026-09-11-mcp-connector §3.8）：装了什么以 gateway 登记行为真源，
-      // 连没连上问中心。登录凭证只在 daemon 内部传给中心，与 apiKeyClient 同一条纪律。
+      // 连没连上问中心。登录票只在 daemon 内部传给中心，与 apiKeyClient 同一条纪律。
       cloudConnectors: {
         getPersona: (personaId2) => personaRegistry.get(personaId2),
         gatewayConnectors: (gatewayPersonaId) => cloudGateway.personaConnectors(gatewayPersonaId),
-        readIdentity: () => {
-          const r2 = ownerIdentityStore.read();
-          return r2 ? { ttcJwt: r2.ttcToken, provider: r2.identity.provider } : null;
-        },
+        getLoginPass: () => ownerIdentityStore.read()?.loginPass ?? null,
         central: {
           mine: (args) => centralConnectorsMine({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args }),
           fill: (args) => centralConnectorFill({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args })
         }
       },
       // 设备目录 + 连接（决策 #15：daemon 代理中心 server）。
-      // exchange/listDevices 包掉 owner ttcJwt（每次现读 store——热切换后立即用新身份）；
+      // exchange/listDevices 包掉本机登录票（每次现读 store——热切换后立即用新身份）；
       // dispatcher 的 FEISHU_GATED_METHODS gate 已保证未登录时这些 RPC 到不了 handler，
       // 这里的 FEISHU_LOGIN_REQUIRED 抛错只是防御纵深。
       feishuDevice: feishuDeviceDeps,