初始提交：terminalX 可运行态（M0/M1/M1.5 已真机验证）

- M0: libghostty SSH 终端（渲染/输入/连接）+ 白屏修复(OutputGate) + 会话状态机/自动重连
- M1: tsnet 用户态组网 + SSH-over-tsnet(fd 桥)，shell 级真机验证；R5(Go+gvisor+C+++Swift 同进程) retire
- M1.5: tmux -CC 原生 tab（MVP）
- 结构: packages/(TXCore·TXTransport), apps/TerminalX, vendor/(libghostty-spm/libssh2/mbedtls/tsnet-bridge), artifacts/
- 文档: CLAUDE.md + docs/HANDOFF.md（新会话入口）
- 环境: 认证代理→依赖 vendor 本地化；Go 在 ~/.local/go；仅模拟器/未签名
- 待续: M2 mosh, tmux 多 pane, M4 安全(host key/SE)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vendor/libssh2/ci/appveyor/docker-bridge.ps1

@@ -0,0 +1,29 @@
+#!/usr/bin/env pwsh
+# Copyright (C) The libssh2 project and its contributors.
+# SPDX-License-Identifier: BSD-3-Clause
+
+# Partially copied from https://github.com/appveyor/ci/blob/master/scripts/enable-rdp.ps1
+
+# get current IP
+$ip = (Get-NetIPAddress -AddressFamily IPv4 | Where-Object {$_.InterfaceAlias -like 'ethernet*'}).IPAddress
+$port = 3389
+if($ip.StartsWith('172.24.')) {
+  $port = 33800 + ($ip.split('.')[2] - 16) * 256 + $ip.split('.')[3]
+}
+elseif($ip.StartsWith('192.168.') -or $ip.StartsWith('10.240.')) {
+  # new environment - behind NAT
+  $port = 33800 + ($ip.split('.')[2] - 0) * 256 + $ip.split('.')[3]
+}
+elseif($ip.StartsWith('10.0.')) {
+  $port = 33800 + ($ip.split('.')[2] - 0) * 256 + $ip.split('.')[3]
+}
+
+# get external IP
+$extip = (New-Object Net.WebClient).DownloadString('https://www.appveyor.com/tools/my-ip.aspx').Trim()
+
+# allow inbound traffic
+New-NetFirewallRule -DisplayName 'SSH via RDP port' -Direction Inbound -Action Allow -Protocol TCP -LocalPort 22,3389
+
+# launch remote docker daemon with reverse SSH tunnel
+$scriptPath = (split-path -parent $MyInvocation.MyCommand.Definition) -replace '\\', '/'
+& C:\msys64\usr\bin\sh -l -c "$scriptPath/docker-bridge.sh $ip $extip $port"

vendor/libssh2/ci/appveyor/docker-bridge.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+# Copyright (C) The libssh2 project and its contributors.
+# SPDX-License-Identifier: BSD-3-Clause
+
+set -e
+
+netsh interface portproxy add v4tov4 listenport=3389 listenaddress="$1" connectport=22 connectaddress=127.0.0.1
+netsh interface portproxy show all
+
+ssh-keygen -t ed25519 -f auth -q -N '' && mkdir .ssh && mv auth.pub .ssh/authorized_keys
+ssh-keygen -A
+"$(command -v sshd)" &
+
+curl \
+  -F "account=${APPVEYOR_ACCOUNT_NAME}" \
+  -F "project=${APPVEYOR_PROJECT_SLUG}" \
+  -F "buildid=${APPVEYOR_BUILD_VERSION}" \
+  -F "base=${APPVEYOR_REPO_BRANCH}" \
+  -F "hash=${APPVEYOR_REPO_COMMIT}" \
+  -F "repo=${APPVEYOR_REPO_NAME}" \
+  -F "ssh_host=$2" \
+  -F "ssh_port=$3" \
+  -F "ssh_user=$(whoami)" \
+  -F "ssh_forward=127.0.0.1:${OPENSSH_SERVER_PORT} 127.0.0.1:${OPENSSH_SERVER_PORT},127.0.0.1:2375 /var/run/docker.sock" \
+  -F "ssh_hostkey=$(paste -d , /etc/ssh/ssh_host_*_key.pub)" \
+  -F "ssh_privkey=$(paste -sd , auth)" \
+  -s 'https://stuff.marc-hoersken.de/libssh2/dispatch.php'

vendor/libssh2/ci/checksrc.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Copyright (C) The libssh2 project and its contributors.
+# SPDX-License-Identifier: BSD-3-Clause
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+git ls-files "*.[ch]" | xargs -n1 \
+./ci/checksrc.pl -i4 -m79 -AFOPENMODE -ASNPRINTF -ATYPEDEFSTRUCT

vendor/libssh2/ci/shellcheck.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+shellcheck --version
+# shellcheck disable=SC2046
+shellcheck --exclude=1091 \
+  --enable=avoid-nullary-conditions,deprecate-which \
+  $(grep -l -E '^#!(/usr/bin/env bash|/bin/sh|/bin/bash)' $(git ls-files))

vendor/libssh2/ci/spellcheck-words.txt

@@ -0,0 +1,3 @@
+gord
+pase
+nam

vendor/libssh2/ci/spellcheck.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# Copyright (C) The libssh2 project and its contributors.
+# SPDX-License-Identifier: BSD-3-Clause
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+# shellcheck disable=SC2046
+codespell --skip='docs/AUTHORS' \
+  --ignore-words='ci/spellcheck-words.txt' \
+  $(git ls-files)