初始提交：terminalX 可运行态（M0/M1/M1.5 已真机验证）

- M0: libghostty SSH 终端（渲染/输入/连接）+ 白屏修复(OutputGate) + 会话状态机/自动重连
- M1: tsnet 用户态组网 + SSH-over-tsnet(fd 桥)，shell 级真机验证；R5(Go+gvisor+C+++Swift 同进程) retire
- M1.5: tmux -CC 原生 tab（MVP）
- 结构: packages/(TXCore·TXTransport), apps/TerminalX, vendor/(libghostty-spm/libssh2/mbedtls/tsnet-bridge), artifacts/
- 文档: CLAUDE.md + docs/HANDOFF.md（新会话入口）
- 环境: 认证代理→依赖 vendor 本地化；Go 在 ~/.local/go；仅模拟器/未签名
- 待续: M2 mosh, tmux 多 pane, M4 安全(host key/SE)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vendor/libssh2/tests/ossfuzz/.gitignore

@@ -0,0 +1,2 @@
+*.a
+ssh2_client_fuzzer

vendor/libssh2/tests/ossfuzz/Makefile.am

@@ -0,0 +1,34 @@
+AM_CPPFLAGS = -I$(top_builddir)/include
+LDADD = $(top_builddir)/src/libssh2.la
+
+if USE_OSSFUZZ_FLAG
+FUZZ_FLAG = $(LIB_FUZZING_ENGINE)
+else
+if USE_OSSFUZZ_STATIC
+LDADD += $(LIB_FUZZING_ENGINE)
+FUZZ_FLAG =
+else
+LDADD += libstandaloneengine.a
+FUZZ_FLAG =
+endif
+endif
+
+noinst_PROGRAMS =
+noinst_LIBRARIES =
+
+if USE_OSSFUZZERS
+noinst_PROGRAMS += \
+  ssh2_client_fuzzer
+
+noinst_LIBRARIES += \
+  libstandaloneengine.a
+endif
+
+ssh2_client_fuzzer_SOURCES = ssh2_client_fuzzer.cc testinput.h
+ssh2_client_fuzzer_CXXFLAGS = $(AM_CXXFLAGS) $(FUZZ_FLAG)
+ssh2_client_fuzzer_LDFLAGS = $(AM_LDFLAGS) -static
+
+libstandaloneengine_a_SOURCES = standaloneengine.cc
+libstandaloneengine_a_CXXFLAGS = $(AM_CXXFLAGS)
+
+EXTRA_DIST = ossfuzz.sh

vendor/libssh2/tests/ossfuzz/ossfuzz.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+set -eu
+
+# This script is called by the oss-fuzz main project when compiling the fuzz
+# targets. This script is regression tested by ci/ossfuzz.sh.
+
+# Save off the current folder as the build root.
+export BUILD_ROOT="$PWD"
+
+echo "CC: $CC"
+echo "CXX: $CXX"
+echo "LIB_FUZZING_ENGINE: $LIB_FUZZING_ENGINE"
+echo "CFLAGS: $CFLAGS"
+echo "CXXFLAGS: $CXXFLAGS"
+echo "OUT: $OUT"
+
+MAKEFLAGS+="-j$(nproc)"
+export MAKEFLAGS
+
+# Install dependencies
+apt-get -y install automake libtool libssl-dev zlib1g-dev
+
+# Compile the fuzzer.
+autoreconf -fi
+./configure --disable-shared \
+            --enable-ossfuzzers \
+            --disable-examples-build \
+            --enable-debug
+make V=1
+
+# Copy the fuzzer to the output directory.
+cp -v tests/ossfuzz/ssh2_client_fuzzer "$OUT/"

vendor/libssh2/tests/ossfuzz/ssh2_client_fuzzer.cc

@@ -0,0 +1,97 @@
+/* Copyright (C) The libssh2 project and its contributors.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+#include <assert.h>
+#include <errno.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <unistd.h>
+#include <libssh2.h>
+#include "testinput.h"
+
+#define FUZZ_ASSERT(COND)                                                     \
+    if(!(COND))                                                               \
+    {                                                                         \
+      fprintf(stderr, "Assertion failed: " #COND "\n%s",                      \
+              strerror(errno));                                               \
+      assert((COND));                                                         \
+    }
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+  int socket_fds[2] = {-1, -1};
+  ssize_t written;
+  int rc;
+  LIBSSH2_SESSION *session = NULL;
+  int handshake_completed = 0;
+
+  rc = libssh2_init(0);
+
+  if(rc) {
+    fprintf(stderr, "libssh2 initialization failed (%d)\n", rc);
+    goto EXIT_LABEL;
+  }
+
+  // Create a socket pair so data can be sent in.
+  rc = socketpair(AF_UNIX, SOCK_STREAM, 0, socket_fds);
+  FUZZ_ASSERT(rc == 0);
+
+  written = send(socket_fds[1], data, size, 0);
+
+  if(written != size)
+  {
+    // Handle whatever error case we're in.
+    fprintf(stderr, "send() of %zu bytes returned %zu (%d)\n",
+            size,
+            written,
+            errno);
+    goto EXIT_LABEL;
+  }
+
+  rc = shutdown(socket_fds[1], SHUT_WR);
+  if(rc)
+  {
+    fprintf(stderr, "socket shutdown failed (%d)\n", rc);
+    goto EXIT_LABEL;
+  }
+
+  // Create a session and start the handshake using the fuzz data passed in.
+  session = libssh2_session_init();
+  if(session) {
+    libssh2_session_set_blocking(session, 1);
+  }
+  else {
+    goto EXIT_LABEL;
+  }
+
+  if(libssh2_session_handshake(session, socket_fds[0])) {
+    goto EXIT_LABEL;
+  }
+
+  // If we get here the handshake actually completed.
+  handshake_completed = 1;
+
+EXIT_LABEL:
+
+  if(session)
+  {
+    if(handshake_completed)
+    {
+      libssh2_session_disconnect(session,
+                                 "Normal Shutdown, Thank you for playing");
+    }
+
+    libssh2_session_free(session);
+  }
+
+  libssh2_exit();
+
+  close(socket_fds[0]);
+  close(socket_fds[1]);
+
+  return 0;
+}

vendor/libssh2/tests/ossfuzz/standaloneengine.cc

@@ -0,0 +1,77 @@
+/* Copyright (C) The libssh2 project and its contributors.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "testinput.h"
+
+/**
+ * Main procedure for standalone fuzzing engine.
+ *
+ * Reads filenames from the argument array. For each filename, read the file
+ * into memory and then call the fuzzing interface with the data.
+ */
+int main(int argc, char **argv)
+{
+  int ii;
+  for(ii = 1; ii < argc; ii++)
+  {
+    FILE *infile;
+    printf("[%s] ", argv[ii]);
+
+    /* Try and open the file. */
+    infile = fopen(argv[ii], "rb");
+    if(infile)
+    {
+      uint8_t *buffer = NULL;
+      size_t buffer_len;
+
+      printf("Opened.. ");
+
+      /* Get the length of the file. */
+      fseek(infile, 0L, SEEK_END);
+      buffer_len = ftell(infile);
+
+      /* Reset the file indicator to the beginning of the file. */
+      fseek(infile, 0L, SEEK_SET);
+
+      /* Allocate a buffer for the file contents. */
+      buffer = (uint8_t *)calloc(buffer_len, sizeof(uint8_t));
+      if(buffer)
+      {
+        /* Read all the text from the file into the buffer. */
+        fread(buffer, sizeof(uint8_t), buffer_len, infile);
+        printf("Read %zu bytes, fuzzing.. ", buffer_len);
+
+        /* Call the fuzzer with the data. */
+        LLVMFuzzerTestOneInput(buffer, buffer_len);
+
+        printf("complete.");
+
+        /* Free the buffer as it's no longer needed. */
+        free(buffer);
+        buffer = NULL;
+      }
+      else
+      {
+        fprintf(stderr,
+                "[%s] Failed to allocate %zu bytes \n",
+                argv[ii],
+                buffer_len);
+      }
+
+      /* Close the file as it's no longer needed. */
+      fclose(infile);
+      infile = NULL;
+    }
+    else
+    {
+      /* Failed to open the file. Maybe wrong name or wrong permissions? */
+      fprintf(stderr, "[%s] Open failed. \n", argv[ii]);
+    }
+
+    printf("\n");
+  }
+}

vendor/libssh2/tests/ossfuzz/testinput.h

@@ -0,0 +1,7 @@
+/* Copyright (C) The libssh2 project and its contributors.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+#include <inttypes.h>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);