tirtc-device-builder 0.9.4 → 0.9.6

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tirtc-device-builder",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "description": "Codex workflows for building and validating TiRTC device firmware across supported chip platforms.",
   "author": {
     "name": "TangeAI",

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 This project follows Semantic Versioning.
 
+## 0.9.6
+
+- Pin ESP32-S3 Device Kit 1.1.6 with TiRTC C SDK 2.5.0 and verify the
+  GitHub release archive checksum before npm publication.
+- Build the Kit from the builder-owned ESP32 source and validate the SDK,
+  installer, project generator, and standalone reference firmware.
+- Keep board-specific media adapters and hardware evidence separate from the
+  reusable Skill; hardware verification remains board-specific.
+
+## 0.9.5
+
+- Add focused video-orientation and WeChat UI-profile guidance distinguishing
+  encoded pixels, display size, rotation conventions and endpoint verification.
+- Package the bounded XiaoTai serial capture/export helper with offline tests
+  for ANSI queries, evidence integrity and retained/empty capture recovery.
+- Pin Waveshare product knowledge to a95f368 and document the watchpoint-proven
+  LVGL callback-count overwrite; preserve pending HIL and non-default UI angles.
+
 ## 0.9.4
 
 - Add a knowledge-only Waveshare ESP32-P4-WIFI6-Touch-LCD-3.5 package with

package/README.md

@@ -8,11 +8,11 @@ TiRTC Device Builder 用于把 ESP32-S3/ESP32-P4 开发板接入 TiRTC。输入
 |---|---|---|
 | `tirtc-esp32-builder` | ESP32-S3 / ESP32-P4、ESP-IDF 5.5.x | 板型识别、Hardware IR、工程生成/移植、H5/AI/设备互呼/微信 VoIP、AEC 门禁、编译烧录和分层验收 |
 
-H5/AI 的 ESP32-S3 托管模板、协议文档和 TiRTC SDK 已打包在独立的 ESP32 Device Kit 中，安装时会自动下载并校验。设备互呼或微信 VoIP 的模拟/移植若超出当前 Kit 内容，则需要在用户授权后使用固定 commit 的 `tirtc-server-example` 完整仓库。ESP32-P4 必须使用匹配的 P4 SDK、BSP 与网络方案，不能复用 S3 预编译库。
+H5/AI 的 ESP32-S3 托管模板、协议文档和 TiRTC SDK 已打包在独立的 ESP32 Device Kit 中，安装时会自动下载并校验。ESP32 示例源码由本仓库的 `kit-src/` 维护；设备互呼或微信 VoIP 的移植可参考其中的独立示例。ESP32-P4 必须使用匹配的 P4 SDK、BSP 与网络方案，不能复用 S3 预编译库。
 
 - npm 包：[tirtc-device-builder](https://www.npmjs.com/package/tirtc-device-builder)
 - GitHub 仓库：[tangeai/tirtc-device-builder](https://github.com/tangeai/tirtc-device-builder)
-- ESP32 Device Kit：[kit-esp32s3-v1.1.4](https://github.com/tangeai/tirtc-device-builder/releases/tag/kit-esp32s3-v1.1.4)
+- ESP32 Device Kit：[kit-esp32s3-v1.1.6](https://github.com/tangeai/tirtc-device-builder/releases/tag/kit-esp32s3-v1.1.6)
 
 文档导航：
 
@@ -282,14 +282,16 @@ board-materials/
 | 参考模组 | ESP32-S3-WROOM-1-N16R8，或资源和配置经过确认的兼容板 |
 | ESP-IDF | 5.5.x |
 | 自动安装版本 | ESP-IDF v5.5.4 |
-| TiRTC SDK | `espressif-esp32s3/2.3.0` |
-| ESP32 Device Kit | 1.1.4 |
+| 本仓库源码与本地打包使用的 TiRTC SDK | `espressif-esp32s3/2.5.0` |
+| ESP32 Device Kit | 1.1.6（内含 TiRTC SDK 2.5.0） |
 | Node.js | 18 或更高版本 |
 | 支持自动安装的系统 | Linux、WSL、macOS |
 | 原生 Windows | 使用 Espressif 官方安装器准备 ESP-IDF，再重新运行检查 |
 
 当前托管自动生成器只提供 ESP32-S3 模板。ESP32-P4 可由 Skill 在已有、证据完整的 P4 BSP/工程上移植，但必须使用 `espressif-esp32p4` SDK、匹配的构建合同和明确的 ESP-Hosted 或以太网方案。Flash 或 PSRAM 容量变化时，需要重新评估 `sdkconfig.defaults`、分区表、DMA 和媒体缓存预算。
 
+从本仓库 `kit-src/` 直接生成或打包时使用 TiRTC 2.5.0；`setup esp32` 安装固定的 Kit 版本，其 SDK 版本以该 Kit 的 `manifest.json` 为准。
+
 ### 本机软件
 
 `setup esp32 --install` 会检查以下基础命令：
@@ -392,7 +394,7 @@ Cline 当前还需要在 `Settings → Features → Enable Skills` 中启用实
 |---|---|
 | Agent Skill | 上表中所选目录下的 `tirtc-esp32-builder` |
 | 托管根目录 | `~/.tirtc-device-builder` |
-| Device Kit | `~/.tirtc-device-builder/kits/esp32s3/1.1.4` |
+| Device Kit | `~/.tirtc-device-builder/kits/esp32s3/1.1.6` |
 | ESP-IDF | `~/.tirtc-device-builder/esp-idf-v5.5.4` |
 | Espressif 工具 | `~/.tirtc-device-builder/espressif` |
 | 安装记录 | `~/.tirtc-device-builder/config.json` |
@@ -437,7 +439,7 @@ npx --yes tirtc-device-builder@latest setup esp32 --install \
 
 ```bash
 npx --yes tirtc-device-builder@latest setup esp32 --install \
-  --kit-archive /absolute/path/tirtc-esp32s3-kit-1.1.4.tar.gz
+  --kit-archive /absolute/path/tirtc-esp32s3-kit-1.1.6.tar.gz
 ```
 
 安装器仍会核对固定的 SHA-256、目录结构、清单和每个资源文件，不接受未经验证的同名压缩包。
@@ -820,7 +822,7 @@ npx --yes tirtc-device-builder@latest setup esp32 --install --force-skill
 
 ```bash
 npx --yes tirtc-device-builder@latest setup esp32 --install \
-  --kit-archive /absolute/path/tirtc-esp32s3-kit-1.1.4.tar.gz
+  --kit-archive /absolute/path/tirtc-esp32s3-kit-1.1.6.tar.gz
 ```
 
 安装器会校验 SHA-256 和内部文件清单。如果校验不一致，请重新获取官方 Release 附件，不要跳过校验。
@@ -880,7 +882,7 @@ npx --yes tirtc-device-builder@latest setup esp32
 
 不需要。普通开发所需的生成器、模板、协议文档、TiRTC 头文件和 `libTiRTC.a` 都在版本化的 ESP32 Device Kit 中。一键安装会下载公开 Release，并把路径写进 `env.sh`。
 
-`--thing-connect-root` 主要用于维护模板、协议或 Device Kit 的开发者复用完整源码工作区。
+维护者可用 `--thing-connect-root` 指向本仓库的 `kit-src/`；普通使用者使用安装好的 Device Kit 路径。
 
 ### 为什么推荐 `npx`，不是安装一个 npm 包就结束？
 
@@ -931,29 +933,28 @@ python3 ~/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py .
 
 ```bash
 npm run pack:esp32-kit -- \
-  --source /absolute/path/tirtc-server-example/thing-connect \
-  --kit-version 1.1.4
+  --kit-version 1.1.6
 ```
 
 输出位于 `dist/`：
 
 ```text
-tirtc-esp32s3-kit-1.1.4.tar.gz
-tirtc-esp32s3-kit-1.1.4.tar.gz.sha256
+tirtc-esp32s3-kit-1.1.6.tar.gz
+tirtc-esp32s3-kit-1.1.6.tar.gz.sha256
 ```
 
-校验后推送独立的 `kit-esp32s3-v<version>` 标签。`publish-kit.yml` 会从 metadata 固定的上游 commit 重建压缩包、核对 SHA-256，并使用 GitHub Actions token 创建 Release：
+校验后推送独立的 `kit-esp32s3-v<version>` 标签。`publish-kit.yml` 会从 metadata 固定的本仓库源码 commit 重建压缩包、核对 SHA-256，并使用 GitHub Actions token 创建 Release：
 
 ```bash
 cd dist
-sha256sum -c tirtc-esp32s3-kit-1.1.4.tar.gz.sha256
+sha256sum -c tirtc-esp32s3-kit-1.1.6.tar.gz.sha256
 cd ..
 
-git tag -a kit-esp32s3-v1.1.4 -m "TiRTC ESP32-S3 Device Kit 1.1.4"
-git push origin kit-esp32s3-v1.1.4
+git tag -a kit-esp32s3-v1.1.6 -m "TiRTC ESP32-S3 Device Kit 1.1.6"
+git push origin kit-esp32s3-v1.1.6
 ```
 
-metadata 中的版本、标签、上游 commit 和期望 SHA-256 必须与本地可复现打包结果一致；工作流不会从浮动的 `main` 取发布内容。
+metadata 中的版本、标签、本仓库源码 commit 和期望 SHA-256 必须与本地可复现打包结果一致；工作流不会从浮动的 `main` 取发布内容。
 
 ### 发布 npm
 
@@ -961,8 +962,8 @@ metadata 中的版本、标签、上游 commit 和期望 SHA-256 必须与本地
 
 ```bash
 npm test
-git tag -a v0.9.4 -m "v0.9.4"
-git push origin v0.9.4
+git tag -a v0.9.6 -m "v0.9.6"
+git push origin v0.9.6
 ```
 
 不要重复发布已经存在的 npm 版本。版本变化同步更新 `package.json`、`.codex-plugin/plugin.json` 和发布说明。

package/bin/esp32-kit-metadata.js

@@ -1,9 +1,10 @@
 export const ESP32_KIT = Object.freeze({
-  archiveName: "tirtc-esp32s3-kit-1.1.4.tar.gz",
-  archiveRoot: "tirtc-esp32s3-kit-1.1.4",
-  releaseTag: "kit-esp32s3-v1.1.4",
-  sha256: "b041baca1fbf6f3f3bd1299921793f0f708c669023b39148a34e3f478e3789fc",
-  sourceCommit: "7e9c595b8b5531bd781e42344c584095f3f74a1b",
-  url: "https://github.com/tangeai/tirtc-device-builder/releases/download/kit-esp32s3-v1.1.4/tirtc-esp32s3-kit-1.1.4.tar.gz",
-  version: "1.1.4",
+  archiveName: "tirtc-esp32s3-kit-1.1.6.tar.gz",
+  archiveRoot: "tirtc-esp32s3-kit-1.1.6",
+  releaseTag: "kit-esp32s3-v1.1.6",
+  sha256: "61243703bdee3e1b492fcc6f5245143f419efbd2310127d180875f0708e91d8b",
+  sdkVersion: "2.5.0",
+  sourceCommit: "68a3b34054ea933d5ea5bfd8acf71e5ff07a7a61",
+  url: "https://github.com/tangeai/tirtc-device-builder/releases/download/kit-esp32s3-v1.1.6/tirtc-esp32s3-kit-1.1.6.tar.gz",
+  version: "1.1.6",
 });

package/bin/install-esp32-kit.js

@@ -24,9 +24,6 @@ const REQUIRED_FILES = [
   "device-sim/templates/esp32-h5-ai/CMakeLists.txt",
   "device-sim/templates/esp32-h5-ai/platform-media-contract.json",
   "device-sim/templates/esp32-h5-ai/tirtc-runtime-contract.json",
-  "device-sim/sdk/espressif-esp32s3/2.3.0/include/tirtc/tiRTC.h",
-  "device-sim/sdk/espressif-esp32s3/2.3.0/lib/libTiRTC.a",
-  "device-sim/sdk/espressif-esp32s3/2.3.0/manifest/build-contract.env",
 ];
 
 function hashFile(path) {
@@ -98,9 +95,21 @@ function validateExtractedKit(root, metadata) {
       `Device Kit version mismatch: expected ${metadata.version}, got ${manifest.kit_version}`,
     );
   }
-  if (manifest.target !== "esp32s3" || manifest.tirtc_sdk_version !== "2.3.0") {
+  if (manifest.target !== "esp32s3" ||
+      !/^(?:2\.3\.0|2\.5\.0)$/.test(manifest.tirtc_sdk_version) ||
+      (metadata.sdkVersion && manifest.tirtc_sdk_version !== metadata.sdkVersion)) {
     throw new Error("Device Kit target or TiRTC SDK version is incompatible");
   }
+  const sdkRoot = `device-sim/sdk/espressif-esp32s3/${manifest.tirtc_sdk_version}`;
+  const sdkFiles = [
+    `${sdkRoot}/include/tirtc/tiRTC.h`,
+    `${sdkRoot}/lib/libTiRTC.a`,
+    `${sdkRoot}/manifest/build-contract.env`,
+  ];
+  const missingSdk = sdkFiles.filter((path) => !existsSync(join(root, path)));
+  if (missingSdk.length > 0) {
+    throw new Error(`Device Kit SDK is incomplete: ${missingSdk.join(", ")}`);
+  }
   if (!manifest.files || typeof manifest.files !== "object") {
     throw new Error("Device Kit manifest has no file checksums");
   }

package/bin/setup-esp32.js

@@ -29,12 +29,6 @@ const GENERATOR_PATH = join(
   "scripts",
   "create_esp32_project.py",
 );
-const SDK_PATH = join(
-  "device-sim",
-  "sdk",
-  "espressif-esp32s3",
-  "2.3.0",
-);
 const REQUIRED_SDK_FILES = [
   join("include", "tirtc", "tiRTC.h"),
   join("lib", "libTiRTC.a"),
@@ -233,6 +227,7 @@ export function inspectDeviceKit(root) {
   const manifestPath = root ? join(root, DEVICE_KIT_MANIFEST) : null;
   let manifestPresent = false;
   let version = null;
+  let sdkVersion = null;
   let manifestError = null;
   if (manifestPath && existsSync(manifestPath)) {
     manifestPresent = true;
@@ -245,6 +240,9 @@ export function inspectDeviceKit(root) {
         manifest.kit_version.trim()
       ) {
         version = manifest.kit_version.trim();
+        if (typeof manifest.tirtc_sdk_version === "string") {
+          sdkVersion = manifest.tirtc_sdk_version;
+        }
       } else {
         manifestError = "manifest.json does not declare kit_version";
       }
@@ -258,11 +256,13 @@ export function inspectDeviceKit(root) {
   const generatorReady = Boolean(
     root && existsSync(join(root, GENERATOR_PATH)),
   );
-  const sdk = root ? join(root, SDK_PATH) : null;
-  const sdkReady = Boolean(
-    sdk &&
-      REQUIRED_SDK_FILES.every((relative) => existsSync(join(sdk, relative))),
-  );
+  const sdkVersions = sdkVersion
+    ? [sdkVersion]
+    : [...new Set(["2.5.0", ESP32_KIT.sdkVersion])];
+  const sdkReady = Boolean(root && sdkVersions.some((candidate) => {
+    const sdk = join(root, "device-sim", "sdk", "espressif-esp32s3", candidate);
+    return REQUIRED_SDK_FILES.every((relative) => existsSync(join(sdk, relative)));
+  }));
   const structureReady = generatorReady && sdkReady;
   const versionCompatible =
     !manifestPresent ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tirtc-device-builder",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "description": "Install and run TiRTC device-development Agent Skills across popular coding clients.",
   "license": "MIT",
   "author": {

package/skills/tirtc-esp32-builder/SKILL.md

@@ -20,11 +20,12 @@ past build as proof for a new artifact.
    talkback, AI intercom, device-to-device calling, and WeChat VoIP. Do not
    silently remove a requested feature because the current starter lacks it.
 3. Resolve a versioned source of truth. The managed ESP32-S3 Device Kit is the
-   default for its packaged capabilities. Device-call/WeChat simulation or
-   protocol porting requires a pinned full `tirtc-server-example` checkout when
-   those sources are absent from the selected Kit. Clone or download it only
-   when the user authorizes that external write. Read applicable repository
-   instructions and the exact business documents routed by `workflow.md`.
+   default for its packaged capabilities; this repository's `kit-src/` owns the
+   ESP32 generator, SDK and standalone reference implementation. For
+   device-call/WeChat protocol simulation use a pinned `tirtc-server-example`
+   checkout when the Kit lacks the Linux C simulator and protocol documents.
+   Clone or download it only when the user authorizes that external write.
+   Read the exact business documents routed by `workflow.md`.
 4. Run Doctor for the exact target and SDK package. Managed generation currently
    automates ESP32-S3. ESP32-P4 is valid only with an evidenced P4 BSP/network
    path and the matching `espressif_esp32p4` SDK/build contract; never link the
@@ -48,6 +49,9 @@ are source maps and evidence, not permission to install a candidate adapter.
 For an existing project's media, memory or scheduling bug, read
 [runtime-resource-review.md](references/runtime-resource-review.md); preserve
 the user's business baseline separately from the hardware reference.
+For video orientation, unexpected cropping, or WeChat display-profile changes,
+read [video-orientation.md](references/video-orientation.md) before changing
+pixel transforms or UI angles.
 
 ## 3. Prove the business flows before board porting
 

package/skills/tirtc-esp32-builder/USAGE.md

@@ -74,7 +74,7 @@ printf '%s\n' "$TIRTC_THING_CONNECT_ROOT"
 python3 <skill-dir>/scripts/doctor.py \
   --expected-idf 5.5 \
   --target esp32s3 \
-  --thing-connect-root ~/.tirtc-device-builder/kits/esp32s3/1.1.4 \
+  --thing-connect-root ~/.tirtc-device-builder/kits/esp32s3/1.1.6 \
   --require-workspace
 ```
 
@@ -119,4 +119,4 @@ python3 <skill-dir>/scripts/firmware_identity.py build/<app>.bin \
 
 ## 当前边界
 
-ThingConnect 仓库提供 ESP32-S3 H5/AI 模板和生成器，但默认媒体适配器不包含特定开发板的摄像头、麦克风、选定视频路径、Wi-Fi 凭证方法和扬声器驱动。模板生成和编译成功只证明工程与协议骨架可用，不代表 Web 已经出图或 AI 音频已经通过实机验收。
+Device Kit 提供 ESP32-S3 H5/AI 模板和生成器，但默认媒体适配器不包含特定开发板的摄像头、麦克风、选定视频路径和扬声器驱动。模板生成和编译成功只证明工程与协议骨架可用，不代表 Web 已经出图或 AI 音频已经通过实机验收。

package/skills/tirtc-esp32-builder/VERSION

@@ -1 +1 @@
-0.9.4
+0.9.6

package/skills/tirtc-esp32-builder/assets/hardware-ir-v2.example.json

@@ -29,8 +29,8 @@
     "verification": "extracted",
     "tirtc": {
       "platform": "espressif-esp32s3",
-      "version": "2.3.0",
-      "sdk_path": "device-sim/sdk/espressif-esp32s3/2.3.0",
+      "version": "2.5.0",
+      "sdk_path": "device-sim/sdk/espressif-esp32s3/2.5.0",
       "build_contract": "manifest/build-contract.env"
     },
     "source_refs": [

package/skills/tirtc-esp32-builder/assets/hardware-ir.example.json

@@ -29,8 +29,8 @@
     "verification": "extracted",
     "tirtc": {
       "platform": "espressif-esp32s3",
-      "version": "2.3.0",
-      "sdk_path": "device-sim/sdk/espressif-esp32s3/2.3.0",
+      "version": "2.5.0",
+      "sdk_path": "device-sim/sdk/espressif-esp32s3/2.5.0",
       "build_contract": "manifest/build-contract.env"
     },
     "source_refs": [

package/skills/tirtc-esp32-builder/assets/lckfb-szpi-esp32s3-portable-prompt.md

@@ -8,7 +8,7 @@
 
 ```bash
 export TIRTC_AGENT_CLIENT=codex
-npx --yes tirtc-device-builder@0.9.4 setup esp32 --install \
+npx --yes tirtc-device-builder@0.9.6 setup esp32 --install \
   --client "$TIRTC_AGENT_CLIENT" --force-skill
 ```
 
@@ -17,11 +17,11 @@ npx --yes tirtc-device-builder@0.9.4 setup esp32 --install \
 本轮第一步先只读运行：
 
 ```bash
-npx --yes tirtc-device-builder@0.9.4 --version
-npx --yes tirtc-device-builder@0.9.4 setup esp32 --client "$TIRTC_AGENT_CLIENT"
+npx --yes tirtc-device-builder@0.9.6 --version
+npx --yes tirtc-device-builder@0.9.6 setup esp32 --client "$TIRTC_AGENT_CLIENT"
 ```
 
-必须根据命令的实际输出和本机文件确认：npm 包为 0.9.4、已安装 Skill 的 `VERSION` 为 0.9.4、所选 Device Kit 的 `manifest.json` 中 `kit_version` 为 1.1.4，并且 Doctor 对 `--expected-kit 1.1.4` 输出 `OVERALL: PASS`。Plugin manifest 不属于这种 npm 安装方式的运行时前置条件，不得把不可访问的 Plugin 版本当作阻塞项。如果版本不一致、Skill 是在当前会话启动后才安装，或环境检查未通过，停止并报告前置条件不成立；不要在当前会话中替换 Skill 后继续生成工程。
+必须根据命令的实际输出和本机文件确认：npm 包为 0.9.6、已安装 Skill 的 `VERSION` 为 0.9.6、所选 Device Kit 的 `manifest.json` 中 `kit_version` 为 1.1.6、`tirtc_sdk_version` 为 2.5.0，并且 Doctor 对 `--expected-kit 1.1.6` 输出 `OVERALL: PASS`。Plugin manifest 不属于这种 npm 安装方式的运行时前置条件，不得把不可访问的 Plugin 版本当作阻塞项。如果版本不一致、Skill 是在当前会话启动后才安装，或环境检查未通过，停止并报告前置条件不成立；不要在当前会话中替换 Skill 后继续生成工程。
 
 工作区与 clean-room 边界：
 - 将启动 Agent 客户端时的当前目录定义为 `WORKSPACE_ROOT`。

package/skills/tirtc-esp32-builder/knowledge/waveshare-esp32-p4-wifi6-touch-lcd-3.5/knowledge.md

@@ -9,7 +9,7 @@ authorize pin reuse. No credentials, raw call logs or user media are retained.
 
 | Baseline | Pinned source | Locate next |
 | --- | --- | --- |
-| Product business | xiaotai, baseline `8d67f0fe1b7385485e9d3de57065be53d10639ed` plus uncommitted P4 port | `lckfb-szpi-esp32s3-tirtc/components/starter_runtime/src/starter_runtime.c`, shared `starter_product`, `starter_tirtc` |
+| Product business | xiaotai `a95f368a037eb3ebe88d8564e1cb2f85e369f525` | `lckfb-szpi-esp32s3-tirtc/components/starter_runtime/src/starter_runtime.c`, shared `starter_product`, `starter_tirtc` |
 | Hardware/media | tirtc-device-example `cad4cbe58c3ff451906322930ceede19e6bf6a07`, app 1.5.3 | `complete-applications/esp32-p4/device-monitor/main/` |
 | Vendor | waveshareteam/ESP32-P4-WIFI6-Touch-LCD-3.5 `870588e62daaf723f3c52f0060d8dc053665ed30` | `examples/esp-idf/06_I2SCodec`, `docs/revisions.md`, schematic |
 | Cross-check | xiaozhi-esp32 `1ce658bcb9ce9aac69d3f87af9894a715b7175f6` | `main/boards/waveshare/esp32-p4-wifi6-touch-lcd-3.5/` |
@@ -59,7 +59,7 @@ is in `waveshare-esp32p4-xiaotai/PORT_STATUS.md` and `BUILD_IDENTITY.md`.
 | UI slow / video not smooth | Product UI tick100ms limits presentation near10fps; renderer input24x256KiB plus output20x480x320x2 dominate pools. Retained pools are intentional, not proven optimal for this product. | `call_video_renderer_config.h`, `p4_video_ui_tick`; measure before tuning |
 
 Product-specific media: device CALL H264 both directions; WeChat VOIP H264 up /
-MJPEG down, profile video enabled with 640x480, 8k mono A-law. Preserve explicit
+MJPEG down, profile video enabled with actual screen 480x320, 8k mono A-law. Preserve explicit
 voice calls. Camera privacy disables local capture/send while keeping remote
 decode/audio; microphone is independent. Profile declaration is not proof of
 actual packets or display. P4 H264 encode is hardware; downstream H264 here is
@@ -78,7 +78,69 @@ These identify historical local artifacts, not bundled binaries or a reproducibl
 release. User reports video visible after the stream-filter correction, without
 a complete artifact-bound capture. Startup logs prove one successful media
 start, not long-run stability. Earlier HMAC signing -> invalid LVGL event crash
-is unresolved; no claim it was fixed by task cleanup. AEC/double-talk, weak
+was subsequently traced to an LVGL overwrite, as detailed below; task cleanup
+was a separate fix. AEC/double-talk, weak
 network, repeated calls, PMIC controls and full product parity remain pending.
 Promote only after exact identity, portable adapter/IR/contracts and per-flow
 artifact-bound acceptance are retained.
+
+## Later findings at the committed product baseline
+
+### LVGL callback counter overwrites an unrelated allocator hook
+
+The diagnostic `diag.9` hardware watchpoint caught `lv_obj_add_event_cb` writing
+the mbedTLS calloc function pointer while `render_page` registered the screen
+event again. `lv_obj_clean(screen)` removed children, not screen callbacks.
+The selected LVGL descriptor count was six bits: registration 64 wrapped it,
+zero-sized realloc returned the allocator's sentinel, and descriptor index -1
+wrote 12 bytes before that sentinel. An ensuing HMAC allocation jumped into
+`on_screen_event(e=1)`. The apparent crypto/LVGL call stack was a consequence,
+not an allocator ABI diagnosis or proof of stack exhaustion.
+
+Correction: register once when the persistent screen is initialized, not on
+every page rebuild; remove temporary watchpoints after capturing the writer.
+`tools/test_screen_event_lifetime.py` in the S3 project runs 512 actual setup
+paths against the relevant LVGL counter logic. Source/build regression passed;
+post-fix sustained HIL is not established by that test. Watchpoint addresses
+belonged to that ELF and must never become hardcoded protection logic.
+
+### Orientation, aspect ratio and profile experiments
+
+Read [video-orientation.md](../../references/video-orientation.md) for the
+general procedure and protocol fields. The capture.13 pre-SDK PNG showed the
+upright test card clockwise90; thus the device's encoded pixels were already
+sideways, not merely H5 CSS. The original H264 was not retained at inspection,
+so 1280x960 is corroborated by PNG/capture metadata, not a fresh SPS inspection.
+
+The upright.14 / voipdir.15 implementation captures native1280x960 and uses
+PPA CCW90 before H264 encode, producing960x1280@15 / target2Mbps without crop
+or spatial scale. It adds about1,843,200 bytes of rotation-output PSRAM and one
+PPA transaction. The source geometry and submission tests cover exchanged axes,
+zero crop offsets, 1:1 scale and rotation-aware resource matching. CALL's
+decoder-limited profile remains separate; these values are not maximum ratings.
+
+The user reported H5 orientation correct and P4's MJPEG CW90 display correct
+with voipdir.15, but mini-program rendering still wrong. These are user-reported
+per-direction observations, not a complete artifact-bound acceptance bundle.
+voipui.16 added UI fields with rotation0 / aspect0.75 / mirrorsfalse / contain.
+The subsequent request selected **additional UI rotation270** in voipui.17;
+that latest setting compiled but has **no confirming post-change HIL**. Do not
+promote270 into the board registry's default or claim it fixes every endpoint.
+
+- Latest compiled BIN SHA256: `8de6f919acd120fe283db17ffd653d347a5850df715e1f3879e7910b3b3df29c`
+- Latest compiled ELF SHA256: `2aecb8fb9e81347ef9aed76371c5f0404364b687f393df8fb4ae2099edfddc1c`
+- Source: `waveshare-esp32p4-xiaotai/main/media/{camera_pipeline,video_yuv420_scaler}.c`,
+  `main/services/call_video_renderer.c`; shared `request_voip_profile`.
+- Tests: P4 `tools/test_full_frame_uplink.py`, `test_uplink_rotation.py`,
+  `test_voip_profile.py`. Local SDK PPA enums are CCW, UI angles CW.
+
+### Reusable capture tool boundary
+
+The packaged `scripts/capture_uplink.py` is derived from the committed P4
+`tools/capture_uplink.py`. Its device counterpart is
+`components/p4_hardware/p4_video_capture.c` plus the pre-SDK hook in `p4_video.c`.
+Device firmware is not shipped by this knowledge-only package. Read product
+`VIDEO_CAPTURE.md` and confirm compatible commands before running the helper.
+The helper's actual dump parsing, fragmented ANSI query handling, stopped/empty
+recovery and disconnect classification have packaged host regressions. They do
+not establish unattended operation on an untested USB/terminal combination.

package/skills/tirtc-esp32-builder/references/environment.md

@@ -16,7 +16,7 @@ The automatic branch never runs `sudo` or modifies a persistent shell profile. W
 When `<setup-root>/env.sh` exists, use it only as an activation prefix for the current command:
 
 ```bash
-bash -lc '. "<setup-root>/env.sh" && python3 "<skill-dir>/scripts/doctor.py" --expected-idf 5.5 --expected-kit 1.1.4 --target esp32s3 --require-workspace'
+bash -lc '. "<setup-root>/env.sh" && python3 "<skill-dir>/scripts/doctor.py" --expected-idf 5.5 --expected-kit 1.1.6 --target esp32s3 --require-workspace'
 ```
 
 The helper contains paths, not device or network credentials. Read `<setup-root>/config.json` when exact managed paths are needed; the environment helper does not authorize unrelated downloads, shell-profile changes, flashing, or credential writes.
@@ -26,7 +26,7 @@ Run the doctor before generation, build, flash, or monitor:
 ```bash
 python3 <skill-dir>/scripts/doctor.py \
   --expected-idf 5.5 \
-  --expected-kit 1.1.4 \
+  --expected-kit 1.1.6 \
   --target esp32s3 \
   --require-workspace
 ```
@@ -44,15 +44,18 @@ For an explicitly selected legacy workspace, omit `--expected-kit`; otherwise re
 1. an explicit `--thing-connect-root <path>`;
 2. `TIRTC_THING_CONNECT_ROOT`;
 3. an ancestor of the project or current directory containing `device-sim/scripts/create_esp32_project.py`;
-4. an ancestor whose `thing-connect/` child contains that generator.
+4. an ancestor whose `kit-src/` or `thing-connect/` child contains that generator.
 
-The default managed root is `<setup-root>/kits/esp32s3/<kit-version>`. The public ThingConnect workspace remains an optional legacy/development input; the doctor accepts either a Device Kit root, a repository root, or its `thing-connect/` child.
+The default managed root is `<setup-root>/kits/esp32s3/<kit-version>`. The `tirtc-device-builder/kit-src` directory is the ESP32 development source; the doctor also accepts an installed Device Kit root. Older `thing-connect/` layouts remain accepted as legacy inputs.
+Resolve the SDK from the selected Kit manifest or generated project. Kit 1.1.6
+and this repository's source generator use the ESP32-S3 SDK 2.5.0.
 
 The managed Kit currently contains the ESP32-S3 H5/AI starter. When the requested
 portfolio includes device-to-device calling or WeChat VoIP and the selected Kit
 does not contain `device-sim-c`, `device-call.md`, `device-voip.md`, and the API
-reference, use a full `tirtc-server-example` checkout pinned to a recorded commit
-for the simulator and porting source. Cloning is an external write and requires
+reference, use this repository's `kit-src/device-sim/device-sim-esp32` for the
+ESP32 implementation and a pinned `tirtc-server-example` commit for server
+protocols and non-ESP32 simulators. Cloning is an external write and requires
 user authorization. Do not track a moving default branch as build evidence.
 
 ESP32-P4 uses a separate `espressif_esp32p4` SDK archive and RISC-V toolchain.

package/skills/tirtc-esp32-builder/references/runtime-resource-review.md

@@ -29,6 +29,15 @@ specific, not generic magic constants.
 
 ## Resource lifecycle
 
+- A callback reached from an unrelated allocator/crypto call can be the victim
+  of an earlier overwrite. Validate the exact ELF, inspect the indirect-call
+  target and use a narrowly scoped watchpoint to catch the writer. In LVGL,
+  persistent screen callbacks belong to screen creation, not every child-page
+  rebuild: cleaning children does not remove callbacks on their parent. Check
+  the actual version's descriptor counter width. See the Waveshare knowledge
+  package for the captured six-bit overflow case; numeric addresses are not
+  portable fixes.
+
 - Inventory task creation and deletion pairs. ESP-IDF `xTaskCreate*WithCaps`
   requires `vTaskDeleteWithCaps`; ordinary deletion retains its statically
   registered stack/TCB. Confirm the installed IDF implementation. Self-deletion

package/skills/tirtc-esp32-builder/references/tirtc-platform.md

@@ -20,7 +20,7 @@ used by a build.
 ## SDK lifecycle
 
 TiRTC is one process-wide runtime. The exact selected header governs API and
-option availability. For SDK 2.3.0 the important order is:
+option availability. For SDK 2.5.0 the important order is:
 
 1. Set `TIRTC_OPT_MAX_SEND_BUFFER` before `TiRtcInit()` when overriding it.
 2. Call `TiRtcInit()` once.
@@ -33,7 +33,12 @@ option availability. For SDK 2.3.0 the important order is:
 6. Stop sessions and connections through deferred lifecycle work before the one
    final `TiRtcStop()` / `TiRtcUninit()` sequence.
 
-The callback table and its context outlive the SDK runtime. Callback payloads
+The callback table and its context outlive the SDK runtime. SDK 2.5.0 adds
+`on_sleep_wakeup_info` at the end of `TIRTCCALLBACKS`; zero-initialize the full
+struct and keep it `NULL` when sleep wakeup is unused. If supplied, this callback
+can run synchronously inside `TiRtcStart()`. Set a custom
+`TIRTC_OPT_TGTRP_POLL_TIMEOUT` after `TiRtcInit()`, which resets it to 10 ms.
+Callback payloads
 are borrowed; copy required data into bounded application-owned storage before
 returning.
 
@@ -68,6 +73,10 @@ authorized contact list, route WeChat MQTT events, and use `POST
 selects an authorized contact; it is not a direct SDK API. Mini-program
 authorization and plugin behavior are separate platform acceptance evidence.
 
+For video profile fields and orientation, use
+[video-orientation.md](video-orientation.md). Screen dimensions, encoded-frame
+aspect ratio and mini-program display transforms describe different boundaries.
+
 ## Simulator before hardware
 
 For the four-feature portfolio, use the pinned Linux C reference implementation
@@ -81,8 +90,8 @@ drop a requested feature or call it verified.
 
 ## ESP32 targets
 
-The current managed generator and Device Kit automate ESP32-S3. Official SDK
-2.3.0 also provides a distinct ESP32-P4 package. P4 needs ESP-IDF 5.5.4, matching
+The current managed generator and Device Kit automate ESP32-S3. ESP32-P4 requires
+a distinct target-specific SDK package. P4 needs ESP-IDF 5.5.4, matching
 RISC-V toolchain/build contract, PSRAM, and an evidenced network path such as
 ESP-Hosted with C6/C61 or Ethernet. P4 and S3 archives are not interchangeable.
 

package/skills/tirtc-esp32-builder/references/video-orientation.md

@@ -0,0 +1,117 @@
+# Video geometry, orientation and WeChat UI
+
+Use when a video appears sideways, mirrored, cropped/zoomed, or differs between
+H5 and WeChat. Keep four independent facts: sensor output, encoded pixels,
+device display viewport, and remote player's UI transform. An absent rotate
+call does not prove upright pixels: camera mounting can already introduce an
+offset. H5 working does not prove the VoIP-mode encoded pixels are identical.
+
+## Locate the transform
+
+Keep the board and an asymmetric upright test card stationary. Use readable
+text plus top/left/right marks; rotation alone and rotation plus reflection
+are distinct. State only what the screenshot establishes, not where the
+transform happened. Avoid repeatedly asking for placement once confirmed.
+
+Compare short **pre-SDK** H264 clips from each affected mode, with the exact
+firmware identity and active generation. Start at SPS/PPS plus IDR, decode
+without automatic rotation, inspect pixels, and read coded width/height from
+SPS (for example ffprobe). Callback dimensions are useful corroboration, not
+a substitute for SPS. A truncated printed ELF hash is not a full identity.
+
+- Matching source clips but different displays: inspect SDK/bridge and player
+  UI settings rather than globally rotating the camera again.
+- Different source clips: inspect mode-specific capture, crop, encoder input
+  and profile transitions first.
+- One correctly oriented receive direction says nothing about the opposite
+  direction. Apply and test corrections at the intended boundary only.
+
+Retain separate claims for observed pixels, verified source configuration,
+successful compilation, and post-change hardware observations.
+
+## Geometry and resources
+
+For a full-frame 90-degree rotation, exchange width/height. A 1280x960 sensor
+frame becomes 960x1280; preserving complete pixels is not the same as forcing
+a landscape aspect ratio. Validate encoder width AND height limits, alignment,
+crop coordinates in input axes, scale factors, clamp logic, direct-input
+bypasses, and reserved-resource matching including rotation. Budget an extra
+output surface and conversion time. PPA angles in the ESP-IDF P4 driver are
+counterclockwise; check the selected header instead of sharing enum values
+with a clockwise UI API.
+
+Treat a conservative reference profile as policy, not silicon capacity. Verify
+the installed sensor's native modes and actual output; selecting an 800x640
+mode and taking its central 640x480 narrows field of view even without a
+digital zoom setting. Disable or expose automatic resolution fallback when
+the product requires an exact output. Keep H5/phone encode capability separate
+from a peer P4's software H264 decode limits.
+
+## WeChat profile contract
+
+Checked 2026-09-07 against the primary
+[profile API](https://github.com/tangeai/tirtc-server-example/blob/main/thing-connect/api-reference.md#post-v1voipdeviceprofile)
+and [VoIP guide](https://github.com/tangeai/tirtc-server-example/blob/main/thing-connect/device-voip.md).
+These URLs track main: pin/recheck the selected platform revision before a
+new integration. Do not infer protocol absence from an older board example.
+
+| Field | Boundary / constraint |
+| --- | --- |
+| `screen_width`, `screen_height` | Actual device display region, not uplink coded dimensions |
+| `camera_rotation` | Additional clockwise mini-program UI angle, one of 0/90/180/270; default 0 |
+| `aspect_ratio` | Device video's width/height, positive; default 4/3 can be wrong for portrait output |
+| `hor_mirror`, `vert_mirror` | Mini-program horizontal/vertical reflection; defaults false |
+| `object_fit` | Mini-program `fill` or `contain`; default fill |
+| `video_res_mode` | Downlink `auto`, `fit_screen`, or `fill_screen`; does not rotate |
+
+The five UI fields do not configure TiRTC encoding. `fit_screen` bounds MJPEG
+inside the screen without cropping/upscaling; `fill_screen` can upscale and
+center-crop. Both need valid screen sizes; fill requires even dimensions.
+Do not silently change a working downlink mode while investigating uplink UI.
+The profile JSON must fit 512 bytes. Test actual serialized fields, types and
+size, not only log text. Re-report after changes and start a fresh call so the
+mini-program consumes updated configuration.
+
+Choose UI angle relative to the already-transformed encoded pixels; avoid
+blindly reporting a physical mounting angle. If pixel correction is already
+upright, zero additional UI rotation is a hypothesis to test, not an absolute
+rule. A observed need for another angle is endpoint-specific evidence: retain
+H5/VoIP captures and test the new call before calling it verified. In particular,
+the Waveshare experiment's requested 270 is not a universal board default.
+
+## Bounded capture and serial recovery
+
+The packaged `scripts/capture_uplink.py` supports the **XiaoTai video-capture
+console protocol**, not arbitrary TiRTC firmware. It does not flash or install
+firmware. Source and device-side integration are pinned in the Waveshare
+knowledge package; verify `video-capture` exists before use. Host requirements:
+Python plus pyserial on POSIX; ffprobe/ffmpeg are optional for decoded PNG.
+
+```bash
+python3 <skill-dir>/scripts/capture_uplink.py --port <exact-port> --output <new-path>.h264
+```
+
+Use test-card media only, with explicit serial/capture authorization. The
+firmware allocates at most 512 KiB PSRAM on demand and copies complete frames
+without blocking for a lock or doing file/serial I/O in the encoder callback.
+It stops on capacity, generation/size change, or contention. Approximate
+two-second duration is not guaranteed; missing SPS/PPS/IDR can leave it empty.
+Export is console-task work after stop and disconnect. No network upload.
+
+The helper answers ANSI status/cursor queries (including queries without a
+newline), preserves partial serial lines, uses CR and clears stale command
+input. It opens the port exclusively where supported, but a read interruption
+alone does not distinguish another reader from USB disconnect or reboot.
+Check process ownership and USB logs without killing unrelated processes.
+Display safe panic/reboot markers rather than dumping credential-bearing logs.
+
+Recovery is explicit: use `--dump-only` to stop then inspect retained capture;
+keep nonempty media, release only an inactive empty buffer, and ask the user
+to close the H5 page or hang up before exporting. Terminal Enter is confirmation,
+not a remote hangup command. Check offsets, length and checksum before writing
+new files. Existing H264/PNG/TXT files can indicate a successful prior export:
+inspect them or select a new basename instead of deleting them blindly.
+
+Completion: accepted serialized profile, identified coded dimensions and
+pre-SDK pixels, plus separate H5 and WeChat display checks. Tool/host tests alone
+do not prove camera orientation, serial HIL or call stability.

package/skills/tirtc-esp32-builder/scripts/capture_uplink.py

@@ -0,0 +1,220 @@
+#!/usr/bin/env python3
+"""Opt-in serial capture of pre-SDK H264. Close idf.py monitor before use."""
+import argparse
+import re
+import shutil
+import subprocess
+import time
+from pathlib import Path
+
+
+class Terminal:
+    """Minimal ANSI responder; retain partial lines across serial read timeouts."""
+    def __init__(self, port):
+        self.port = port
+        self.pending = bytearray()
+        self.tail = bytearray()
+        self.received = 0
+        self.signals = []
+
+    def write(self, data):
+        return self.port.write(data)
+
+    def readline(self):
+        deadline = time.monotonic() + 0.2
+        while time.monotonic() < deadline:
+            if b"\n" in self.pending:
+                line, _, rest = self.pending.partition(b"\n")
+                self.pending = bytearray(rest)
+                for signature in (b"Guru Meditation", b"panic'ed", b"assert failed",
+                                  b"CORRUPT HEAP", b"Stack smashing", b"Brownout",
+                                  b"Rebooting", b"ESP-ROM:"):
+                    if signature in line and signature.decode() not in self.signals:
+                        self.signals.append(signature.decode())
+                        # Do not print unrelated runtime logs or credentials.
+                        print(f"设备诊断标记：{signature.decode()}", flush=True)
+                return bytes(line) + b"\n"
+            try:
+                chunk = self.port.read(min(self.port.in_waiting or 1, 4096))
+            except OSError as error:
+                raise RuntimeError(
+                    f"串口读取中断（已收到{self.received}字节；"
+                    f"已观测异常标记={','.join(self.signals) or '无，不能排除重启'}）。"
+                    "请检查串口占用及USB断连/设备重启；未自动重连或清除设备抓流。"
+                ) from error
+            self.received += len(chunk)
+            for byte in chunk:
+                self.tail.append(byte)
+                self.tail = self.tail[-8:]
+                if self.tail.endswith(b"\x1b[6n"):
+                    self.write(b"\x1b[1;80R")
+                elif self.tail.endswith(b"\x1b[5n"):
+                    self.write(b"\x1b[0n")
+            self.pending.extend(chunk)
+            if len(self.pending) > 16384 and b"\n" not in self.pending:
+                raise RuntimeError("console line too long; check serial port/baud")
+        return b""
+
+    def settle(self):
+        deadline = time.monotonic() + 0.6
+        while time.monotonic() < deadline:
+            self.readline()
+
+    def command(self, text):
+        self.settle()
+        # Ctrl-U clears a stale partially typed command; REPL expects CR.
+        self.write(b"\x15" + text.encode("ascii") + b"\r")
+
+
+def firmware_identity(port):
+    port.settle()
+    port.command("version")
+    try:
+        return until(port, "Firmware:", timeout=5)
+    except TimeoutError:
+        # An earlier monitor may have consumed the cursor query without replying.
+        # Complete that outstanding read, then clear the input and retry once.
+        port.write(b"\x1b[1;80R")
+        port.settle()
+        port.command("version")
+        return until(port, "Firmware:", timeout=10)
+
+
+def fnv(data):
+    value = 2166136261
+    for byte in data:
+        value = ((value ^ byte) * 16777619) & 0xffffffff
+    return value
+
+
+class Dump:
+    def __init__(self):
+        self.data = bytearray()
+        self.meta = None
+
+    def feed(self, line):
+        # Ignore unrelated logs, but reject holes, duplicates and corrupted data.
+        start = re.search(r"VCAP BEGIN bytes=(\d+) fnv=([0-9a-f]{8}) mode=(\d+) "
+                          r"generation=(\d+) width=(\d+) height=(\d+) frames=(\d+)", line)
+        if start:
+            if self.meta is not None:
+                raise ValueError("duplicate dump header")
+            self.meta = [int(start[1]), int(start[2], 16)] + [int(start[i]) for i in range(3, 8)]
+            if not 0 < self.meta[0] <= 512 * 1024:
+                raise ValueError("invalid dump size")
+        elif "VCAP DATA " in line:
+            match = re.search(r"VCAP DATA ([0-9a-f]{8}) ([0-9a-f]+)\s*$", line)
+            if self.meta is None or not match or int(match[1], 16) != len(self.data):
+                raise ValueError("missing/corrupted/out-of-order dump line; retry dump")
+            chunk = bytes.fromhex(match[2])
+            if not 0 < len(chunk) <= 64 or len(self.data) + len(chunk) > self.meta[0]:
+                raise ValueError("invalid chunk size")
+            self.data.extend(chunk)
+        elif "VCAP END" in line:
+            if self.meta is None or len(self.data) != self.meta[0] or fnv(self.data) != self.meta[1]:
+                raise ValueError("incomplete dump or checksum mismatch; retry dump")
+            return True
+        elif "VCAP ERROR" in line:
+            raise RuntimeError(line[line.index("VCAP ERROR"):].strip())
+        return False
+
+
+def until(port, marker, timeout=15):
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        line = port.readline().decode("ascii", errors="replace")
+        if "VCAP ERROR" in line:
+            raise RuntimeError(line[line.index("VCAP ERROR"):].strip())
+        if marker in line:
+            return line[line.index(marker):].strip()
+    raise TimeoutError(f"did not receive {marker}; check port/firmware")
+
+
+def capture_status(port, command="status"):
+    port.command("video-capture " + command)
+    line = until(port, "VCAP STATUS")
+    print(line, flush=True)
+    match = re.search(r"active=(\d+) bytes=(\d+) frames=(\d+) width=(\d+) height=(\d+) reason=(\S+)", line)
+    if not match:
+        raise RuntimeError("抓流状态不完整，请保留上述状态输出")
+    return dict(zip(("active", "bytes", "frames", "width", "height", "reason"),
+                    [int(match[i]) for i in range(1, 6)] + [match[6]]))
+
+
+def stop_for_export(port):
+    status = capture_status(port, "stop")
+    if status["active"]:
+        raise RuntimeError("设备尚未停止抓流，未尝试导出")
+    if not status["bytes"]:
+        # No media to preserve. Release the allocation that otherwise blocks start.
+        capture_status(port, "clear")
+        raise RuntimeError(
+            f"缓冲为0字节，没有可导出的H264（reason={status['reason']}）；"
+            "已释放空缓冲。请保留上面的STATUS输出，重新建立视频后运行不带--dump-only的命令。"
+        )
+    return status
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--port", required=True)
+    parser.add_argument("--output", required=True, type=Path)
+    parser.add_argument("--dump-only", action="store_true", help="retry exporting retained capture after hangup")
+    args = parser.parse_args()
+    if args.output.exists() or args.output.with_suffix(".png").exists() or args.output.with_suffix(".txt").exists():
+        parser.error("output or companion file exists; choose a new name")
+    import serial
+    # POSIX advisory exclusive access: prevents cooperating serial tools from
+    # taking the same port; cannot evict/detect every already-open reader.
+    with serial.Serial(args.port, 115200, timeout=0.1, write_timeout=5, exclusive=True) as raw_port:
+        port = Terminal(raw_port)
+        if not args.dump_only:
+            input("保持标识纸不动，进入 H5 实时查看或微信视频通话，出图后按 Enter：")
+            identity = firmware_identity(port)
+            print(identity)
+            status = capture_status(port)
+            if status["active"] or status["bytes"]:
+                raise RuntimeError("存在正在进行或已保存的抓流，未覆盖。请退出查看后用--dump-only导出")
+            if status["reason"] != "empty":
+                capture_status(port, "clear")  # inactive, zero-byte allocation only
+            port.command("video-capture start")
+            print(until(port, "VCAP ARMED"))
+            # Drain unrelated logs while allowing up to 5s for IDR + 2s capture.
+            deadline = time.monotonic() + 7
+            while time.monotonic() < deadline:
+                port.readline()
+        else:
+            identity = firmware_identity(port)
+            print(identity)
+        stop_for_export(port)
+        input("现在退出所有 H5 查看页面/挂断通话；确认连接断开后按 Enter 导出（不要只最小化页面）：")
+        port.command("video-capture dump")
+        dump = Dump()
+        deadline = time.monotonic() + 240
+        while time.monotonic() < deadline:
+            if dump.feed(port.readline().decode("ascii", errors="replace")):
+                break
+        else:
+            raise TimeoutError("dump timed out; retained on device, retry with --dump-only")
+        with args.output.open("xb") as file:
+            file.write(dump.data)
+        with args.output.with_suffix(".txt").open("x") as file:
+            file.write(identity + "\n")
+            file.write(f"bytes,fnv,mode,generation,width,height,frames={dump.meta}\n")
+        port.command("video-capture clear")
+        until(port, "VCAP STATUS")
+    print(f"校验通过，已保存 {args.output}；设备抓流缓冲已释放。")
+    if shutil.which("ffprobe"):
+        subprocess.run(["ffprobe", "-v", "error", "-f", "h264", "-show_entries",
+                        "stream=codec_name,width,height", "-of", "default=nw=1", str(args.output)], check=True)
+    if shutil.which("ffmpeg"):
+        subprocess.run(["ffmpeg", "-v", "error", "-n", "-noautorotate", "-f", "h264", "-i",
+                        str(args.output), "-frames:v", "1", str(args.output.with_suffix(".png"))], check=True)
+        print(f"发送前画面（未自动旋转）：{args.output.with_suffix('.png')}")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (TimeoutError, RuntimeError, OSError, ValueError) as error:
+        raise SystemExit(f"抓流未完成：{error}") from None

package/skills/tirtc-esp32-builder/scripts/doctor.py

@@ -24,9 +24,7 @@ CONTRACT_KEYS = {
 }
 THING_CONNECT_ENV = "TIRTC_THING_CONNECT_ROOT"
 GENERATOR_RELATIVE_PATH = Path("device-sim/scripts/create_esp32_project.py")
-DEFAULT_SDK_RELATIVE_PATH = Path(
-    "device-sim/sdk/espressif-esp32s3/2.3.0"
-)
+SDK_RELATIVE_ROOT = Path("device-sim/sdk/espressif-esp32s3")
 DEVICE_KIT_MANIFEST = "manifest.json"
 
 
@@ -161,7 +159,7 @@ def discover_serial_ports() -> list[str]:
 def normalize_thing_connect_root(candidate: Path) -> Path | None:
     """Accept either the ThingConnect directory or its parent repository."""
     resolved = candidate.expanduser().resolve()
-    for root in (resolved, resolved / "thing-connect"):
+    for root in (resolved, resolved / "kit-src", resolved / "thing-connect"):
         if (root / GENERATOR_RELATIVE_PATH).is_file():
             return root
     return None
@@ -248,7 +246,20 @@ def resolve_sdk_dir(
         if bundled.is_dir():
             return bundled, "generated project"
     if thing_connect_root is not None:
-        return thing_connect_root / DEFAULT_SDK_RELATIVE_PATH, "Device Kit or legacy workspace"
+        manifest_path = thing_connect_root / DEVICE_KIT_MANIFEST
+        if manifest_path.is_file():
+            try:
+                manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+                version = manifest.get("tirtc_sdk_version")
+                if isinstance(version, str) and re.fullmatch(r"\d+\.\d+\.\d+", version):
+                    return thing_connect_root / SDK_RELATIVE_ROOT / version, "Device Kit"
+            except (OSError, json.JSONDecodeError):
+                pass
+        for version in ("2.5.0", "2.3.0"):
+            candidate = thing_connect_root / SDK_RELATIVE_ROOT / version
+            if candidate.is_dir():
+                return candidate, "ESP32 source workspace"
+        return thing_connect_root / SDK_RELATIVE_ROOT / "2.5.0", "ESP32 source workspace"
     return None, "not found"