初始提交：terminalX 可运行态（M0/M1/M1.5 已真机验证）

- M0: libghostty SSH 终端（渲染/输入/连接）+ 白屏修复(OutputGate) + 会话状态机/自动重连
- M1: tsnet 用户态组网 + SSH-over-tsnet(fd 桥)，shell 级真机验证；R5(Go+gvisor+C+++Swift 同进程) retire
- M1.5: tmux -CC 原生 tab（MVP）
- 结构: packages/(TXCore·TXTransport), apps/TerminalX, vendor/(libghostty-spm/libssh2/mbedtls/tsnet-bridge), artifacts/
- 文档: CLAUDE.md + docs/HANDOFF.md（新会话入口）
- 环境: 认证代理→依赖 vendor 本地化；Go 在 ~/.local/go；仅模拟器/未签名
- 待续: M2 mosh, tmux 多 pane, M4 安全(host key/SE)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vendor/mbedtls/framework/scripts/check-python-files.sh

@@ -0,0 +1,104 @@
+#! /usr/bin/env sh
+
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+# Purpose: check Python files for potential programming errors or maintenance
+# hurdles. Run pylint to detect some potential mistakes and enforce PEP8
+# coding standards. Run mypy to perform static type checking.
+
+# We'll keep going on errors and report the status at the end.
+ret=0
+
+if type python3 >/dev/null 2>/dev/null; then
+    PYTHON=python3
+else
+    PYTHON=python
+fi
+
+check_version () {
+    $PYTHON - "$2" <<EOF
+import packaging.version
+import sys
+import $1 as package
+actual = package.__version__
+wanted = sys.argv[1]
+if packaging.version.parse(actual) < packaging.version.parse(wanted):
+    sys.stderr.write("$1: version %s is too old (want %s)\n" % (actual, wanted))
+    exit(1)
+EOF
+}
+
+can_pylint () {
+    # Pylint 1.5.2 from Ubuntu 16.04 is too old:
+    #     E: 34, 0: Unable to import 'mbedtls_framework' (import-error)
+    # Pylint 1.8.3 from Ubuntu 18.04 passed on the first commit containing this line.
+    check_version pylint 1.8.3
+}
+
+can_mypy () {
+    # mypy 0.770 is too old:
+    #     framework/scripts/test_psa_constant_names.py:34: error: Cannot find implementation or library stub for module named 'mbedtls_framework'
+    # mypy 0.780 from pip passed on the first commit containing this line.
+    check_version mypy.version 0.780
+}
+
+# With just a --can-xxx option, check whether the tool for xxx is available
+# with an acceptable version, and exit without running any checks. The exit
+# status is true if the tool is available and acceptable and false otherwise.
+if [ "$1" = "--can-pylint" ]; then
+    can_pylint
+    exit
+elif [ "$1" = "--can-mypy" ]; then
+    can_mypy
+    exit
+fi
+
+echo 'Running pylint ...'
+# Exclude `maintainer` subdirectories, because they can contain code
+# that does not work with the versions of pylint and mypy we use on the CI.
+# https://github.com/Mbed-TLS/mbedtls-framework/issues/293
+#
+# When we move Python code between repositories, there is a transition
+# period during which code is duplicated between the old repository and
+# the new repository.
+# Pylint looks for duplicate code inside files that are mentioned in the
+# same invocation. When we move some code from A to B, we want to skip
+# duplicate-code checks between A and B. So we arrange for two separate
+# runs of pylint: one for the A files, and one for the others.
+# Remove exceptions below once the A file (or the moved code in the A file)
+# has been removed from all consuming branches.
+find framework/scripts scripts tests/scripts \
+     -name maintainer -prune -o \
+     -name '*.py' \( \
+     ! -path scripts/abi_check.py \
+     ! -path scripts/code_size_compare.py \
+     ! -path scripts/ecp_comb_table.py \
+     ! -path tests/scripts/audit-validity-dates.py \
+     ! -path tests/scripts/generate_server9_bad_saltlen.py \
+     ! -path tests/scripts/psa_collect_statuses.py \
+     ! -path tests/scripts/run_demos.py \
+     ! -path tests/scripts/test_config_script.py \
+     ! -path framework/scripts/make_generated_files.py \
+        -exec $PYTHON -m pylint {} + \
+     -o -exec $PYTHON -m pylint {} + \) || {
+    echo >&2 "pylint reported errors"
+    ret=1
+}
+
+echo
+echo 'Running mypy ...'
+$PYTHON -m mypy framework/scripts || {
+    echo >&2 "mypy reported errors in the framework"
+    ret=1
+}
+
+# Exclude `maintainer` subdirectories, because they can contain code
+# that does not work with the versions of pylint and mypy we use on the CI.
+# https://github.com/Mbed-TLS/mbedtls-framework/issues/293
+$PYTHON -m mypy --exclude maintainer scripts tests/scripts || {
+    echo >&2 "mypy reported errors in the parent repository"
+    ret=1
+}
+
+exit $ret