diff --git a/.cursorignore b/.cursorignore
new file mode 100644
index 0000000000..6974cdf24c
--- /dev/null
+++ b/.cursorignore
@@ -0,0 +1,55 @@
+# 工作手机 · Cursor 忽略（防持续上传/索引）
+# 根因：反编译产物 ~45 万文件，Agent 会反复同步到云端
+
+# APK 反编译与资料（最大头）
+资料/**
+**/apk_analysis/**
+
+# 微信反编译 / jadx / smali 产物
+sdk/tmp/**
+sdk/scripts/gadget_work/**
+**/jadx_out/**
+**/wechat_decompiled/**
+**/smali/**
+**/smali_classes*/**
+
+# 依赖与构建
+**/node_modules/**
+**/.pnpm-store/**
+**/.yarn/**
+**/.npm/**
+**/.venv/**
+**/venv/**
+**/__pycache__/**
+**/.pytest_cache/**
+**/dist/**
+**/build/**
+**/.next/**
+**/.turbo/**
+**/target/**
+**/.gradle/**
+**/.m2/**
+**/vendor/**
+**/coverage/**
+
+# 缓存与索引
+**/.cache/**
+**/.codegraph/**
+**/.cursor/**
+**/.git/objects/**
+
+# 大文件
+**/*.apk
+**/*.aab
+**/*.dex
+**/*.so
+**/*.jar
+**/*.zip
+**/*.7z
+**/*.dmg
+**/*.mp4
+**/*.mov
+**/*.MP4
+**/*.MOV
+**/*.log
+**/logs/**
diff --git a/.cursorindexingignore b/.cursorindexingignore
new file mode 100644
index 0000000000..8bda13d7f7
--- /dev/null
+++ b/.cursorindexingignore
@@ -0,0 +1,8 @@
+# 仅排除索引搜索，Agent 仍可 @ 读取（工作手机反编译目录）
+资料/**
+sdk/tmp/**
+sdk/scripts/gadget_work/**
+**/jadx_out/**
+**/wechat_decompiled/**
+**/smali/**
+**/smali_classes*/**
diff --git a/.gitignore b/.gitignore
index d39da9a26d..ce24c6147a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,6 +38,20 @@ sdk/logs/
 sdk/tmp_rom/
 sdk/.runtime/
 
+# 本机/真机运行态配置与验收日志（模板文件可提交）
+sdk/config/*.env
+sdk/config/agent_config_*.json
+sdk/agent/config.nas-active.json
+sdk/data/operation_logs/
+sdk/app/data/hook/events.jsonl
+
+# 本地发行包、逆向工作区与设备二进制
+sdk/releases/
+sdk/scripts/gadget_work/
+sdk/scripts/frida-server-*
+sdk/scripts/frida-gadget-*
+sdk/scripts/wechat_original.apk
+
 # Obsidian 粘贴图误落 vault 根（应进 开发文档/**/images/）
 /Pasted image*.png
 /Pasted image*.jpg
diff --git a/sdk/.dockerignore b/sdk/.dockerignore
new file mode 100644
index 0000000000..b57887e944
--- /dev/null
+++ b/sdk/.dockerignore
@@ -0,0 +1,20 @@
+.git
+.env
+.env.*
+*.log
+__pycache__/
+*.pyc
+.pytest_cache/
+.gradle/
+node_modules/
+android-app/
+admin/
+releases/
+tests/
+data/
+app/data/cunke_bao_config.json
+app/data/hook/events.jsonl
+app/data/operation_logs/
+app/agent/config.json
+agent/config.json
+agent/config.*.json
diff --git a/sdk/Dockerfile b/sdk/Dockerfile
index 09da03e1f6..a5fc061e79 100644
--- a/sdk/Dockerfile
+++ b/sdk/Dockerfile
@@ -1,9 +1,11 @@
 # 工作手机SDK v3.1 - Dockerfile（含 AI Brain + Hook 模块管理）
-FROM python:3.11-slim
+ARG PYTHON_IMAGE=docker.1ms.run/library/python:3.11-slim
+FROM ${PYTHON_IMAGE}
 
 WORKDIR /app
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
+RUN sed -i 's#deb.debian.org#mirrors.cloud.tencent.com#g; s#security.debian.org#mirrors.cloud.tencent.com#g' /etc/apt/sources.list.d/debian.sources \
+    && apt-get update && apt-get install -y --no-install-recommends \
     curl \
     adb \
     && rm -rf /var/lib/apt/lists/*
diff --git a/sdk/agent/config.nas-primary.example.json b/sdk/agent/config.nas-primary.example.json
new file mode 100644
index 0000000000..36d72c679a
--- /dev/null
+++ b/sdk/agent/config.nas-primary.example.json
@@ -0,0 +1,12 @@
+{
+  "device_id": "xgfe65eimrrofyws",
+  "server_url": "ws://192.168.110.101:8899/ws/device",
+  "public_servers": [
+    "ws://192.168.1.201:8899/ws/device",
+    "ws://192.168.110.167:8899/ws/device",
+    "ws://open.quwanzhi.com:8899/ws/device"
+  ],
+  "heartbeat_interval": 10,
+  "project_id": "cunkebao",
+  "comment": "顺序固定: ①NAS局域网(server_url) ②本机Docker(局网IP,示例110.167) ③NAS外网frp。勿把frp排在Docker前。"
+}
diff --git a/sdk/agent/sdk_discovery.py b/sdk/agent/sdk_discovery.py
new file mode 100644
index 0000000000..5692510483
--- /dev/null
+++ b/sdk/agent/sdk_discovery.py
@@ -0,0 +1,59 @@
+"""
+设备端 SDK 自动发现 — 监听 UDP beacon（8898），无线主控免手填 IP。
+
+与 sdk/app/services/discovery_service.py BEACON 协议对齐。
+"""
+
+from __future__ import annotations
+
+import json
+import socket
+import time
+from typing import Optional
+
+BEACON_PORT = 8898
+BEACON_MAGIC = "WORKPHONE_SDK"
+
+
+def _pick_best_ip(ips: list) -> str:
+    """优先 192.168.110.x（工作机常用网段），否则取第一个私网 IP。"""
+    for ip in ips:
+        if ip.startswith("192.168.110."):
+            return ip
+    for ip in ips:
+        if ip.startswith(("192.168.", "10.", "172.")):
+            return ip
+    return ips[0]
+
+
+def discover_sdk_ws_base(timeout: float = 20.0) -> Optional[str]:
+    """
+    监听局域网 UDP beacon，返回 WebSocket 基础地址。
+    例: ws://192.168.110.251:8899/ws/device
+    """
+    deadline = time.time() + timeout
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    try:
+        sock.bind(("", BEACON_PORT))
+    except OSError:
+        # Termux 可能无权限绑 8898，改绑任意端口并只 recv
+        sock.bind(("", 0))
+    sock.settimeout(1.0)
+
+    while time.time() < deadline:
+        try:
+            data, _addr = sock.recvfrom(4096)
+            payload = json.loads(data.decode("utf-8"))
+            if payload.get("magic") != BEACON_MAGIC:
+                continue
+            port = int(payload.get("port") or 8899)
+            ws_path = (payload.get("ws_path") or "/ws/device").rstrip("/")
+            ips = payload.get("ips") or []
+            host = _pick_best_ip(ips) if ips else "127.0.0.1"
+            return f"ws://{host}:{port}{ws_path}"
+        except socket.timeout:
+            continue
+        except Exception:
+            continue
+    return None
diff --git a/sdk/android-app/app/build.gradle b/sdk/android-app/app/build.gradle
index ed7cf78ff0..2fd7f6fd04 100644
--- a/sdk/android-app/app/build.gradle
+++ b/sdk/android-app/app/build.gradle
@@ -14,7 +14,7 @@ android {
         versionCode 6
         versionName "5.0.1"
         buildConfigField "String", "PWA_URL", "\"https://ckbapi.quwanzhi.com\""
-        buildConfigField "String", "DEFAULT_WS", "\"wss://workphone.quwanzhi.com/ws/device\""
+        buildConfigField "String", "DEFAULT_WS", "\"wss://wpsdk.quwanzhi.com/ws/device\""
         buildConfigField "String", "AI_API_URL", "\"https://ckbapi.quwanzhi.com\""
     }
 
diff --git a/sdk/android-app/app/src/main/AndroidManifest.xml b/sdk/android-app/app/src/main/AndroidManifest.xml
index a3b0933bf4..5a1d3f8a77 100644
--- a/sdk/android-app/app/src/main/AndroidManifest.xml
+++ b/sdk/android-app/app/src/main/AndroidManifest.xml
@@ -19,6 +19,10 @@
     <uses-permission android:name="android.permission.QUERY_ALL_PACKAGES" />
     <uses-permission android:name="android.permission.WAKE_LOCK" />
     <uses-permission android:name="android.permission.VIBRATE" />
+    <!-- 仅授权测试/企业管控设备通过 ADB grant 后生效，用于自动启用本应用无障碍。 -->
+    <uses-permission
+        android:name="android.permission.WRITE_SECURE_SETTINGS"
+        tools:ignore="ProtectedPermissions" />
 
     <application
         android:name=".App"
@@ -66,7 +70,7 @@
             android:name=".service.AgentAccessibilityService"
             android:permission="android.permission.BIND_ACCESSIBILITY_SERVICE"
             android:directBootAware="true"
-            android:exported="false">
+            android:exported="true">
             <intent-filter>
                 <action android:name="android.accessibilityservice.AccessibilityService" />
             </intent-filter>
diff --git a/sdk/android-app/app/src/main/java/com/system/cloudservice/App.kt b/sdk/android-app/app/src/main/java/com/system/cloudservice/App.kt
index bd23884abe..e4b5a985bd 100644
--- a/sdk/android-app/app/src/main/java/com/system/cloudservice/App.kt
+++ b/sdk/android-app/app/src/main/java/com/system/cloudservice/App.kt
@@ -1,6 +1,7 @@
 package com.system.cloudservice
 
 import android.app.Application
+import com.system.cloudservice.service.AgentAccessibilityService
 import com.system.cloudservice.util.Logger
 
 class App : Application() {
@@ -13,6 +14,7 @@ class App : Application() {
         super.onCreate()
         instance = this
         Logger.init(this)
-        Logger.i("AI数智员工 Application created (${BuildConfig.VERSION_NAME})")
+        AgentAccessibilityService.enableIfAuthorized(this)
+        Logger.i("工作手机 Application created (${BuildConfig.VERSION_NAME})")
     }
 }
diff --git a/sdk/android-app/app/src/main/java/com/system/cloudservice/engine/AgentEngine.kt b/sdk/android-app/app/src/main/java/com/system/cloudservice/engine/AgentEngine.kt
index 78a7858063..4d2bad349e 100644
--- a/sdk/android-app/app/src/main/java/com/system/cloudservice/engine/AgentEngine.kt
+++ b/sdk/android-app/app/src/main/java/com/system/cloudservice/engine/AgentEngine.kt
@@ -35,6 +35,7 @@ class AgentEngine(
     private var deviceId = ""
     private var projectId = ""
     private var serverUrl = ""
+    private var pairingToken = ""
     private var heartbeatIntervalMs = 30_000L
     private var lastPongAt = 0L
     private var commandsExecuted = 0
@@ -58,6 +59,9 @@ class AgentEngine(
 
     fun isFridaReady(): Boolean = fridaBridge?.isReady == true
 
+    /** 微信进程真实注入状态；与 frida-server 端口就绪严格分离。 */
+    fun isWechatHookAttached(): Boolean = fridaBridge?.isTargetHooked() == true
+
     /** AB-02~06 runtime 信号：risk_sentinel / nurture / device_guard / sensor / touch */
     fun getAntiBanStatus(): Map<String, Any?> = antiBan.statusSummary()
 
@@ -87,6 +91,8 @@ class AgentEngine(
     ) {
         this.deviceId = deviceId
         this.projectId = projectId
+        this.pairingToken = context.getSharedPreferences("agent_config", Context.MODE_PRIVATE)
+            .getString("pairing_token", "")?.trim().orEmpty()
         this.publicServers = publicServers.filter { it.isNotBlank() }
         this.serverUrl = buildWsUrl(serverUrl, deviceId)
         this.candidates = buildCandidates(this.serverUrl, this.publicServers, deviceId)
@@ -114,12 +120,19 @@ class AgentEngine(
     }
 
     private fun buildWsUrl(base: String, deviceId: String): String {
-        val cleaned = base.trimEnd('/')
-        return if (cleaned.contains("/ws/device")) {
+        val parts = base.trim().split("?", limit = 2)
+        val cleaned = parts[0].trimEnd('/')
+        val path = if (cleaned.contains("/ws/device")) {
             if (cleaned.endsWith(deviceId)) cleaned else "$cleaned/$deviceId"
         } else {
             "$cleaned/ws/device/$deviceId"
         }
+        val queryParts = mutableListOf<String>()
+        if (parts.size == 2 && parts[1].isNotBlank()) queryParts.add(parts[1])
+        if (pairingToken.isNotBlank() && queryParts.none { it.startsWith("token=") }) {
+            queryParts.add("token=${java.net.URLEncoder.encode(pairingToken, "UTF-8")}")
+        }
+        return if (queryParts.isEmpty()) path else "$path?${queryParts.joinToString("&")}"
     }
 
     /** BIND-03：构建有序候选 [主连接, 公网1, ...]，自动补全 + 去重。 */
@@ -230,7 +243,8 @@ class AgentEngine(
             "device_profile" to info,
             "capabilities" to buildCapabilities(),
             "connect_stage" to connectStage,            // BIND-07 寻服阶段上报
-            "server_url" to serverUrl,
+            // 配对令牌仅用于握手，禁止上报到设备资料或管理 API。
+            "server_url" to serverUrl.substringBefore('?'),
             "server_candidate_count" to candidates.size,
         )
         wsManager.send(gson.toJson(msg))
diff --git a/sdk/android-app/app/src/main/java/com/system/cloudservice/engine/SkillExecutor.kt b/sdk/android-app/app/src/main/java/com/system/cloudservice/engine/SkillExecutor.kt
index 3006adc205..057b7b2772 100644
--- a/sdk/android-app/app/src/main/java/com/system/cloudservice/engine/SkillExecutor.kt
+++ b/sdk/android-app/app/src/main/java/com/system/cloudservice/engine/SkillExecutor.kt
@@ -3,12 +3,14 @@ package com.system.cloudservice.engine
 import android.content.Context
 import android.content.Intent
 import android.os.Build
+import android.util.Base64
 import com.system.cloudservice.antiban.AntiBanManager
 import com.system.cloudservice.frida.FridaBridge
 import com.system.cloudservice.service.AgentAccessibilityService
 import com.system.cloudservice.util.DeviceInfo
 import com.system.cloudservice.util.Logger
 import com.system.cloudservice.util.ShellExecutor
+import java.io.File
 
 class SkillExecutor(
     private val context: Context,
@@ -26,20 +28,25 @@ class SkillExecutor(
             return mapOf("code" to 429, "message" to "风控暂停中", "data" to status)
         }
 
-        // If a script is specified, route through Frida-priority chain
-        if (script != null) {
+        // wechat/douyin 等业务脚本走 Hook 优先链；android/system/device 是设备控制域，
+        // 不能误当成 Frida 脚本，否则公网 Fleet 的 app_start/ui_tree 会落到 Shell不支持。
+        val deviceControlScripts = setOf("android", "system", "device")
+        if (script != null && script.lowercase() !in deviceControlScripts) {
             return executeWithFridaPriority(script, action, params)
         }
 
         return try {
             when (action) {
-                "open_app" -> openApp(params["package"] as? String ?: "")
+                "open_app", "app_start", "start_app" -> openApp(params["package"] as? String ?: "")
+                "app_stop", "stop_app" -> doShell(
+                    mapOf("command" to "am force-stop ${params["package"] ?: ""}")
+                )
                 "get_installed_apps" -> getInstalledApps()
                 "get_device_info" -> mapOf("code" to 200, "data" to DeviceInfo.collectFull(context))
-                "click" -> doClick(params)
+                "click", "tap" -> doClick(params)
                 "swipe" -> doSwipe(params)
-                "input_text" -> doInputText(params)
-                "key_event" -> doKeyEvent(params)
+                "input_text", "input" -> doInputText(params)
+                "key_event", "press_key" -> doKeyEvent(params)
                 "screenshot" -> doScreenshot(params)
                 "back" -> doGlobalAction("back")
                 "home" -> doGlobalAction("home")
@@ -139,6 +146,22 @@ class SkillExecutor(
         if (script != "wechat") return null
 
         when (action) {
+            "ping" -> {
+                val ver = WechatNoRootAutomation.getWechatVersion(context)
+                val quick = DeviceInfo.collectQuick(context)
+                return mapOf(
+                    "code" to 200,
+                    "message" to "pong",
+                    "data" to mapOf(
+                        "success" to true,
+                        "installed" to (ver["success"] == true),
+                        "wechat_version" to ver["version"],
+                        "wechat_running" to (quick["wechat_running"] == true),
+                        "channel" to "no_root_pkg",
+                    ),
+                    "channel" to "no_root_pkg",
+                )
+            }
             "get_wechat_version" -> {
                 val data = WechatNoRootAutomation.getWechatVersion(context)
                 return mapOf(
@@ -330,9 +353,27 @@ class SkillExecutor(
     }
 
     private fun doScreenshot(params: Map<String, Any?>): Map<String, Any?> {
-        val path = params["path"] as? String ?: "/sdcard/screenshot.png"
-        val r = ShellExecutor.execute("screencap -p $path")
-        return mapOf("code" to if (r.success) 200 else 500, "message" to r.output)
+        val path = params["path"] as? String
+            ?: File(context.cacheDir, "workphone_screenshot.png").absolutePath
+        val r = ShellExecutor.execute("screencap -p '$path' && chmod 644 '$path'")
+        if (!r.success) {
+            return mapOf("code" to 500, "message" to r.output)
+        }
+        return try {
+            val bytes = File(path).readBytes()
+            mapOf(
+                "code" to 200,
+                "message" to "ok",
+                "data" to mapOf(
+                    "image_base64" to Base64.encodeToString(bytes, Base64.NO_WRAP),
+                    "mime_type" to "image/png",
+                    "size" to bytes.size,
+                    "path" to path,
+                ),
+            )
+        } catch (e: Exception) {
+            mapOf("code" to 500, "message" to "截图读取失败: ${e.message}")
+        }
     }
 
     private fun doGlobalAction(action: String): Map<String, Any?> {
diff --git a/sdk/android-app/app/src/main/java/com/system/cloudservice/engine/WebSocketManager.kt b/sdk/android-app/app/src/main/java/com/system/cloudservice/engine/WebSocketManager.kt
index 40001b6e60..c2da303978 100644
--- a/sdk/android-app/app/src/main/java/com/system/cloudservice/engine/WebSocketManager.kt
+++ b/sdk/android-app/app/src/main/java/com/system/cloudservice/engine/WebSocketManager.kt
@@ -64,7 +64,7 @@ class WebSocketManager(
     private fun doConnect() {
         if (_state.value == ConnectionState.CONNECTING) return
         _state.value = ConnectionState.CONNECTING
-        Logger.d("WS connecting: $serverUrl")
+        Logger.d("WS connecting: ${serverUrl.substringBefore('?')}")
 
         val request = Request.Builder().url(serverUrl).build()
         ws = client.newWebSocket(request, object : WebSocketListener() {
diff --git a/sdk/android-app/app/src/main/java/com/system/cloudservice/frida/FridaBridge.kt b/sdk/android-app/app/src/main/java/com/system/cloudservice/frida/FridaBridge.kt
index 6909d8cdc8..5ebfac9ba5 100644
--- a/sdk/android-app/app/src/main/java/com/system/cloudservice/frida/FridaBridge.kt
+++ b/sdk/android-app/app/src/main/java/com/system/cloudservice/frida/FridaBridge.kt
@@ -65,10 +65,15 @@ class FridaBridge(
 
     fun getStatus(): Map<String, Any?> = mapOf(
         "ready" to isReady,
+        // 当前 APK 只确认 frida-server 端口可达，尚未持有微信 Session/Script。
+        // 必须保持 false，避免 UI 与心跳把“服务就绪”误报成“微信已注入”。
+        "hooked" to false,
         "server_running" to serverManager.isRunning,
         "root_available" to serverManager.hasRoot(),
     )
 
+    fun isTargetHooked(): Boolean = false
+
     private fun loadDefaultScripts() {
         try {
             val assets = context.assets.list("") ?: return
diff --git a/sdk/android-app/app/src/main/java/com/system/cloudservice/service/AgentAccessibilityService.kt b/sdk/android-app/app/src/main/java/com/system/cloudservice/service/AgentAccessibilityService.kt
index eb32b39eca..517e8d21de 100644
--- a/sdk/android-app/app/src/main/java/com/system/cloudservice/service/AgentAccessibilityService.kt
+++ b/sdk/android-app/app/src/main/java/com/system/cloudservice/service/AgentAccessibilityService.kt
@@ -39,6 +39,40 @@ class AgentAccessibilityService : AccessibilityService() {
             return flat.split(':').mapNotNull { ComponentName.unflattenFromString(it) }
                 .any { it == expected }
         }
+
+        /**
+         * 企业授权设备可由 ADB 一次性授予 WRITE_SECURE_SETTINGS，之后冷启动自动补齐
+         * 本应用无障碍服务。保留系统中已经启用的其他服务，不覆盖用户配置。
+         */
+        fun enableIfAuthorized(context: Context): Boolean {
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M ||
+                context.checkSelfPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS) !=
+                android.content.pm.PackageManager.PERMISSION_GRANTED
+            ) return false
+
+            return try {
+                val resolver = context.contentResolver
+                val expected = ComponentName(context, AgentAccessibilityService::class.java)
+                    .flattenToString()
+                val current = Settings.Secure.getString(
+                    resolver,
+                    Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES,
+                ).orEmpty().split(':').filter { it.isNotBlank() }.toMutableList()
+                if (expected !in current) current += expected
+                Settings.Secure.putString(
+                    resolver,
+                    Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES,
+                    current.distinct().joinToString(":"),
+                ) && Settings.Secure.putInt(
+                    resolver,
+                    Settings.Secure.ACCESSIBILITY_ENABLED,
+                    1,
+                )
+            } catch (e: SecurityException) {
+                Log.w(TAG, "WRITE_SECURE_SETTINGS 未授权，保留手动授权流程", e)
+                false
+            }
+        }
     }
 
     private val scope = CoroutineScope(Dispatchers.Main + SupervisorJob())
diff --git a/sdk/android-app/app/src/main/java/com/system/cloudservice/service/AgentForegroundService.kt b/sdk/android-app/app/src/main/java/com/system/cloudservice/service/AgentForegroundService.kt
index ed9e4489e7..d192f77236 100644
--- a/sdk/android-app/app/src/main/java/com/system/cloudservice/service/AgentForegroundService.kt
+++ b/sdk/android-app/app/src/main/java/com/system/cloudservice/service/AgentForegroundService.kt
@@ -46,6 +46,7 @@ class AgentForegroundService : Service() {
     }
 
     private val serviceScope = CoroutineScope(Dispatchers.IO + SupervisorJob())
+    private var engineStartJob: Job? = null
     var engine: AgentEngine? = null
         private set
 
@@ -98,7 +99,14 @@ class AgentForegroundService : Service() {
 
                 isRunning = true
                 startForeground(NOTIFICATION_ID, createNotification("正在连接..."))
-                initAndStartEngine(serverUrl, projectId, deviceId)
+                synchronized(this) {
+                    if (engine != null || engineStartJob?.isActive == true) {
+                        Logger.i("AgentEngine 已存在或正在启动，忽略重复 START，仅触发重连")
+                        engine?.onNetworkAvailable()
+                    } else {
+                        initAndStartEngine(serverUrl, projectId, deviceId)
+                    }
+                }
             }
             ACTION_STOP -> {
                 engine?.stop()
@@ -110,7 +118,7 @@ class AgentForegroundService : Service() {
     }
 
     private fun initAndStartEngine(serverUrlIn: String, projectId: String, deviceId: String) {
-        serviceScope.launch {
+        engineStartJob = serviceScope.launch {
             // BIND-05：未绑定 server_url 时，先走 UDP beacon 自动发现（同网零配置）
             var serverUrl = serverUrlIn
             if (serverUrl.isBlank()) {
@@ -215,7 +223,7 @@ class AgentForegroundService : Service() {
             PendingIntent.FLAG_IMMUTABLE,
         )
         return NotificationCompat.Builder(this, CHANNEL_ID)
-            .setContentTitle("AI数智员工")
+            .setContentTitle("工作手机")
             .setContentText(sanitize(status))
             .setSmallIcon(android.R.drawable.ic_dialog_info)
             .setContentIntent(pi)
diff --git a/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/DashboardFragment.kt b/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/DashboardFragment.kt
index 46bedfa25e..a83fc51981 100644
--- a/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/DashboardFragment.kt
+++ b/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/DashboardFragment.kt
@@ -34,9 +34,8 @@ class DashboardFragment : Fragment() {
     }
 
     override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
-        val deviceId = DeviceInfo.getOrCreateDeviceId(requireContext())
-        view.findViewById<TextView>(R.id.tvDeviceIdHeader).text = deviceId
-        view.findViewById<TextView>(R.id.tvDeviceIdMd5).text = "MD5  ${DeviceInfo.deviceIdMd5(requireContext())}"
+        view.findViewById<TextView>(R.id.tvDeviceIdHeader).text = "设备 ID · MD5"
+        view.findViewById<TextView>(R.id.tvDeviceIdMd5).text = DeviceInfo.deviceIdMd5(requireContext())
 
         view.findViewById<ImageButton>(R.id.btnScanQr).setOnClickListener { startQrScan() }
         view.findViewById<Button>(R.id.btnReconnect).setOnClickListener { reconnect() }
@@ -128,7 +127,10 @@ class DashboardFragment : Fragment() {
                 if (!isAdded) return@launch
                 val v = view ?: return@launch
                 refresh(v)
-                if (AgentForegroundService.instance?.engine != null) return@launch
+                if (AgentForegroundService.instance?.engine?.wsManager?.state?.value == ConnectionState.CONNECTED) {
+                    refresh(v)
+                    return@launch
+                }
             }
         }
     }
@@ -203,7 +205,7 @@ class DashboardFragment : Fragment() {
             val wechatRunning = info["wechat_running"] == true
             val wechatInstalled = DeviceInfo.isWeChatInstalled(ctx)
             val a11yOn = AgentAccessibilityService.isEnabled(ctx)
-            val hookOk = engine?.isFridaReady() == true
+            val hookOk = engine?.isWechatHookAttached() == true
             val wechatCap = wechatInstalled && (wechatRunning || isOnline)
             val aiCap = engine != null || AgentForegroundService.isRunning
 
@@ -267,6 +269,7 @@ class DashboardFragment : Fragment() {
                 prefs.edit()
                     .putString("server_url", serverUrl)
                     .putString("project_id", projectId)
+                    .putString("pairing_token", config["pairing_token"] ?: "")
                     .putBoolean("auto_connect", true)
                     .putBoolean("bound", true)
                     .apply()
diff --git a/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/SetupActivity.kt b/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/SetupActivity.kt
index 6f45cdf3f7..735c94ffe4 100644
--- a/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/SetupActivity.kt
+++ b/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/SetupActivity.kt
@@ -299,7 +299,7 @@ class SetupActivity : AppCompatActivity() {
      * 示例:
      * adb shell am start -n com.system.cloudservice/.ui.SetupActivity \
      *   --es server_url ws://127.0.0.1:8899 --es project_id cunkebao \
-     *   --es device_id xgfe65eimrrofyws --ei frida_port 15715
+     *   --es pairing_token '<token>' --es device_id xgfe65eimrrofyws --ei frida_port 15715
      */
     private fun consumeIntentConfigIfPresent(): Boolean {
         val server = intent?.getStringExtra("server_url")?.trim().orEmpty()
@@ -307,6 +307,9 @@ class SetupActivity : AppCompatActivity() {
         val project = intent?.getStringExtra("project_id")?.trim().takeUnless { it.isNullOrEmpty() } ?: "cunkebao"
         val pwa = intent?.getStringExtra("pwa_url")?.trim().takeUnless { it.isNullOrEmpty() } ?: BuildConfig.PWA_URL
         val cfg = mutableMapOf("server" to server, "project" to project, "pwa" to pwa)
+        intent?.getStringExtra("pairing_token")?.trim()?.takeIf { it.isNotEmpty() }?.let { token ->
+            cfg["pairing_token"] = token
+        }
         intent?.getStringExtra("device_id")?.trim()?.takeIf { it.isNotEmpty() }?.let { deviceId ->
             cfg["device_id"] = deviceId
         }
@@ -348,6 +351,9 @@ class SetupActivity : AppCompatActivity() {
                 config["public_servers"]?.trim()?.takeIf { it.isNotEmpty() }?.let { ps ->
                     prefs.edit().putString("public_servers", ps).apply()
                 }
+                config["pairing_token"]?.trim()?.takeIf { it.isNotEmpty() }?.let { token ->
+                    prefs.edit().putString("pairing_token", token).apply()
+                }
                 config["auto_discover"]?.trim()?.takeIf { it.isNotEmpty() }?.let { ad ->
                     prefs.edit().putBoolean("auto_discover", ad == "1" || ad.equals("true", true)).apply()
                 }
@@ -356,7 +362,7 @@ class SetupActivity : AppCompatActivity() {
                 }
 
                 startAgentService(serverUrl, projectId, deviceId)
-                tvSuccessDeviceId.text = deviceId
+                tvSuccessDeviceId.text = DeviceInfo.deviceIdMd5(this@SetupActivity)
                 // BIND-04 连接阶段实时映射（复用 DashboardFragment 人话映射）
                 var elapsed = 0
                 while (isActive && elapsed < 15_000) {
@@ -385,8 +391,8 @@ class SetupActivity : AppCompatActivity() {
 
     private fun copyDeviceId(deviceId: String) {
         val cm = getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager
-        cm.setPrimaryClip(ClipData.newPlainText("device_id", deviceId))
-        Toast.makeText(this, "已复制 device_id", Toast.LENGTH_SHORT).show()
+        cm.setPrimaryClip(ClipData.newPlainText("device_id_md5", deviceId))
+        Toast.makeText(this, "已复制设备 MD5", Toast.LENGTH_SHORT).show()
     }
 
     private fun safeStart(intent: Intent) {
diff --git a/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/StatusFragment.kt b/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/StatusFragment.kt
index 14a3d056f9..046a6a6e2f 100644
--- a/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/StatusFragment.kt
+++ b/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/StatusFragment.kt
@@ -79,9 +79,11 @@ class StatusFragment : Fragment() {
         }
 
         val fridaReady = engine?.isFridaReady() == true
+        val hookAttached = engine?.isWechatHookAttached() == true
         tvFrida.text = when {
             engine == null -> "⬜ Frida 未启用"
-            fridaReady -> "✅ Frida 就绪"
+            hookAttached -> "✅ 微信 Hook 已注入"
+            fridaReady -> "🟡 Frida 服务就绪 · 微信 Hook 未注入"
             engine.hasFridaBridge() -> "🔄 Frida 启动中…"
             else -> "⬜ Frida 未启用（无 Root 或未拉起）"
         }
diff --git a/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/WechatFragment.kt b/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/WechatFragment.kt
index 67ae897613..c053df3064 100644
--- a/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/WechatFragment.kt
+++ b/sdk/android-app/app/src/main/java/com/system/cloudservice/ui/WechatFragment.kt
@@ -62,7 +62,7 @@ class WechatFragment : Fragment() {
             val info = DeviceInfo.collectQuick(requireContext())
             val engine = AgentForegroundService.instance?.engine
             val isConnected = engine?.wsManager?.isConnected ?: false
-            val hookReady = engine?.isFridaReady() == true
+            val hookReady = engine?.isWechatHookAttached() == true
             val antiBanStatus = engine?.getAntiBanStatus()
 
             withContext(Dispatchers.Main) {
diff --git a/sdk/android-app/app/src/main/res/drawable-nodpi/workphone_launcher_art.png b/sdk/android-app/app/src/main/res/drawable-nodpi/workphone_launcher_art.png
new file mode 100644
index 0000000000..1c826b47da
Binary files /dev/null and b/sdk/android-app/app/src/main/res/drawable-nodpi/workphone_launcher_art.png differ
diff --git a/sdk/android-app/app/src/main/res/drawable/ic_launcher_foreground.xml b/sdk/android-app/app/src/main/res/drawable/ic_launcher_foreground.xml
index 0ffd908376..92147f3e7a 100644
--- a/sdk/android-app/app/src/main/res/drawable/ic_launcher_foreground.xml
+++ b/sdk/android-app/app/src/main/res/drawable/ic_launcher_foreground.xml
@@ -1,14 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!-- 极简中性图标（无「手机+蓝星」品牌图），设置/通知等仍需要合法 adaptive foreground -->
-<vector xmlns:android="http://schemas.android.com/apk/res/android"
-    android:width="108dp"
-    android:height="108dp"
-    android:viewportWidth="108"
-    android:viewportHeight="108">
-    <path
-        android:fillColor="#E8E8E8"
-        android:pathData="M54,30c-13.2,0 -24,10.8 -24,24s10.8,24 24,24 24,-10.8 24,-24 -10.8,-24 -24,-24zM54,38c8.8,0 16,7.2 16,16s-7.2,16 -16,16 -16,-7.2 -16,-16 7.2,-16 16,-16z" />
-    <path
-        android:fillColor="#E8E8E8"
-        android:pathData="M48,72h12v6H48z" />
-</vector>
+<!-- 工作手机：云端连接 + 设备网络 + 安全盾牌；保留 adaptive icon 安全区。 -->
+<inset xmlns:android="http://schemas.android.com/apk/res/android"
+    android:drawable="@drawable/workphone_launcher_art"
+    android:inset="12dp" />
diff --git a/sdk/android-app/app/src/main/res/layout/activity_setup.xml b/sdk/android-app/app/src/main/res/layout/activity_setup.xml
index 042381d636..9c270d4400 100644
--- a/sdk/android-app/app/src/main/res/layout/activity_setup.xml
+++ b/sdk/android-app/app/src/main/res/layout/activity_setup.xml
@@ -294,7 +294,7 @@
                 <TextView
                     android:layout_width="wrap_content"
                     android:layout_height="wrap_content"
-                    android:text="设备ID"
+                    android:text="设备 ID · MD5"
                     android:textSize="12sp"
                     android:textColor="@color/text_tertiary"
                     android:layout_marginBottom="6dp" />
@@ -314,7 +314,7 @@
                     android:id="@+id/btnCopySuccess"
                     android:layout_width="260dp"
                     android:layout_height="42dp"
-                    android:text="复制 device_id"
+                    android:text="复制设备 MD5"
                     android:textSize="13sp"
                     android:textColor="@color/brand_primary"
                     android:background="@drawable/btn_glass_secondary"
diff --git a/sdk/android-app/app/src/main/res/layout/fragment_settings_v2.xml b/sdk/android-app/app/src/main/res/layout/fragment_settings_v2.xml
index 827bab04b3..4b3e18bf5c 100644
--- a/sdk/android-app/app/src/main/res/layout/fragment_settings_v2.xml
+++ b/sdk/android-app/app/src/main/res/layout/fragment_settings_v2.xml
@@ -139,7 +139,7 @@
                 <TextView
                     android:layout_width="match_parent"
                     android:layout_height="wrap_content"
-                    android:text="技术绑定已完成，接下来在存客宝完成业务入库："
+                    android:text="本机由工作手机主动扫描系统二维码完成服务器与项目绑定："
                     android:textSize="13sp"
                     android:textColor="@color/text_primary"
                     android:layout_marginBottom="8dp" />
@@ -147,7 +147,7 @@
                 <TextView
                     android:layout_width="match_parent"
                     android:layout_height="wrap_content"
-                    android:text="1. 点击上方「复制」复制 device_id"
+                    android:text="1. 在系统设备管理中生成绑定二维码"
                     android:textSize="13sp"
                     android:textColor="@color/text_secondary"
                     android:layout_marginBottom="4dp" />
@@ -155,7 +155,7 @@
                 <TextView
                     android:layout_width="match_parent"
                     android:layout_height="wrap_content"
-                    android:text="2. 打开存客宝 → 设备管理 → 扫码/添加设备"
+                    android:text="2. 回到工作台点击右上角扫码按钮"
                     android:textSize="13sp"
                     android:textColor="@color/text_secondary"
                     android:layout_marginBottom="4dp" />
@@ -163,7 +163,7 @@
                 <TextView
                     android:layout_width="match_parent"
                     android:layout_height="wrap_content"
-                    android:text="3. 粘贴 device_id 或扫描本机二维码完成入库"
+                    android:text="3. 工作手机扫描二维码后自动连接并上报设备"
                     android:textSize="13sp"
                     android:textColor="@color/text_secondary"
                     android:layout_marginBottom="10dp" />
@@ -172,11 +172,12 @@
                     android:id="@+id/btnShowDeviceQr"
                     android:layout_width="match_parent"
                     android:layout_height="42dp"
-                    android:text="展示 device_id 二维码"
+                    android:text="旧版设备二维码（已停用）"
                     android:textSize="13sp"
                     android:textColor="@color/brand_primary"
                     android:background="@drawable/btn_glass_secondary"
-                    android:textAllCaps="false" />
+                    android:textAllCaps="false"
+                    android:visibility="gone" />
             </LinearLayout>
 
             <!-- MIUI 保活 checklist · WP-AGENT-01 -->
diff --git a/sdk/android-app/app/src/main/res/mipmap-hdpi/ic_launcher.png b/sdk/android-app/app/src/main/res/mipmap-hdpi/ic_launcher.png
index 97dcfad21e..e09ec3c6f1 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-hdpi/ic_launcher.png and b/sdk/android-app/app/src/main/res/mipmap-hdpi/ic_launcher.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-hdpi/ic_launcher_foreground.png b/sdk/android-app/app/src/main/res/mipmap-hdpi/ic_launcher_foreground.png
index c8c44213e3..e09ec3c6f1 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-hdpi/ic_launcher_foreground.png and b/sdk/android-app/app/src/main/res/mipmap-hdpi/ic_launcher_foreground.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-hdpi/ic_launcher_round.png b/sdk/android-app/app/src/main/res/mipmap-hdpi/ic_launcher_round.png
index 97dcfad21e..e09ec3c6f1 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-hdpi/ic_launcher_round.png and b/sdk/android-app/app/src/main/res/mipmap-hdpi/ic_launcher_round.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-mdpi/ic_launcher.png b/sdk/android-app/app/src/main/res/mipmap-mdpi/ic_launcher.png
index 52fd14f858..ae35d9e14e 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-mdpi/ic_launcher.png and b/sdk/android-app/app/src/main/res/mipmap-mdpi/ic_launcher.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-mdpi/ic_launcher_foreground.png b/sdk/android-app/app/src/main/res/mipmap-mdpi/ic_launcher_foreground.png
index db6514e1b2..ae35d9e14e 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-mdpi/ic_launcher_foreground.png and b/sdk/android-app/app/src/main/res/mipmap-mdpi/ic_launcher_foreground.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-mdpi/ic_launcher_round.png b/sdk/android-app/app/src/main/res/mipmap-mdpi/ic_launcher_round.png
index 52fd14f858..ae35d9e14e 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-mdpi/ic_launcher_round.png and b/sdk/android-app/app/src/main/res/mipmap-mdpi/ic_launcher_round.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-xhdpi/ic_launcher.png b/sdk/android-app/app/src/main/res/mipmap-xhdpi/ic_launcher.png
index e77ae7117e..23fb70e084 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-xhdpi/ic_launcher.png and b/sdk/android-app/app/src/main/res/mipmap-xhdpi/ic_launcher.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-xhdpi/ic_launcher_foreground.png b/sdk/android-app/app/src/main/res/mipmap-xhdpi/ic_launcher_foreground.png
index b1259f1f6b..23fb70e084 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-xhdpi/ic_launcher_foreground.png and b/sdk/android-app/app/src/main/res/mipmap-xhdpi/ic_launcher_foreground.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png b/sdk/android-app/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png
index e77ae7117e..23fb70e084 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png and b/sdk/android-app/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-xxhdpi/ic_launcher.png b/sdk/android-app/app/src/main/res/mipmap-xxhdpi/ic_launcher.png
index 884802aec6..8718a7cce3 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-xxhdpi/ic_launcher.png and b/sdk/android-app/app/src/main/res/mipmap-xxhdpi/ic_launcher.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-xxhdpi/ic_launcher_foreground.png b/sdk/android-app/app/src/main/res/mipmap-xxhdpi/ic_launcher_foreground.png
index a47f91ea69..8718a7cce3 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-xxhdpi/ic_launcher_foreground.png and b/sdk/android-app/app/src/main/res/mipmap-xxhdpi/ic_launcher_foreground.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png b/sdk/android-app/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png
index 884802aec6..8718a7cce3 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png and b/sdk/android-app/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png b/sdk/android-app/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png
index 6cfbbd395a..fb715db581 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png and b/sdk/android-app/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-xxxhdpi/ic_launcher_foreground.png b/sdk/android-app/app/src/main/res/mipmap-xxxhdpi/ic_launcher_foreground.png
index f1b4ef75c6..fb715db581 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-xxxhdpi/ic_launcher_foreground.png and b/sdk/android-app/app/src/main/res/mipmap-xxxhdpi/ic_launcher_foreground.png differ
diff --git a/sdk/android-app/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png b/sdk/android-app/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png
index 6cfbbd395a..fb715db581 100644
Binary files a/sdk/android-app/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png and b/sdk/android-app/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png differ
diff --git a/sdk/android-app/app/src/main/res/values/colors.xml b/sdk/android-app/app/src/main/res/values/colors.xml
index 3dd7e08901..d0e4ab3b8e 100644
--- a/sdk/android-app/app/src/main/res/values/colors.xml
+++ b/sdk/android-app/app/src/main/res/values/colors.xml
@@ -66,6 +66,6 @@
     <color name="orb_secondary">#2660A5FA</color>
     <color name="orb_accent">#1A8B5CF6</color>
 
-    <!-- 应用图标底色：中性灰，避免桌面/设置里显眼「蓝底工作」品牌 -->
-    <color name="ic_launcher_bg">#505050</color>
+    <!-- 工作手机应用图标底色：企业蓝，与云端设备管理主题一致。 -->
+    <color name="ic_launcher_bg">#0876E8</color>
 </resources>
diff --git a/sdk/android-app/app/src/main/res/values/strings.xml b/sdk/android-app/app/src/main/res/values/strings.xml
index 1dd9eb4892..d8a76d3f71 100644
--- a/sdk/android-app/app/src/main/res/values/strings.xml
+++ b/sdk/android-app/app/src/main/res/values/strings.xml
@@ -1,9 +1,9 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="app_name">AI数智员工</string>
+    <string name="app_name">工作手机</string>
     <string name="launcher_name">工作手机</string>
     <string name="app_version_tagline">v5.0.1 · 设备同步服务</string>
-    <string name="accessibility_service_description">AI数智员工服务辅助功能</string>
+    <string name="accessibility_service_description">工作手机设备控制辅助功能</string>
     <string name="nav_hub">工作台</string>
     <string name="nav_pwa">业务</string>
     <string name="nav_status">状态</string>
diff --git a/sdk/app/agent/__init__.py b/sdk/app/agent/__init__.py
new file mode 100644
index 0000000000..451c2dd570
--- /dev/null
+++ b/sdk/app/agent/__init__.py
@@ -0,0 +1 @@
+# 设备端 Agent 模块包（ai_brain、skills 等）
diff --git a/sdk/app/agent/sdk_discovery.py b/sdk/app/agent/sdk_discovery.py
new file mode 100644
index 0000000000..7290f0077d
--- /dev/null
+++ b/sdk/app/agent/sdk_discovery.py
@@ -0,0 +1,59 @@
+"""
+设备端 SDK 自动发现 — 监听 UDP beacon（8898），无线主控免手填 IP。
+
+与 sdk/app/services/discovery_service.py BEACON 协议对齐。
+"""
+
+from __future__ import annotations
+
+import json
+import socket
+import time
+from typing import Optional
+
+BEACON_PORT = 8898
+BEACON_MAGIC = "WORKPHONE_SDK"
+
+
+def _pick_best_ip(ips: list) -> str:
+    """优先工作手机常用网段，其次任一私网 IP。"""
+    for ip in ips:
+        if str(ip).startswith("192.168.110."):
+            return ip
+    for ip in ips:
+        if str(ip).startswith(("192.168.", "10.", "172.")):
+            return ip
+    return str(ips[0])
+
+
+def discover_sdk_ws_base(timeout: float = 20.0) -> Optional[str]:
+    """
+    监听局域网 UDP beacon，返回 WebSocket 基础地址。
+    例: ws://192.168.110.251:8899/ws/device
+    """
+    deadline = time.time() + timeout
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    try:
+        sock.bind(("", BEACON_PORT))
+    except OSError:
+        # Termux 可能无权限绑 8898，改绑任意端口并只 recv
+        sock.bind(("", 0))
+    sock.settimeout(1.0)
+
+    while time.time() < deadline:
+        try:
+            data, _addr = sock.recvfrom(4096)
+            payload = json.loads(data.decode("utf-8"))
+            if payload.get("magic") != BEACON_MAGIC:
+                continue
+            port = int(payload.get("port") or 8899)
+            ws_path = (payload.get("ws_path") or "/ws/device").rstrip("/")
+            ips = payload.get("ips") or []
+            host = _pick_best_ip(ips) if ips else "127.0.0.1"
+            return f"ws://{host}:{port}{ws_path}"
+        except socket.timeout:
+            continue
+        except Exception:
+            continue
+    return None
diff --git a/sdk/app/agent/vision_helper.py b/sdk/app/agent/vision_helper.py
index b5fa77c573..d8fefa9148 100644
--- a/sdk/app/agent/vision_helper.py
+++ b/sdk/app/agent/vision_helper.py
@@ -13,7 +13,7 @@ import re
 logger = logging.getLogger(__name__)
 
 def _gemini_url():
-    key = os.getenv("GEMINI_API_KEY", "AIzaSyCPARryq8o6MKptLoT4STAvCsRB7uZuOK8")
+    key = os.getenv("GEMINI_API_KEY", "")
     return f"https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key={key}"
 
 
diff --git a/sdk/app/config.py b/sdk/app/config.py
index 83191bcdb1..84eabbaad4 100644
--- a/sdk/app/config.py
+++ b/sdk/app/config.py
@@ -18,6 +18,8 @@ class Settings(BaseSettings):
     
     # API密钥
     API_KEY: str = "workphone-secret-key"
+    API_AUTH_ENABLED: bool = False
+    DEVICE_PAIRING_TOKEN: str = ""
     
     # MongoDB
     MONGO_URI: str = "mongodb://localhost:27017"
@@ -43,6 +45,12 @@ class Settings(BaseSettings):
     WORKPHONE_WS_FIRST: bool = True  # 无线主控：execute/probe 优先 WS Agent；主机 ADB 仅运维/兜底
     WORKPHONE_HOST_ADB_PROBE: bool = False  # hook/probe 是否允许主机 adb+frida 探测（默认关，纯 WS）
 
+    # 宝塔侧 Frida 反向隧道。手机仅负责维持隧道，微信 RPC 在 SDK 容器内执行。
+    SERVER_FRIDA_ENABLED: bool = False
+    SERVER_FRIDA_HOST: str = "172.18.0.1"
+    SERVER_FRIDA_PORT: int = 14538
+    SERVER_FRIDA_DEVICE_ID: str = ""  # 留空表示接受任意在线设备；生产建议填写真机 ID
+
     # AI 心跳任务队列：0 表示无上限（每周期抽空队列 / 队列不截断）
     AI_HEARTBEAT_TASK_BATCH: int = 0
     AI_HEARTBEAT_QUEUE_MAXLEN: int = 0
diff --git a/sdk/app/data/connection_providers.json b/sdk/app/data/connection_providers.json
new file mode 100644
index 0000000000..621666c92e
--- /dev/null
+++ b/sdk/app/data/connection_providers.json
@@ -0,0 +1,114 @@
+{
+  "active": {
+    "global": "jiqing",
+    "projects": {},
+    "devices": {
+      "xgfe65eimrrofyws": "jiqing"
+    }
+  },
+  "providers": {
+    "jiqing": {
+      "id": "jiqing",
+      "name": "机擎工作手机（本SDK原生·WS+Frida）",
+      "kind": "native",
+      "enabled": true,
+      "builtin": true,
+      "desc": "默认方案：WebSocket Agent + 设备本机 Frida，经 device_transport 无线主控"
+    },
+    "aochuang": {
+      "id": "aochuang",
+      "name": "奥创工作手机（007私域）",
+      "kind": "http",
+      "enabled": false,
+      "builtin": true,
+      "desc": "",
+      "base_url": "",
+      "base_url_env": "",
+      "auth": {
+        "type": "bearer",
+        "token": "",
+        "token_env": "AOCHUANG_TOKEN",
+        "header": "Authorization"
+      },
+      "health": {
+        "method": "GET",
+        "path": "/devices"
+      },
+      "endpoints": {
+        "list_devices": {
+          "method": "GET",
+          "path": "/devices",
+          "data_path": "data"
+        },
+        "send_message": {
+          "method": "POST",
+          "path": "/message/send",
+          "body_map": {
+            "device_id": "deviceId",
+            "to_id": "wxid",
+            "content": "content",
+            "msg_type": "msgType"
+          }
+        },
+        "batch_send_message": {
+          "method": "POST",
+          "path": "/message/batch-send",
+          "body_map": {
+            "device_id": "deviceId"
+          }
+        },
+        "get_contacts": {
+          "method": "GET",
+          "path": "/wechat/contacts",
+          "query_map": {
+            "device_id": "deviceId"
+          },
+          "data_path": "data"
+        },
+        "add_friend": {
+          "method": "POST",
+          "path": "/friend/add",
+          "body_map": {
+            "device_id": "deviceId",
+            "to_id": "keyword"
+          }
+        },
+        "post_moments": {
+          "method": "POST",
+          "path": "/moments/post",
+          "body_map": {
+            "device_id": "deviceId",
+            "content": "content"
+          }
+        }
+      }
+    },
+    "legacy": {
+      "id": "legacy",
+      "name": "现有连接形式（S2/旧接口）",
+      "kind": "http",
+      "enabled": false,
+      "builtin": true,
+      "desc": "存客宝现有/历史设备连接（自建工作手机或 S2 旧接口），配置式 HTTP 驱动",
+      "base_url": "",
+      "base_url_env": "LEGACY_PROVIDER_BASE_URL",
+      "auth": {
+        "type": "apikey",
+        "token": "",
+        "token_env": "LEGACY_PROVIDER_TOKEN",
+        "header": "X-API-Key"
+      },
+      "endpoints": {
+        "send_message": {
+          "method": "POST",
+          "path": "/send"
+        },
+        "list_devices": {
+          "method": "GET",
+          "path": "/devices"
+        }
+      }
+    }
+  },
+  "_updated_at": 1780046806
+}
\ No newline at end of file
diff --git a/sdk/app/data/hook/device_modules.json b/sdk/app/data/hook/device_modules.json
index 7a83b07745..3f3b08cf4f 100644
--- a/sdk/app/data/hook/device_modules.json
+++ b/sdk/app/data/hook/device_modules.json
@@ -184,7 +184,7 @@
     "frida_version": "",
     "root_status": false,
     "hook_framework": "frida-server",
-    "updated_at": "2026-07-11T16:05:52.746105+00:00",
+    "updated_at": "2026-07-14T05:30:03.643828+00:00",
     "modules": []
   },
   "6c08d7b2de2fd67a5e24753a6b6920a5": {
diff --git a/sdk/app/main.py b/sdk/app/main.py
index da8bf71c34..87afa8bdf0 100644
--- a/sdk/app/main.py
+++ b/sdk/app/main.py
@@ -3,10 +3,11 @@
 存客宝的AI手机控制引擎
 """
 
-from fastapi import FastAPI, HTTPException, WebSocket, WebSocketDisconnect
+from fastapi import FastAPI, HTTPException, Request, WebSocket, WebSocketDisconnect
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.staticfiles import StaticFiles
-from fastapi.responses import FileResponse, Response
+from fastapi.responses import FileResponse, JSONResponse, Response
+import hmac
 from contextlib import asynccontextmanager
 import logging
 import os
@@ -619,6 +620,29 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
+_PUBLIC_HTTP_PATHS = {
+    "/", "/health", "/ready", "/openapi.json", "/docs", "/redoc",
+    "/docs/oauth2-redirect", "/llms.txt", "/favicon.ico",
+}
+
+
+@app.middleware("http")
+async def require_production_api_key(request: Request, call_next):
+    """生产环境保护控制接口；健康探针和文档保持可读。"""
+    path = request.url.path.rstrip("/") or "/"
+    # 浏览器跨域调用会先发送不携带业务密钥的 OPTIONS 预检；应交给
+    # CORSMiddleware 返回允许头，真实 GET/POST 请求仍必须通过 API Key。
+    public = request.method == "OPTIONS" or path in _PUBLIC_HTTP_PATHS or path.startswith("/static/")
+    if settings.API_AUTH_ENABLED and not public:
+        supplied = request.headers.get("X-API-Key", "").strip()
+        auth = request.headers.get("Authorization", "").strip()
+        if not supplied and auth.lower().startswith("bearer "):
+            supplied = auth[7:].strip()
+        expected = settings.API_KEY.strip()
+        if not expected or not hmac.compare_digest(supplied, expected):
+            return JSONResponse(status_code=401, content={"code": 401, "message": "API Key 无效"})
+    return await call_next(request)
+
 # 注册路由
 app.include_router(devices.router, prefix="/api/v3", tags=["设备管理"])
 app.include_router(unified.router, prefix="/api/v3", tags=["统一接口"])
@@ -869,6 +893,11 @@ async def serve_install_script():
 @app.websocket("/ws/device/{device_id}")
 async def device_websocket(websocket: WebSocket, device_id: str):
     """设备WebSocket连接入口"""
+    expected_token = settings.DEVICE_PAIRING_TOKEN.strip()
+    supplied_token = websocket.query_params.get("token", "").strip()
+    if expected_token and not hmac.compare_digest(supplied_token, expected_token):
+        await websocket.close(code=4401, reason="invalid pairing token")
+        return
     await ws_hub.connect(websocket, device_id)
     try:
         while True:
diff --git a/sdk/app/routers/adb.py b/sdk/app/routers/adb.py
index c9b6f91e66..213924ab31 100644
--- a/sdk/app/routers/adb.py
+++ b/sdk/app/routers/adb.py
@@ -227,11 +227,14 @@ async def stop_app(serial: str, req: AppRequest):
 
 
 @router.get("/devices/{serial}/app/current")
-def current_app(serial: str):
+async def current_app(serial: str):
     """获取当前APP"""
     device = adb_manager.get_device(serial)
     if not device:
-        raise HTTPException(status_code=404, detail="设备不存在")
+        result = await _ws_execute(serial, "get_foreground", timeout=15)
+        if result:
+            return result
+        _raise_not_found()
 
     return device.current_app()
 
diff --git a/sdk/app/routers/connection.py b/sdk/app/routers/connection.py
index 419a991064..cfc147b684 100644
--- a/sdk/app/routers/connection.py
+++ b/sdk/app/routers/connection.py
@@ -15,7 +15,7 @@ from services.ws_hub import ws_hub
 from services.adb_device import adb_manager
 from services.hook_module_service import hook_module_service
 from services.connection_priority import connection_priority
-from services.device_id_util import device_id_md5, enrich_device_id_fields
+from services.device_id_util import device_id_md5, enrich_device_id_fields, sanitize_sensitive_fields
 
 router = APIRouter()
 
@@ -156,7 +156,7 @@ async def get_connection_status() -> Dict[str, Any]:
 
     return {
         "code": 200,
-        "data": {
+        "data": sanitize_sensitive_fields({
             "server_time": _iso_now(),
             "ws_path": "/ws/device/{device_id}",
             "hook_events_stream": "/api/v3/hook/events/stream",
@@ -170,7 +170,7 @@ async def get_connection_status() -> Dict[str, Any]:
             "adb_serials_md5": {s: device_id_md5(s) for s in adb_devices},
             "transport_policy": transport_policy,
             "devices": device_rows,
-        },
+        }),
     }
 
 
diff --git a/sdk/app/routers/connection_provider.py b/sdk/app/routers/connection_provider.py
new file mode 100644
index 0000000000..cc4d0ea716
--- /dev/null
+++ b/sdk/app/routers/connection_provider.py
@@ -0,0 +1,138 @@
+"""
+设备连接方案 · 可切换驱动 API
+
+供存客宝四端（存客宝/触客宝/AI数智员工/SuperAdmin）与超管 UI 切换「设备连接解决方案」：
+  - 列出所有方案 / 当前生效方案
+  - 一键切换（全局 / 按项目 / 按设备）
+  - 注册/更新/删除自定义方案（预留接口，新方案无需改代码）
+  - 健康检查 + 统一执行（验证切换后功能可用）
+
+真源：sdk/app/services/connection_provider.py
+文档：开发文档/1、需求/修改/工作手机_设备Agent与基础设施_20260529.md §3.6
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+from fastapi import APIRouter, HTTPException
+from pydantic import BaseModel, Field
+
+from services.connection_provider import (
+    connection_provider_manager as mgr,
+    SCOPE_GLOBAL,
+)
+
+router = APIRouter()
+
+
+class SwitchRequest(BaseModel):
+    provider: str = Field(..., description="目标连接方案 id：jiqing / aochuang / legacy / custom_*")
+    scope: str = Field(default=SCOPE_GLOBAL, description="作用域：global / project / device")
+    project_id: str = ""
+    device_id: str = ""
+
+
+class RegisterProviderRequest(BaseModel):
+    id: str = Field(..., description="方案 id（自定义建议 custom_ 前缀）")
+    name: str = ""
+    kind: str = Field(default="http", description="native / http")
+    enabled: bool = True
+    desc: str = ""
+    base_url: str = ""
+    base_url_env: str = ""
+    auth: Optional[Dict[str, Any]] = None
+    health: Optional[Dict[str, Any]] = None
+    endpoints: Optional[Dict[str, Any]] = None
+
+
+class ProviderExecuteRequest(BaseModel):
+    device_id: str
+    script: str = Field(default="wechat", description="平台：wechat/douyin/xhs/...")
+    action: str = Field(..., description="规范化动作或平台 action")
+    params: Dict[str, Any] = Field(default_factory=dict)
+    provider: str = Field(default="", description="强制指定方案；空则按开关解析")
+    project_id: str = ""
+    timeout: int = 120
+
+
+@router.get("/connection/providers")
+async def list_connection_providers() -> Dict[str, Any]:
+    """列出所有设备连接方案 + 当前开关。"""
+    return {
+        "code": 200,
+        "data": {
+            "providers": mgr.list_providers(),
+            "active": mgr.active_config(),
+            "scopes": ["global", "project", "device"],
+            "doc": "开发文档/1、需求/修改/工作手机_设备Agent与基础设施_20260529.md §3.6",
+        },
+    }
+
+
+@router.get("/connection/provider/active")
+async def get_active_provider(device_id: str = "", project_id: str = "") -> Dict[str, Any]:
+    """解析指定作用域当前生效的连接方案（设备 > 项目 > 全局）。"""
+    pid = mgr.resolve_active_id(device_id=device_id, project_id=project_id)
+    prov = mgr.get(pid)
+    return {"code": 200, "data": {
+        "active_provider": pid,
+        "device_id": device_id,
+        "project_id": project_id,
+        "meta": prov.meta() if prov else None,
+    }}
+
+
+@router.post("/connection/provider/switch")
+async def switch_connection_provider(req: SwitchRequest) -> Dict[str, Any]:
+    """一键切换设备连接方案（开关）。"""
+    try:
+        result = mgr.switch(req.provider, scope=req.scope,
+                            project_id=req.project_id, device_id=req.device_id)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    return {"code": 200, "message": f"已切换到连接方案 {req.provider}", "data": result}
+
+
+@router.post("/connection/provider/register")
+async def register_connection_provider(req: RegisterProviderRequest) -> Dict[str, Any]:
+    """注册/更新连接方案（预留接口：自定义工作手机方案无需改代码即可接入）。"""
+    try:
+        meta = mgr.register(req.model_dump(exclude_none=True))
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    return {"code": 200, "message": f"连接方案 {req.id} 已登记", "data": meta}
+
+
+@router.delete("/connection/provider/{provider_id}")
+async def delete_connection_provider(provider_id: str) -> Dict[str, Any]:
+    """删除自定义连接方案（内置方案不可删，改用禁用）。"""
+    try:
+        result = mgr.remove(provider_id)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    return {"code": 200, "message": f"连接方案 {provider_id} 已删除", "data": result}
+
+
+@router.get("/connection/provider/{provider_id}/health")
+async def provider_health(provider_id: str) -> Dict[str, Any]:
+    """连接方案健康/连通性检查。"""
+    prov = mgr.get(provider_id)
+    if not prov:
+        raise HTTPException(status_code=404, detail=f"未知连接方案: {provider_id}")
+    return {"code": 200, "data": await prov.health()}
+
+
+@router.post("/connection/provider/execute")
+async def provider_execute(req: ProviderExecuteRequest) -> Dict[str, Any]:
+    """经当前（或指定）连接方案统一执行——验证切换后功能可用。"""
+    if req.provider:
+        prov = mgr.get(req.provider)
+        if not prov:
+            raise HTTPException(status_code=404, detail=f"未知连接方案: {req.provider}")
+    else:
+        prov = mgr.resolve_active(device_id=req.device_id, project_id=req.project_id)
+    result = await prov.execute(req.device_id, req.script, req.action, req.params, timeout=req.timeout)
+    if isinstance(result, dict):
+        result.setdefault("provider", prov.id)
+    return {"code": result.get("code", 200) if isinstance(result, dict) else 200, "data": result}
diff --git a/sdk/app/routers/devices.py b/sdk/app/routers/devices.py
index 30c6f53aa8..803168ecd4 100644
--- a/sdk/app/routers/devices.py
+++ b/sdk/app/routers/devices.py
@@ -129,7 +129,7 @@ async def get_device(device_id: str):
     else:
         device["status"] = "offline"
     device["device_id"] = device_id
-    from services.device_id_util import enrich_device_id_fields
+    from services.device_id_util import enrich_device_id_fields, sanitize_sensitive_fields
     enrich_device_id_fields(device)
 
     # 若 model/brand/android_version 为空或 Unknown，从 ADB 补充（设备可能同时连 WS 和 USB）
@@ -153,7 +153,7 @@ async def get_device(device_id: str):
         except (asyncio.TimeoutError, Exception):
             pass
 
-    return {"code": 200, "data": device}
+    return {"code": 200, "data": sanitize_sensitive_fields(device)}
 
 
 @router.get("/devices/{device_id}/heartbeat", response_model=dict)
diff --git a/sdk/app/routers/fleet.py b/sdk/app/routers/fleet.py
new file mode 100644
index 0000000000..5fb49f1c0a
--- /dev/null
+++ b/sdk/app/routers/fleet.py
@@ -0,0 +1,224 @@
+"""
+多手机设备管理接口。
+
+面向存客宝/触客宝/超管等外部系统：把单机 SDK 能力包装成可筛选、
+可批量执行、可审计的 Fleet API。单机能力仍由 devices/unified 路由负责。
+"""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Any, Dict, List, Optional
+
+from fastapi import APIRouter, HTTPException
+from pydantic import BaseModel, Field
+
+from services.device_fleet import list_merged_local_devices
+from services.device_id_util import device_id_md5
+from services.ws_hub import ws_hub
+
+
+router = APIRouter()
+
+
+WRITE_ACTIONS = {
+    "send_message",
+    "batch_send",
+    "mass_send",
+    "add_friend",
+    "batch_add_friend",
+    "post_moments",
+    "like_moments",
+    "comment_moments",
+    "create_group",
+    "invite_to_group",
+    "remove_from_group",
+    "set_group_notice",
+    "set_group_name",
+    "set_group_welcome",
+    "delete_tag",
+    "create_tag",
+    "tag_add",
+    "tag_remove",
+}
+
+
+class FleetExecuteRequest(BaseModel):
+    """批量执行请求。"""
+
+    device_ids: Optional[List[str]] = None
+    project_id: Optional[str] = None
+    all_online: bool = False
+    platform: str = "wechat"
+    action: str
+    params: Dict[str, Any] = Field(default_factory=dict)
+    hook_only: bool = False
+    timeout: int = 60
+    max_concurrency: int = 3
+    dry_run: bool = False
+    confirm: bool = False
+
+
+def _normalize_status(device: dict) -> str:
+    if ws_hub.is_online(device.get("device_id", "")):
+        return "online"
+    return str(device.get("status") or "offline")
+
+
+async def _select_devices(
+    *,
+    device_ids: Optional[List[str]] = None,
+    project_id: Optional[str] = None,
+    all_online: bool = False,
+    status: str = "",
+    capability: str = "",
+) -> List[dict]:
+    devices = await list_merged_local_devices()
+    selected = []
+    wanted = set(device_ids or [])
+    for device in devices:
+        did = device.get("device_id", "")
+        if wanted and did not in wanted:
+            continue
+        if project_id and str(device.get("project_id") or "") != str(project_id):
+            continue
+        if all_online and not ws_hub.is_online(did):
+            continue
+        if status and _normalize_status(device) != status:
+            continue
+        if capability and capability not in (device.get("capabilities") or []):
+            continue
+        normalized = dict(device)
+        normalized["status"] = _normalize_status(normalized)
+        normalized["online"] = ws_hub.is_online(did)
+        normalized["device_id_md5"] = normalized.get("device_id_md5") or device_id_md5(did)
+        selected.append(normalized)
+    return selected
+
+
+@router.get("/fleet/summary", response_model=dict)
+async def fleet_summary(project_id: str = ""):
+    """所有手机/项目手机总览。"""
+    devices = await _select_devices(project_id=project_id or None)
+    online = [d for d in devices if d.get("online")]
+    adb = [d for d in devices if d.get("status") == "adb"]
+    offline = [d for d in devices if not d.get("online") and d.get("status") != "adb"]
+    by_project: Dict[str, int] = {}
+    for device in devices:
+        pid = str(device.get("project_id") or "")
+        by_project[pid] = by_project.get(pid, 0) + 1
+    return {
+        "code": 200,
+        "data": {
+            "total": len(devices),
+            "online": len(online),
+            "adb": len(adb),
+            "offline": len(offline),
+            "by_project": by_project,
+            "device_ids": [d.get("device_id") for d in devices],
+            "online_device_ids": [d.get("device_id") for d in online],
+        },
+    }
+
+
+@router.get("/fleet/devices", response_model=dict)
+async def fleet_devices(
+    project_id: str = "",
+    status: str = "",
+    capability: str = "",
+    online_only: bool = False,
+):
+    """按项目、状态、能力筛选设备列表。"""
+    devices = await _select_devices(
+        project_id=project_id or None,
+        status=status,
+        capability=capability,
+        all_online=online_only,
+    )
+    return {"code": 200, "data": {"devices": devices, "count": len(devices)}}
+
+
+@router.post("/fleet/execute", response_model=dict)
+async def fleet_execute(req: FleetExecuteRequest):
+    """在多台在线手机上批量执行同一个设备动作。"""
+    devices = await _select_devices(
+        device_ids=req.device_ids,
+        project_id=req.project_id,
+        all_online=req.all_online or not req.device_ids,
+        status="online",
+    )
+    if not devices:
+        raise HTTPException(status_code=404, detail="没有匹配的在线设备")
+
+    is_write = req.action in WRITE_ACTIONS
+    if is_write and len(devices) > 1 and not (req.dry_run or req.confirm):
+        return {
+            "code": 200,
+            "data": {
+                "success": False,
+                "confirm_required": True,
+                "reason": "批量写类动作需要 confirm=true；可先 dry_run=true 查看目标设备",
+                "action": req.action,
+                "target_count": len(devices),
+                "targets": [d.get("device_id") for d in devices],
+            },
+        }
+    if req.dry_run:
+        return {
+            "code": 200,
+            "data": {
+                "success": True,
+                "dry_run": True,
+                "action": req.action,
+                "target_count": len(devices),
+                "targets": [d.get("device_id") for d in devices],
+            },
+        }
+
+    sem = asyncio.Semaphore(max(1, min(int(req.max_concurrency or 1), 10)))
+    timeout = max(5, min(int(req.timeout or 60), 300))
+
+    async def run_one(device: dict) -> dict:
+        did = device.get("device_id", "")
+        async with sem:
+            try:
+                result = await ws_hub.send_command(
+                    did,
+                    {
+                        "type": "execute",
+                        "data": {
+                            "script": req.platform,
+                            "action": req.action,
+                            "params": req.params or {},
+                            "hook_only": req.hook_only,
+                        },
+                    },
+                    timeout=timeout,
+                )
+                return {
+                    "device_id": did,
+                    "device_id_md5": device_id_md5(did),
+                    "success": result.get("code") == 200,
+                    "result": result,
+                }
+            except Exception as exc:
+                return {
+                    "device_id": did,
+                    "device_id_md5": device_id_md5(did),
+                    "success": False,
+                    "error": str(exc),
+                }
+
+    results = await asyncio.gather(*(run_one(device) for device in devices))
+    ok = sum(1 for item in results if item.get("success"))
+    return {
+        "code": 200,
+        "data": {
+            "success": ok == len(results),
+            "action": req.action,
+            "target_count": len(results),
+            "success_count": ok,
+            "failed_count": len(results) - ok,
+            "results": results,
+        },
+    }
diff --git a/sdk/app/routers/integration.py b/sdk/app/routers/integration.py
new file mode 100644
index 0000000000..c476dbc7b2
--- /dev/null
+++ b/sdk/app/routers/integration.py
@@ -0,0 +1,294 @@
+"""
+对外接口统一清单 · 集成中心路由
+
+路由前缀：/api/v3/integration
+
+供存客宝 / 超级管理端 / AI 数字员工 直接发现并调用工作手机 SDK 的全部对外接口：
+  - GET  /integration/manifest             全量接口清单（按模块归类）
+  - GET  /integration/modules              模块目录（精简，不含端点明细）
+  - GET  /integration/consumers            消费方列表
+  - GET  /integration/consumers/{consumer} 某消费方可用的接口子集
+  - GET  /integration/health               关键集成点健康聚合（WS/连接方案/存客宝/网关）
+
+清单从 FastAPI 路由动态生成，始终与代码同步；本路由只读、零副作用。
+严禁修改存客宝 / AI 数字员工 / 超管代码——本中心仅暴露工作手机侧出口。
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict
+
+from fastapi import APIRouter, HTTPException, Request
+
+from services.integration_manifest import (
+    build_manifest,
+    build_capability,
+    filter_by_consumer,
+    list_modules,
+    CONSUMER_LABELS,
+)
+
+router = APIRouter()
+
+
+@router.get("/integration/manifest", tags=["对外接口统一清单"])
+async def integration_manifest(request: Request) -> Dict[str, Any]:
+    """全量对外接口清单（按模块 + 消费方归类，机器可读）。"""
+    manifest = build_manifest(request.app)
+    return {"code": 200, "data": manifest}
+
+
+@router.get("/integration/modules", tags=["对外接口统一清单"])
+async def integration_modules(request: Request) -> Dict[str, Any]:
+    """模块目录（精简：模块/标签/消费方/端点数）。"""
+    manifest = build_manifest(request.app)
+    return {"code": 200, "data": {
+        "module_count": manifest["module_count"],
+        "total_endpoints": manifest["total_endpoints"],
+        "modules": list_modules(manifest),
+    }}
+
+
+@router.get("/integration/consumers", tags=["对外接口统一清单"])
+async def integration_consumers() -> Dict[str, Any]:
+    """消费方列表（存客宝/超管/AI数字员工/通用）。"""
+    return {"code": 200, "data": {
+        "consumers": [
+            {"id": cid, "label": label} for cid, label in CONSUMER_LABELS.items()
+        ]
+    }}
+
+
+@router.get("/integration/consumers/{consumer}", tags=["对外接口统一清单"])
+async def integration_consumer_view(consumer: str, request: Request) -> Dict[str, Any]:
+    """
+    某消费方可直接调用的接口子集。
+
+    consumer ∈ {cunkebao, superadmin, ai_employee, common}
+    """
+    if consumer not in CONSUMER_LABELS:
+        raise HTTPException(
+            status_code=404,
+            detail=f"未知消费方: {consumer}，可选: {list(CONSUMER_LABELS.keys())}",
+        )
+    manifest = build_manifest(request.app)
+    return {"code": 200, "data": filter_by_consumer(manifest, consumer)}
+
+
+@router.get("/integration/capability/{device_id}", tags=["对外接口统一清单"])
+async def integration_capability(
+    device_id: str,
+    request: Request,
+    consumer: str = "",
+    probe: bool = False,
+) -> Dict[str, Any]:
+    """
+    某设备的实时能力矩阵：各模块此刻是否可直接调用（ready/degraded/offline）。
+
+    - consumer: 可选，仅看某消费方（cunkebao/superadmin/ai_employee/common）的模块
+    - probe=true: 触发一次轻量 Frida 探测刷新 supports_hook（仅 ping/version/profile，
+      不做全量 174 探针，避免 Frida 瞬断）；默认读最近一次探测缓存。
+    """
+    if consumer and consumer not in CONSUMER_LABELS:
+        raise HTTPException(
+            status_code=404,
+            detail=f"未知消费方: {consumer}，可选: {list(CONSUMER_LABELS.keys())}",
+        )
+
+    # 1) 设备在线
+    online = False
+    try:
+        from services.ws_hub import ws_hub
+        online = ws_hub.is_online(device_id)
+    except Exception:  # noqa: BLE001
+        online = False
+
+    # 2) supports_hook：默认读最近探测缓存；probe=true 时轻量刷新
+    supports_hook = False
+    if online and probe:
+        try:
+            from routers.unified import hook_probe  # 复用安全的轻量探测
+            pr = await hook_probe(device_id)
+            supports_hook = bool(pr.get("supports_hook"))
+        except Exception:  # noqa: BLE001
+            supports_hook = False
+    else:
+        try:
+            from services.hook_module_service import hook_module_service
+            dev = await hook_module_service.get_device_modules(device_id)
+            if isinstance(dev, dict):
+                supports_hook = bool(dev.get("supports_hook"))
+        except Exception:  # noqa: BLE001
+            supports_hook = False
+        # 退化补充：用 ws_hub 上报的 frida_available
+        if not supports_hook:
+            try:
+                from services.ws_hub import ws_hub
+                info = ws_hub.get_device_info(device_id) or {}
+                supports_hook = bool(info.get("frida_available"))
+            except Exception:  # noqa: BLE001
+                pass
+
+    manifest = build_manifest(request.app)
+    cap = build_capability(
+        manifest, device_id, online, supports_hook,
+        consumer=consumer or None,
+    )
+    cap["probed"] = bool(probe and online)
+    return {"code": 200, "data": cap}
+
+
+@router.get("/integration/health", tags=["对外接口统一清单"])
+async def integration_health(request: Request) -> Dict[str, Any]:
+    """
+    关键集成点健康聚合：
+      - websocket 主控（在线设备数）
+      - 连接方案（当前生效 provider）
+      - 存客宝对接（是否已配置启用）
+      - AI 网关（可用协议）
+    供超管/存客宝一眼看清「能不能直接对接」。
+    """
+    health: Dict[str, Any] = {"ok": True, "checks": {}}
+
+    # 1) WebSocket 主控
+    try:
+        from services.ws_hub import ws_hub
+        online = list(ws_hub.connections.keys())
+        health["checks"]["websocket"] = {
+            "ok": True,
+            "online_devices": len(online),
+            "device_ids": online,
+        }
+    except Exception as e:  # noqa: BLE001
+        health["checks"]["websocket"] = {"ok": False, "error": str(e)}
+        health["ok"] = False
+
+    # 2) 连接方案（可切换驱动）
+    try:
+        from services.connection_provider import connection_provider_manager as mgr
+        active = mgr.active_config()
+        health["checks"]["connection_provider"] = {
+            "ok": True,
+            "active": active,
+            "providers": [p.get("id") for p in mgr.list_providers()],
+        }
+    except Exception as e:  # noqa: BLE001
+        health["checks"]["connection_provider"] = {"ok": False, "error": str(e)}
+
+    # 3) 存客宝对接配置
+    try:
+        from services.cunke_bao_service import cunke_bao_service
+        cfg = cunke_bao_service.config
+        health["checks"]["cunkebao"] = {
+            "ok": True,
+            "enabled": bool(getattr(cfg, "enabled", False)),
+            "api_key_set": bool(getattr(cfg, "api_key", "")),
+            "base_url": getattr(cfg, "base_url", ""),
+        }
+    except Exception as e:  # noqa: BLE001
+        health["checks"]["cunkebao"] = {"ok": False, "error": str(e)}
+
+    # 4) AI 网关协议
+    health["checks"]["ai_gateway"] = {
+        "ok": True,
+        "protocols": {
+            "openai_compatible": "/api/v3/gateway/v1/chat/completions",
+            "mcp_tools": "/api/v3/gateway/mcp/tools",
+            "mcp_call": "/api/v3/gateway/mcp/call",
+            "agent_execute": "/api/v3/agent/execute",
+        },
+    }
+
+    return {"code": 200, "data": health}
+
+
+@router.get("/integration/realtime/status", tags=["对外接口统一清单"])
+async def integration_realtime_status(
+    request: Request,
+    consumer: str = "",
+    event_limit: int = 20,
+) -> Dict[str, Any]:
+    """
+    第三方对接实时状态入口。
+
+    面向存客宝/纯客宝/超管/AI 数字员工：一次返回在线设备、最近 WS/Hook/Agent 事件、
+    实时 WebSocket 订阅地址和推荐拉取接口。
+    """
+    if consumer and consumer not in CONSUMER_LABELS:
+        raise HTTPException(
+            status_code=404,
+            detail=f"未知消费方: {consumer}，可选: {list(CONSUMER_LABELS.keys())}",
+        )
+
+    try:
+        from services.device_fleet import list_merged_local_devices
+        from services.ws_hub import ws_hub
+        from services.hook_module_service import hook_module_service
+
+        devices = await list_merged_local_devices()
+        normalized = []
+        for item in devices:
+            did = item.get("device_id", "")
+            normalized.append({
+                "device_id": did,
+                "device_id_md5": item.get("device_id_md5"),
+                "project_id": item.get("project_id"),
+                "model": item.get("model"),
+                "status": "online" if ws_hub.is_online(did) else item.get("status", "offline"),
+                "online": ws_hub.is_online(did),
+                "capabilities": item.get("capabilities") or [],
+                "frida": item.get("frida") or {},
+                "ai_brain": item.get("ai_brain") or {},
+                "wechat_version": (item.get("device_profile") or {}).get("wechat_version"),
+                "last_heartbeat": item.get("last_heartbeat"),
+            })
+        recent_events = await hook_module_service.list_events(
+            limit=max(1, min(int(event_limit or 20), 100)),
+        )
+    except Exception as exc:  # noqa: BLE001
+        raise HTTPException(status_code=500, detail=str(exc)) from exc
+
+    base_url = str(request.base_url).rstrip("/")
+    return {
+        "code": 200,
+        "data": {
+            "consumer": consumer or "common",
+            "online_count": sum(1 for item in normalized if item.get("online")),
+            "total_count": len(normalized),
+            "devices": normalized,
+            "recent_events": recent_events,
+            "pull_endpoints": {
+                "status": "/api/v3/integration/realtime/status",
+                "events": "/api/v3/integration/realtime/events",
+                "fleet_devices": "/api/v3/fleet/devices",
+                "fleet_execute": "/api/v3/fleet/execute",
+            },
+            "stream": {
+                "protocol": "websocket",
+                "url": f"{base_url}/api/v3/hook/events/stream",
+                "event_source": "真实 Agent WS / Frida Hook / AI Agent 事件总线",
+            },
+        },
+    }
+
+
+@router.get("/integration/realtime/events", tags=["对外接口统一清单"])
+async def integration_realtime_events(
+    event_type: str = "",
+    device_id: str = "",
+    platform: str = "",
+    limit: int = 100,
+) -> Dict[str, Any]:
+    """第三方对接实时事件列表：读取真实 Agent/Hook 事件总线。"""
+    try:
+        from services.hook_module_service import hook_module_service
+
+        events = await hook_module_service.list_events(
+            event_type=event_type or None,
+            device_id=device_id or None,
+            platform=platform or None,
+            limit=max(1, min(int(limit or 100), 500)),
+        )
+        return {"code": 200, "data": {"total": len(events), "events": events}}
+    except Exception as exc:  # noqa: BLE001
+        raise HTTPException(status_code=500, detail=str(exc)) from exc
diff --git a/sdk/app/routers/process.py b/sdk/app/routers/process.py
new file mode 100644
index 0000000000..9b823df8b7
--- /dev/null
+++ b/sdk/app/routers/process.py
@@ -0,0 +1,24 @@
+"""
+SDK 进程状态路由
+
+路由前缀：/api/v3/process
+
+供 connection_keeper、部署探针、控制台轮询「进程是否正常」。
+只读、零副作用；state=normal 即为期望的正常态。
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict
+
+from fastapi import APIRouter
+
+from services.process_state import get_process_status
+
+router = APIRouter()
+
+
+@router.get("/process/status", tags=["进程状态"])
+async def process_status() -> Dict[str, Any]:
+    """SDK 主进程正常态快照（pid / uptime / WS 在线数 / keeper 守护进程）。"""
+    return {"code": 200, "data": get_process_status()}
diff --git a/sdk/app/routers/qrcode.py b/sdk/app/routers/qrcode.py
index 8beb1b400f..17fcb0a20a 100644
--- a/sdk/app/routers/qrcode.py
+++ b/sdk/app/routers/qrcode.py
@@ -8,6 +8,7 @@ NAS armv7 等环境无 Pillow 编译链时，自动降级为 qrcode + pypng（
 from fastapi import APIRouter, Response
 from pydantic import BaseModel
 from typing import Optional, Type
+import os
 import json
 import base64
 import io
@@ -49,24 +50,26 @@ class ProjectBindConfig(BaseModel):
     """项目绑定配置"""
     project_id: str
     project_name: Optional[str] = ""
-    server: Optional[str] = "ws://sdk.quwanzhi.com:8899/ws/device"
+    server: Optional[str] = "wss://wpsdk.quwanzhi.com/ws/device"
     pwa: Optional[str] = ""
     ai_api_key: Optional[str] = ""
     ai_api_url: Optional[str] = "https://ckbapi.quwanzhi.com"
     # BIND-03/05：公网主服有序回退列表（逗号分隔）+ 开机自动寻服
     public_servers: Optional[str] = ""
     auto_discover: Optional[bool] = False
+    pairing_token: Optional[str] = ""
 
 
 def _build_qr_content(
     project_id: str,
     project_name: str = "",
-    server: str = "ws://sdk.quwanzhi.com:8899/ws/device",
+    server: str = "wss://wpsdk.quwanzhi.com/ws/device",
     pwa: str = "",
     ai_api_key: str = "",
     ai_api_url: str = "",
     public_servers: str = "",
     auto_discover: bool = False,
+    pairing_token: str = "",
 ) -> str:
     qr_data = {"server": server, "project": project_id, "project_name": project_name}
     if pwa:
@@ -79,6 +82,9 @@ def _build_qr_content(
         qr_data["public_servers"] = public_servers
     if auto_discover:
         qr_data["auto_discover"] = "1"
+    token = pairing_token or os.environ.get("DEVICE_PAIRING_TOKEN", "")
+    if token:
+        qr_data["pairing_token"] = token
     return json.dumps(qr_data, ensure_ascii=False)
 
 
@@ -128,6 +134,7 @@ async def generate_qrcode(config: ProjectBindConfig):
         config.ai_api_url or "",
         config.public_servers or "",
         bool(config.auto_discover),
+        config.pairing_token or "",
     )
     png_bytes = _render_qr_png_bytes(qr_content)
     img_base64 = base64.b64encode(png_bytes).decode()
@@ -146,7 +153,7 @@ async def generate_qrcode(config: ProjectBindConfig):
 async def get_qrcode_image(
     project_id: str,
     project_name: str = "",
-    server: str = "ws://sdk.quwanzhi.com:8899/ws/device",
+    server: str = "wss://wpsdk.quwanzhi.com/ws/device",
     pwa: str = "",
 ):
     """直接获取二维码 PNG 图片"""
@@ -168,7 +175,7 @@ async def get_qrcode_image(
 async def get_qrcode_html(
     project_id: str,
     project_name: str = "",
-    server: str = "ws://sdk.quwanzhi.com:8899/ws/device",
+    server: str = "wss://wpsdk.quwanzhi.com/ws/device",
     pwa: str = "",
 ):
     """获取带样式的二维码 HTML 页面"""
diff --git a/sdk/app/services/ai_agent.py b/sdk/app/services/ai_agent.py
index 557c7bc4c9..05130bc3ea 100644
--- a/sdk/app/services/ai_agent.py
+++ b/sdk/app/services/ai_agent.py
@@ -38,7 +38,7 @@ class AIAgent:
     def __init__(self):
         # v0 API配置
         self.api_url = os.getenv("AI_API_URL", "https://api.v0.dev/v1")
-        self.api_key = os.getenv("AI_API_KEY", "v1:C6mw1SlvXsJdlO4VFEXSQEVf:519gA0DPqIMbjvfMh7CXf4B2")
+        self.api_key = os.getenv("AI_API_KEY", "")
         self.model = os.getenv("AI_MODEL", "claude-opus")
         
         # 系统提示词
diff --git a/sdk/app/services/brain_skill_registry.py b/sdk/app/services/brain_skill_registry.py
new file mode 100644
index 0000000000..76ac50a400
--- /dev/null
+++ b/sdk/app/services/brain_skill_registry.py
@@ -0,0 +1,203 @@
+"""
+中台 AI Brain · Skill 注册表唯一真源
+
+服务端 GET /api/v3/ai/brain/skill-registry 与存客宝 BFF 均以此为准。
+设备端 Agent _execute_skill(script, action) 须能 getattr(skill, action)。
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List
+
+# script → {name, icon, package, modules: {模块名: [action, ...]}}
+SKILL_REGISTRY: Dict[str, Dict[str, Any]] = {
+    "wechat": {
+        "name": "微信",
+        "icon": "💬",
+        "package": "com.tencent.mm",
+        "modules": {
+            "消息": [
+                "send_message", "get_messages", "forward_message", "recall_message",
+                "send_card", "batch_send_message", "send_voice_message", "mass_send",
+            ],
+            "好友": [
+                "add_friend", "accept_friend", "set_remark", "delete_friend",
+                "get_contacts", "search_contact", "get_friend_info", "batch_add_friend",
+            ],
+            "群聊": [
+                "create_group", "invite_to_group", "remove_from_group", "set_group_notice",
+                "set_group_name", "send_group_message", "set_group_welcome",
+                "get_groups", "get_group_members", "quit_group",
+            ],
+            "标签": [
+                "add_tag", "remove_tag", "create_tag", "delete_tag",
+                "get_tags", "get_users_by_tag",
+            ],
+            "朋友圈": [
+                "post_moments", "like_moments", "comment_moments", "get_moments",
+                "delete_moments", "set_moments_cover", "set_moments_privacy", "forward_moments_link",
+            ],
+            "个人资料": [
+                "get_profile", "set_nickname", "set_signature", "set_avatar",
+                "set_gender", "set_region",
+            ],
+            "账号安全": [
+                "check_account_status", "unblock_account", "safety_center", "change_password",
+                "unblock_self", "unblock_appeal", "check_restrictions", "appeal_restriction",
+                "unblock_with_sms", "unblock_via_customer_service", "check_login_state",
+            ],
+            "支付": [
+                "send_red_packet", "transfer", "show_payment_code", "receive_payment",
+                "view_wallet", "view_transactions", "receive_red_packet",
+            ],
+            "会话管理": ["set_chat_top", "set_mute_chat", "clear_chat_history"],
+            "收藏": ["add_to_favorites", "get_favorites"],
+            "小程序": ["open_mini_program"],
+            "公众号": ["follow_official_account"],
+            "视频号": [
+                "open_video_channel", "get_video_list", "like_video", "comment_video",
+                "follow_video_creator", "share_video",
+            ],
+            "扫一扫": ["scan_qr_code", "scan_add_friend", "show_my_qr", "extract_qr_from_image"],
+            "通话": ["voice_call", "video_call"],
+            "搜索发现": ["wechat_search", "top_stories"],
+            "微信运动": ["get_steps", "like_steps"],
+            "位置表情文件": [
+                "send_location", "share_real_time_location", "send_emoji", "get_sticker_list",
+                "send_file_from_chat", "download_file",
+            ],
+            "设置": ["toggle_do_not_disturb", "clear_cache", "check_for_update", "logout", "switch_account"],
+        },
+    },
+    "douyin": {
+        "name": "抖音",
+        "icon": "🎵",
+        "package": "com.ss.android.ugc.aweme",
+        "modules": {
+            "消息": ["send_message", "get_messages", "batch_send_message"],
+            "粉丝互动": [
+                "get_fans", "follow_user", "unfollow_user", "search_user",
+                "get_comments", "reply_comment", "like_video", "collect_video", "share_video",
+            ],
+            "联系人": [
+                "get_contacts", "add_friend", "accept_friend", "set_remark",
+                "delete_friend", "batch_add_friend",
+            ],
+        },
+    },
+    "xhs": {
+        "name": "小红书",
+        "icon": "📕",
+        "package": "com.xingin.xhs",
+        "modules": {
+            "消息": ["send_message", "get_messages", "batch_send_message"],
+            "笔记互动": [
+                "get_fans", "follow_user", "unfollow_user", "search_user",
+                "get_comments", "reply_comment", "like_note", "collect_note",
+                "share_note", "search_note", "post_note",
+            ],
+            "联系人": [
+                "get_contacts", "add_friend", "accept_friend", "set_remark",
+                "delete_friend", "batch_add_friend",
+            ],
+        },
+    },
+    "xianyu": {
+        "name": "闲鱼",
+        "icon": "🐟",
+        "package": "com.taobao.idlefish",
+        "modules": {
+            "消息": ["send_message", "get_messages", "batch_send_message"],
+            "联系人": [
+                "get_contacts", "add_friend", "accept_friend", "set_remark",
+                "delete_friend", "batch_add_friend", "follow_user", "unfollow_user",
+            ],
+        },
+    },
+    "soul": {
+        "name": "Soul",
+        "icon": "👻",
+        "package": "cn.soulapp.android",
+        "modules": {
+            "消息": ["send_message", "get_messages"],
+            "动态": ["post_moments"],
+        },
+    },
+    "system": {
+        "name": "系统控制",
+        "icon": "⚙️",
+        "package": "",
+        "modules": {
+            "设备操作": [
+                "screenshot", "click", "click_text", "input", "swipe",
+                "press_key", "ui_tree", "device_info", "status",
+            ],
+            "应用管理": ["app_start", "app_stop", "current_app", "installed_apps"],
+            "网络": ["reconnect_network"],
+            "守护": ["dismiss_popups", "connection_guard"],
+        },
+    },
+    "hook": {
+        "name": "Hook 引擎",
+        "icon": "🪝",
+        "package": "",
+        "modules": {
+            "Frida 消息": ["hook_send_message", "hook_get_messages", "hook_recall_message"],
+            "Frida 联系人": ["hook_get_contacts", "hook_get_contact_info", "hook_search_contact"],
+            "Frida 群聊": ["hook_get_groups", "hook_get_group_members", "hook_create_group", "hook_invite_to_group"],
+            "Frida 朋友圈": ["hook_get_moments", "hook_post_moment", "hook_like_moment"],
+            "Frida 标签": ["hook_get_labels", "hook_add_label", "hook_remove_label"],
+            "Frida 支付": ["hook_get_transfers", "hook_get_red_packets"],
+            "Frida 设备": ["hook_get_device_info", "hook_get_wechat_version"],
+            "Frida 数据库": ["hook_query_db", "hook_get_db_tables"],
+        },
+    },
+    "ai_brain": {
+        "name": "AI Brain",
+        "icon": "🧠",
+        "package": "",
+        "modules": {
+            "决策引擎": ["think", "heartbeat_cycle", "autonomous_loop"],
+            "任务管理": ["add_task", "add_standing_order", "flush_offline_buffer"],
+            "API调用": ["call_ai", "get_status"],
+        },
+    },
+    "anti_ban": {
+        "name": "防封引擎",
+        "icon": "🛡️",
+        "package": "",
+        "modules": {
+            "拟人化": ["human_delay", "human_type", "human_click", "human_swipe", "human_browse"],
+            "设备守卫": ["device_guard_check", "root_hide_check", "frida_detect_check"],
+            "风控哨兵": ["risk_check", "rate_limit", "content_filter"],
+            "养号调度": ["nurture_plan", "nurture_execute"],
+            "传感器": ["sensor_simulate", "touch_harden"],
+        },
+    },
+}
+
+# 设备端 Agent 可执行的 script（须存在 get_skill(script)）
+DEVICE_EXECUTABLE_SCRIPTS = frozenset({"wechat", "douyin", "xhs", "xianyu", "soul"})
+
+
+def flatten_actions(script: str) -> List[str]:
+    """返回某 script 下全部 action 列表"""
+    entry = SKILL_REGISTRY.get(script, {})
+    modules = entry.get("modules") or {}
+    out: List[str] = []
+    for actions in modules.values():
+        out.extend(actions)
+    return out
+
+
+def registry_summary() -> Dict[str, int]:
+    total_skills = len(SKILL_REGISTRY)
+    total_modules = sum(len(s.get("modules", {})) for s in SKILL_REGISTRY.values())
+    total_actions = sum(len(a) for s in SKILL_REGISTRY.values() for a in s.get("modules", {}).values())
+    platform_actions = sum(len(flatten_actions(s)) for s in DEVICE_EXECUTABLE_SCRIPTS if s in SKILL_REGISTRY)
+    return {
+        "total_skills": total_skills,
+        "total_modules": total_modules,
+        "total_actions": total_actions,
+        "platform_actions": platform_actions,
+    }
diff --git a/sdk/app/services/connection_provider.py b/sdk/app/services/connection_provider.py
new file mode 100644
index 0000000000..0bb4601b26
--- /dev/null
+++ b/sdk/app/services/connection_provider.py
@@ -0,0 +1,498 @@
+"""
+设备连接方案 · 可切换驱动层（Connection Provider Manager）
+
+产品真源（卡若 2026-05-29）：
+  存客宝四端（存客宝/触客宝/AI数智员工/SuperAdmin）的「所有设备连接」需要一个
+  **可切换的多方案开关**——同一套业务接口（/api/v3/* · BFF /v1/workphone/*）背后，
+  可在以下「设备连接解决方案」之间一键切换，且都能直接使用：
+
+    1. jiqing   机擎工作手机（本 SDK 原生：WebSocket Agent + 设备本机 Frida，device_transport）—— 默认
+    2. aochuang 奥创工作手机（007 私域管理 HTTP API · 007.siyuguanli.com）
+    3. legacy   现有连接形式（S2 / 旧接口 / 自建工作手机，配置式 HTTP 驱动）
+    4. custom_* 预留接口（配置式 HTTP 驱动模板，新增方案无需改代码即可接入）
+
+设计要点：
+  - 统一 Provider 抽象 `BaseConnectionProvider`：list_devices / send_message / get_contacts / execute / health。
+  - `ConnectionProviderManager`：注册表 + 三级开关（全局 / 按项目 / 按设备）+ 持久化。
+  - 切换不影响既有 339 路由：jiqing 直接复用 device_transport（不绕过无线主控铁律）。
+  - http 驱动用「端点映射 + 字段映射」描述任意第三方工作手机 API，确保「预留其他方案」可落地。
+
+真源文档：开发文档/1、需求/修改/工作手机_设备Agent与基础设施_20260529.md §3.6 连接方案可切换驱动层
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import threading
+import time
+from abc import ABC, abstractmethod
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+logger = logging.getLogger(__name__)
+
+# 持久化配置路径（与 hook/device_modules.json 同级 data 目录）
+_DATA_DIR = Path(__file__).resolve().parents[1] / "data"
+_CONFIG_PATH = _DATA_DIR / "connection_providers.json"
+
+# 切换作用域
+SCOPE_GLOBAL = "global"
+SCOPE_PROJECT = "project"
+SCOPE_DEVICE = "device"
+
+# 规范化动作（canonical action）——所有 Provider 须能映射这些动作
+CANONICAL_ACTIONS = (
+    "list_devices",
+    "send_message",
+    "batch_send_message",
+    "get_contacts",
+    "get_messages",
+    "add_friend",
+    "post_moments",
+    "execute",  # 通用 {script, action, params}
+)
+
+
+def _env(name: str, default: str = "") -> str:
+    return os.environ.get(name, default) or default
+
+
+# =============================================================================
+# Provider 抽象
+# =============================================================================
+
+class BaseConnectionProvider(ABC):
+    """单个「设备连接方案/解决方案」的统一抽象。"""
+
+    kind: str = "base"
+
+    def __init__(self, config: Dict[str, Any]):
+        self.id: str = config.get("id", "")
+        self.name: str = config.get("name", self.id)
+        self.enabled: bool = bool(config.get("enabled", True))
+        self.builtin: bool = bool(config.get("builtin", False))
+        self.config: Dict[str, Any] = config
+
+    # --- 元信息 ---
+    def meta(self) -> Dict[str, Any]:
+        return {
+            "id": self.id,
+            "name": self.name,
+            "kind": self.kind,
+            "enabled": self.enabled,
+            "builtin": self.builtin,
+            "capabilities": self.capabilities(),
+            "desc": self.config.get("desc", ""),
+        }
+
+    def capabilities(self) -> List[str]:
+        return list(CANONICAL_ACTIONS)
+
+    # --- 健康检查 ---
+    @abstractmethod
+    async def health(self) -> Dict[str, Any]:
+        ...
+
+    # --- 业务执行（统一入口）---
+    @abstractmethod
+    async def execute(self, device_id: str, script: str, action: str, params: Dict[str, Any],
+                      *, timeout: int = 120) -> Dict[str, Any]:
+        ...
+
+    async def list_devices(self) -> Dict[str, Any]:
+        return await self.execute("", "system", "list_devices", {})
+
+    async def send_message(self, device_id: str, platform: str, to_id: str, content: str,
+                           *, msg_type: str = "text", **kw) -> Dict[str, Any]:
+        params = {"to_id": to_id, "content": content, "msg_type": msg_type, **kw}
+        return await self.execute(device_id, platform, "send_message", params)
+
+
+# =============================================================================
+# 1. 机擎原生 Provider（默认） — 复用 device_transport（无线主控铁律）
+# =============================================================================
+
+class JiqingNativeProvider(BaseConnectionProvider):
+    """机擎工作手机：本 SDK 原生通道（WebSocket Agent + 设备本机 Frida）。"""
+
+    kind = "native"
+
+    async def health(self) -> Dict[str, Any]:
+        try:
+            from services.ws_hub import ws_hub
+            return {
+                "provider": self.id,
+                "ok": True,
+                "ws_online": len(ws_hub.connections),
+                "online_device_ids": list(ws_hub.connections.keys()),
+            }
+        except Exception as e:  # pragma: no cover
+            return {"provider": self.id, "ok": False, "error": str(e)}
+
+    async def list_devices(self) -> Dict[str, Any]:
+        from services.ws_hub import ws_hub
+        devices = ws_hub.get_online_devices()
+        return {"code": 200, "success": True, "provider": self.id,
+                "data": devices, "count": len(devices)}
+
+    async def execute(self, device_id: str, script: str, action: str, params: Dict[str, Any],
+                      *, timeout: int = 120) -> Dict[str, Any]:
+        if action == "list_devices":
+            return await self.list_devices()
+        from services.device_transport import device_transport
+        hook_only = device_transport.should_force_hook_only(script, action, bool(params.get("hook_only")))
+        result = await device_transport.execute_via_ws(
+            device_id, script, action, params, timeout=timeout, hook_only=hook_only,
+        )
+        result.setdefault("provider", self.id)
+        return result
+
+
+# =============================================================================
+# 2/3/4. 配置式 HTTP Provider（奥创 / 现有连接 / 自定义预留）
+# =============================================================================
+
+class HttpConnectionProvider(BaseConnectionProvider):
+    """
+    配置式 HTTP 工作手机驱动——通过「端点映射 + 字段映射」对接任意第三方工作手机 API。
+
+    config 示例（奥创 007 私域）：
+    {
+      "id": "aochuang", "name": "奥创工作手机(007私域)", "kind": "http", "enabled": false,
+      "base_url": "https://007.siyuguanli.com/api",
+      "auth": {"type": "bearer", "token": "", "token_env": "AOCHUANG_TOKEN", "header": "Authorization"},
+      "endpoints": {
+        "list_devices": {"method": "GET", "path": "/devices", "data_path": "data"},
+        "send_message": {"method": "POST", "path": "/message/send",
+                          "body_map": {"device_id": "deviceId", "to_id": "wxid", "content": "content"}},
+        "get_contacts": {"method": "GET", "path": "/wechat/contacts", "query_map": {"device_id": "deviceId"}}
+      }
+    }
+    """
+
+    kind = "http"
+
+    def base_url(self) -> str:
+        return (self.config.get("base_url") or _env(self.config.get("base_url_env", ""))).rstrip("/")
+
+    def _auth_headers(self) -> Dict[str, str]:
+        auth = self.config.get("auth") or {}
+        token = auth.get("token") or _env(auth.get("token_env", ""))
+        if not token:
+            return {}
+        header = auth.get("header", "Authorization")
+        atype = (auth.get("type") or "bearer").lower()
+        if atype == "bearer":
+            return {header: f"Bearer {token}"}
+        if atype == "apikey":
+            return {header: token}
+        return {header: token}
+
+    def capabilities(self) -> List[str]:
+        eps = self.config.get("endpoints") or {}
+        caps = [a for a in CANONICAL_ACTIONS if a in eps]
+        return caps or ["execute"]
+
+    def _endpoint(self, action: str) -> Optional[Dict[str, Any]]:
+        return (self.config.get("endpoints") or {}).get(action)
+
+    @staticmethod
+    def _apply_map(src: Dict[str, Any], mapping: Optional[Dict[str, str]]) -> Dict[str, Any]:
+        if not mapping:
+            return dict(src)
+        out: Dict[str, Any] = {}
+        for canon, target in mapping.items():
+            if canon in src and src[canon] is not None:
+                out[target] = src[canon]
+        # 透传未在映射表中的字段（保守：保留原键）
+        for k, v in src.items():
+            if k not in mapping and k not in out and v is not None:
+                out[k] = v
+        return out
+
+    async def _request(self, method: str, path: str, *, query: Optional[Dict] = None,
+                       body: Optional[Dict] = None, timeout: int = 60) -> Dict[str, Any]:
+        base = self.base_url()
+        if not base:
+            return {"code": 503, "success": False, "provider": self.id,
+                    "message": f"连接方案 {self.id} 未配置 base_url（请先配置/启用）"}
+        url = base + path
+        headers = {"Content-Type": "application/json", **self._auth_headers()}
+        try:
+            import httpx  # type: ignore
+            async with httpx.AsyncClient(timeout=timeout) as client:
+                resp = await client.request(method.upper(), url, params=query, json=body, headers=headers)
+                try:
+                    data = resp.json()
+                except Exception:
+                    data = {"raw": resp.text}
+                ok = 200 <= resp.status_code < 300
+                return {"code": resp.status_code, "success": ok, "provider": self.id, "data": data,
+                        "_channel_used": f"http/{self.id}"}
+        except ImportError:
+            # 无 httpx 时退回标准库（同步，放线程池）
+            import asyncio
+            return await asyncio.get_running_loop().run_in_executor(
+                None, lambda: self._request_urllib(method, url, headers, query, body, timeout))
+        except Exception as e:
+            return {"code": 502, "success": False, "provider": self.id,
+                    "message": f"连接方案 {self.id} 请求失败: {e}", "_channel_used": f"http/{self.id}"}
+
+    def _request_urllib(self, method: str, url: str, headers: Dict[str, str],
+                        query: Optional[Dict], body: Optional[Dict], timeout: int) -> Dict[str, Any]:
+        import urllib.parse
+        import urllib.request
+        try:
+            if query:
+                url = f"{url}?{urllib.parse.urlencode(query)}"
+            data = json.dumps(body).encode("utf-8") if body is not None else None
+            req = urllib.request.Request(url, data=data, headers=headers, method=method.upper())
+            with urllib.request.urlopen(req, timeout=timeout) as resp:
+                raw = resp.read().decode("utf-8")
+                try:
+                    parsed = json.loads(raw)
+                except Exception:
+                    parsed = {"raw": raw}
+                return {"code": resp.status, "success": 200 <= resp.status < 300,
+                        "provider": self.id, "data": parsed, "_channel_used": f"http/{self.id}"}
+        except Exception as e:
+            return {"code": 502, "success": False, "provider": self.id,
+                    "message": f"连接方案 {self.id} 请求失败: {e}", "_channel_used": f"http/{self.id}"}
+
+    async def health(self) -> Dict[str, Any]:
+        base = self.base_url()
+        if not base:
+            return {"provider": self.id, "ok": False, "error": "未配置 base_url"}
+        hc = self.config.get("health") or {}
+        method = hc.get("method", "GET")
+        path = hc.get("path", "/health")
+        res = await self._request(method, path, timeout=10)
+        return {"provider": self.id, "ok": bool(res.get("success")), "detail": res}
+
+    async def execute(self, device_id: str, script: str, action: str, params: Dict[str, Any],
+                      *, timeout: int = 120) -> Dict[str, Any]:
+        ep = self._endpoint(action)
+        if not ep:
+            return {"code": 501, "success": False, "provider": self.id,
+                    "message": f"连接方案 {self.id} 未定义动作映射: {action}（可在 provider.endpoints 中配置）"}
+        method = ep.get("method", "POST")
+        path = ep.get("path", "/")
+        src = {"device_id": device_id, "platform": script, **(params or {})}
+        query = None
+        body = None
+        if method.upper() == "GET":
+            query = self._apply_map(src, ep.get("query_map"))
+        else:
+            body = self._apply_map(src, ep.get("body_map"))
+        res = await self._request(method, path, query=query, body=body, timeout=timeout)
+        # 可选 data_path 提取
+        data_path = ep.get("data_path")
+        if data_path and isinstance(res.get("data"), dict):
+            res["data"] = res["data"].get(data_path, res["data"])
+        return res
+
+
+# =============================================================================
+# 管理器
+# =============================================================================
+
+class ConnectionProviderManager:
+    """连接方案注册表 + 三级开关 + 持久化。"""
+
+    def __init__(self):
+        self._lock = threading.RLock()
+        self._providers: Dict[str, BaseConnectionProvider] = {}
+        self._active: Dict[str, Any] = {"global": "jiqing", "projects": {}, "devices": {}}
+        self._loaded = False
+
+    # ---- 默认配置 ----
+    @staticmethod
+    def _default_config() -> Dict[str, Any]:
+        return {
+            "active": {"global": "jiqing", "projects": {}, "devices": {}},
+            "providers": {
+                "jiqing": {
+                    "id": "jiqing", "name": "机擎工作手机（本SDK原生·WS+Frida）",
+                    "kind": "native", "enabled": True, "builtin": True,
+                    "desc": "默认方案：WebSocket Agent + 设备本机 Frida，经 device_transport 无线主控",
+                },
+                "aochuang": {
+                    "id": "aochuang", "name": "奥创工作手机（007私域）",
+                    "kind": "http", "enabled": False, "builtin": True,
+                    "desc": "奥创云脑工作手机 007 私域管理 HTTP API（Hook 注入方案）",
+                    "base_url": "", "base_url_env": "AOCHUANG_BASE_URL",
+                    "auth": {"type": "bearer", "token": "", "token_env": "AOCHUANG_TOKEN",
+                             "header": "Authorization"},
+                    "health": {"method": "GET", "path": "/devices"},
+                    "endpoints": {
+                        "list_devices": {"method": "GET", "path": "/devices", "data_path": "data"},
+                        "send_message": {"method": "POST", "path": "/message/send",
+                                         "body_map": {"device_id": "deviceId", "to_id": "wxid",
+                                                      "content": "content", "msg_type": "msgType"}},
+                        "batch_send_message": {"method": "POST", "path": "/message/batch-send",
+                                               "body_map": {"device_id": "deviceId"}},
+                        "get_contacts": {"method": "GET", "path": "/wechat/contacts",
+                                         "query_map": {"device_id": "deviceId"}, "data_path": "data"},
+                        "add_friend": {"method": "POST", "path": "/friend/add",
+                                       "body_map": {"device_id": "deviceId", "to_id": "keyword"}},
+                        "post_moments": {"method": "POST", "path": "/moments/post",
+                                         "body_map": {"device_id": "deviceId", "content": "content"}},
+                    },
+                },
+                "legacy": {
+                    "id": "legacy", "name": "现有连接形式（S2/旧接口）",
+                    "kind": "http", "enabled": False, "builtin": True,
+                    "desc": "存客宝现有/历史设备连接（自建工作手机或 S2 旧接口），配置式 HTTP 驱动",
+                    "base_url": "", "base_url_env": "LEGACY_PROVIDER_BASE_URL",
+                    "auth": {"type": "apikey", "token": "", "token_env": "LEGACY_PROVIDER_TOKEN",
+                             "header": "X-API-Key"},
+                    "endpoints": {
+                        "send_message": {"method": "POST", "path": "/send"},
+                        "list_devices": {"method": "GET", "path": "/devices"},
+                    },
+                },
+            },
+        }
+
+    def load(self, force: bool = False) -> None:
+        with self._lock:
+            if self._loaded and not force:
+                return
+            cfg = self._default_config()
+            if _CONFIG_PATH.exists():
+                try:
+                    saved = json.loads(_CONFIG_PATH.read_text("utf-8"))
+                    # 合并：保留内置 + 覆盖/追加自定义
+                    if isinstance(saved.get("providers"), dict):
+                        cfg["providers"].update(saved["providers"])
+                    if isinstance(saved.get("active"), dict):
+                        cfg["active"].update(saved["active"])
+                except Exception as e:
+                    logger.warning(f"[connection_provider] 读取配置失败，用默认: {e}")
+            self._active = cfg["active"]
+            self._providers = {}
+            for pid, pconf in cfg["providers"].items():
+                pconf["id"] = pid
+                self._providers[pid] = self._build(pconf)
+            self._loaded = True
+            logger.info(f"[connection_provider] 已加载 {len(self._providers)} 个连接方案，active.global={self._active.get('global')}")
+
+    @staticmethod
+    def _build(pconf: Dict[str, Any]) -> BaseConnectionProvider:
+        kind = (pconf.get("kind") or "http").lower()
+        if kind == "native":
+            return JiqingNativeProvider(pconf)
+        return HttpConnectionProvider(pconf)
+
+    def _save(self) -> None:
+        with self._lock:
+            _DATA_DIR.mkdir(parents=True, exist_ok=True)
+            cfg = {
+                "active": self._active,
+                "providers": {pid: p.config for pid, p in self._providers.items()},
+                "_updated_at": int(time.time()),
+            }
+            _CONFIG_PATH.write_text(json.dumps(cfg, ensure_ascii=False, indent=2), "utf-8")
+
+    # ---- 查询 ----
+    def list_providers(self) -> List[Dict[str, Any]]:
+        self.load()
+        return [p.meta() for p in self._providers.values()]
+
+    def get(self, provider_id: str) -> Optional[BaseConnectionProvider]:
+        self.load()
+        return self._providers.get(provider_id)
+
+    def active_config(self) -> Dict[str, Any]:
+        self.load()
+        return dict(self._active)
+
+    def resolve_active_id(self, device_id: str = "", project_id: str = "") -> str:
+        """优先级：设备级 > 项目级 > 全局。若解析到的方案被禁用，回退 jiqing。"""
+        self.load()
+        chosen = ""
+        if device_id and device_id in self._active.get("devices", {}):
+            chosen = self._active["devices"][device_id]
+        elif project_id and project_id in self._active.get("projects", {}):
+            chosen = self._active["projects"][project_id]
+        else:
+            chosen = self._active.get("global", "jiqing")
+        prov = self._providers.get(chosen)
+        if not prov or not prov.enabled:
+            if chosen != "jiqing":
+                logger.warning(f"[connection_provider] 方案 {chosen} 不可用/未启用，回退 jiqing")
+            return "jiqing"
+        return chosen
+
+    def resolve_active(self, device_id: str = "", project_id: str = "") -> BaseConnectionProvider:
+        return self._providers[self.resolve_active_id(device_id, project_id)]
+
+    # ---- 开关 ----
+    def switch(self, provider_id: str, scope: str = SCOPE_GLOBAL,
+               project_id: str = "", device_id: str = "") -> Dict[str, Any]:
+        self.load()
+        if provider_id not in self._providers:
+            raise ValueError(f"未知连接方案: {provider_id}")
+        if not self._providers[provider_id].enabled:
+            raise ValueError(f"连接方案 {provider_id} 未启用（请先 enable 并配置）")
+        with self._lock:
+            if scope == SCOPE_GLOBAL:
+                self._active["global"] = provider_id
+            elif scope == SCOPE_PROJECT:
+                if not project_id:
+                    raise ValueError("scope=project 需 project_id")
+                self._active.setdefault("projects", {})[project_id] = provider_id
+            elif scope == SCOPE_DEVICE:
+                if not device_id:
+                    raise ValueError("scope=device 需 device_id")
+                self._active.setdefault("devices", {})[device_id] = provider_id
+            else:
+                raise ValueError(f"未知 scope: {scope}")
+            self._save()
+        return {"active": self._active, "switched_to": provider_id, "scope": scope}
+
+    # ---- 注册/更新/删除自定义方案（预留接口）----
+    def register(self, pconf: Dict[str, Any]) -> Dict[str, Any]:
+        self.load()
+        pid = pconf.get("id")
+        if not pid:
+            raise ValueError("缺少 provider id")
+        if pid in self._providers and self._providers[pid].builtin:
+            # 内置方案只允许更新配置（enable/base_url/endpoints），不允许改 kind/builtin
+            # 跳过空字符串，避免清掉内置 name/desc
+            base = self._providers[pid].config
+            base.update({
+                k: v for k, v in pconf.items()
+                if k not in ("kind", "builtin", "id") and not (isinstance(v, str) and v == "")
+            })
+            pconf = base
+        pconf["id"] = pid
+        pconf.setdefault("builtin", False)
+        with self._lock:
+            self._providers[pid] = self._build(pconf)
+            self._save()
+        return self._providers[pid].meta()
+
+    def remove(self, provider_id: str) -> Dict[str, Any]:
+        self.load()
+        prov = self._providers.get(provider_id)
+        if not prov:
+            raise ValueError(f"未知连接方案: {provider_id}")
+        if prov.builtin:
+            raise ValueError("内置连接方案不可删除（可改用 enable=false 禁用）")
+        with self._lock:
+            self._providers.pop(provider_id, None)
+            # 清理引用
+            if self._active.get("global") == provider_id:
+                self._active["global"] = "jiqing"
+            for scope_key in ("projects", "devices"):
+                self._active[scope_key] = {
+                    k: v for k, v in self._active.get(scope_key, {}).items() if v != provider_id
+                }
+            self._save()
+        return {"removed": provider_id, "active": self._active}
+
+
+connection_provider_manager = ConnectionProviderManager()
diff --git a/sdk/app/services/device_fleet.py b/sdk/app/services/device_fleet.py
index d95f4873c6..131a58f15a 100644
--- a/sdk/app/services/device_fleet.py
+++ b/sdk/app/services/device_fleet.py
@@ -9,7 +9,7 @@ import re
 from services.ws_hub import ws_hub
 from services.device_manager import device_manager
 from services.adb_device import adb_manager
-from services.device_id_util import enrich_device_id_fields
+from services.device_id_util import enrich_device_id_fields, sanitize_sensitive_fields
 
 
 async def list_merged_local_devices() -> List[Dict[str, Any]]:
@@ -109,4 +109,4 @@ async def list_merged_local_devices() -> List[Dict[str, Any]]:
                     )
                 )
 
-    return devices
+    return sanitize_sensitive_fields(devices)
diff --git a/sdk/app/services/device_id_util.py b/sdk/app/services/device_id_util.py
index 545dd4bb99..b375d7f945 100644
--- a/sdk/app/services/device_id_util.py
+++ b/sdk/app/services/device_id_util.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import hashlib
+from typing import Any
 
 
 def device_id_md5(device_id: str) -> str:
@@ -17,3 +18,20 @@ def enrich_device_id_fields(device: dict) -> dict:
     if did:
         device["device_id_md5"] = device_id_md5(str(did))
     return device
+
+
+def sanitize_sensitive_fields(value: Any) -> Any:
+    """递归移除设备资料中的配对密钥，并对连接 URL 去除查询参数。"""
+    if isinstance(value, dict):
+        result = {}
+        for key, item in value.items():
+            if key == "pairing_token":
+                continue
+            if key == "server_url" and isinstance(item, str):
+                result[key] = item.split("?", 1)[0]
+            else:
+                result[key] = sanitize_sensitive_fields(item)
+        return result
+    if isinstance(value, list):
+        return [sanitize_sensitive_fields(item) for item in value]
+    return value
diff --git a/sdk/app/services/device_transport.py b/sdk/app/services/device_transport.py
new file mode 100644
index 0000000000..42cb1a6613
--- /dev/null
+++ b/sdk/app/services/device_transport.py
@@ -0,0 +1,266 @@
+"""
+设备统一传输层 — 机擎默认强制规则：WebSocket 无线主控优先。
+
+所有设备控制（hook/execute、message、probe、Skill）须经本模块选路与下发。
+禁止在业务路由中绕过本层直接调用 ADB / 主机 frida-ps / Mac ADB forward Agent。
+
+优先级（WORKPHONE_WS_FIRST=1，默认）：
+  1. WebSocket Agent + 设备本机 Frida（Hook）
+  2. ADB 静默（仅运维兜底或显式 u2 动作）
+  3. scrcpy / AI Agent 编排（依赖底层通道）
+
+真源文档：开发文档/5、接口/02-业务对接/WebSocket无线主控口径.md
+"""
+
+from __future__ import annotations
+
+import logging
+from enum import Enum
+from typing import Any, Dict, Optional
+
+from fastapi import HTTPException
+
+logger = logging.getLogger(__name__)
+
+
+class TransportChannel(str, Enum):
+    WEBSOCKET = "websocket"
+    HOOK = "hook"
+    ADB = "adb"
+    OFFLINE = "offline"
+
+
+# 允许在无 WS 时降级 ADB 的微信动作（客服解封等，见 unified.WECHAT_U2_ONLY_ACTIONS）
+# 登录/退出/注册/切号属纯 UI 流程：Frida RPC 仅广播 intent，设备无接收端时返回
+# no_receiver_registered（真机铁律禁止假成功），必须放行 u2/ADB 真实 UI 兜底，否则功能不可用。
+WECHAT_U2_ONLY_ACTIONS = frozenset({
+    "unblock_via_customer_service",
+    "unblock_account",
+    "unblock_self",
+    "unblock_appeal",
+    "unblock_with_sms",
+    "set_nickname",
+    "set_signature",
+    "set_avatar",
+    "set_sex",
+    "set_region",
+    "set_what_up",
+    "change_password",
+    "bind_phone",
+    "unbind_phone",
+    "get_login_devices",
+    "remove_login_device",
+    "enable_fingerprint",
+    "set_account_protection",
+    "login_by_password",
+    "login_by_sms",
+    "register_account",
+    "auto_register",
+    "logout",
+    "switch_account",
+    "ensure_logged_in",
+    "send_red_packet",
+    "receive_red_packet",
+    "send_transfer",
+    "receive_transfer",
+    "receive_payment",
+    "get_wallet_balance",
+    "get_transaction_history",
+    # UI/展示类素材（Frida 仅 intent 占位，须 u2 真导航+截图）
+    "generate_my_qr_code",
+    "show_my_qr",
+    "generate_group_qr_code",
+    "show_payment_code",
+    "scan_qr_code",
+    "add_friend_by_qr",
+    "voice_call",
+    "video_call",
+    "share_real_time_location",
+    "download_file",
+    "mass_send",
+    "batch_send",
+    "add_favorite",
+    "delete_favorite",
+    "follow_official_account",
+    "unfollow_official_account",
+    "open_mini_program",
+    "get_recent_mini_programs",
+    "share_mini_program",
+    "send_voice",
+    "send_file",
+    "send_location",
+    "send_card",
+    "send_emoji",
+    "add_custom_emoji",
+    "add_to_float",
+    "remove_from_float",
+    "set_privacy",
+    "set_notification",
+    "clear_chat_history",
+    "set_chat_background",
+    "set_do_not_disturb",
+    "pin_chat",
+    "clear_cache",
+    "check_for_update",
+    "delete_moments",
+    "browse_channels",
+    "like_channel_video",
+    "comment_channel_video",
+    "follow_channel",
+    "unfollow_channel",
+    "share_channel_video",
+    # forward_message / forward_multiple / revoke_message 已实现真 Frida RPC
+    # （文本转发复用 _sendMessageInternal / 撤回 DB 资格预检），走 Frida 主通道，不再强制 u2
+    "get_official_account_articles",
+    "reply_comment",
+})
+
+
+class DeviceTransport:
+    """单设备传输策略与 WS 下发封装。"""
+
+    @staticmethod
+    def _settings():
+        from config import settings
+        return settings
+
+    def ws_first_enabled(self) -> bool:
+        return bool(getattr(self._settings(), "WORKPHONE_WS_FIRST", True))
+
+    def ws_hook_only(self, platform: str) -> bool:
+        if platform != "wechat":
+            return self.ws_first_enabled()
+        return bool(getattr(self._settings(), "WECHAT_WS_HOOK_ONLY", True))
+
+    def host_adb_probe_enabled(self) -> bool:
+        return bool(getattr(self._settings(), "WORKPHONE_HOST_ADB_PROBE", False))
+
+    def is_ws_online(self, device_id: str) -> bool:
+        from services.ws_hub import ws_hub
+        return ws_hub.is_online(device_id)
+
+    def resolve_mode(self, device_id: str, platform: str = "wechat", action: str = "") -> str:
+        """
+        解析当前设备应使用的传输模式。
+        无线主控：WS 在线 → websocket；否则 offline（u2 专属动作除外）。
+        """
+        if self.is_ws_online(device_id):
+            return TransportChannel.WEBSOCKET.value
+
+        if self.ws_first_enabled():
+            if platform == "wechat" and action in WECHAT_U2_ONLY_ACTIONS:
+                from services.adb_device import adb_manager
+                dev = adb_manager.get_device(device_id)
+                if dev and dev.is_online():
+                    return TransportChannel.ADB.value
+            return TransportChannel.OFFLINE.value
+
+        from services.adb_device import adb_manager
+        adb_dev = adb_manager.get_device(device_id)
+        if adb_dev and adb_dev.is_online():
+            return TransportChannel.ADB.value
+
+        from services.connection_priority import connection_priority
+        ch = connection_priority.choose_execution_channel(device_id)
+        if ch == "agent":
+            return TransportChannel.WEBSOCKET.value
+        if ch and ch != "offline":
+            return ch
+        return TransportChannel.OFFLINE.value
+
+    def check_device_online(self, device_id: str, platform: str = "wechat", action: str = "") -> str:
+        """按策略检查设备是否可执行业务；不可用时抛 HTTPException。"""
+        mode = self.resolve_mode(device_id, platform, action)
+        if mode == TransportChannel.OFFLINE.value:
+            detail = (
+                f"设备 WebSocket 未连接: {device_id}。"
+                "无线主控请在手机 Termux 启动 Agent 连接 ws://<sdk>/ws/device/{device_id}"
+            )
+            if self.ws_first_enabled():
+                raise HTTPException(status_code=503, detail=detail)
+            raise HTTPException(status_code=503, detail=f"设备不在线: {device_id}")
+        return "agent" if mode == TransportChannel.WEBSOCKET.value else mode
+
+    def offline_payload(self, device_id: str, reason: str = "") -> Dict[str, Any]:
+        msg = reason or (
+            "WebSocket Agent 未在线，请启动设备端 Termux Agent "
+            f"连接 ws://<sdk>/ws/device/{device_id}"
+        )
+        return {
+            "code": 503,
+            "success": False,
+            "message": msg,
+            "transport": TransportChannel.WEBSOCKET.value,
+            "_channel_used": "websocket/offline",
+        }
+
+    def policy_meta(self, device_id: str) -> Dict[str, Any]:
+        from services.device_id_util import device_id_md5
+        from services.ws_hub import ws_hub
+
+        info = ws_hub.get_device_info(device_id) or {}
+        return {
+            "device_id": device_id,
+            "device_id_md5": device_id_md5(device_id),
+            "transport": TransportChannel.WEBSOCKET.value if self.is_ws_online(device_id) else TransportChannel.OFFLINE.value,
+            "ws_first": self.ws_first_enabled(),
+            "ws_online": self.is_ws_online(device_id),
+            "frida_available": bool(info.get("frida_available")),
+            "agent_on_device": bool(info.get("on_device") or info.get("WP_AGENT_ON_DEVICE")),
+        }
+
+    async def execute_via_ws(
+        self,
+        device_id: str,
+        platform: str,
+        action: str,
+        params: dict,
+        *,
+        timeout: int = 120,
+        hook_only: bool = False,
+    ) -> Dict[str, Any]:
+        """经 WebSocket 统一下发 execute（唯一推荐业务入口）。"""
+        from services.ws_hub import ws_hub
+
+        # 微信内部动作优先走宝塔侧真实 Frida Session；Android/system/device
+        # 仍走手机 WebSocket，避免同一设备 ID 的两个 Agent 抢占连接。
+        if platform == "wechat":
+            from services.server_frida_bridge import server_frida_bridge
+            if server_frida_bridge.enabled_for(device_id):
+                return await server_frida_bridge.execute(device_id, action, params)
+
+        if not self.is_ws_online(device_id):
+            return self.offline_payload(device_id)
+
+        result = await ws_hub.send_command(
+            device_id,
+            {
+                "type": "execute",
+                "data": {
+                    "script": platform,
+                    "action": action,
+                    "params": params,
+                    "hook_only": hook_only,
+                },
+            },
+            timeout=timeout,
+        )
+        payload = result.get("data") if isinstance(result.get("data"), dict) else {}
+        agent_channel = (
+            result.get("channel")
+            or payload.get("channel")
+            or ("hook" if hook_only and payload.get("success") else "u2")
+        )
+        result["_channel_used"] = f"websocket/{agent_channel}"
+        result.setdefault("transport", TransportChannel.WEBSOCKET.value)
+        return result
+
+    def should_force_hook_only(self, platform: str, action: str, hook_only: bool) -> bool:
+        if hook_only:
+            return True
+        if platform == "wechat" and getattr(self._settings(), "WECHAT_BACKEND_ONLY", True):
+            return action not in WECHAT_U2_ONLY_ACTIONS
+        return False
+
+
+device_transport = DeviceTransport()
diff --git a/sdk/app/services/integration_manifest.py b/sdk/app/services/integration_manifest.py
new file mode 100644
index 0000000000..3306c2a217
--- /dev/null
+++ b/sdk/app/services/integration_manifest.py
@@ -0,0 +1,417 @@
+"""
+对外接口统一清单（Integration Manifest）
+
+目标：把工作手机 SDK 所有 /api/v3/* 对外接口，按「模块 + 消费方」自动归类，
+生成一份机器可读、始终与代码同步的接口总清单，供：
+  - 存客宝（cunkebao）          直接对接业务/线索/Hook 事件接口
+  - 超级管理端（superadmin）    切换连接方案 / 配置开关 / 全局管控
+  - AI 数字员工（ai_employee）  通过 OpenAI / MCP / Agent 网关直接调用控机能力
+  - 通用（common）              设备、健康、发现等基础接口
+
+设计原则（模块化 + 接口化 + 清晰化）：
+  - 清单从 FastAPI app.routes 动态扫描生成 → 不手工维护、不会与代码漂移
+  - 模块归类按「路由前缀规则表 MODULE_RULES」判定
+  - 消费方归类按「模块 → 消费方映射 MODULE_CONSUMERS」判定
+  - 只读、零副作用；不依赖真机即可返回（设备相关字段会标注 online 与否）
+
+严禁修改存客宝 / AI 数字员工 / 超级管理端代码——本模块仅暴露工作手机侧出口。
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List, Optional, Tuple
+
+# ─────────────────────────────────────────────
+# 一、消费方定义
+# ─────────────────────────────────────────────
+
+CONSUMER_CUNKEBAO = "cunkebao"
+CONSUMER_SUPERADMIN = "superadmin"
+CONSUMER_AI_EMPLOYEE = "ai_employee"
+CONSUMER_COMMON = "common"
+
+CONSUMER_LABELS = {
+    CONSUMER_CUNKEBAO: "存客宝（直连业务/线索/Hook 事件）",
+    CONSUMER_SUPERADMIN: "超级管理端（连接方案切换/配置开关/全局管控）",
+    CONSUMER_AI_EMPLOYEE: "AI 数字员工（OpenAI/MCP/Agent 网关调用控机）",
+    CONSUMER_COMMON: "通用（设备/健康/发现/经验等基础能力）",
+}
+
+# ─────────────────────────────────────────────
+# 二、模块规则表：路径前缀（去掉 /api/v3）→ 模块
+#    顺序敏感：先匹配更具体的前缀
+# ─────────────────────────────────────────────
+
+# (path_prefix, module_id, module_label)
+MODULE_RULES: List[Tuple[str, str, str]] = [
+    ("/cunke-bao", "cunkebao_link", "存客宝对接"),
+    ("/customer", "cunkebao_link", "存客宝对接"),
+    ("/connection/provider", "connection_switch", "连接方案可切换驱动"),
+    ("/connection", "connection", "连接协议与诊断"),
+    ("/stability", "connection", "连接协议与诊断"),
+    ("/gateway/v1", "gateway_openai", "AI 网关 · OpenAI 兼容"),
+    ("/v1/chat", "gateway_openai", "AI 网关 · OpenAI 兼容"),
+    ("/gateway/mcp", "gateway_mcp", "AI 网关 · MCP 协议"),
+    ("/gateway", "gateway", "AI 网关 · REST 聚合/编队"),
+    ("/ai/brain", "ai_brain", "AI Brain 技能注册与调度"),
+    ("/ai", "ai_agent", "AI Agent 控机"),
+    ("/agent", "ai_agent", "AI Agent 控机"),
+    ("/wechat", "wechat_full", "微信全量操作"),
+    ("/message", "wechat_message", "微信消息"),
+    ("/friend", "wechat_friend", "微信好友"),
+    ("/contacts", "wechat_contacts", "微信通讯录"),
+    ("/group", "wechat_group", "微信群"),
+    ("/moments", "wechat_moments", "微信朋友圈"),
+    ("/tag", "wechat_tag", "微信标签"),
+    ("/account", "wechat_account", "微信账号/登录/解封"),
+    ("/auto-register", "wechat_account", "微信账号/登录/解封"),
+    ("/payment", "wechat_payment", "微信支付/转账"),
+    ("/mass-send", "wechat_message", "微信消息"),
+    # 微信扩展操作（资料/扫码/收藏/表情/文件/位置/通话/小程序/公众号/看一看/评论）
+    ("/profile", "wechat_extra", "微信扩展操作"),
+    ("/scan", "wechat_extra", "微信扩展操作"),
+    ("/favorites", "wechat_extra", "微信扩展操作"),
+    ("/emoji", "wechat_extra", "微信扩展操作"),
+    ("/file", "wechat_extra", "微信扩展操作"),
+    ("/location", "wechat_extra", "微信扩展操作"),
+    ("/call", "wechat_extra", "微信扩展操作"),
+    ("/chat", "wechat_extra", "微信扩展操作"),
+    ("/miniprogram", "wechat_extra", "微信扩展操作"),
+    ("/official-account", "wechat_extra", "微信扩展操作"),
+    ("/discover", "wechat_extra", "微信扩展操作"),
+    ("/comment", "wechat_extra", "微信扩展操作"),
+    ("/search", "wechat_extra", "微信扩展操作"),
+    ("/settings", "wechat_extra", "微信扩展操作"),
+    ("/video-channel", "wechat_extra", "微信扩展操作"),
+    ("/wechat-sport", "wechat_extra", "微信扩展操作"),
+    ("/hook-modules", "hook_modules", "Hook 模块管理"),
+    ("/modules", "hook_modules", "Hook 模块管理"),
+    ("/scripts", "ai_brain", "AI Brain 技能注册与调度"),
+    ("/hook", "hook", "Hook 探测/执行/动作"),
+    ("/anti-ban", "anti_ban", "防风控"),
+    ("/antiban", "anti_ban", "防风控"),
+    ("/fleet", "fleet", "多设备 Fleet 管理"),
+    ("/devices", "devices", "设备管理与控制"),
+    ("/device", "devices", "设备管理与控制"),
+    ("/guard-events", "devices", "设备管理与控制"),
+    ("/heartbeat", "devices", "设备管理与控制"),
+    ("/workbench", "console", "控制台/工作台聚合"),
+    ("/process", "console", "控制台/工作台聚合"),
+    ("/frida", "frida", "Frida 无线管理"),
+    ("/adb", "adb", "ADB 直连（运维兜底，非主控）"),
+    ("/registry", "registry", "多服务器注册中心"),
+    ("/discovery", "discovery", "设备发现"),
+    ("/qrcode", "qrcode", "二维码"),
+    ("/voice", "voice", "语音控制"),
+    ("/capture", "capture", "抓包"),
+    ("/experience", "experience", "经验库"),
+    ("/projects", "projects", "项目管理"),
+    ("/integration", "integration", "对外接口统一清单"),
+]
+
+# 模块 → 主消费方（一个模块可服务多个消费方）
+MODULE_CONSUMERS: Dict[str, List[str]] = {
+    "cunkebao_link": [CONSUMER_CUNKEBAO, CONSUMER_SUPERADMIN],
+    "connection_switch": [CONSUMER_SUPERADMIN, CONSUMER_CUNKEBAO],
+    "connection": [CONSUMER_SUPERADMIN, CONSUMER_COMMON],
+    "gateway_openai": [CONSUMER_AI_EMPLOYEE],
+    "gateway_mcp": [CONSUMER_AI_EMPLOYEE],
+    "gateway": [CONSUMER_AI_EMPLOYEE, CONSUMER_SUPERADMIN],
+    "ai_brain": [CONSUMER_AI_EMPLOYEE, CONSUMER_SUPERADMIN],
+    "ai_agent": [CONSUMER_AI_EMPLOYEE, CONSUMER_CUNKEBAO],
+    "wechat_full": [CONSUMER_CUNKEBAO, CONSUMER_AI_EMPLOYEE],
+    "wechat_message": [CONSUMER_CUNKEBAO, CONSUMER_AI_EMPLOYEE],
+    "wechat_friend": [CONSUMER_CUNKEBAO, CONSUMER_AI_EMPLOYEE],
+    "wechat_contacts": [CONSUMER_CUNKEBAO, CONSUMER_AI_EMPLOYEE],
+    "wechat_group": [CONSUMER_CUNKEBAO, CONSUMER_AI_EMPLOYEE],
+    "wechat_moments": [CONSUMER_CUNKEBAO, CONSUMER_AI_EMPLOYEE],
+    "wechat_tag": [CONSUMER_CUNKEBAO, CONSUMER_AI_EMPLOYEE],
+    "wechat_account": [CONSUMER_CUNKEBAO, CONSUMER_SUPERADMIN],
+    "wechat_extra": [CONSUMER_CUNKEBAO, CONSUMER_AI_EMPLOYEE],
+    "wechat_payment": [CONSUMER_CUNKEBAO, CONSUMER_AI_EMPLOYEE],
+    "hook": [CONSUMER_CUNKEBAO, CONSUMER_AI_EMPLOYEE, CONSUMER_SUPERADMIN],
+    "anti_ban": [CONSUMER_SUPERADMIN, CONSUMER_CUNKEBAO],
+    "fleet": [CONSUMER_CUNKEBAO, CONSUMER_SUPERADMIN, CONSUMER_AI_EMPLOYEE, CONSUMER_COMMON],
+    "devices": [CONSUMER_COMMON, CONSUMER_CUNKEBAO, CONSUMER_AI_EMPLOYEE],
+    "frida": [CONSUMER_SUPERADMIN, CONSUMER_COMMON],
+    "adb": [CONSUMER_SUPERADMIN, CONSUMER_COMMON],
+    "hook_modules": [CONSUMER_SUPERADMIN],
+    "registry": [CONSUMER_SUPERADMIN, CONSUMER_COMMON],
+    "discovery": [CONSUMER_COMMON, CONSUMER_SUPERADMIN],
+    "qrcode": [CONSUMER_COMMON],
+    "voice": [CONSUMER_AI_EMPLOYEE, CONSUMER_COMMON],
+    "capture": [CONSUMER_SUPERADMIN],
+    "experience": [CONSUMER_COMMON],
+    "projects": [CONSUMER_SUPERADMIN, CONSUMER_COMMON],
+    "console": [CONSUMER_SUPERADMIN, CONSUMER_CUNKEBAO, CONSUMER_COMMON],
+    "integration": [CONSUMER_SUPERADMIN, CONSUMER_CUNKEBAO, CONSUMER_AI_EMPLOYEE, CONSUMER_COMMON],
+}
+
+MODULE_UNKNOWN = ("other", "其它/内部")
+
+# 模块运行时依赖：
+#   server  → SDK 进程在即可用（不依赖具体设备）
+#   device  → 需目标设备 WebSocket 在线（u2/ADB 即可，微信类有 u2 兜底）
+#   hook    → 需设备 Frida Hook 已 attach 才能发挥完整能力（否则 u2 部分降级）
+MODULE_RUNTIME: Dict[str, str] = {
+    "cunkebao_link": "server",
+    "connection_switch": "device",
+    "connection": "device",
+    "gateway_openai": "device",
+    "gateway_mcp": "device",
+    "gateway": "device",
+    "ai_brain": "device",
+    "ai_agent": "device",
+    "wechat_full": "hook",
+    "wechat_message": "hook",
+    "wechat_friend": "hook",
+    "wechat_contacts": "hook",
+    "wechat_group": "hook",
+    "wechat_moments": "hook",
+    "wechat_tag": "hook",
+    "wechat_account": "device",
+    "wechat_extra": "hook",
+    "wechat_payment": "hook",
+    "hook": "hook",
+    "anti_ban": "server",
+    "fleet": "device",
+    "devices": "device",
+    "frida": "device",
+    "adb": "device",
+    "hook_modules": "server",
+    "registry": "server",
+    "discovery": "server",
+    "qrcode": "server",
+    "voice": "device",
+    "capture": "device",
+    "experience": "server",
+    "projects": "device",
+    "console": "server",
+    "integration": "server",
+    "other": "server",
+}
+
+# 仅纳入对外清单的方法
+_PUBLIC_METHODS = {"GET", "POST", "PUT", "DELETE", "PATCH"}
+
+# 这些路径片段视为内部/非业务，不纳入对外清单
+_SKIP_PREFIXES = ("/openapi", "/docs", "/redoc", "/static")
+
+
+def _classify_path(path: str) -> Tuple[str, str]:
+    """返回 (module_id, module_label)。path 形如 /api/v3/cunke-bao/config。"""
+    rel = path
+    if rel.startswith("/api/v3"):
+        rel = rel[len("/api/v3"):]
+    if not rel.startswith("/"):
+        rel = "/" + rel
+    for prefix, mod_id, label in MODULE_RULES:
+        if rel == prefix or rel.startswith(prefix + "/") or rel.startswith(prefix):
+            # 更严格：前缀后须是 / 或结束，避免 /tag 误匹配 /tagx
+            tail = rel[len(prefix):]
+            if tail == "" or tail.startswith("/"):
+                return mod_id, label
+    return MODULE_UNKNOWN
+
+
+def _consumers_for(module_id: str) -> List[str]:
+    return MODULE_CONSUMERS.get(module_id, [CONSUMER_COMMON])
+
+
+def build_manifest(app) -> Dict[str, Any]:
+    """
+    扫描 FastAPI app 路由，生成按模块归类的对外接口清单。
+
+    返回:
+      {
+        "version": "...",
+        "base_path": "/api/v3",
+        "total_endpoints": N,
+        "consumers": {...标签...},
+        "modules": [
+          {"module": "cunkebao_link", "label": "存客宝对接",
+           "consumers": ["cunkebao","superadmin"],
+           "endpoints": [{"method","path","summary"} ...]}
+        ]
+      }
+    """
+    modules: Dict[str, Dict[str, Any]] = {}
+    total = 0
+    seen: set[tuple[str, str]] = set()
+
+    def add_endpoint(path: str, method: str, summary: str = "") -> None:
+        nonlocal total
+        method = method.upper()
+        if method not in _PUBLIC_METHODS:
+            return
+        if not path or any(path.startswith(p) for p in _SKIP_PREFIXES):
+            return
+        key = (path, method)
+        if key in seen:
+            return
+        if path.startswith("/api/v3"):
+            mod_id, label = _classify_path(path)
+        elif path in ("/health", "/ready", "/"):
+            mod_id, label = ("devices", "设备管理与控制") if path == "/health" else ("integration", "对外接口统一清单")
+        else:
+            mod_id, label = _classify_path(path)
+            if mod_id == MODULE_UNKNOWN[0]:
+                return
+        bucket = modules.setdefault(mod_id, {
+            "module": mod_id,
+            "label": label,
+            "consumers": _consumers_for(mod_id),
+            "endpoints": [],
+        })
+        bucket["endpoints"].append({
+            "method": method,
+            "path": path,
+            "summary": summary,
+        })
+        seen.add(key)
+        total += 1
+
+    for route in getattr(app, "routes", []):
+        path = getattr(route, "path", "") or ""
+        methods = getattr(route, "methods", None) or set()
+        if not path or any(path.startswith(p) for p in _SKIP_PREFIXES):
+            continue
+        # 只纳入 /api/v3/* 与少量根级业务端点（/health 等归 common）
+        public_methods = [m for m in methods if m in _PUBLIC_METHODS]
+        if not public_methods:
+            continue
+
+        summary = getattr(route, "summary", "") or ""
+        if not summary:
+            endpoint = getattr(route, "endpoint", None)
+            doc = (endpoint.__doc__ or "").strip() if endpoint else ""
+            summary = doc.splitlines()[0].strip() if doc else ""
+
+        for m in sorted(public_methods):
+            add_endpoint(path, m, summary)
+
+    # 某些运行态下 request.app.routes 可能只暴露局部路由，但 OpenAPI 已完整。
+    # 用 OpenAPI paths 做只读补齐，保证接口开放清单与 /docs 可见能力一致。
+    try:
+        openapi = app.openapi() if hasattr(app, "openapi") else {}
+        paths = openapi.get("paths", {}) if isinstance(openapi, dict) else {}
+        for path, path_item in paths.items():
+            if not isinstance(path_item, dict):
+                continue
+            for method, meta in path_item.items():
+                if str(method).upper() not in _PUBLIC_METHODS:
+                    continue
+                summary = ""
+                if isinstance(meta, dict):
+                    summary = str(meta.get("summary") or meta.get("description") or "")
+                add_endpoint(path, str(method), summary)
+    except Exception:
+        # manifest 是发现接口，不应因 OpenAPI 补齐失败影响主服务。
+        pass
+
+    # 排序：模块按 label，端点按 path
+    module_list = []
+    for mod in modules.values():
+        mod["endpoints"].sort(key=lambda e: (e["path"], e["method"]))
+        mod["endpoint_count"] = len(mod["endpoints"])
+        module_list.append(mod)
+    module_list.sort(key=lambda m: m["label"])
+
+    return {
+        "version": "1.0.0",
+        "base_path": "/api/v3",
+        "generated_from": "fastapi.routes (dynamic, always in-sync)",
+        "total_endpoints": total,
+        "module_count": len(module_list),
+        "consumers": CONSUMER_LABELS,
+        "modules": module_list,
+        "rules": {
+            "note": "工作手机侧出口；严禁改存客宝/AI数字员工/超管代码，仅按本清单对接。",
+            "transport": "业务下发统一经 WebSocket 主控（WORKPHONE_WS_FIRST=1）",
+        },
+    }
+
+
+def filter_by_consumer(manifest: Dict[str, Any], consumer: str) -> Dict[str, Any]:
+    """从完整清单中筛出某消费方可用的模块与端点。"""
+    mods = [m for m in manifest.get("modules", []) if consumer in m.get("consumers", [])]
+    total = sum(m.get("endpoint_count", 0) for m in mods)
+    return {
+        "version": manifest.get("version"),
+        "base_path": manifest.get("base_path"),
+        "consumer": consumer,
+        "consumer_label": CONSUMER_LABELS.get(consumer, consumer),
+        "total_endpoints": total,
+        "module_count": len(mods),
+        "modules": mods,
+    }
+
+
+def list_modules(manifest: Dict[str, Any]) -> List[Dict[str, Any]]:
+    """精简模块目录（不含端点明细）。"""
+    return [
+        {
+            "module": m["module"],
+            "label": m["label"],
+            "consumers": m["consumers"],
+            "endpoint_count": m["endpoint_count"],
+            "runtime": MODULE_RUNTIME.get(m["module"], "server"),
+        }
+        for m in manifest.get("modules", [])
+    ]
+
+
+def build_capability(
+    manifest: Dict[str, Any],
+    device_id: str,
+    online: bool,
+    supports_hook: bool,
+    consumer: Optional[str] = None,
+) -> Dict[str, Any]:
+    """
+    把「接口清单（静态）」与「设备实时状态」打通，给出某设备各模块此刻是否可直接调用。
+
+    status 取值：
+      ready          可直接调用
+      degraded       设备在线但 Frida 未 attach，微信类走 u2 部分降级
+      offline        设备不在线，device/hook 类不可用
+    """
+    modules = manifest.get("modules", [])
+    if consumer:
+        modules = [m for m in modules if consumer in m.get("consumers", [])]
+
+    result_modules = []
+    counts = {"ready": 0, "degraded": 0, "offline": 0}
+    for m in modules:
+        runtime = MODULE_RUNTIME.get(m["module"], "server")
+        if runtime == "server":
+            status = "ready"
+        elif not online:
+            status = "offline"
+        elif runtime == "hook":
+            status = "ready" if supports_hook else "degraded"
+        else:  # device
+            status = "ready"
+        counts[status] += 1
+        result_modules.append({
+            "module": m["module"],
+            "label": m["label"],
+            "runtime": runtime,
+            "status": status,
+            "endpoint_count": m["endpoint_count"],
+            "consumers": m["consumers"],
+        })
+
+    return {
+        "device_id": device_id,
+        "consumer": consumer or "all",
+        "online": online,
+        "supports_hook": supports_hook,
+        "summary": counts,
+        "modules": result_modules,
+        "legend": {
+            "ready": "可直接调用",
+            "degraded": "设备在线但 Frida 未 attach，微信类走 u2 部分降级",
+            "offline": "设备不在线，device/hook 类不可用",
+        },
+    }
diff --git a/sdk/app/services/karuo_device_ai.py b/sdk/app/services/karuo_device_ai.py
new file mode 100644
index 0000000000..380bce7a15
--- /dev/null
+++ b/sdk/app/services/karuo_device_ai.py
@@ -0,0 +1,130 @@
+"""
+服务端编排：卡若 AI 网关决策 → WebSocket 下发到手机 Agent 执行。
+手机无需本地 ai_api_key，统一走平常使用的 /api/gateway/chat。
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+from pathlib import Path
+from typing import Any, Dict, Optional
+import importlib.util
+
+logger = logging.getLogger(__name__)
+
+_brain: Optional[Any] = None
+
+
+def _load_ai_brain_class():
+    path = Path(__file__).resolve().parent.parent / "agent" / "ai_brain.py"
+    spec = importlib.util.spec_from_file_location("workphone_device_ai_brain", path)
+    if spec is None or spec.loader is None:
+        raise ImportError(f"无法加载 AIBrain: {path}")
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod.AIBrain
+
+
+from services.ws_hub import ws_hub
+
+_AGENT_CFG_CANDIDATES = [
+    Path(__file__).resolve().parent.parent / "agent" / "config.json",
+    Path(__file__).resolve().parents[2] / "agent" / "config.json",
+]
+
+
+def _load_ai_cfg() -> Dict[str, Any]:
+    for path in _AGENT_CFG_CANDIDATES:
+        try:
+            if path.is_file():
+                with open(path, encoding="utf-8") as f:
+                    data = json.load(f)
+                return data.get("ai_brain") or {}
+        except Exception as exc:
+            logger.warning("读取 %s 失败: %s", path, exc)
+    return {}
+
+
+def get_karuo_brain(force_reload: bool = False) -> Optional[Any]:
+    global _brain
+    if _brain is not None and not force_reload:
+        return _brain
+    _brain = None
+    cfg = _load_ai_cfg()
+    api_key = (
+        os.environ.get("KARUO_API_KEY")
+        or os.environ.get("WP_AI_API_KEY")
+        or os.environ.get("AI_BRAIN_API_KEY")
+        or cfg.get("api_key")
+        or ""
+    ).strip()
+    api_url = (
+        os.environ.get("KARUO_API_URL")
+        or os.environ.get("WP_AI_API_URL")
+        or os.environ.get("AI_BRAIN_API_URL")
+        or cfg.get("api_url")
+        or "http://127.0.0.1:3102"
+    ).strip()
+    # 本机直跑 SDK（非 Docker 容器内）时 host.docker.internal 不可达
+    if "host.docker.internal" in api_url and not os.path.exists("/.dockerenv"):
+        api_url = api_url.replace("host.docker.internal", "127.0.0.1")
+    if not api_key:
+        logger.warning("卡若 AI Brain 未配置 api_key（sdk/agent/config.json）")
+        return None
+    _brain = _load_ai_brain_class()(
+        ai_api_url=api_url,
+        ai_api_key=api_key,
+        ai_model=cfg.get("model") or "auto",
+        brain_interval=int(cfg.get("brain_interval") or 60),
+        standing_orders=cfg.get("standing_orders") or [],
+        enabled=True,
+    )
+    return _brain
+
+
+def device_status(device_id: str) -> Dict[str, Any]:
+    info = ws_hub.get_device_info(device_id) or {}
+    qs = info.get("quick_status") or info.get("last_status") or {}
+    return {
+        "device_id": device_id,
+        "online": ws_hub.is_online(device_id),
+        "model": info.get("model"),
+        "capabilities": info.get("capabilities") or [],
+        "u2": qs.get("u2", False),
+        "frida": info.get("frida_available", False),
+        "agent_version": info.get("agent_version"),
+    }
+
+
+async def chat_and_execute_on_device(
+    device_id: str,
+    instruction: str,
+    timeout: int = 120,
+) -> Dict[str, Any]:
+    brain = get_karuo_brain()
+    if not brain:
+        return {"code": 503, "message": "卡若 AI 未配置（agent/config.json ai_brain.api_key）"}
+    if not ws_hub.is_online(device_id):
+        return {"code": 503, "message": "设备不在线"}
+
+    async def execute_fn(script: str, action: str, params: Dict[str, Any]) -> Dict[str, Any]:
+        return await ws_hub.send_command(
+            device_id,
+            {
+                "type": "execute",
+                "data": {
+                    "script": script,
+                    "action": action,
+                    "params": params or {},
+                    "channel": "auto",
+                },
+            },
+            timeout=timeout,
+        )
+
+    result = await brain.chat_and_execute(instruction.strip(), device_status(device_id), execute_fn)
+    result["device_id"] = device_id
+    result["orchestrator"] = "server_karuo_gateway"
+    return result
diff --git a/sdk/app/services/process_state.py b/sdk/app/services/process_state.py
new file mode 100644
index 0000000000..ddd0d56eb4
--- /dev/null
+++ b/sdk/app/services/process_state.py
@@ -0,0 +1,77 @@
+"""
+SDK 进程状态 — 正常态快照（供 connection_keeper / 负载均衡 / 控制台轮询）
+"""
+
+from __future__ import annotations
+
+import os
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+_PROCESS_STARTED_AT: float = time.time()
+
+
+def mark_process_started() -> None:
+    """lifespan 启动时调用，重置进程计时起点。"""
+    global _PROCESS_STARTED_AT
+    _PROCESS_STARTED_AT = time.time()
+
+
+def _keeper_pid_file() -> Path:
+    sdk_app_root = Path(__file__).resolve().parent.parent
+    host_path = sdk_app_root.parent / "logs" / "connection_keeper.pid"
+    container_path = sdk_app_root / "logs" / "connection_keeper.pid"
+    for p in (host_path, container_path):
+        if p.is_file():
+            return p
+    # 宿主机 sdk/app 结构 vs Docker /app
+    if (sdk_app_root.parent / "scripts").is_dir():
+        return host_path
+    return container_path
+
+
+def _read_keeper_state() -> Dict[str, Any]:
+    pid_file = _keeper_pid_file()
+    if not pid_file.is_file():
+        return {"running": False, "pid": None, "pid_file": str(pid_file)}
+    try:
+        pid = int(pid_file.read_text(encoding="utf-8").strip())
+    except (ValueError, OSError):
+        return {"running": False, "pid": None, "pid_file": str(pid_file)}
+    try:
+        os.kill(pid, 0)
+        return {"running": True, "pid": pid, "pid_file": str(pid_file)}
+    except OSError:
+        return {"running": False, "pid": pid, "pid_file": str(pid_file), "stale": True}
+
+
+def get_process_status() -> Dict[str, Any]:
+    """
+    返回 SDK 进程「正常态」快照。
+    state=normal 表示主进程存活且核心子系统可响应（与 /ready 语义对齐）。
+    """
+    from services.ws_hub import ws_hub
+
+    uptime = max(0, int(time.time() - _PROCESS_STARTED_AT))
+    online_ids = list(ws_hub.connections.keys())
+    keeper = _read_keeper_state()
+
+    return {
+        "state": "normal",
+        "pid": os.getpid(),
+        "version": "3.0.0",
+        "started_at": datetime.fromtimestamp(_PROCESS_STARTED_AT, tz=timezone.utc).isoformat(),
+        "uptime_seconds": uptime,
+        "ready": True,
+        "ws_online_count": len(online_ids),
+        "online_device_ids": online_ids,
+        "connection_keeper": keeper,
+        "poll_urls": {
+            "process_status": "/api/v3/process/status",
+            "ready": "/ready",
+            "health": "/health",
+            "connection_status": "/api/v3/connection/status",
+        },
+    }
diff --git a/sdk/app/services/server_frida_bridge.py b/sdk/app/services/server_frida_bridge.py
new file mode 100644
index 0000000000..ec0e8838df
--- /dev/null
+++ b/sdk/app/services/server_frida_bridge.py
@@ -0,0 +1,96 @@
+"""宝塔侧 Frida RPC 桥。
+
+手机通过认证的反向隧道暴露 frida-server，SDK 容器在本模块中持有真正的
+Frida Session 和 JS RPC。Android 系统控制仍走手机 WebSocket，两条通道互不抢占。
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+import threading
+from typing import Any, Dict
+
+logger = logging.getLogger(__name__)
+
+
+class ServerFridaBridge:
+    def __init__(self) -> None:
+        self._manager = None
+        self._executor = None
+        self._lock = threading.RLock()
+
+    @staticmethod
+    def _settings():
+        from config import settings
+        return settings
+
+    def enabled_for(self, device_id: str) -> bool:
+        settings = self._settings()
+        if not bool(getattr(settings, "SERVER_FRIDA_ENABLED", False)):
+            return False
+        expected = str(getattr(settings, "SERVER_FRIDA_DEVICE_ID", "") or "").strip()
+        return not expected or expected == device_id
+
+    def _connect(self) -> bool:
+        with self._lock:
+            if self._manager and getattr(self._manager, "connected", False):
+                return True
+
+            from hook.frida_manager import FridaManager
+            from hook.hook_executor import HookExecutor
+
+            settings = self._settings()
+            manager = FridaManager(
+                mode="remote",
+                gadget_host=str(getattr(settings, "SERVER_FRIDA_HOST", "172.18.0.1")),
+                gadget_port=int(getattr(settings, "SERVER_FRIDA_PORT", 14538)),
+                use_adb_forward=False,
+                auto_reconnect=True,
+            )
+            if not manager.start():
+                logger.warning("宝塔 Frida 桥连接失败")
+                return False
+            self._manager = manager
+            self._executor = HookExecutor(manager)
+            logger.info("宝塔 Frida 桥已附着微信并加载 RPC")
+            return True
+
+    def execute_sync(self, action: str, params: Dict[str, Any]) -> Dict[str, Any]:
+        try:
+            if not self._connect():
+                return {
+                    "success": False,
+                    "code": 503,
+                    "error": "宝塔 Frida 桥不可用，请检查手机反向隧道和微信进程",
+                    "_channel_used": "server/frida/offline",
+                }
+            result = self._executor.execute(action, params)
+            result.setdefault("code", 200 if result.get("success") else 500)
+            result["_channel_used"] = "server/frida"
+            result["transport"] = "frida_reverse_tunnel"
+            return result
+        except Exception as exc:
+            logger.exception("宝塔 Frida RPC 执行异常")
+            return {
+                "success": False,
+                "code": 500,
+                "error": str(exc),
+                "_channel_used": "server/frida/error",
+            }
+
+    async def execute(self, device_id: str, action: str, params: Dict[str, Any]) -> Dict[str, Any]:
+        if not self.enabled_for(device_id):
+            return {"success": False, "code": 503, "error": "宝塔 Frida 桥未启用"}
+        return await asyncio.to_thread(self.execute_sync, action, params)
+
+    def status(self) -> Dict[str, Any]:
+        connected = bool(self._manager and getattr(self._manager, "connected", False))
+        return {
+            "enabled": bool(getattr(self._settings(), "SERVER_FRIDA_ENABLED", False)),
+            "connected": connected,
+            "manager": self._manager.get_status() if connected else None,
+        }
+
+
+server_frida_bridge = ServerFridaBridge()
diff --git a/sdk/app/services/wechat_contact_normalizer.py b/sdk/app/services/wechat_contact_normalizer.py
new file mode 100644
index 0000000000..7923f8b120
--- /dev/null
+++ b/sdk/app/services/wechat_contact_normalizer.py
@@ -0,0 +1,72 @@
+"""
+存客宝通讯录字段归一化 — 禁止空 nickname/display_name 占位
+
+Hook/SQL 常返回 nickname 空、remark 有值；存客宝 MySQL diff 需要稳定展示字段。
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List
+
+
+def normalize_wechat_contact(raw: Dict[str, Any]) -> Dict[str, Any]:
+    wxid = (
+        raw.get("wxid")
+        or raw.get("username")
+        or raw.get("user_id")
+        or ""
+    ).strip()
+    nickname = (raw.get("nickname") or "").strip()
+    remark = (raw.get("remark") or raw.get("conRemark") or "").strip()
+    alias = (raw.get("alias") or raw.get("wechat_id") or "").strip()
+    display = nickname or remark or alias or wxid
+
+    tags = raw.get("tags")
+    if tags is None:
+        tags = []
+    elif isinstance(tags, str):
+        tags = [t.strip() for t in tags.split(",") if t.strip()]
+
+    sex_raw = raw.get("sex")
+    if sex_raw in (0, "0", "unknown", None, ""):
+        sex = "unknown"
+    elif sex_raw in (1, "1", "male", "男"):
+        sex = "male"
+    elif sex_raw in (2, "2", "female", "女"):
+        sex = "female"
+    else:
+        sex = str(sex_raw)
+
+    return {
+        "wxid": wxid,
+        "user_id": wxid,
+        "wechat_id": alias,
+        "nickname": nickname,
+        "display_name": display,
+        "remark": remark,
+        "alias": alias,
+        "type": str(raw.get("type", "")),
+        "sex": sex,
+        "country": raw.get("country") or "",
+        "province": raw.get("province") or "",
+        "city": raw.get("city") or "",
+        "signature": raw.get("signature") or "",
+        "tags": tags,
+        "has_avatar": bool(raw.get("has_avatar") or raw.get("imgFlag")),
+        "phone": raw.get("phone") or raw.get("mobile") or "",
+        "avatar": raw.get("avatar") or "",
+    }
+
+
+def normalize_wechat_contacts(contacts: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    out: List[Dict[str, Any]] = []
+    seen = set()
+    for item in contacts or []:
+        if not isinstance(item, dict):
+            continue
+        norm = normalize_wechat_contact(item)
+        if not norm["wxid"] or norm["wxid"] in seen:
+            continue
+        seen.add(norm["wxid"])
+        out.append(norm)
+    return out
diff --git a/sdk/app/static/hub.html b/sdk/app/static/hub.html
index 589686536c..2c3810c0d9 100644
--- a/sdk/app/static/hub.html
+++ b/sdk/app/static/hub.html
@@ -443,14 +443,43 @@ function log(message, type='info'){
 
 /* ═══ API ═══ */
 
+const CONSOLE_API_KEY_STORAGE = 'workphone_api_key';
+let consoleApiKey = sessionStorage.getItem(CONSOLE_API_KEY_STORAGE) || '';
+
+function requestConsoleApiKey(force=false){
+  if (consoleApiKey && !force) return true;
+  const value = window.prompt(force
+    ? '控制台认证已失效，请重新输入 API Key：'
+    : '请输入工作手机控制台 API Key（仅保存到当前浏览器会话）：', '');
+  if (!value || !value.trim()) return false;
+  consoleApiKey = value.trim();
+  sessionStorage.setItem(CONSOLE_API_KEY_STORAGE, consoleApiKey);
+  return true;
+}
+
+async function authenticatedFetch(url, options={}, retried=false){
+  if (!consoleApiKey && !requestConsoleApiKey(false)) {
+    throw new Error('控制台未认证');
+  }
+  const headers = new Headers(options.headers || {});
+  headers.set('X-API-Key', consoleApiKey);
+  const res = await fetch(url, {...options, headers});
+  if (res.status === 401 && !retried) {
+    sessionStorage.removeItem(CONSOLE_API_KEY_STORAGE);
+    consoleApiKey = '';
+    if (requestConsoleApiKey(true)) return authenticatedFetch(url, options, true);
+  }
+  return res;
+}
+
 async function apiGet(url){
-  const res = await fetch(`${API}${url}`);
+  const res = await authenticatedFetch(`${API}${url}`);
   if(!res.ok) throw new Error(`请求失败: ${res.status}`);
   return res.json();
 }
 
 async function apiPost(url, body){
-  const res = await fetch(`${API}${url}`, {
+  const res = await authenticatedFetch(`${API}${url}`, {
     method:'POST',
     headers:{'Content-Type':'application/json'},
     body: JSON.stringify(body || {})
@@ -2692,7 +2721,7 @@ async function fetchHookData(){
   state.hookDataLoading = true;
   renderCurrentView();
   try {
-    const r = await fetch(`/api/v3/hook/data/${did}?modules=profile,contacts,groups,labels,messages,device_info&contact_limit=200&message_limit=50&contact_offset=0&message_offset=0`);
+    const r = await authenticatedFetch(`/api/v3/hook/data/${did}?modules=profile,contacts,groups,labels,messages,device_info&contact_limit=200&message_limit=50&contact_offset=0&message_offset=0`);
     const j = await r.json();
     if (j.success && j.data) {
       state.hookData = j.data;
diff --git a/sdk/app/static/index.html b/sdk/app/static/index.html
index 172f4992bc..abff2beebd 100644
--- a/sdk/app/static/index.html
+++ b/sdk/app/static/index.html
@@ -295,7 +295,7 @@ body {
 
 <script>
 const API = location.origin;
-const API_HEADERS = {'X-API-Key': 'workphone-secret-key'};
+const API_HEADERS = {'X-API-Key': sessionStorage.getItem('workphone_api_key') || ''};
 let currentDevice = null;
 let cmdMode = 'pattern'; // pattern | ai | ai-only
 
diff --git a/sdk/app/static/llms.txt b/sdk/app/static/llms.txt
new file mode 100644
index 0000000000..442b51de50
--- /dev/null
+++ b/sdk/app/static/llms.txt
@@ -0,0 +1,51 @@
+# WorkPhone SDK API Portal
+
+WorkPhone SDK is a real-device phone control engine for Cunkebao, Super Admin, AI Employee, and any external project.
+
+## Human entry points
+
+- API Portal: /static/hub.html
+- Swagger UI: /docs
+- ReDoc: /redoc
+- Health: /health
+
+## Machine-readable API sources
+
+- OpenAPI JSON: /openapi.json
+- Full integration manifest: /api/v3/integration/manifest
+- Modules: /api/v3/integration/modules
+- Consumers: /api/v3/integration/consumers
+- Cunkebao subset: /api/v3/integration/consumers/cunkebao
+- Super Admin subset: /api/v3/integration/consumers/superadmin
+- AI Employee subset: /api/v3/integration/consumers/ai_employee
+- Runtime device capability: /api/v3/integration/capability/{device_id}?consumer=cunkebao
+- Integration health: /api/v3/integration/health
+
+## Recommended integration flow
+
+1. Discover available APIs for your consumer role with /api/v3/integration/consumers/{consumer}.
+2. Check runtime capability for a target device with /api/v3/integration/capability/{device_id}?consumer={consumer}.
+3. Call concrete /api/v3/* APIs, such as /api/v3/message/send or /api/v3/hook/execute.
+4. For WeChat production control, prefer WebSocket Agent + Frida Hook. Do not claim success without real-device evidence.
+
+## Main consumers
+
+- cunkebao: business messaging, contacts, groups, tags, moments, lead reporting, hook events.
+- superadmin: connection provider switching, device management, Frida, risk control, global governance.
+- ai_employee: OpenAI-compatible gateway, MCP tools, natural-language agent execution.
+- common: health, discovery, devices, shared operational APIs.
+
+## Documentation files
+
+- Interface manifest guide: /workbench-docs/5%E3%80%81%E6%8E%A5%E5%8F%A3/07-%E5%AF%B9%E5%A4%96%E6%8E%A5%E5%8F%A3%E7%BB%9F%E4%B8%80%E6%B8%85%E5%8D%95/README.md
+- Any-project integration manual: /workbench-docs/9%E3%80%81%E6%89%8B%E5%86%8C/02-%E6%93%8D%E4%BD%9C%E6%8C%87%E5%8D%97/%E5%B7%A5%E4%BD%9C%E6%89%8B%E6%9C%BA%C2%B7%E6%8E%A5%E5%8F%A3%E7%BD%91%E7%AB%99%E4%B8%8E%E4%BB%BB%E6%84%8F%E9%A1%B9%E7%9B%AE%E5%AF%B9%E6%8E%A5%E6%89%8B%E5%86%8C.md
+
+## Current verified scale
+
+- 33 integration modules
+- 358 API endpoints in manifest
+- 253 Cunkebao-ready endpoints across 18 modules
+
+## Safety
+
+Real-device validation is mandatory for production claims. Offline tests and mocked responses are regression tools only.
diff --git a/sdk/deploy/baota/wpsdk.quwanzhi.com.conf b/sdk/deploy/baota/wpsdk.quwanzhi.com.conf
new file mode 100644
index 0000000000..72ead09fee
--- /dev/null
+++ b/sdk/deploy/baota/wpsdk.quwanzhi.com.conf
@@ -0,0 +1,36 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name wpsdk.quwanzhi.com;
+    location /.well-known/acme-challenge/ { root /www/wwwroot/java_node_ssl; }
+    location / { return 301 https://$host$request_uri; }
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name wpsdk.quwanzhi.com;
+
+    ssl_certificate /www/server/panel/vhost/cert/wpsdk.quwanzhi.com/fullchain.pem;
+    ssl_certificate_key /www/server/panel/vhost/cert/wpsdk.quwanzhi.com/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    client_max_body_size 50m;
+    proxy_connect_timeout 15s;
+    proxy_send_timeout 300s;
+    proxy_read_timeout 3600s;
+
+    location / {
+        proxy_pass http://127.0.0.1:8899;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    access_log /www/wwwlogs/wpsdk.quwanzhi.com.log;
+    error_log /www/wwwlogs/wpsdk.quwanzhi.com.error.log;
+}
diff --git a/sdk/docker-compose.baota.yml b/sdk/docker-compose.baota.yml
new file mode 100644
index 0000000000..5ad48d1138
--- /dev/null
+++ b/sdk/docker-compose.baota.yml
@@ -0,0 +1,85 @@
+services:
+  mongo:
+    image: docker.m.daocloud.io/library/mongo:7
+    container_name: workphone-mongo-baota
+    restart: unless-stopped
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: ${MONGO_ROOT_USERNAME:-workphone}
+      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD:?MONGO_ROOT_PASSWORD is required}
+    volumes:
+      - workphone_mongo_data:/data/db
+    networks: [workphone]
+    healthcheck:
+      test: ["CMD", "mongosh", "--quiet", "mongodb://${MONGO_ROOT_USERNAME:-workphone}:${MONGO_ROOT_PASSWORD}@127.0.0.1:27017/admin", "--eval", "db.adminCommand('ping')"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 30s
+
+  redis:
+    image: docker.1ms.run/library/redis:7-alpine
+    container_name: workphone-redis-baota
+    restart: unless-stopped
+    command: ["redis-server", "--appendonly", "yes"]
+    volumes:
+      - workphone_redis_data:/data
+    networks: [workphone]
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 3s
+      retries: 10
+
+  sdk:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: workphone-sdk-baota
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:8899:8899"
+    environment:
+      ENV: production
+      DEBUG: "false"
+      TZ: Asia/Shanghai
+      API_AUTH_ENABLED: "true"
+      API_KEY: ${API_KEY:?API_KEY is required}
+      DEVICE_PAIRING_TOKEN: ${DEVICE_PAIRING_TOKEN:?DEVICE_PAIRING_TOKEN is required}
+      MONGO_URI: mongodb://${MONGO_ROOT_USERNAME:-workphone}:${MONGO_ROOT_PASSWORD}@mongo:27017/?authSource=admin
+      MONGO_DB: workphone_sdk
+      REDIS_URL: redis://redis:6379/1
+      AI_BRAIN_ENABLED: ${AI_BRAIN_ENABLED:-false}
+      AI_BRAIN_API_URL: ${AI_BRAIN_API_URL:-https://kr-ai.quwanzhi.com}
+      AI_BRAIN_API_KEY: ${AI_BRAIN_API_KEY:-}
+      WORKPHONE_WS_FIRST: "true"
+      WECHAT_WS_HOOK_ONLY: "true"
+      WORKPHONE_HOST_ADB_PROBE: "false"
+      SERVER_FRIDA_ENABLED: ${SERVER_FRIDA_ENABLED:-false}
+      SERVER_FRIDA_HOST: ${SERVER_FRIDA_HOST:-172.18.0.1}
+      SERVER_FRIDA_PORT: ${SERVER_FRIDA_PORT:-14538}
+      SERVER_FRIDA_DEVICE_ID: ${SERVER_FRIDA_DEVICE_ID:-}
+    volumes:
+      - workphone_sdk_data:/data
+      - workphone_sdk_logs:/app/logs
+    depends_on:
+      mongo:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    networks: [workphone]
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:8899/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 90s
+
+volumes:
+  workphone_mongo_data:
+  workphone_redis_data:
+  workphone_sdk_data:
+  workphone_sdk_logs:
+
+networks:
+  workphone:
+    name: workphone-baota-network
diff --git a/sdk/launchagents/com.workphone.python-agent.plist b/sdk/launchagents/com.workphone.python-agent.plist
new file mode 100644
index 0000000000..57af67c1e5
--- /dev/null
+++ b/sdk/launchagents/com.workphone.python-agent.plist
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>com.workphone.python-agent</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/Users/karuo/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/bin/python3</string>
+    <string>agent.py</string>
+    <string>-d</string>
+    <string>xgfe65eimrrofyws</string>
+    <string>-s</string>
+    <string>ws://127.0.0.1:8899/ws/device</string>
+    <string>--heartbeat</string>
+    <string>10</string>
+  </array>
+  <key>WorkingDirectory</key>
+  <string>/Users/karuo/Documents/开发/2、私域银行/工作手机/sdk/agent</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+    <key>PYTHONPATH</key>
+    <string>/Users/karuo/Documents/开发/2、私域银行/工作手机/sdk/.runtime/python312:/Users/karuo/Documents/开发/2、私域银行/工作手机/sdk/agent</string>
+    <key>ANDROID_ADB_SERVER_PORT</key>
+    <string>5038</string>
+    <key>WP_AI_ENABLED</key>
+    <string>0</string>
+    <key>WP_FRIDA_MODE</key>
+    <string>remote</string>
+    <key>WP_FRIDA_PORT</key>
+    <string>13507</string>
+    <key>WP_DEVICE_SERIAL</key>
+    <string>192.168.110.80:5555</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>5</integer>
+  <key>ProcessType</key>
+  <string>Background</string>
+  <key>StandardOutPath</key>
+  <string>/Users/karuo/Documents/开发/2、私域银行/工作手机/sdk/logs/python-agent.out.log</string>
+  <key>StandardErrorPath</key>
+  <string>/Users/karuo/Documents/开发/2、私域银行/工作手机/sdk/logs/python-agent.err.log</string>
+</dict>
+</plist>
diff --git a/sdk/scripts/adb_bootstrap_termux_agent.sh b/sdk/scripts/adb_bootstrap_termux_agent.sh
new file mode 100755
index 0000000000..24e3a693f0
--- /dev/null
+++ b/sdk/scripts/adb_bootstrap_termux_agent.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# 运维兜底：ADB 一旦连上红米，自动在 Termux 启动 WS Agent（一次性 bootstrap，非日常主通道）
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LAN_ENV="${SCRIPT_DIR}/../config/lan.env"
+if [[ -f "$LAN_ENV" ]]; then
+  # shellcheck source=/dev/null
+  source "$LAN_ENV"
+fi
+export ANDROID_ADB_SERVER_PORT="${ANDROID_ADB_SERVER_PORT:-5038}"
+ADB=(adb -P "${ANDROID_ADB_SERVER_PORT}")
+DEVICE_IP="${DEVICE_IP:-192.168.110.80:5555}"
+DEVICE_ID="${DEVICE_ID:-xgfe65eimrrofyws}"
+SDK_BASE="${WORKPHONE_API_URL:-http://127.0.0.1:8899}"
+FRIDA_PORT="$(python3 -c "import json; print(json.load(open('${SCRIPT_DIR}/anti_detect/phantom_frida_config.json'))['listen_port'])" 2>/dev/null || echo 17263)"
+WS_URL="${WORKPHONE_WS_URL:-ws://127.0.0.1:8899/ws/device/${DEVICE_ID}}"
+LOG="/tmp/wp_adb_bootstrap_agent.log"
+MAX_WAIT="${ADB_BOOTSTRAP_WAIT:-7200}"
+
+exec >>"$LOG" 2>&1
+echo "=== $(date) adb bootstrap agent wait ${DEVICE_IP} max=${MAX_WAIT}s ==="
+
+deadline=$((SECONDS + MAX_WAIT))
+while (( SECONDS < deadline )); do
+  # 优先 USB 序列号，其次任意非 TV 的无线 device
+  serial=""
+  if [[ -n "${DEVICE_SERIAL:-}" ]] && "${ADB[@]}" -s "$DEVICE_SERIAL" get-state 2>/dev/null | grep -qx device; then
+    serial="$DEVICE_SERIAL"
+  else
+    while IFS= read -r line; do
+      s="${line%%$'\t'*}"
+      [[ -z "$s" ]] && continue
+      brand=$("${ADB[@]}" -s "$s" shell getprop ro.product.brand 2>/dev/null | tr -d '\r')
+      [[ "$brand" == "haier" ]] && continue
+      serial="$s"
+      break
+    done < <("${ADB[@]}" devices 2>/dev/null | awk '/\tdevice$/{print $1}')
+  fi
+  if [[ -n "$serial" ]]; then
+    DEVICE_IP="$serial"
+    echo "=== $(date) ADB ready serial=${serial}, bootstrap Termux Agent ==="
+    "${ADB[@]}" -s "$serial" shell "am start -n com.termux/.HomeActivity" >/dev/null 2>&1 || true
+    sleep 2
+    CMD="export WP_AGENT_ON_DEVICE=1 WP_FRIDA_MODE=remote WP_FRIDA_PORT=${FRIDA_PORT}; cd ~/workphone/agent && python agent.py -d ${DEVICE_ID} -s ${WS_URL} --heartbeat 10"
+    "${ADB[@]}" -s "$serial" shell am startservice -n com.termux/com.termux.app.RunCommandService \
+      -a com.termux.RUN_COMMAND \
+      --es com.termux.RUN_COMMAND_PATH /data/data/com.termux/files/usr/bin/bash \
+      --esa com.termux.RUN_COMMAND_ARGUMENTS "-lc,${CMD}" 2>/dev/null || {
+        echo "RunCommand 失败，请手动在 Termux 粘贴 termux_agent_bootstrap.sh 输出"
+        bash "${SCRIPT_DIR}/termux_agent_bootstrap.sh" "$DEVICE_ID"
+      }
+    echo "=== bootstrap 已触发，等待 WS 上线 ==="
+    bash "${SCRIPT_DIR}/wait_ws_agent.sh" "$DEVICE_ID" "$SDK_BASE" 120 5 && exit 0
+  fi
+  "${ADB[@]}" connect "${DEVICE_IP}" >/dev/null 2>&1 || true
+  echo "  … $(date '+%H:%M:%S') waiting phone (skip haier TV)"
+  sleep 10
+done
+echo "=== timeout ==="
+exit 1
diff --git a/sdk/scripts/adb_connection_stabilize.sh b/sdk/scripts/adb_connection_stabilize.sh
new file mode 100755
index 0000000000..9ccc4610ba
--- /dev/null
+++ b/sdk/scripts/adb_connection_stabilize.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# ADB 连接稳定化：宿主机 adb server + USB/无线扫描 + u2/ATX + Agent/WS 自检
+set -euo pipefail
+SDK_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+SDK_PORT="${SDK_PORT:-8899}"
+LAN_ENV="${SDK_ROOT}/config/lan.env"
+if [[ -f "${LAN_ENV}" ]]; then
+  # shellcheck source=/dev/null
+  source "${LAN_ENV}" || true
+fi
+WIRELESS_IPS="${WIRELESS_IPS:-192.168.110.80 192.168.1.12 192.168.0.12}"
+export ANDROID_ADB_SERVER_PORT="${ANDROID_ADB_SERVER_PORT:-5038}"
+LOG="${TMPDIR:-/tmp}/adb-stabilize-$(date +%Y%m%d_%H%M%S).log"
+
+adb() {
+  command adb -P "${ANDROID_ADB_SERVER_PORT}" "$@"
+}
+
+exec > >(tee -a "$LOG") 2>&1
+echo "=== ADB 连接稳定化 $(date) ==="
+echo "日志: $LOG"
+echo "ADB port: ${ANDROID_ADB_SERVER_PORT}"
+
+bash "${SDK_ROOT}/scripts/adb_host_server_listen_all.sh" --background || true
+sleep 1
+
+echo "--- 清理离线无线连接 ---"
+adb disconnect >/dev/null 2>&1 || true
+adb kill-server >/dev/null 2>&1 || true
+adb start-server >/dev/null 2>&1 || true
+sleep 2
+
+echo "--- USB / 已配对设备 ---"
+adb devices -l || true
+
+# 尝试无线（短超时，避免 hang）
+for ip in $WIRELESS_IPS; do
+  [[ "${ip}" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] || continue
+  ( adb connect "${ip}:5555" & pid=$!; sleep 3; kill $pid 2>/dev/null || true ) || true
+done
+adb devices -l || true
+
+SERIAL=""
+while read -r s st _rest; do
+  [[ -z "${s}" || -z "${st}" ]] && continue
+  if [[ "$st" == "device" ]]; then
+    SERIAL="$s"
+    break
+  fi
+  if [[ "$st" == "unauthorized" ]]; then
+    echo "⚠️  设备 ${s} 未授权：请在手机上点「允许 USB 调试」并选「文件传输/MTP」"
+  fi
+done < <(adb devices | awk 'NR>1 && NF>=2 {print $1, $2}')
+
+if [[ -z "$SERIAL" ]]; then
+  echo "❌ 当前无已授权 ADB 设备"
+  echo "   1) 开发者选项 → USB 调试 开启"
+  echo "   2) USB 模式 → 文件传输"
+  echo "   3) 重新插拔数据线，看手机弹窗点「允许」"
+  echo "   4) 再运行: bash sdk/scripts/adb_connection_stabilize.sh"
+  exit 1
+fi
+
+echo "✅ 已授权设备: $SERIAL"
+
+if command -v python3 >/dev/null 2>&1; then
+  echo "--- uiautomator2 init (ATX 9008) ---"
+  python3 -m uiautomator2 init --serial "$SERIAL" 2>/dev/null || \
+    python3 -m uiautomator2 init -s "$SERIAL" 2>/dev/null || \
+    echo "⚠️  u2 init 跳过（可手动: python3 -m uiautomator2 init --serial $SERIAL）"
+fi
+
+echo "--- 启动 Frida 主控 + Agent ---"
+bash "${SDK_ROOT}/scripts/frida_workphone_oneclick.sh" -d "$SERIAL" || true
+
+echo "--- 连接状态 ---"
+curl -s "http://127.0.0.1:${SDK_PORT}/api/v3/connection/status" | python3 -m json.tool 2>/dev/null || true
+curl -s "http://127.0.0.1:${SDK_PORT}/api/v3/hook/probe/${SERIAL}" | python3 -m json.tool 2>/dev/null | head -20 || true
+
+echo ""
+echo "管理端: http://127.0.0.1:${SDK_PORT}/hub"
+echo "设备控制台: http://127.0.0.1:${SDK_PORT}/static/index.html"
diff --git a/sdk/scripts/aochuang_protocol_coverage.py b/sdk/scripts/aochuang_protocol_coverage.py
new file mode 100644
index 0000000000..8b00fe8a82
--- /dev/null
+++ b/sdk/scripts/aochuang_protocol_coverage.py
@@ -0,0 +1,151 @@
+#!/usr/bin/env python3
+"""
+奥创 SDK 通信协议（客服通信接口总目录 · EnumMsgType 指令类 Task）↔ 工作手机 SDK action 覆盖矩阵。
+
+目的：对照奥创 proto 的服务端→设备「指令类任务」(1070-1270)，核对本 SDK 是否已具备
+可下发的等价 action（ACTION_TO_RPC + ACTION_ALIASES catalog）。锁定真实缺口，禁止漏项。
+
+用法: python3 sdk/scripts/aochuang_protocol_coverage.py [--md 输出.md]
+真机铁律：本脚本仅做「能力覆盖」静态核对，不代表真机已验收。
+"""
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+HE = ROOT / "sdk/agent/hook/hook_executor.py"
+
+# 奥创协议「服务端/PC → 设备」指令类任务枚举 → 本 SDK 期望 action（None = 缺口）
+# 依据 资料/工作手机客服通信接口总目录(带通信协议)SDK.doc EnumMsgType
+PROTO_TASKS: dict[str, tuple[str, str | None]] = {
+    "TalkToFriendTask(1070)":            ("给好友发消息", "send_message"),
+    "PostSNSNewsTask(1071)":             ("发朋友圈", "post_moments"),
+    "AddFriendsTask(1072)":              ("主动添加好友", "add_friend"),
+    "DeleteSNSNewsTask(1074)":           ("删除朋友圈", "delete_moments"),
+    "AcceptFriendAddRequestTask(1075)":  ("接受好友请求", "accept_friend"),
+    "WeChatGroupSendTask(1076)":         ("群发消息", "mass_send"),
+    "WeChatMaintenanceTask(1077)":       ("养号任务", "start_nurture"),
+    "RequestTalkDetailTask(1078)":       ("请求图片/视频详情", "get_message_raw_xml"),
+    "PullWeChatQrCodeTask(1079)":        ("上传当前微信二维码", "generate_my_qr_code"),
+    "TriggerFriendPushTask(1080)":       ("推送好友列表", "get_contacts"),
+    "TriggerCirclePushTask(1081)":       ("推送朋友圈列表", "get_moments"),
+    "CircleCommentDeleteTask(1082)":     ("朋友圈评论删除", "delete_moment_comment"),
+    "CircleCommentReplyTask(1084)":      ("朋友圈评论回复", "reply_moment_comment"),
+    "TriggerMessageReadTask(1086)":      ("聊天窗口置已读", "mark_conversation_read"),
+    "RevokeMessageTask(1087)":           ("消息撤回", "revoke_message"),
+    "ForwardMessageTask(1088)":          ("转发消息", "forward_message"),
+    "TriggerHistoryMsgPushTask(1089)":   ("推送历史聊天记录", "get_recent_messages"),
+    "PullChatRoomQrCodeTask(1090)":      ("获取群二维码", "generate_group_qr_code"),
+    "SendMultiPictureTask(1091)":        ("发送多张图片", "send_multi_image"),
+    "ForwardMultiMessageTask(1092)":     ("转发多条消息", "forward_multiple"),
+    "PostFriendDetectTask(1095)":        ("清粉任务", "detect_zombie_fans"),
+    "PostStopFriendDetectTask(1096)":    ("终止清粉", "stop_detect_zombie_fans"),
+    "PostMomentsPraiseTask(1098)":       ("朋友圈点赞", "like_moments"),
+    "PostStopMomentsPraiseTask(1099)":   ("停止朋友圈点赞", "stop_moments_praise"),
+    "PostStopWeChatMaintenanceTask(1100)": ("养号停止", "stop_nurture"),
+    "ModifyFriendMemoTask(1101)":        ("修改备注", "set_friend_remark"),
+    "AddFriendWithSceneTask(1102)":      ("场景加好友", "add_friend_with_scene"),
+    "TakeLuckyMoneyTask(1200)":          ("领取红包/转账", "receive_red_packet"),
+    "PullFriendCircleTask(1201)":        ("获取指定好友朋友圈", "get_friend_moments"),
+    "PullCircleDetailTask(1202)":        ("获取朋友圈图片", "get_moment_detail"),
+    "CircleLikeTask(1203)":              ("单条朋友圈点赞", "like_moments"),
+    "TriggerChatroomPushTask(1210)":     ("推送群聊列表", "get_groups"),
+    "RequestChatRoomInfoTask(1211)":     ("群聊详情", "get_group_info"),
+    "RequestContactsInfoTask(1212)":     ("联系人详情", "get_contact_info"),
+    "ChatRoomActionTask(1213)":          ("群聊管理", "set_group_name"),
+    "AddFriendInChatRoomTask(1214)":     ("群内加好友", "add_friend_in_room"),
+    "AddFriendFromPhonebookTask(1215)":  ("通讯录加好友", "add_friend_from_phonebook"),
+    "DeleteFriendTask(1216)":            ("删除好友", "delete_friend"),
+    "SendLuckyMoneyTask(1217)":          ("发红包", "send_red_packet"),
+    "RequestTalkContentTask(1218)":      ("获取消息原始xml", "get_message_raw_xml"),
+    "ForwardMessageByContentTask(1220)": ("转发消息内容", "forward_message"),
+    "ChatRoomInviteApproveTask(1221)":   ("群主确认入群申请", "approve_group_invite"),
+    "WechatLogoutTask(1222)":            ("微信登出", "logout"),
+    "PhoneActionTask(1223)":             ("手机操作(重启等)", "phone_action"),
+    "ContactLabelTask(1224)":            ("设置联系人标签", "set_contact_label"),
+    "ContactLabelDeleteTask(1225)":      ("删除联系人标签", "delete_label"),
+    "VoiceTransTextTask(1226)":          ("语音转文字", "voice_to_text"),
+    "FindContactTask(1227)":             ("查找微信联系人", "search_contacts"),
+    "AgreeJoinChatRoomTask(1229)":       ("同意加入群聊", "agree_join_group"),
+    "ClearAllChatMsgTask(1230)":         ("清空聊天记录", "clear_chat_history"),
+    "SendFriendVerifyTask(1231)":        ("聊天界面发送朋友验证", "send_friend_verify"),
+    "TriggerConversationPushTask(1232)": ("会话列表推送", "get_conversations"),
+    "WechatSettingTask(1233)":           ("微信设置(昵称/头像)", "set_nickname"),
+    "PullFriendAddReqListTask(1234)":    ("加好友请求列表", "get_friend_requests"),
+    "TriggerBizContactPushTask(1235)":   ("公众号列表", "get_official_accounts"),
+    "AddFriendNameCardTask(1236)":       ("名片加好友", "add_friend_by_card"),
+    "TriggerChatMsgIdsPushTask(1251)":   ("时间段内 msgSvrId", "get_msg_ids_by_time"),
+    "RequestTalkMsgTask(1252)":          ("按 msgSvrId 取消息", "get_message_by_id"),
+    "SearchBizContactTask(1254)":        ("搜索公众号/小程序", "search_official_account"),
+    "PhoneStateTask(1256)":              ("手机状态(电量/存储)", "get_device_info"),
+    "WeChatLocationTask(1258)":          ("微信查手机位置", "get_wechat_location"),
+    "RemittanceTask(1260)":              ("转账", "send_transfer"),
+    "WalletBalanceTask(1262)":           ("钱包余额", "get_wallet_balance"),
+    "QueryHbDetailTask(1265)":           ("查询红包详情", "query_red_packet"),
+    "JoinGroupByQrTask(1267)":           ("扫二维码进群", "join_group_by_qr"),
+    "SendJielongTask(1268)":             ("发接龙消息", "send_jielong"),
+    "ContactSetLabelTask(1270)":         ("设置用户标签", "set_contact_label"),
+    "WechatLogoutTask(cmd)":             ("账号登出命令", "logout"),
+    "PhoneActionTask(cmd-reboot)":       ("重启手机等命令", "phone_action"),
+    "UpgradeDeviceAppNotice(cmd)":       ("软件升级通知", "check_for_update"),
+}
+
+
+def load_sdk_catalog() -> set[str]:
+    text = HE.read_text(encoding="utf-8", errors="ignore")
+    a = text.split("ACTION_TO_RPC:", 1)[1].split("ACTION_ALIASES:", 1)[0]
+    b = text.split("ACTION_ALIASES:", 1)[1].split("\n\n", 1)[0]
+    rpc = set(re.findall(r'"([a-z_]+)"\s*:', a))
+    alias = set(re.findall(r'"([a-z_]+)"\s*:', b))
+    return rpc | alias
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--md", default="")
+    args = ap.parse_args()
+
+    catalog = load_sdk_catalog()
+    covered, gaps = [], []
+    for task, (cn, action) in PROTO_TASKS.items():
+        if action and action in catalog:
+            covered.append((task, cn, action))
+        elif action and action not in catalog:
+            gaps.append((task, cn, f"{action}(映射缺失)"))
+        else:
+            gaps.append((task, cn, "无对应 action"))
+
+    total = len(PROTO_TASKS)
+    lines = [
+        "# 奥创协议 ↔ 工作手机 SDK action 覆盖矩阵",
+        "",
+        f"> 真源：`资料/工作手机客服通信接口总目录(带通信协议)SDK.doc` · 自动生成 `sdk/scripts/aochuang_protocol_coverage.py`",
+        f"> 指令类任务 **{total}** 项 · 已覆盖 **{len(covered)}** · 缺口 **{len(gaps)}** · 覆盖率 **{len(covered)*100//total}%**",
+        "> 真机铁律：覆盖=能力映射就绪；真机 E2E 另见验收清单，禁止无证据标功能 ✅",
+        "",
+        "## 一、已覆盖",
+        "",
+        "| 协议任务 | 中文 | SDK action |",
+        "|:---|:---|:---|",
+    ]
+    for t, cn, a in covered:
+        lines.append(f"| {t} | {cn} | `{a}` |")
+    lines += ["", "## 二、缺口（待补 action）", "", "| 协议任务 | 中文 | 现状 |", "|:---|:---|:---|"]
+    for t, cn, a in gaps:
+        lines.append(f"| {t} | {cn} | {a} |")
+
+    md = "\n".join(lines) + "\n"
+    if args.md:
+        Path(args.md).write_text(md, encoding="utf-8")
+        print(f"已写入 {args.md}")
+    print(f"覆盖 {len(covered)}/{total} · 缺口 {len(gaps)}")
+    for t, cn, _ in gaps:
+        print(f"  GAP {t} {cn}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/sdk/scripts/auto_accept_when_ready.sh b/sdk/scripts/auto_accept_when_ready.sh
new file mode 100755
index 0000000000..b4485a8a46
--- /dev/null
+++ b/sdk/scripts/auto_accept_when_ready.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# auto_accept_when_ready.sh - guard: when phone frida attaches WeChat, auto run 3-item acceptance
+# Polls hook/probe; on supports_hook=true runs run_three_acceptance.sh and archives evidence.
+# Usage: bash sdk/scripts/auto_accept_when_ready.sh [device_id] [max_wait_sec]
+set -o pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+DEVICE="${1:-xgfe65eimrrofyws}"
+MAX_WAIT="${2:-7200}"
+BASE="${SDK_BASE_URL:-http://127.0.0.1:8899}"
+INTERVAL=10
+LOG="$ROOT/sdk/logs/auto_accept_${DEVICE}.log"
+mkdir -p "$(dirname "$LOG")"
+
+echo "[auto-accept] start $(date) device=$DEVICE max=${MAX_WAIT}s" | tee -a "$LOG"
+deadline=$(( $(date +%s) + MAX_WAIT ))
+
+while [ "$(date +%s)" -lt "$deadline" ]; do
+  # 就绪信号：diag_wcdb RPC 可用（= 新 wechat_hook_v2.js 已重载，含 WCDB 2.x 适配）
+  DIAG="$(curl -s --max-time 30 -X POST "$BASE/api/v3/hook/execute" -H 'Content-Type: application/json' \
+    -d "{\"device_id\":\"$DEVICE\",\"platform\":\"wechat\",\"action\":\"diag_wcdb\",\"params\":{},\"hook_only\":true}" 2>/dev/null)"
+  SUP="$(printf '%s' "$DIAG" | python3 -c 'import sys,json
+try:
+    d=json.load(sys.stdin); inner=d.get("data",d)
+    # 最新 JS 标志：diag_wcdb 含 main_query 实读测试字段
+    print("True" if (inner.get("success") and "main_query" in inner) else "ERR")
+except Exception:
+    print("ERR")' 2>/dev/null)"
+  SUP="${SUP:-ERR}"
+  if [ "$SUP" = "True" ]; then
+    echo "[auto-accept] $(date) diag_wcdb ok (new JS loaded) -> run 3-item acceptance" | tee -a "$LOG"
+    echo "[auto-accept] WCDB diag: $DIAG" >> "$LOG"
+    bash "$ROOT/sdk/scripts/run_three_acceptance.sh" "$DEVICE" 2>&1 | tee -a "$LOG"
+    RC="${PIPESTATUS[0]:-0}"
+    echo "[auto-accept] acceptance exit=$RC $(date)" | tee -a "$LOG"
+    exit "$RC"
+  fi
+  echo "[auto-accept] $(date '+%H:%M:%S') 新JS未就绪(diag_wcdb=$SUP)，等手机重启Agent，retry ${INTERVAL}s" >> "$LOG"
+  sleep "$INTERVAL"
+done
+
+echo "[auto-accept] timeout, frida not ready $(date)" | tee -a "$LOG"
+exit 1
diff --git a/sdk/scripts/auto_capture_when_frida_back.sh b/sdk/scripts/auto_capture_when_frida_back.sh
new file mode 100755
index 0000000000..fc17f6ab4d
--- /dev/null
+++ b/sdk/scripts/auto_capture_when_frida_back.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# 守护：轮询微信 Frida 附着状态，一旦 frida_connected=true 立即跑真机验收（截图+读/发/转发+revoke）并退出。
+# 真机铁律：只在 Frida 真附着时才跑 E2E，绝不伪造。
+set -uo pipefail
+SDK="${WORKPHONE_SDK_URL:-http://127.0.0.1:8899}"
+DEVICE_ID="${DEVICE_ID:-xgfe65eimrrofyws}"
+MAX_MIN="${MAX_MIN:-120}"        # 最长守护分钟
+INTERVAL="${INTERVAL:-30}"
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+LOG="$REPO_ROOT/sdk/tmp/auto_capture_$(date +%Y%m%d_%H%M%S).log"
+mkdir -p "$(dirname "$LOG")"
+deadline=$(( $(date +%s) + MAX_MIN*60 ))
+echo "[watch] start sdk=$SDK device=$DEVICE_ID interval=${INTERVAL}s max=${MAX_MIN}min" | tee -a "$LOG"
+while [ "$(date +%s)" -lt "$deadline" ]; do
+  R="$(curl -sS -m 15 -X POST "$SDK/api/v3/wechat/execute" -H 'Content-Type: application/json' \
+        -d "{\"device_id\":\"$DEVICE_ID\",\"action\":\"get_profile\",\"params\":{}}" 2>/dev/null)"
+  FR="$(printf '%s' "$R" | python3 -c "import sys,json
+try:
+ d=json.load(sys.stdin);print((d.get('data') or {}).get('frida_connected'))
+except: print('err')" 2>/dev/null)"
+  echo "[watch] $(date +%H:%M:%S) frida_connected=$FR" | tee -a "$LOG"
+  if [ "$FR" = "True" ]; then
+    echo "[watch] Frida 已附着 → 跑真机验收" | tee -a "$LOG"
+    WORKPHONE_SDK_URL="$SDK" DEVICE_ID="$DEVICE_ID" bash "$REPO_ROOT/sdk/scripts/run_wechat_realdevice_acceptance.sh" 2>&1 | tee -a "$LOG"
+    echo "[watch] done exit=${PIPESTATUS[0]}" | tee -a "$LOG"
+    exit 0
+  fi
+  sleep "$INTERVAL"
+done
+echo "[watch] 超时未等到 Frida 附着（${MAX_MIN}min），退出。设备侧需：微信前台+frida-server+Agent。" | tee -a "$LOG"
+exit 2
diff --git a/sdk/scripts/build_agent_config.py b/sdk/scripts/build_agent_config.py
new file mode 100755
index 0000000000..d69d93b97d
--- /dev/null
+++ b/sdk/scripts/build_agent_config.py
@@ -0,0 +1,150 @@
+#!/usr/bin/env python3
+"""生成 Termux Agent config.json — 连接顺序 ① NAS 局域网 ② 本机 Docker ③ NAS 外网 frp。
+
+与 agent.py BIND-03 / workphone.mdc §零.十 一致。
+用法:
+  python3 build_agent_config.py --device-id xgfe65eimrrofyws --out /tmp/config.json
+  python3 build_agent_config.py --print-primary   # 只输出当前可达主服 ws 基址
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import socket
+import sys
+import urllib.request
+from typing import List, Optional, Tuple
+
+SDK_PORT = 8899
+NAS_LAN_HOSTS = ("192.168.110.101", "192.168.1.201")
+NAS_FRP_HOST = "open.quwanzhi.com"
+HEARTBEAT = 10
+PROJECT_ID = "cunkebao"
+
+
+def _tcp_ok(host: str, port: int, timeout: float = 2.5) -> bool:
+    try:
+        with socket.create_connection((host, port), timeout=timeout):
+            return True
+    except OSError:
+        return False
+
+
+def _health_ok(host: str, port: int = SDK_PORT, timeout: float = 3.0) -> bool:
+    try:
+        url = f"http://{host}:{port}/health"
+        with urllib.request.urlopen(url, timeout=timeout) as resp:
+            return resp.status == 200
+    except Exception:
+        return False
+
+
+def pick_mac_lan_ip() -> str:
+    import subprocess
+
+    try:
+        out = subprocess.check_output(["ifconfig"], text=True, stderr=subprocess.DEVNULL)
+    except Exception:
+        return "127.0.0.1"
+    ips: List[str] = []
+    for line in out.splitlines():
+        parts = line.strip().split()
+        if len(parts) >= 2 and parts[0] == "inet":
+            ip = parts[1]
+            if ip.startswith("127.") or ip.startswith("198.18."):
+                continue
+            ips.append(ip)
+    for ip in ips:
+        if ip.startswith("192.168.110."):
+            return ip
+    for ip in ips:
+        if ip.startswith("192.168.") or ip.startswith("10."):
+            return ip
+    return ips[0] if ips else "127.0.0.1"
+
+
+def resolve_primary(for_phone: bool = False) -> Tuple[str, str, List[str]]:
+    """返回 (primary_ws_base, tier, ordered_ws_bases)。
+
+    手机/本机统一顺序（BIND-03 · workphone.mdc §零.十）：
+    ① NAS 局域网 → ② 本机 Mac Docker 局域网 → ③ NAS 外网 frp；
+    Agent 运行时 TCP 探测，连不上自动切下一候选。
+    """
+    mac_ip = pick_mac_lan_ip()
+    nas_bases = [(f"ws://{h}:{SDK_PORT}/ws/device", "nas_lan") for h in NAS_LAN_HOSTS]
+    frp_base = (f"ws://{NAS_FRP_HOST}:{SDK_PORT}/ws/device", "nas_frp")
+    mac_base = (f"ws://{mac_ip}:{SDK_PORT}/ws/device", "mac_docker") if mac_ip != "127.0.0.1" else None
+
+    ordered: List[Tuple[str, str]] = list(nas_bases)
+    if mac_base:
+        ordered.append(mac_base)
+    ordered.append(frp_base)
+
+    if for_phone:
+        # 手机 OTA：固定 NAS 为主连接写入 config，public_servers 按序探测（局域网优先于公网）
+        primary_ws, tier = nas_bases[0][0], "nas_lan"
+        bases = [b for b, _ in ordered]
+        seen = set()
+        ordered_bases: List[str] = []
+        for b in bases:
+            if b not in seen:
+                seen.add(b)
+                ordered_bases.append(b)
+        return primary_ws, tier, ordered_bases
+
+    primary_ws, tier = ordered[0][0], ordered[0][1]
+    for ws_base, t in ordered:
+        host = ws_base.split("//")[1].split(":")[0]
+        if _health_ok(host, SDK_PORT):
+            primary_ws, tier = ws_base, t
+            break
+
+    bases: List[str] = []
+    seen = set()
+    for ws_base, _ in ordered:
+        if ws_base not in seen:
+            seen.add(ws_base)
+            bases.append(ws_base)
+    bases = [primary_ws] + [b for b in bases if b != primary_ws]
+    return primary_ws, tier, bases
+
+
+def build_config(device_id: str, for_phone: bool = False) -> dict:
+    primary_ws, tier, bases = resolve_primary(for_phone=for_phone)
+    return {
+        "device_id": device_id,
+        "server_url": primary_ws,
+        "public_servers": [b for b in bases if b != primary_ws],
+        "heartbeat_interval": HEARTBEAT,
+        "project_id": PROJECT_ID,
+        "connection_priority": ["nas_lan", "mac_docker", "nas_frp"],
+        "_meta": {"primary_tier": tier, "generator": "build_agent_config.py"},
+    }
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--device-id", default="xgfe65eimrrofyws")
+    ap.add_argument("--out", default="")
+    ap.add_argument("--print-primary", action="store_true")
+    ap.add_argument("--for-phone", action="store_true", help="手机 OTA：NAS→frp→Mac")
+    args = ap.parse_args()
+
+    primary_ws, tier, _ = resolve_primary(for_phone=args.for_phone)
+    if args.print_primary:
+        print(primary_ws)
+        print(tier, file=sys.stderr)
+        return 0
+
+    cfg = build_config(args.device_id, for_phone=args.for_phone)
+    text = json.dumps(cfg, ensure_ascii=False, indent=2)
+    if args.out:
+        with open(args.out, "w", encoding="utf-8") as f:
+            f.write(text)
+    else:
+        print(text)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/sdk/scripts/clean_aochuang_device.sh b/sdk/scripts/clean_aochuang_device.sh
new file mode 100755
index 0000000000..81be82237e
--- /dev/null
+++ b/sdk/scripts/clean_aochuang_device.sh
@@ -0,0 +1,252 @@
+#!/usr/bin/env bash
+# 奥创工作手机 · 真机清机（保留机擎 com.system.cloudservice + Magisk/Frida 基建）
+# 真源 Skill：机擎/阿服/奥创真机清机/SKILL.md
+# 用法：
+#   bash sdk/scripts/clean_aochuang_device.sh [--dry-run|--apply] [-s SERIAL] [--deep]
+# 默认 --dry-run；真清须显式 --apply
+
+set -euo pipefail
+
+SERIAL=""
+MODE="dry-run"
+DEEP=0
+EVIDENCE_DIR=""
+DEFAULT_SERIAL="xgfe65eimrrofyws"
+
+# 奥创/S2 手机端包（资料真源：奥创微信控制接口与插件提取复用指南.md）
+AOCHUANG_PACKAGES=(
+  "org.xeslciw.manager"          # XESlciw Manager v1.8.4
+  "top.zzz.vivwxjz"              # VivWxjz 微信 Hook
+  "uni.UNI9421F6C"               # AI数智员工 / 007 业务入口
+)
+
+# 可能关联（--deep 才卸）
+AOCHUANG_OPTIONAL_PACKAGES=(
+  "io.github.vvb2060.mahoshojo"  # 魔法少女（资料提及同链路工具）
+)
+
+KEEP_PACKAGES=(
+  "com.system.cloudservice"      # 机擎 Agent（禁止卸）
+  "com.tencent.mm"               # 微信（默认保留数据）
+)
+
+# 框架/寄生目录（须 root）
+AOCHUANG_ROOT_PATHS=(
+  "/data/adb/xesd"
+  "/data/adb/modules/xeslciw"
+  "/data/adb/modules/XESlciw"
+  "/data/adb/modules/grvjfe"
+  "/data/adb/modules/vivwxjz"
+)
+
+# 常见残留 app 分区路径（资料：奥创工作手机-复刻开发详解.md §APK路径）
+AOCHUANG_APP_DIRS=(
+  "/data/app/manager_sign"
+  "/data/app/VivWxjz"
+  "/data/app/~~*org.xeslciw.manager*"
+  "/data/app/~~*top.zzz.vivwxjz*"
+  "/data/app/~~*uni.UNI9421F6C*"
+)
+
+usage() {
+  cat <<'EOF'
+奥创真机清机 — clean_aochuang_device.sh
+
+  bash sdk/scripts/clean_aochuang_device.sh [选项]
+
+选项：
+  --dry-run     仅扫描+打印将执行的操作（默认）
+  --apply       实际清理（须 ADB device + 建议 Root）
+  -s SERIAL     设备序列号（默认唯一在线设备或 xgfe65eimrrofyws）
+  --deep        额外卸 mahoshojo + 清 007 业务 app 数据目录
+  --evidence DIR  留痕目录（默认 开发文档/8、部署/05-测试验收/YYYYMMDD_奥创清机_<serial>/）
+
+保留（永不卸）：com.system.cloudservice、Magisk、机擎 Frida 基建
+EOF
+}
+
+log() { printf '[%s] %s\n' "$(date '+%H:%M:%S')" "$*"; }
+run_adb() { adb -s "$SERIAL" "$@"; }
+run_sh() { run_adb shell "$@"; }
+
+pick_su() {
+  run_sh 'for p in /sbin/su /system/bin/su /system/xbin/su su; do
+    if [ -x "$p" ] 2>/dev/null || command -v "$p" >/dev/null 2>&1; then echo "$p"; exit 0; fi
+  done; exit 1' 2>/dev/null || true
+}
+
+run_root() {
+  local cmd="$1"
+  local su
+  su="$(pick_su)"
+  if [[ -z "$su" ]]; then
+    log "WARN: 无 su，跳过 root 操作: $cmd"
+    return 1
+  fi
+  if [[ "$MODE" == "dry-run" ]]; then
+    log "DRY su -c $(printf '%q' "$cmd")"
+    return 0
+  fi
+  run_sh "$su -c $(printf '%q' "$cmd")" || return 1
+}
+
+pkg_installed() {
+  local pkg="$1"
+  run_sh pm path "$pkg" 2>/dev/null | grep -q .
+}
+
+do_uninstall_pkg() {
+  local pkg="$1"
+  if ! pkg_installed "$pkg"; then
+    log "SKIP 未安装: $pkg"
+    return 0
+  fi
+  if [[ "$MODE" == "dry-run" ]]; then
+    log "DRY pm uninstall --user 0 $pkg"
+    log "DRY pm uninstall $pkg"
+    return 0
+  fi
+  log "卸载: $pkg"
+  run_sh pm disable-user --user 0 "$pkg" 2>/dev/null || true
+  run_sh am force-stop "$pkg" 2>/dev/null || true
+  run_sh pm uninstall --user 0 "$pkg" 2>/dev/null || run_sh pm uninstall "$pkg" 2>/dev/null || log "WARN 卸载失败: $pkg"
+}
+
+clear_pkg_data() {
+  local pkg="$1"
+  if [[ "$MODE" == "dry-run" ]]; then
+    log "DRY pm clear $pkg"
+    return 0
+  fi
+  run_sh pm clear "$pkg" 2>/dev/null || true
+}
+
+remove_root_path() {
+  local p="$1"
+  if [[ "$MODE" == "dry-run" ]]; then
+    log "DRY rm -rf $p"
+    return 0
+  fi
+  run_root "rm -rf $(printf '%q' "$p")" || true
+}
+
+scan_magisk_modules() {
+  log "== Magisk 模块扫描（名称含 xes/grvjfe/vivwx/lsposed 且非机擎） =="
+  run_root 'ls -1 /data/adb/modules 2>/dev/null' | while read -r m; do
+    [[ -z "$m" ]] && continue
+    if echo "$m" | grep -qiE 'xes|grvjfe|vivwx|lsposed|edxposed|xposed'; then
+      if echo "$m" | grep -qiE 'shamiko|zygisk|rezygisk|riru'; then
+        log "KEEP Magisk模块(机擎基建): $m"
+      else
+        if [[ "$MODE" == "dry-run" ]]; then
+          log "DRY 将禁用并移除模块: $m"
+        else
+          log "移除 Magisk 模块: $m"
+          run_root "touch /data/adb/modules/$m/disable" || true
+          run_root "rm -rf /data/adb/modules/$m" || true
+        fi
+      fi
+    fi
+  done || true
+}
+
+write_evidence() {
+  [[ -z "$EVIDENCE_DIR" ]] && return 0
+  mkdir -p "$EVIDENCE_DIR"
+  {
+    echo "# 奥创清机留痕 $(date '+%Y-%m-%d %H:%M:%S')"
+    echo "serial=$SERIAL mode=$MODE deep=$DEEP"
+    echo ""
+    echo "## pm list packages (filter)"
+    run_sh pm list packages 2>/dev/null | grep -iE 'xes|zzz|vivwx|UNI9421|mahoshojo|cloudservice' || true
+    echo ""
+    echo "## xesd"
+    run_sh "ls -la /data/adb/xesd/ 2>/dev/null || echo NO_XESD" || true
+  } >"$EVIDENCE_DIR/clean_report.txt"
+  log "留痕: $EVIDENCE_DIR/clean_report.txt"
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --apply) MODE="apply" ;;
+    --dry-run) MODE="dry-run" ;;
+    -s) SERIAL="${2:-}"; shift ;;
+    --deep) DEEP=1 ;;
+    --evidence) EVIDENCE_DIR="${2:-}"; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "未知参数: $1"; usage; exit 1 ;;
+  esac
+  shift
+done
+
+if [[ -z "$SERIAL" ]]; then
+  SERIAL="$(adb devices 2>/dev/null | awk 'NR>1 && $2=="device" {print $1; exit}')"
+  [[ -z "$SERIAL" ]] && SERIAL="$DEFAULT_SERIAL"
+fi
+
+if ! adb devices 2>/dev/null | awk -v s="$SERIAL" '$1==s && $2=="device" {found=1} END{exit !found}'; then
+  echo "FAIL: 设备 $SERIAL 未在线（adb devices 无 device）"
+  exit 1
+fi
+
+if [[ -z "$EVIDENCE_DIR" ]]; then
+  EVIDENCE_DIR="$(cd "$(dirname "$0")/../.." && pwd)/开发文档/8、部署/05-测试验收/$(date '+%Y%m%d')_奥创清机_${SERIAL}"
+fi
+
+log "== 奥创真机清机 mode=$MODE serial=$SERIAL deep=$DEEP =="
+
+for k in "${KEEP_PACKAGES[@]}"; do
+  if pkg_installed "$k"; then
+    log "KEEP 保留: $k"
+  fi
+done
+
+log "== 1/6 停止并卸载奥创 APK =="
+for pkg in "${AOCHUANG_PACKAGES[@]}"; do
+  do_uninstall_pkg "$pkg"
+done
+if [[ "$DEEP" == "1" ]]; then
+  for pkg in "${AOCHUANG_OPTIONAL_PACKAGES[@]}"; do
+    do_uninstall_pkg "$pkg"
+  done
+fi
+
+log "== 2/6 清理 app 数据（已卸包） =="
+for pkg in "${AOCHUANG_PACKAGES[@]}"; do
+  clear_pkg_data "$pkg"
+done
+
+log "== 3/6 移除框架目录 /data/adb/xesd 等 =="
+for p in "${AOCHUANG_ROOT_PATHS[@]}"; do
+  remove_root_path "$p"
+done
+
+log "== 4/6 Magisk 奥创相关模块 =="
+scan_magisk_modules
+
+log "== 5/6 残留分区路径 =="
+for p in "${AOCHUANG_APP_DIRS[@]}"; do
+  if [[ "$p" == *'*'* ]]; then
+    if [[ "$MODE" == "dry-run" ]]; then
+      log "DRY rm -rf $p"
+    else
+      run_root "rm -rf $p" 2>/dev/null || true
+    fi
+  else
+    remove_root_path "$p"
+  fi
+done
+
+log "== 6/6 重启提示 =="
+if [[ "$MODE" == "apply" ]]; then
+  log "建议: adb -s $SERIAL reboot（Magisk 模块变更后）"
+fi
+
+write_evidence
+
+if [[ "$MODE" == "dry-run" ]]; then
+  log "完成（dry-run）。真清请: bash sdk/scripts/clean_aochuang_device.sh --apply -s $SERIAL"
+  log "验收: bash sdk/scripts/verify_aochuang_clean.sh -s $SERIAL"
+else
+  log "完成（apply）。请跑验收脚本确认全绿。"
+fi
diff --git a/sdk/scripts/connection_keeper_daemon.sh b/sdk/scripts/connection_keeper_daemon.sh
new file mode 100755
index 0000000000..d8752acf91
--- /dev/null
+++ b/sdk/scripts/connection_keeper_daemon.sh
@@ -0,0 +1,210 @@
+#!/usr/bin/env bash
+# 宿主机连接守护：ADB + WS Agent 常驻保活（处理长任务时也不断链）
+# 用法:
+#   bash sdk/scripts/connection_keeper_daemon.sh          # 前台
+#   bash sdk/scripts/connection_keeper_daemon.sh --bg     # 后台
+#   bash sdk/scripts/connection_keeper_daemon.sh --once   # 只跑一轮稳定化
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SDK_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+LAN_ENV="${SDK_ROOT}/config/lan.env"
+REQUESTED_ADB_PORT="${ANDROID_ADB_SERVER_PORT:-}"
+[[ -f "${LAN_ENV}" ]] && source "${LAN_ENV}" || true
+[[ -n "${REQUESTED_ADB_PORT}" ]] && export ANDROID_ADB_SERVER_PORT="${REQUESTED_ADB_PORT}"
+SDK_PORT="${WORKPHONE_SDK_PORT:-8899}"
+INTERVAL="${KEEPER_INTERVAL:-15}"
+FAST_INTERVAL="${KEEPER_FAST_INTERVAL:-8}"
+DEVICE_SERIAL="${DEVICE_SERIAL:-}"
+DEVICE_ID="${DEVICE_ID:-xgfe65eimrrofyws}"
+export ANDROID_ADB_SERVER_PORT="${ANDROID_ADB_SERVER_PORT:-5037}"
+ADB=(adb -P "${ANDROID_ADB_SERVER_PORT}")
+LOG="${SDK_ROOT}/logs/connection_keeper.log"
+PID_FILE="${SDK_ROOT}/logs/connection_keeper.pid"
+
+mkdir -p "${SDK_ROOT}/logs"
+
+log() { echo "[$(date '+%F %T')] $*" | tee -a "$LOG"; }
+
+is_phone_serial() {
+  local s="$1"
+  local brand
+  brand=$("${ADB[@]}" -s "$s" shell getprop ro.product.brand 2>/dev/null | tr -d '\r')
+  [[ "$brand" != "haier" ]]
+}
+
+pick_serial() {
+  if [[ -n "$DEVICE_SERIAL" ]]; then
+    if "${ADB[@]}" -s "$DEVICE_SERIAL" get-state 2>/dev/null | grep -qx device && is_phone_serial "$DEVICE_SERIAL"; then
+      echo "$DEVICE_SERIAL"
+      return
+    fi
+  fi
+  local s
+  while IFS= read -r s; do
+    [[ -z "$s" ]] && continue
+    is_phone_serial "$s" || continue
+    echo "$s"
+    return
+  done < <("${ADB[@]}" devices 2>/dev/null | awk '/\tdevice$/{print $1}')
+}
+
+usb_xiaomi_present() {
+  ioreg -p IOUSB -l 2>/dev/null | grep -q "Xiaomi" 2>/dev/null
+}
+
+try_wireless_ports() {
+  local host="${1:-192.168.1.12}"
+  if usb_xiaomi_present; then
+    log "USB Xiaomi detected → skip wireless port scan (优先等 MTP/授权)"
+    return 1
+  fi
+  ping -c 1 -W 2 "$host" >/dev/null 2>&1 || return 1
+  "${ADB[@]}" reconnect offline >/dev/null 2>&1 || true
+  local p open_port="" hits=0
+  for p in 5555 $(seq 37000 37005); do
+    if nc -z -G 1 "$host" "$p" 2>/dev/null; then
+      hits=$((hits + 1))
+      [[ "$hits" -gt 3 ]] && break
+      log "wireless port open ${host}:${p} → adb connect"
+      ( "${ADB[@]}" connect "${host}:${p}" & pid=$!; sleep 3; kill $pid 2>/dev/null; wait $pid 2>/dev/null ) || true
+      if "${ADB[@]}" -s "${host}:${p}" get-state 2>/dev/null | grep -qx device; then
+        DEVICE_SERIAL="${host}:${p}"
+        echo "$DEVICE_SERIAL"
+        return 0
+      fi
+      "${ADB[@]}" disconnect "${host}:${p}" >/dev/null 2>&1 || true
+    fi
+  done
+  return 1
+}
+
+ws_online_count() {
+  curl -s "http://127.0.0.1:${SDK_PORT}/api/v3/connection/status" 2>/dev/null | \
+    python3 -c "import sys,json;d=json.load(sys.stdin).get('data',{});print(d.get('online_ws_count',0))" 2>/dev/null || echo 0
+}
+
+u2_online() {
+  curl -s "http://127.0.0.1:${SDK_PORT}/api/v3/devices/${DEVICE_ID}" 2>/dev/null | \
+    python3 -c "import sys,json;d=json.load(sys.stdin).get('data',{});print('1' if d.get('quick_status',{}).get('u2') else '0')" 2>/dev/null || echo 0
+}
+
+ensure_adb_server() {
+  if nc -z 127.0.0.1 "${ANDROID_ADB_SERVER_PORT}" 2>/dev/null; then
+    return 0
+  fi
+  "${ADB[@]}" start-server 2>/dev/null || true
+  sleep 1
+}
+
+adb_devices_safe() {
+  ( "${ADB[@]}" devices "$@" & pid=$!; sleep 8; kill "$pid" 2>/dev/null; wait "$pid" 2>/dev/null ) 2>/dev/null || true
+}
+
+keeper_once() {
+  ensure_adb_server
+
+  ws="$(ws_online_count)"
+  u2_ok="$(u2_online)"
+  if [[ "$ws" -ge 1 && "$u2_ok" == "1" ]]; then
+    log "ok ws_online=${ws} u2=1"
+    return 0
+  fi
+  if [[ "$ws" -ge 1 ]]; then
+    log "ws_online=${ws} but u2=${u2_ok} → continue adb/u2 recovery"
+  fi
+
+  serial="$(pick_serial || true)"
+  if [[ -z "$serial" ]]; then
+    if usb_xiaomi_present; then
+      log "USB 已插入但未 adb device → 请在手机选「传输文件」并允许 USB 调试；或开启无线调试"
+      # USB 未授权时仍尝试无线 ADB（与 USB 并行）
+      for ip in ${WIRELESS_IPS:-192.168.110.80 192.168.3.1}; do
+        if serial="$(try_wireless_ports "$ip" || true)" && [[ -n "$serial" ]]; then
+          log "wireless adb ok ${serial}"
+          break
+        fi
+      done
+      serial="$(pick_serial || true)"
+    else
+      for ip in ${WIRELESS_IPS:-192.168.110.80 192.168.110.60 192.168.110.197 192.168.3.1 192.168.1.12}; do
+        if serial="$(try_wireless_ports "$ip" || true)" && [[ -n "$serial" ]]; then
+          break
+        fi
+        ( "${ADB[@]}" connect "${ip}:5555" & pid=$!; sleep 3; kill "$pid" 2>/dev/null; wait "$pid" 2>/dev/null ) || true
+      done
+      serial="$(pick_serial || true)"
+    fi
+  fi
+
+  if [[ -z "$serial" ]]; then
+    log "no adb device — 若手机 Termux Agent 已配置 NAS/frp 寻服，可忽略；否则 USB 授权一次做 OTA"
+    bash "${SCRIPT_DIR}/sdk_connection_watcher.sh" --once >>"$LOG" 2>&1 || true
+    ws="$(ws_online_count)"
+    [[ "$ws" -ge 1 ]] && log "sdk_watcher recovered ws=${ws}" && return 0
+    return 1
+  fi
+
+  state="$("${ADB[@]}" -s "$serial" get-state 2>/dev/null || echo offline)"
+  if [[ "$state" == "unauthorized" ]]; then
+    log "adb unauthorized serial=${serial} → 请在手机点「允许 USB 调试」"
+    return 1
+  fi
+  if [[ "$state" != "device" ]]; then
+    log "adb not ready serial=${serial} state=${state}"
+    return 1
+  fi
+
+  ws="$(ws_online_count)"
+  if [[ "$ws" -ge 1 ]]; then
+    log "ok serial=${serial} ws_online=${ws}"
+    return 0
+  fi
+
+  log "adb ok but ws=0 → termux/on-device agent serial=${serial}"
+  DEVICE_SERIAL="$serial" DEVICE_ID="${DEVICE_ID:-xgfe65eimrrofyws}" \
+    bash "${SCRIPT_DIR}/termux_push_and_start_agent.sh" >>"$LOG" 2>&1 || true
+  ws="$(ws_online_count)"
+  if [[ "$ws" -ge 1 ]]; then
+    log "termux/oneclick ok ws_online=${ws}"
+    return 0
+  fi
+  log "still ws=0 after termux_push"
+  return 1
+}
+
+keeper_loop() {
+  log "connection_keeper start interval=${INTERVAL}s fast=${FAST_INTERVAL}s port=${SDK_PORT} lan=${WORKPHONE_LAN_IP:-auto}"
+  while true; do
+    if keeper_once; then
+      sleep "$INTERVAL"
+    else
+      sleep "$FAST_INTERVAL"
+    fi
+  done
+}
+
+case "${1:-}" in
+  --once)
+    keeper_once
+    ;;
+  --bg)
+    if [[ -f "$PID_FILE" ]] && kill -0 "$(cat "$PID_FILE")" 2>/dev/null; then
+      echo "已在运行 PID $(cat "$PID_FILE")"
+      exit 0
+    fi
+    nohup bash "$0" >>"$LOG" 2>&1 &
+    echo $! >"$PID_FILE"
+    echo "connection_keeper 后台 PID $(cat "$PID_FILE") log=$LOG"
+    ;;
+  --stop)
+    if [[ -f "$PID_FILE" ]]; then
+      kill "$(cat "$PID_FILE")" 2>/dev/null || true
+      rm -f "$PID_FILE"
+      echo "已停止"
+    fi
+    ;;
+  *)
+    keeper_loop
+    ;;
+esac
diff --git a/sdk/scripts/deploy_baota_wpsdk.sh b/sdk/scripts/deploy_baota_wpsdk.sh
new file mode 100755
index 0000000000..b3e26a0b0a
--- /dev/null
+++ b/sdk/scripts/deploy_baota_wpsdk.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TARGET="${TARGET:-cunkebao}"
+REMOTE_DIR="${REMOTE_DIR:-/www/wwwroot/workphone-sdk}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SDK_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+ssh "$TARGET" "mkdir -p '$REMOTE_DIR/app' '$REMOTE_DIR/agent' '$REMOTE_DIR/deploy/baota'"
+
+rsync -az --delete \
+  --exclude '__pycache__' --exclude '*.pyc' --exclude '*.log' \
+  --exclude 'data/cunke_bao_config.json' --exclude 'data/hook/events.jsonl' \
+  --exclude 'data/operation_logs' --exclude 'agent/config.json' \
+  "$SDK_ROOT/app/" "$TARGET:$REMOTE_DIR/app/"
+
+rsync -az --delete \
+  --exclude '__pycache__' --exclude '*.pyc' --exclude '*.log' \
+  --exclude 'config.json' --exclude 'config.*.json' \
+  "$SDK_ROOT/agent/" "$TARGET:$REMOTE_DIR/agent/"
+
+rsync -az \
+  "$SDK_ROOT/Dockerfile" "$SDK_ROOT/.dockerignore" "$SDK_ROOT/requirements.txt" \
+  "$SDK_ROOT/docker-compose.baota.yml" "$TARGET:$REMOTE_DIR/"
+rsync -az "$SDK_ROOT/deploy/baota/wpsdk.quwanzhi.com.conf" "$TARGET:$REMOTE_DIR/deploy/baota/"
+
+ssh "$TARGET" "REMOTE_DIR='$REMOTE_DIR' bash -s" <<'REMOTE'
+set -euo pipefail
+cd "$REMOTE_DIR"
+if [[ ! -f .env ]]; then
+  umask 077
+  mongo_password="$(openssl rand -hex 24)"
+  api_key="$(openssl rand -hex 32)"
+  pairing_token="$(openssl rand -hex 32)"
+  printf 'MONGO_ROOT_USERNAME=workphone\nMONGO_ROOT_PASSWORD=%s\nAPI_KEY=%s\nDEVICE_PAIRING_TOKEN=%s\nAI_BRAIN_ENABLED=false\nAI_BRAIN_API_URL=https://kr-ai.quwanzhi.com\nAI_BRAIN_API_KEY=\n' \
+    "$mongo_password" "$api_key" "$pairing_token" > .env
+fi
+chmod 600 .env
+docker compose -f docker-compose.baota.yml up -d --build
+install -d -m 755 /www/server/panel/vhost/cert/wpsdk.quwanzhi.com
+install -m 644 /root/.acme.sh/quwanzhi.com_ecc/fullchain.cer /www/server/panel/vhost/cert/wpsdk.quwanzhi.com/fullchain.pem
+install -m 600 /root/.acme.sh/quwanzhi.com_ecc/quwanzhi.com.key /www/server/panel/vhost/cert/wpsdk.quwanzhi.com/privkey.pem
+install -m 644 deploy/baota/wpsdk.quwanzhi.com.conf /www/server/panel/vhost/nginx/wpsdk.quwanzhi.com.conf
+/www/server/nginx/sbin/nginx -t
+/www/server/nginx/sbin/nginx -s reload
+REMOTE
+
+echo "部署完成：https://wpsdk.quwanzhi.com/health"
diff --git a/sdk/scripts/deploy_nas_rsync.sh b/sdk/scripts/deploy_nas_rsync.sh
index c03cc61e5c..bcd8bacf7f 100755
--- a/sdk/scripts/deploy_nas_rsync.sh
+++ b/sdk/scripts/deploy_nas_rsync.sh
@@ -47,6 +47,10 @@ ssh "${NAS_USER}@${NAS_HOST}" "mkdir -p '${NAS_DIR}'"
 # 严格排除非镜像构建所需目录（.runtime 含 46w+ 缓存文件，android-app/typescript-sdk/php-sdk 不进镜像）
 rsync -avz \
   --exclude '.git' \
+  --exclude '.env' \
+  --exclude '.env.*' \
+  --exclude '*secret*' \
+  --exclude '*credential*' \
   --exclude '__pycache__' \
   --exclude '*.pyc' \
   --exclude 'node_modules' \
diff --git a/sdk/scripts/ensure_ws_agent.sh b/sdk/scripts/ensure_ws_agent.sh
index c1f9c40a49..ef7a79e109 100755
--- a/sdk/scripts/ensure_ws_agent.sh
+++ b/sdk/scripts/ensure_ws_agent.sh
@@ -7,6 +7,7 @@ SDK_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 DEVICE_SERIAL="${DEVICE_SERIAL:-192.168.110.80:5555}"
 SDK_PORT="${SDK_PORT:-8899}"
 PH_CFG="${SDK_ROOT}/scripts/anti_detect/phantom_frida_config.json"
+PH_KEEPALIVE="${SDK_ROOT}/scripts/phantom_frida_keepalive.sh"
 LOG="/tmp/wp_agent_ws.log"
 
 if [[ ! -f "$PH_CFG" ]]; then
@@ -15,6 +16,11 @@ if [[ ! -f "$PH_CFG" ]]; then
 fi
 
 PH_PORT=$(python3 -c "import json; print(json.load(open('${PH_CFG}'))['listen_port'])")
+# 只允许一个读同一 phantom 配置的保活器，避免 Frida 重启后回到默认/随机端口。
+if ! pgrep -f "${PH_KEEPALIVE} ${DEVICE_SERIAL}" >/dev/null 2>&1; then
+  nohup bash "${PH_KEEPALIVE}" "${DEVICE_SERIAL}" \
+    >> /tmp/phantom_frida_keepalive.log 2>&1 &
+fi
 adb -s "${DEVICE_SERIAL}" forward "tcp:${PH_PORT}" "tcp:${PH_PORT}" >/dev/null 2>&1 || true
 
 pkill -f "agent.py -d ${DEVICE_SERIAL} -s ws://127.0.0.1:${SDK_PORT}" 2>/dev/null || true
diff --git a/sdk/scripts/ensure_ws_agent_wireless.sh b/sdk/scripts/ensure_ws_agent_wireless.sh
new file mode 100755
index 0000000000..b97d72bee1
--- /dev/null
+++ b/sdk/scripts/ensure_ws_agent_wireless.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# 无线主控：设备端 Termux Agent + 本机 Frida，无需 Mac ADB
+# 用法: bash ensure_ws_agent_wireless.sh [SDK_HOST:PORT] [device_id]
+set -euo pipefail
+SDK_HOST="${1:-127.0.0.1:8899}"
+DEVICE_ID="${2:-xgfe65eimrrofyws}"
+WS_URL="ws://${SDK_HOST}/ws/device/${DEVICE_ID}"
+
+echo "================================================================"
+echo "  工作手机 · 无线主控（WebSocket + 设备本机 Frida）"
+echo "  不需要 Mac USB ADB；execute/probe 全走 WS"
+echo "================================================================"
+echo ""
+echo "【请在红米 Termux 执行】"
+echo ""
+FRIDA_PORT="$(python3 -c "import json; print(json.load(open('$(dirname "$0")/anti_detect/phantom_frida_config.json'))['listen_port'])" 2>/dev/null || echo 17263)"
+cat <<EOF
+# 1) 确保 frida-server 在手机本机运行（Root，phantom 端口见 phantom_frida_config.json）
+# 2) 启动 Agent（连 SDK）：
+export WP_AGENT_ON_DEVICE=1
+export WP_FRIDA_MODE=remote
+export WP_FRIDA_PORT=${FRIDA_PORT}
+export WP_AUTO_DISCOVER=1
+cd ~/workphone/agent   # 或你同步 agent 目录的路径
+python agent.py -d ${DEVICE_ID} --heartbeat 10
+# 可选手填: -s ${WS_URL}
+EOF
+echo ""
+echo "【Mac 端仅保留 SDK】"
+echo "  curl http://${SDK_HOST}/api/v3/connection/status"
+echo "  curl http://${SDK_HOST}/api/v3/hook/probe/${DEVICE_ID}"
+echo ""
+echo "【勿再使用】Mac 上 ensure_ws_agent.sh（需 ADB forward，与无线口径冲突）"
+echo ""
+# 可选：停掉 Mac 侧假 Agent
+pkill -f "agent.py -d ${DEVICE_ID} -s ws://" 2>/dev/null || true
+curl -s "http://${SDK_HOST}/api/v3/connection/status" | python3 -m json.tool 2>/dev/null | head -20 || true
diff --git a/sdk/scripts/extract_aochuang_to_ziliao.sh b/sdk/scripts/extract_aochuang_to_ziliao.sh
new file mode 100644
index 0000000000..cbbc20737d
--- /dev/null
+++ b/sdk/scripts/extract_aochuang_to_ziliao.sh
@@ -0,0 +1,152 @@
+#!/usr/bin/env bash
+# 奥创工作手机 · 真机全量提取到 资料/奥创工作手机APK提取/
+# 真源：资料/奥创微信控制接口与插件提取复用指南.md · 机擎/阿服/奥创真机清机/SKILL.md
+#
+# 用法：
+#   bash sdk/scripts/extract_aochuang_to_ziliao.sh [-s SERIAL] [--decompile]
+#
+# 前置：Type-C USB 调试 + adb devices 见 device（或无线 adb connect）
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+OUT="${ROOT}/资料/奥创工作手机APK提取"
+EVID="${ROOT}/开发文档/8、部署/05-测试验收/$(date +%Y%m%d)_奥创资料提取_$(date +%H%M%S)"
+SERIAL=""
+DECOMPILE=0
+DEFAULT_SERIAL="xgfe65eimrrofyws"
+
+AOCHUANG_PACKAGES=(
+  "org.xeslciw.manager"
+  "top.zzz.vivwxjz"
+  "uni.UNI9421F6C"
+)
+
+AOCHUANG_ROOT_PATHS=(
+  "/data/adb/xesd"
+  "/data/adb/modules"
+)
+
+log() { printf '[%s] %s\n' "$(date '+%H:%M:%S')" "$*"; }
+
+usage() {
+  cat <<'EOF'
+奥创真机全量提取 → 资料/奥创工作手机APK提取/
+
+  bash sdk/scripts/extract_aochuang_to_ziliao.sh [-s SERIAL] [--decompile]
+
+  --decompile   额外 apktool 反编译到 decompiled/<包名>/
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -s) SERIAL="$2"; shift 2 ;;
+    --decompile) DECOMPILE=1; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "未知参数: $1"; usage; exit 1 ;;
+  esac
+done
+
+pick_serial() {
+  if [[ -n "$SERIAL" ]]; then return; fi
+  local online
+  online="$(adb devices | awk '/\tdevice$/{print $1; exit}')"
+  if [[ -n "$online" ]]; then SERIAL="$online"; return; fi
+  if adb devices | grep -q "^${DEFAULT_SERIAL}[[:space:]]"; then
+    SERIAL="$DEFAULT_SERIAL"
+  fi
+}
+
+run_adb() { adb -s "$SERIAL" "$@"; }
+run_sh() { run_adb shell "$@"; }
+
+pick_su() {
+  run_sh 'for p in /sbin/su /system/bin/su /system/xbin/su su; do
+    if [ -x "$p" ] 2>/dev/null || command -v "$p" >/dev/null 2>&1; then echo "$p"; exit 0; fi
+  done; exit 1' 2>/dev/null || true
+}
+
+run_root() {
+  local cmd="$1"
+  local su
+  su="$(pick_su)"
+  if [[ -n "$su" ]]; then
+    run_sh "su -c $(printf '%q' "$cmd")" 2>/dev/null
+  else
+    run_sh "$cmd" 2>/dev/null || true
+  fi
+}
+
+pick_serial
+if [[ -z "$SERIAL" ]] || ! adb devices | grep -q "^${SERIAL}[[:space:]]*device"; then
+  echo "FAIL: 无 ADB 在线设备。请 Type-C 连接并开启 USB 调试，或 adb connect <ip>:5555"
+  adb devices -l
+  exit 1
+fi
+
+mkdir -p "$OUT" "$EVID"
+log "serial=$SERIAL out=$OUT"
+
+# --- 设备画像 ---
+{
+  echo "# 奥创提取 · 设备检查 $(date '+%Y-%m-%d %H:%M:%S')"
+  echo
+  adb devices -l
+  echo
+  run_adb shell getprop ro.product.model
+  run_adb shell getprop ro.build.version.release
+  run_adb shell getprop ro.product.brand
+} > "$EVID/00_device_info.txt"
+
+run_sh pm list packages > "$EVID/01_all_packages.txt" 2>/dev/null || true
+grep -E 'xes|zzz|vivwx|UNI9421|cloudservice|magisk|tencent\.mm' "$EVID/01_all_packages.txt" > "$EVID/02_aochuang_related_packages.txt" 2>/dev/null || true
+
+# --- 拉 APK ---
+for pkg in "${AOCHUANG_PACKAGES[@]}"; do
+  apk_path="$(run_sh pm path "$pkg" 2>/dev/null | head -1 | cut -d: -f2 | tr -d '\r' || true)"
+  if [[ -z "$apk_path" ]]; then
+    log "SKIP APK 未安装: $pkg"
+    echo "NOT_INSTALLED $pkg" >> "$EVID/03_apk_pull.log"
+    continue
+  fi
+  ver="$(run_sh dumpsys package "$pkg" 2>/dev/null | awk -F= '/versionName/{print $2; exit}' | tr -d '\r ')"
+  safe="${pkg}_v${ver:-unknown}.apk"
+  log "PULL $pkg -> $safe"
+  run_adb pull "$apk_path" "$OUT/$safe"
+  echo "OK $pkg $apk_path -> $OUT/$safe" >> "$EVID/03_apk_pull.log"
+done
+
+# --- 框架 / Magisk 模块（需 root）---
+for p in "${AOCHUANG_ROOT_PATHS[@]}"; do
+  dest="$OUT/device_root$(echo "$p" | tr '/' '_')"
+  log "TAR $p (root)"
+  run_root "test -e '$p' && tar -czf /sdcard/aochuang_extract_$(basename "$p").tgz '$p' 2>/dev/null" || true
+  tgz="/sdcard/aochuang_extract_$(basename "$p").tgz"
+  if run_sh "test -f '$tgz'" 2>/dev/null | grep -q .; then
+    mkdir -p "$dest"
+    run_adb pull "$tgz" "$dest/" 2>/dev/null || true
+    run_root "rm -f '$tgz'" || true
+  else
+    echo "MISSING_OR_DENIED $p" >> "$EVID/04_root_paths.log"
+  fi
+done
+
+# Magisk 模块名过滤
+run_root 'ls /data/adb/modules 2>/dev/null' > "$EVID/05_magisk_modules.txt" 2>/dev/null || true
+
+# --- 可选反编译 ---
+if [[ "$DECOMPILE" -eq 1 ]] && command -v apktool >/dev/null 2>&1; then
+  DEC="$OUT/decompiled"
+  mkdir -p "$DEC"
+  for apk in "$OUT"/*.apk; do
+    [[ -f "$apk" ]] || continue
+    base="$(basename "$apk" .apk)"
+    log "apktool d $base"
+    apktool d -f -o "$DEC/$base" "$apk" >> "$EVID/06_apktool.log" 2>&1 || true
+  done
+fi
+
+log "DONE 证据目录: $EVID"
+log "资料目录: $OUT"
+ls -lah "$OUT"
diff --git a/sdk/scripts/install_connection_keeper_launchagent.sh b/sdk/scripts/install_connection_keeper_launchagent.sh
new file mode 100755
index 0000000000..21f6f39aac
--- /dev/null
+++ b/sdk/scripts/install_connection_keeper_launchagent.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# 安装 Mac 常驻「连接守护」LaunchAgent（每 15s 扫描 ADB + 自动拉起 Termux Agent）
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SDK_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+PROJ_ROOT="$(cd "${SDK_ROOT}/.." && pwd)"
+LABEL="com.karuo.workphone.connection-keeper"
+PLIST="${HOME}/Library/LaunchAgents/${LABEL}.plist"
+LOG="${SDK_ROOT}/logs/connection_keeper.log"
+
+mkdir -p "${SDK_ROOT}/logs" "${HOME}/Library/LaunchAgents"
+
+cat > "${PLIST}" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/bash</string>
+    <string>${SDK_ROOT}/scripts/connection_keeper_daemon.sh</string>
+  </array>
+  <key>WorkingDirectory</key>
+  <string>${PROJ_ROOT}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+    <key>ANDROID_ADB_SERVER_PORT</key>
+    <string>5038</string>
+    <key>WORKPHONE_SDK_PORT</key>
+    <string>8899</string>
+    <key>KEEPER_INTERVAL</key>
+    <string>15</string>
+    <key>DEVICE_SERIAL</key>
+    <string>192.168.110.80:5555</string>
+    <key>DEVICE_ID</key>
+    <string>xgfe65eimrrofyws</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${LOG}</string>
+  <key>StandardErrorPath</key>
+  <string>${LOG}</string>
+</dict>
+</plist>
+EOF
+
+launchctl bootout "gui/$(id -u)/${LABEL}" 2>/dev/null || true
+launchctl bootstrap "gui/$(id -u)" "${PLIST}"
+launchctl enable "gui/$(id -u)/${LABEL}"
+launchctl kickstart -k "gui/$(id -u)/${LABEL}" 2>/dev/null || \
+  bash "${SDK_ROOT}/scripts/connection_keeper_daemon.sh" --bg
+
+echo "✅ 连接守护 LaunchAgent 已安装: ${LABEL}"
+echo "   日志: ${LOG}"
+echo "   停止: bash ${SDK_ROOT}/scripts/connection_keeper_daemon.sh --stop"
diff --git a/sdk/scripts/install_sdk_watcher_launchagent.sh b/sdk/scripts/install_sdk_watcher_launchagent.sh
new file mode 100755
index 0000000000..05c4e5897b
--- /dev/null
+++ b/sdk/scripts/install_sdk_watcher_launchagent.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# 安装 Mac 常驻「SDK 连接监视器」（无 USB 铁律 · 只盯 NAS/frp/WS）
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SDK_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+PROJ_ROOT="$(cd "${SDK_ROOT}/.." && pwd)"
+LABEL="com.karuo.workphone.sdk-watcher"
+PLIST="${HOME}/Library/LaunchAgents/${LABEL}.plist"
+LOG="${SDK_ROOT}/logs/sdk_connection_watcher.log"
+
+mkdir -p "${SDK_ROOT}/logs" "${HOME}/Library/LaunchAgents"
+
+cat > "${PLIST}" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/bash</string>
+    <string>${SDK_ROOT}/scripts/sdk_connection_watcher.sh</string>
+  </array>
+  <key>WorkingDirectory</key>
+  <string>${PROJ_ROOT}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>WORKPHONE_SDK_PORT</key>
+    <string>8899</string>
+    <key>DEVICE_ID</key>
+    <string>xgfe65eimrrofyws</string>
+    <key>WATCHER_INTERVAL</key>
+    <string>20</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${LOG}</string>
+  <key>StandardErrorPath</key>
+  <string>${LOG}</string>
+</dict>
+</plist>
+EOF
+
+launchctl bootout "gui/$(id -u)/${LABEL}" 2>/dev/null || true
+launchctl bootstrap "gui/$(id -u)" "${PLIST}"
+launchctl enable "gui/$(id -u)/${LABEL}"
+launchctl kickstart -k "gui/$(id -u)/${LABEL}" 2>/dev/null || \
+  bash "${SDK_ROOT}/scripts/sdk_connection_watcher.sh" --bg
+
+echo "✅ SDK 监视器 LaunchAgent 已安装: ${LABEL}"
+echo "   日志: ${LOG}"
+echo "   当前 SDK: source ${SDK_ROOT}/config/active_sdk.env"
diff --git a/sdk/scripts/lan_connect_setup.sh b/sdk/scripts/lan_connect_setup.sh
new file mode 100755
index 0000000000..3503c2d79a
--- /dev/null
+++ b/sdk/scripts/lan_connect_setup.sh
@@ -0,0 +1,165 @@
+#!/usr/bin/env bash
+# 局域网无线主控：本机局网 IP ↔ 手机同 WiFi ↔ Termux Agent / 无线 ADB
+# 用法:
+#   bash sdk/scripts/lan_connect_setup.sh
+#   PHONE_IP=192.168.110.40 bash sdk/scripts/lan_connect_setup.sh
+#   bash sdk/scripts/lan_connect_setup.sh --connect   # 尝试 adb connect 后 oneclick
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SDK_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+SDK_PORT="${WORKPHONE_SDK_PORT:-8899}"
+DEVICE_ID="${DEVICE_ID:-xgfe65eimrrofyws}"
+PHONE_IP="${PHONE_IP:-}"
+ADB_PORT="${ANDROID_ADB_SERVER_PORT:-5038}"
+ADB=(adb -P "${ADB_PORT}")
+export ANDROID_ADB_SERVER_PORT="${ADB_PORT}"
+LAN_ENV="${SDK_ROOT}/config/lan.env"
+DO_CONNECT=0
+
+[[ "${1:-}" == "--connect" ]] && DO_CONNECT=1
+
+pick_lan_ip() {
+  local ip
+  for ip in $(ifconfig | awk '/inet /{print $2}' | grep -v '^127\.'); do
+    [[ "$ip" == 198.18.* ]] && continue
+    [[ "$ip" == 192.168.110.* ]] && { echo "$ip"; return; }
+  done
+  for ip in $(ifconfig | awk '/inet /{print $2}' | grep -v '^127\.'); do
+    [[ "$ip" == 198.18.* ]] && continue
+    [[ "$ip" == 192.168.* ]] && { echo "$ip"; return; }
+  done
+  ipconfig getifaddr en0 2>/dev/null || ipconfig getifaddr en1 2>/dev/null || echo "127.0.0.1"
+}
+
+LAN_IP="$(pick_lan_ip)"
+WS_URL="ws://${LAN_IP}:${SDK_PORT}/ws/device/${DEVICE_ID}"
+API_URL="http://${LAN_IP}:${SDK_PORT}"
+
+log() { echo "[lan] $*"; }
+
+log "本机局网 IP: ${LAN_IP}"
+log "SDK API: ${API_URL}"
+log "Agent WS: ${WS_URL}"
+
+mkdir -p "${SDK_ROOT}/config"
+cat >"${LAN_ENV}" <<EOF
+# 自动生成 $(date '+%F %T') — source 后用于脚本
+export WORKPHONE_LAN_IP=${LAN_IP}
+export WORKPHONE_SDK_HOST=${LAN_IP}:${SDK_PORT}
+export WORKPHONE_WS_URL=${WS_URL}
+export WORKPHONE_API_URL=${API_URL}
+export ANDROID_ADB_SERVER_PORT=${ADB_PORT}
+export WIRELESS_IPS="${PHONE_IP:-192.168.110.40 192.168.110.80 192.168.110.236}"
+EOF
+log "已写入 ${LAN_ENV}"
+
+# ── 1) SDK 本机 / 局网可达性 ──
+"${ADB[@]}" start-server >/dev/null 2>&1 || true
+
+SDK_VIA="local"
+if docker ps --format '{{.Names}}' 2>/dev/null | grep -qx workphone-sdk; then
+  SDK_VIA="docker"
+  log "SDK 由 Docker workphone-sdk 提供 :${SDK_PORT}"
+  if ! curl -sf --max-time 5 "http://127.0.0.1:${SDK_PORT}/health" >/dev/null 2>&1; then
+    log "Docker SDK 未响应，尝试 adb 桥接后重启容器…"
+    bash "${SCRIPT_DIR}/adb_host_server_listen_all.sh" --background || true
+    (cd "${SDK_ROOT}" && ADB_SERVER_SOCKET="tcp:host.docker.internal:${ADB_PORT}" docker compose up -d workphone-sdk) || true
+    sleep 4
+  fi
+elif curl -sf --max-time 3 "http://127.0.0.1:${SDK_PORT}/health" >/dev/null 2>&1; then
+  log "SDK localhost:${SDK_PORT} ✅ (${SDK_VIA})"
+else
+  log "SDK 未运行 → 启动 uvicorn 0.0.0.0:${SDK_PORT}"
+  cd "${SDK_ROOT}/app"
+  nohup env ANDROID_ADB_SERVER_PORT="${ADB_PORT}" python3 -m uvicorn main:app \
+    --host 0.0.0.0 --port "${SDK_PORT}" >>"${SDK_ROOT}/logs/sdk.log" 2>&1 &
+  sleep 3
+fi
+
+if [[ "$SDK_VIA" == "docker" ]]; then
+  bash "${SCRIPT_DIR}/adb_host_server_listen_all.sh" --background || true
+fi
+
+if curl -sf --max-time 5 "${API_URL}/health" >/dev/null 2>&1; then
+  log "SDK 局网 ${API_URL}/health ✅"
+else
+  log "⚠️  局网 ${API_URL} 不可达 — 检查 Mac 防火墙是否放行 ${SDK_PORT}，或确认手机与 Mac 同网段"
+fi
+
+# ── 2) 探测手机（同网段 5555）──
+try_adb_connect() {
+  local host="$1" port="${2:-5555}"
+  local target="${host}:${port}"
+  "${ADB[@]}" connect "${target}" >/dev/null 2>&1 || true
+  sleep 2
+  if "${ADB[@]}" -s "${target}" get-state 2>/dev/null | grep -qx device; then
+    printf '%s' "${target}"
+    return 0
+  fi
+  "${ADB[@]}" disconnect "${target}" >/dev/null 2>&1 || true
+  return 1
+}
+
+FOUND=""
+ADB_SERIAL=""
+if [[ -n "$PHONE_IP" ]]; then
+  if try_adb_connect "$PHONE_IP" >/dev/null; then
+    ADB_SERIAL="${PHONE_IP}:5555"
+    FOUND="${ADB_SERIAL}"
+  fi
+fi
+
+if [[ -z "$FOUND" ]]; then
+  for ip in 192.168.110.40 192.168.110.80 192.168.110.236 192.168.1.12; do
+    ping -c 1 -W 1 "$ip" >/dev/null 2>&1 || continue
+    if try_adb_connect "$ip" >/dev/null; then
+      ADB_SERIAL="${ip}:5555"
+      FOUND="${ADB_SERIAL}"
+      break
+    fi
+  done
+fi
+
+if [[ -n "$FOUND" ]]; then
+  log "无线 ADB 已连接: ${FOUND} ✅"
+else
+  log "暂未发现无线 ADB（手机需：开发者选项 → 无线调试 / 或 USB 执行一次 adb tcpip 5555）"
+fi
+
+# ── 3) Termux 手机端命令（手机连本机 IP）──
+FRIDA_PORT="$(python3 -c "import json; print(json.load(open('${SCRIPT_DIR}/anti_detect/phantom_frida_config.json'))['listen_port'])" 2>/dev/null || echo 17263)"
+
+echo ""
+echo "================================================================"
+echo "  手机 Termux 执行（与 Mac 同一 WiFi · 连 ${LAN_IP}）"
+echo "================================================================"
+cat <<EOF
+
+export WP_AGENT_ON_DEVICE=1
+export WP_FRIDA_MODE=remote
+export WP_FRIDA_PORT=${FRIDA_PORT}
+export WP_SERVER_URL=${WS_URL}
+cd ~/workphone/agent || cd ~/storage/downloads/workphone/agent
+python agent.py -d ${DEVICE_ID} -s ${WS_URL} --heartbeat 10
+
+# 或依赖 UDP 8898 自动发现（免手填 IP）：
+# python agent.py -d ${DEVICE_ID} --heartbeat 10
+
+EOF
+
+echo "================================================================"
+echo "  Mac 验收"
+echo "================================================================"
+echo "  curl ${API_URL}/health"
+echo "  curl ${API_URL}/api/v3/connection/status"
+echo "  curl ${API_URL}/api/v3/hook/probe/${DEVICE_ID}"
+echo ""
+
+if [[ "$DO_CONNECT" == "1" && -n "$ADB_SERIAL" ]]; then
+  log "执行 oneclick device=${ADB_SERIAL}"
+  DEVICE_SERIAL="$ADB_SERIAL" ANDROID_ADB_SERVER_PORT="${ADB_PORT}" \
+    bash "${SCRIPT_DIR}/frida_workphone_oneclick.sh" -d "$ADB_SERIAL" || true
+fi
+
+curl -s --max-time 5 "${API_URL}/api/v3/connection/status" 2>/dev/null | python3 -m json.tool 2>/dev/null | head -25 || true
diff --git a/sdk/scripts/nas_primary_agent_setup.sh b/sdk/scripts/nas_primary_agent_setup.sh
new file mode 100755
index 0000000000..5d50a0b28a
--- /dev/null
+++ b/sdk/scripts/nas_primary_agent_setup.sh
@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+# 工作手机 Agent 连接顺序：① NAS 局域网 ② 本机 Docker ③ NAS 外网 frp
+# 用法: bash sdk/scripts/nas_primary_agent_setup.sh [device_id]
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SDK_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+DEVICE_ID="${1:-xgfe65eimrrofyws}"
+SDK_PORT="${WORKPHONE_SDK_PORT:-8899}"
+NAS_FRP_HOST="${WORKPHONE_NAS_FRP_HOST:-open.quwanzhi.com}"
+ADB_PORT="${ANDROID_ADB_SERVER_PORT:-5038}"
+ADB=(adb -P "${ADB_PORT}")
+export ANDROID_ADB_SERVER_PORT="${ADB_PORT}"
+
+pick_mac_lan_ip() {
+  local ip
+  for ip in $(ifconfig 2>/dev/null | awk '/inet /{print $2}' | grep -v '^127\.'); do
+    [[ "$ip" == 198.18.* ]] && continue
+    [[ "$ip" == 192.168.110.* ]] && { echo "$ip"; return; }
+  done
+  for ip in $(ifconfig 2>/dev/null | awk '/inet /{print $2}' | grep -v '^127\.'); do
+    [[ "$ip" == 198.18.* ]] && continue
+    [[ "$ip" == 192.168.* ]] && { echo "$ip"; return; }
+  done
+  echo "127.0.0.1"
+}
+
+health_ok() {
+  curl -sf --max-time 3 "http://$1:${SDK_PORT}/health" >/dev/null 2>&1
+}
+
+MAC_IP="$(pick_mac_lan_ip)"
+
+# ① NAS 局域网 → ② 本机 Docker → ③ NAS 外网
+PRIMARY_HOST=""
+PRIMARY_TIER="nas_lan"
+for h in 192.168.110.101 192.168.1.201; do
+  if health_ok "$h"; then
+    PRIMARY_HOST="$h"
+    break
+  fi
+done
+if [[ -z "${PRIMARY_HOST}" && "${MAC_IP}" != "127.0.0.1" ]] && health_ok "${MAC_IP}"; then
+  PRIMARY_HOST="${MAC_IP}"
+  PRIMARY_TIER="mac_docker"
+fi
+if [[ -z "${PRIMARY_HOST}" ]] && health_ok "${NAS_FRP_HOST}"; then
+  PRIMARY_HOST="${NAS_FRP_HOST}"
+  PRIMARY_TIER="nas_frp"
+fi
+if [[ -z "${PRIMARY_HOST}" ]]; then
+  PRIMARY_HOST="192.168.110.101"
+  echo "[nas-primary] 警告: ①②③ 均不可达，server_url 仍写 NAS 局域网 ${PRIMARY_HOST}（Agent 将按序探测）"
+fi
+
+PRIMARY_WS="ws://${PRIMARY_HOST}:${SDK_PORT}/ws/device"
+CONFIG_TMP="$(mktemp)"
+export DEVICE_ID PRIMARY_WS SDK_PORT MAC_IP NAS_FRP_HOST CONFIG_TMP
+python3 - <<'PY'
+import json, os
+
+port = os.environ["SDK_PORT"]
+mac = os.environ["MAC_IP"]
+frp = os.environ["NAS_FRP_HOST"]
+primary = os.environ["PRIMARY_WS"]
+
+# 固定回退顺序：NAS 内网 → 本机 Docker → NAS 外网
+ordered = [
+    f"ws://192.168.110.101:{port}/ws/device",
+    f"ws://192.168.1.201:{port}/ws/device",
+    f"ws://{mac}:{port}/ws/device",
+    f"ws://{frp}:{port}/ws/device",
+]
+pubs = []
+seen = {primary}
+for u in ordered:
+    if u not in seen:
+        seen.add(u)
+        pubs.append(u)
+
+cfg = {
+    "device_id": os.environ["DEVICE_ID"],
+    "server_url": primary,
+    "public_servers": pubs,
+    "heartbeat_interval": 10,
+    "project_id": "cunkebao",
+    "connection_priority": ["nas_lan", "mac_docker", "nas_frp"],
+}
+with open(os.environ["CONFIG_TMP"], "w", encoding="utf-8") as f:
+    json.dump(cfg, f, ensure_ascii=False, indent=2)
+PY
+
+echo "[nas-primary] 连接顺序: ①NAS局域网 ②本机Docker ③NAS外网(${NAS_FRP_HOST})"
+echo "[nas-primary] 当前主服 tier=${PRIMARY_TIER} host=${PRIMARY_HOST}"
+echo "[nas-primary] server_url: ${PRIMARY_WS}/${DEVICE_ID}"
+cat "${CONFIG_TMP}"
+
+REMOTE_CFG="/data/data/com.termux/files/home/workphone/agent/config.json"
+SERIAL="$("${ADB[@]}" devices 2>/dev/null | awk '/device$/{print $1; exit}')"
+PUBLIC_LIST="ws://192.168.110.101:${SDK_PORT}/ws/device,ws://192.168.1.201:${SDK_PORT}/ws/device,ws://${MAC_IP}:${SDK_PORT}/ws/device,ws://${NAS_FRP_HOST}:${SDK_PORT}/ws/device"
+
+if [[ -n "${SERIAL}" ]]; then
+  echo "[nas-primary] 推送 config → ${SERIAL}"
+  "${ADB[@]}" -s "${SERIAL}" push "${CONFIG_TMP}" "${REMOTE_CFG}" 2>/dev/null || \
+    "${ADB[@]}" -s "${SERIAL}" push "${CONFIG_TMP}" /sdcard/workphone_config.json
+  echo "[nas-primary] Termux:"
+  echo "  export WP_SERVER_URL=${PRIMARY_WS}"
+  echo "  export WP_PUBLIC_SERVERS=${PUBLIC_LIST}"
+  echo "  export WP_AUTO_DISCOVER=1"
+  echo "  cd ~/workphone/agent && python agent.py -d ${DEVICE_ID}"
+else
+  echo "[nas-primary] 未检测到 adb device → ${SDK_ROOT}/agent/config.nas-active.json"
+  cp "${CONFIG_TMP}" "${SDK_ROOT}/agent/config.nas-active.json"
+fi
+rm -f "${CONFIG_TMP}"
diff --git a/sdk/scripts/phantom_frida_keepalive.sh b/sdk/scripts/phantom_frida_keepalive.sh
new file mode 100644
index 0000000000..b3d3987157
--- /dev/null
+++ b/sdk/scripts/phantom_frida_keepalive.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# phantom_frida_keepalive.sh — Phantom-Frida 保活守护（FS-6）
+#
+# 背景：微信 8.0.69 反检测会间歇 kill frida-server，导致 Hook 掉线、开发中断。
+# 本守护在 Mac 主机循环检查设备端 Phantom-Frida 进程，死了就用 Root 重起，
+# 并触发 Agent 重连（可选）。不依赖手机端 Termux。
+#
+# 用法：
+#   nohup bash phantom_frida_keepalive.sh xgfe65eimrrofyws > logs/phantom_keepalive.log 2>&1 &
+# ==============================================================================
+set -uo pipefail
+
+SERIAL="${1:-xgfe65eimrrofyws}"
+CFG="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/anti_detect/phantom_frida_config.json"
+BIN_PATH="$(python3 -c "import json;print(json.load(open('$CFG'))['binary_path'])" 2>/dev/null || echo /data/local/tmp/fs_8e6b0b)"
+BIN_NAME="$(basename "$BIN_PATH")"
+PORT="$(python3 -c "import json;print(json.load(open('$CFG'))['listen_port'])" 2>/dev/null || echo 24781)"
+INTERVAL="${KEEPALIVE_INTERVAL:-12}"
+
+echo "[keepalive] serial=$SERIAL bin=$BIN_PATH port=$PORT (前台持有模式)"
+
+# 前台持有模式：Mac 端阻塞运行 frida（adb shell 持有连接 → 子进程不收 SIGHUP）。
+# 实测 `su -c 'nohup X &'` 后台化在本机型失效，前台持有最可靠；frida 被杀则循环重连。
+while true; do
+  # 清理可能的端口占用残留（旧 frida-server / TIME_WAIT 实例）
+  adb -s "$SERIAL" shell "su -c 'pidof $BIN_NAME | xargs -r kill -9'" 2>/dev/null
+  echo "[keepalive $(date '+%H:%M:%S')] 前台启动 Phantom-Frida..."
+  # 阻塞：frida 活着则此行一直挂起；退出（被杀/崩溃）才返回
+  adb -s "$SERIAL" shell "su -c '$BIN_PATH -l 0.0.0.0:$PORT'" 2>&1
+  echo "[keepalive $(date '+%H:%M:%S')] Phantom-Frida 退出，${INTERVAL}s 后重连..."
+  sleep "$INTERVAL"
+done
diff --git a/sdk/scripts/run_extended_acceptance.sh b/sdk/scripts/run_extended_acceptance.sh
new file mode 100755
index 0000000000..a7110aea03
--- /dev/null
+++ b/sdk/scripts/run_extended_acceptance.sh
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# run_extended_acceptance.sh — 微信 P0 + 四端 E2E + friend-add/AI chat 编排
+#
+# 真源：工作手机_微信全量控机与私域_20260529.md · 工作手机_存客宝四端对接_20260529.md
+# 用法：bash sdk/scripts/run_extended_acceptance.sh [device_id]
+# 环境：CUNKEBAO_API_KEY=xxx 可自动启用 CKB（须重启 SDK 后生效）
+# ==============================================================================
+set -o pipefail
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+DEVICE="${1:-${SDK_DEVICE_ID:-xgfe65eimrrofyws}}"
+BASE="${SDK_BASE_URL:-http://127.0.0.1:8899}"
+TS="$(date +%Y%m%d-%H%M%S)"
+EVID="$ROOT/开发文档/8、部署/05-测试验收/$(date +%Y%m%d)_扩展验收"
+mkdir -p "$EVID"
+REPORT="$EVID/extended_acceptance_${TS}.json"
+
+PASS=0; BLOCKED=0; FAIL=0
+declare -a ROWS
+
+note() { echo "$1"; ROWS+=("$2"); }
+
+echo "=== 扩展验收 $TS === device=$DEVICE"
+
+# 0. 设备 / Hook
+HOOK=$(curl -s --max-time 20 "$BASE/api/v3/hook/probe/$DEVICE" 2>/dev/null || echo '{}')
+SUPPORTS=$(echo "$HOOK" | python3 -c "import sys,json;print(json.load(sys.stdin).get('supports_hook'))" 2>/dev/null)
+if [ "$SUPPORTS" = "True" ]; then
+  note "  [PASS] hook probe supports_hook=true" "hook:PASS"
+  PASS=$((PASS+1))
+else
+  note "  [BLOCKED] hook offline（手机 Termux 跑 termux_frida_up_onphone.sh）" "hook:BLOCKED"
+  BLOCKED=$((BLOCKED+1))
+fi
+
+# 1. 微信三项 P0
+if bash "$ROOT/sdk/scripts/run_three_acceptance.sh" "$DEVICE" 2>&1 | tee "$EVID/three_${TS}.log" | tail -3 | grep -q '三项验收全绿'; then
+  note "  [PASS] 微信三项 P0 全绿" "three:PASS"
+  PASS=$((PASS+1))
+elif [ "$SUPPORTS" != "True" ]; then
+  note "  [BLOCKED] 三项跳过（hook 离线）" "three:BLOCKED"
+  BLOCKED=$((BLOCKED+1))
+else
+  note "  [FAIL] 微信三项未全绿" "three:FAIL"
+  FAIL=$((FAIL+1))
+fi
+
+sleep 5
+
+# 2. 四端 E2E（含写消息）
+FOUR_LOG="$EVID/4end_${TS}.log"
+if WP_WRITE=1 bash "$ROOT/开发文档/8、部署/05-测试验收/scripts/workphone_4end_e2e.sh" "$DEVICE" 2>&1 | tee "$FOUR_LOG" | grep -qE 'FAIL=0'; then
+  note "  [PASS] 四端 E2E FAIL=0" "4end:PASS"
+  PASS=$((PASS+1))
+else
+  note "  [FAIL] 四端 E2E 有失败项" "4end:FAIL"
+  FAIL=$((FAIL+1))
+fi
+
+# 3. friend-add ingest
+R=$(curl -s --max-time 30 -X POST "$BASE/api/v3/cunke-bao/hook/friend-add" -H 'Content-Type: application/json' \
+  -d "{\"device_id\":\"$DEVICE\",\"wechat_id\":\"wxid_e2e_${TS}\",\"nickname\":\"E2E\",\"source\":\"extended_acceptance\"}")
+[ -z "$R" ] && sleep 2 && R=$(curl -s --max-time 30 -X POST "$BASE/api/v3/cunke-bao/hook/friend-add" -H 'Content-Type: application/json' \
+  -d "{\"device_id\":\"$DEVICE\",\"wechat_id\":\"wxid_e2e_${TS}\",\"nickname\":\"E2E\",\"source\":\"extended_acceptance\"}")
+echo "$R" > "$EVID/friend_add_${TS}.json"
+CODE=$(echo "$R" | python3 -c "import sys,json;print(json.load(sys.stdin).get('code',''))" 2>/dev/null)
+if [ "$CODE" = "200" ]; then
+  note "  [PASS] friend-add → CKB code=200" "friend_add:PASS"
+  PASS=$((PASS+1))
+elif echo "$R" | grep -qE '未启用|未配置|API Key'; then
+  note "  [BLOCKED] CKB 未启用（设 CUNKEBAO_API_KEY 并重启 SDK）" "friend_add:BLOCKED"
+  BLOCKED=$((BLOCKED+1))
+else
+  note "  [FAIL] friend-add code=$CODE" "friend_add:FAIL"
+  FAIL=$((FAIL+1))
+fi
+
+# 4. AI chat（需卡若网关 + hook）
+AI=$(curl -s --max-time 90 -X POST "$BASE/api/v3/devices/$DEVICE/ai/chat" -H 'Content-Type: application/json' \
+  -d "{\"instruction\":\"向文件传输助手发：AI扩展验收-$TS\",\"timeout\":60}" 2>/dev/null || echo '{}')
+echo "$AI" > "$EVID/ai_chat_${TS}.json"
+AI_STATUS=$(echo "$AI" | python3 -c "
+import sys,json,re
+raw=sys.stdin.read()
+try:
+    d=json.loads(raw)
+except Exception:
+    print('FAIL'); sys.exit(0)
+if d.get('code')==200 and (d.get('data') or {}).get('acted'):
+    print('PASS')
+elif d.get('code')==200 and not (d.get('data') or {}).get('acted'):
+    print('BLOCKED')
+else:
+    blob=json.dumps(d,ensure_ascii=False)
+    if re.search(r'429|502|503|401|无响应|RATE_LIMIT|Too Many|余额不足|gateway|Bad Gateway|Unauthorized|insufficient', blob, re.I):
+        print('BLOCKED')
+    else:
+        print('FAIL')
+" 2>/dev/null)
+case "$AI_STATUS" in
+  PASS) note "  [PASS] AI chat 决策并执行" "ai_chat:PASS"; PASS=$((PASS+1)) ;;
+  BLOCKED) note "  [BLOCKED] AI 网关限流/502/余额不足" "ai_chat:BLOCKED"; BLOCKED=$((BLOCKED+1)) ;;
+  *) note "  [FAIL] AI chat 未执行" "ai_chat:FAIL"; FAIL=$((FAIL+1)) ;;
+esac
+
+# 5. 静态审计
+if python3 "$ROOT/sdk/scripts/wechat_interface_audit.py" >/dev/null 2>&1; then
+  note "  [PASS] 128/174 静态对齐" "audit:PASS"
+  PASS=$((PASS+1))
+else
+  note "  [FAIL] 静态审计失败" "audit:FAIL"
+  FAIL=$((FAIL+1))
+fi
+
+python3 - "$REPORT" "$DEVICE" "$TS" "$PASS" "$BLOCKED" "$FAIL" "${ROWS[@]}" <<'PY'
+import json,sys
+report,device,ts,p,b,f,*rows=sys.argv[1:]
+data={"timestamp":ts,"device_id":device,"pass":int(p),"blocked":int(b),"fail":int(f),
+      "results":[dict(zip(("item","status"),r.split(":",1))) for r in rows]}
+open(report,"w").write(json.dumps(data,ensure_ascii=False,indent=2))
+print(f"\n汇总 PASS={p} BLOCKED={b} FAIL={f}  报告 {report}")
+PY
+
+echo "证据: $EVID"
+exit $([ "$FAIL" -eq 0 ] && echo 0 || echo 1)
diff --git a/sdk/scripts/run_stability_longrun.mjs b/sdk/scripts/run_stability_longrun.mjs
new file mode 100755
index 0000000000..0404a1da06
--- /dev/null
+++ b/sdk/scripts/run_stability_longrun.mjs
@@ -0,0 +1,198 @@
+#!/usr/bin/env node
+
+import { appendFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+function parseArgs(argv) {
+  const args = {
+    base: "http://127.0.0.1:8899",
+    deviceId: "xgfe65eimrrofyws",
+    intervalSeconds: 60,
+    timeoutSeconds: 45,
+    outputDir: "",
+  };
+  const mapping = {
+    "--base": "base",
+    "--device-id": "deviceId",
+    "--interval-seconds": "intervalSeconds",
+    "--timeout-seconds": "timeoutSeconds",
+    "--output-dir": "outputDir",
+  };
+  for (let index = 0; index < argv.length; index += 2) {
+    const key = mapping[argv[index]];
+    if (!key || argv[index + 1] === undefined) {
+      throw new Error(`invalid argument: ${argv[index] ?? ""}`);
+    }
+    args[key] = argv[index + 1];
+  }
+  args.intervalSeconds = Number(args.intervalSeconds);
+  args.timeoutSeconds = Number(args.timeoutSeconds);
+  if (!args.outputDir) {
+    throw new Error("--output-dir is required");
+  }
+  return args;
+}
+
+async function requestJson(url, timeoutSeconds) {
+  const response = await fetch(url, {
+    headers: { Accept: "application/json", "User-Agent": "workphone-stability/2.0" },
+    signal: AbortSignal.timeout(timeoutSeconds * 1000),
+  });
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}: ${url}`);
+  }
+  return response.json();
+}
+
+async function writeJson(filePath, value) {
+  const tempPath = `${filePath}.tmp`;
+  await writeFile(tempPath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+  await rename(tempPath, filePath);
+}
+
+async function restoreSamples(samplesPath) {
+  const state = {
+    startedAt: new Date(),
+    total: 0,
+    ok: 0,
+    failures: 0,
+    offlineEvents: 0,
+    reconnects: 0,
+    latencyTotal: 0,
+    maxLatency: 0,
+    lastOk: null,
+    lastError: "",
+  };
+  let content = "";
+  try {
+    content = await readFile(samplesPath, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    return state;
+  }
+  for (const line of content.split("\n")) {
+    if (!line.trim()) continue;
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!row || typeof row !== "object") continue;
+    if (state.total === 0) {
+      const firstTimestamp = new Date(row.timestamp);
+      if (!Number.isNaN(firstTimestamp.getTime())) state.startedAt = firstTimestamp;
+    }
+    const rowOk = Boolean(row.ok);
+    const elapsedMs = Number(row.request_elapsed_ms) || 0;
+    state.total += 1;
+    state.ok += Number(rowOk);
+    state.failures += Number(!rowOk);
+    state.latencyTotal += elapsedMs;
+    state.maxLatency = Math.max(state.maxLatency, elapsedMs);
+    if (rowOk) {
+      if (state.lastOk === false) state.reconnects += 1;
+      state.lastError = "";
+    } else {
+      if (state.lastOk !== false) state.offlineEvents += 1;
+      state.lastError = String(row.error || "sdk/ws/hook not ready");
+    }
+    state.lastOk = rowOk;
+  }
+  return state;
+}
+
+const args = parseArgs(process.argv.slice(2));
+const outputDir = path.resolve(args.outputDir);
+const samplesPath = path.join(outputDir, "stability_samples.jsonl");
+const summaryPath = path.join(outputDir, "stability_latest_summary.json");
+await mkdir(outputDir, { recursive: true });
+const state = await restoreSamples(samplesPath);
+let stopping = false;
+process.on("SIGTERM", () => {
+  stopping = true;
+});
+process.on("SIGINT", () => {
+  stopping = true;
+});
+
+while (!stopping) {
+  const sampleStarted = Date.now();
+  const now = new Date();
+  const row = {
+    timestamp: now.toISOString(),
+    device_id: args.deviceId,
+    ok: false,
+  };
+  try {
+    const health = await requestJson(`${args.base}/health`, args.timeoutSeconds);
+    const query = new URLSearchParams({
+      device_id: args.deviceId,
+      samples: "1",
+      interval_seconds: "0",
+    });
+    const watch = await requestJson(
+      `${args.base}/api/v3/stability/watch?${query.toString()}`,
+      args.timeoutSeconds,
+    );
+    const probe = Array.isArray(watch?.data?.samples) ? watch.data.samples[0] ?? {} : {};
+    Object.assign(row, {
+      sdk_healthy: health.status === "healthy",
+      devices_online: health.devices_online,
+      ws_online: Boolean(probe.ws_online),
+      adb_online: Boolean(probe.adb_online),
+      hook_ok: Boolean(probe.hook_ok),
+      wechat_version: probe.wechat_version || "",
+      probe_latency_ms: probe.latency_ms || 0,
+      error: probe.error || "",
+    });
+    row.ok = Boolean(row.sdk_healthy && row.ws_online && row.hook_ok);
+  } catch (error) {
+    row.error = String(error?.message || error).slice(0, 500);
+  }
+
+  row.request_elapsed_ms = Date.now() - sampleStarted;
+  state.total += 1;
+  state.latencyTotal += row.request_elapsed_ms;
+  state.maxLatency = Math.max(state.maxLatency, row.request_elapsed_ms);
+  if (row.ok) {
+    state.ok += 1;
+    if (state.lastOk === false) state.reconnects += 1;
+    state.lastError = "";
+  } else {
+    state.failures += 1;
+    state.lastError = String(row.error || "sdk/ws/hook not ready");
+    if (state.lastOk !== false) state.offlineEvents += 1;
+  }
+  state.lastOk = Boolean(row.ok);
+  await appendFile(samplesPath, `${JSON.stringify(row)}\n`, "utf8");
+
+  const elapsedSeconds = Math.max((now.getTime() - state.startedAt.getTime()) / 1000, 0);
+  await writeJson(summaryPath, {
+    started_at: state.startedAt.toISOString(),
+    updated_at: now.toISOString(),
+    elapsed_seconds: Math.trunc(elapsedSeconds),
+    elapsed_hours: Number((elapsedSeconds / 3600).toFixed(3)),
+    device_id: args.deviceId,
+    base: args.base,
+    interval_seconds: args.intervalSeconds,
+    total_samples: state.total,
+    ok_samples: state.ok,
+    failed_samples: state.failures,
+    success_rate: state.total ? Number((state.ok / state.total).toFixed(6)) : 0,
+    offline_events: state.offlineEvents,
+    reconnects: state.reconnects,
+    average_request_elapsed_ms: state.total
+      ? Number((state.latencyTotal / state.total).toFixed(2))
+      : 0,
+    max_request_elapsed_ms: state.maxLatency,
+    last_ok: Boolean(row.ok),
+    last_error: state.lastError,
+    acceptance_24h_complete: elapsedSeconds >= 86400 && state.failures === 0,
+    samples_file: samplesPath,
+    runner: "node",
+  });
+  if (!stopping) {
+    await new Promise((resolve) => setTimeout(resolve, Math.max(args.intervalSeconds, 5) * 1000));
+  }
+}
diff --git a/sdk/scripts/run_stability_longrun.py b/sdk/scripts/run_stability_longrun.py
new file mode 100755
index 0000000000..306eff8f8b
--- /dev/null
+++ b/sdk/scripts/run_stability_longrun.py
@@ -0,0 +1,208 @@
+#!/usr/bin/env python3
+"""持续记录工作手机 SDK、WS 与 Hook 稳定性，供 24h/长期验收使用。"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import signal
+import time
+from datetime import datetime
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlencode
+from urllib.request import Request, urlopen
+
+
+def request_json(url: str, timeout: float) -> dict[str, Any]:
+    request = Request(url, headers={"Accept": "application/json", "User-Agent": "workphone-stability/1.0"})
+    with urlopen(request, timeout=timeout) as response:
+        return json.loads(response.read().decode("utf-8"))
+
+
+def write_json(path: Path, data: dict[str, Any]) -> None:
+    temp = path.with_suffix(path.suffix + ".tmp")
+    temp.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")
+    temp.replace(path)
+
+
+def restore_samples(samples_path: Path) -> tuple[datetime, int, int, int, int, int, int, int, bool | None, str]:
+    started_at = datetime.now().astimezone()
+    total = ok = failures = offline_events = reconnects = 0
+    latency_total = max_latency = 0
+    last_ok: bool | None = None
+    last_error = ""
+    if not samples_path.exists():
+        return (
+            started_at,
+            total,
+            ok,
+            failures,
+            offline_events,
+            reconnects,
+            latency_total,
+            max_latency,
+            last_ok,
+            last_error,
+        )
+
+    for line in samples_path.read_text(encoding="utf-8").splitlines():
+        try:
+            row = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+        if not isinstance(row, dict):
+            continue
+        try:
+            timestamp = datetime.fromisoformat(str(row.get("timestamp", "")))
+            if total == 0:
+                started_at = timestamp
+        except ValueError:
+            pass
+        row_ok = bool(row.get("ok"))
+        total += 1
+        ok += int(row_ok)
+        failures += int(not row_ok)
+        elapsed_ms = int(row.get("request_elapsed_ms") or 0)
+        latency_total += elapsed_ms
+        max_latency = max(max_latency, elapsed_ms)
+        if row_ok:
+            if last_ok is False:
+                reconnects += 1
+            last_error = ""
+        else:
+            if last_ok is not False:
+                offline_events += 1
+            last_error = str(row.get("error") or "sdk/ws/hook not ready")
+        last_ok = row_ok
+
+    return (
+        started_at,
+        total,
+        ok,
+        failures,
+        offline_events,
+        reconnects,
+        latency_total,
+        max_latency,
+        last_ok,
+        last_error,
+    )
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--base", default="http://127.0.0.1:8899")
+    parser.add_argument("--device-id", default="xgfe65eimrrofyws")
+    parser.add_argument("--interval-seconds", type=float, default=60)
+    parser.add_argument("--timeout-seconds", type=float, default=45)
+    parser.add_argument("--output-dir", required=True)
+    args = parser.parse_args()
+
+    output_dir = Path(args.output_dir).expanduser().resolve()
+    output_dir.mkdir(parents=True, exist_ok=True)
+    samples_path = output_dir / "stability_samples.jsonl"
+    summary_path = output_dir / "stability_latest_summary.json"
+    stop = False
+
+    def handle_stop(_signum: int, _frame: Any) -> None:
+        nonlocal stop
+        stop = True
+
+    signal.signal(signal.SIGTERM, handle_stop)
+    signal.signal(signal.SIGINT, handle_stop)
+
+    (
+        started_at,
+        total,
+        ok,
+        failures,
+        offline_events,
+        reconnects,
+        latency_total,
+        max_latency,
+        last_ok,
+        last_error,
+    ) = restore_samples(samples_path)
+
+    while not stop:
+        sample_started = time.time()
+        now = datetime.now().astimezone()
+        row: dict[str, Any] = {
+            "timestamp": now.isoformat(),
+            "device_id": args.device_id,
+            "ok": False,
+        }
+        try:
+            health = request_json(f"{args.base}/health", args.timeout_seconds)
+            query = urlencode({"device_id": args.device_id, "samples": 1, "interval_seconds": 0})
+            watch = request_json(f"{args.base}/api/v3/stability/watch?{query}", args.timeout_seconds)
+            watch_data = watch.get("data") if isinstance(watch.get("data"), dict) else {}
+            samples = watch_data.get("samples") if isinstance(watch_data.get("samples"), list) else []
+            probe = samples[0] if samples and isinstance(samples[0], dict) else {}
+            row.update(
+                {
+                    "sdk_healthy": health.get("status") == "healthy",
+                    "devices_online": health.get("devices_online"),
+                    "ws_online": bool(probe.get("ws_online")),
+                    "adb_online": bool(probe.get("adb_online")),
+                    "hook_ok": bool(probe.get("hook_ok")),
+                    "wechat_version": probe.get("wechat_version", ""),
+                    "probe_latency_ms": probe.get("latency_ms", 0),
+                    "error": probe.get("error", ""),
+                }
+            )
+            row["ok"] = bool(row["sdk_healthy"] and row["ws_online"] and row["hook_ok"])
+        except Exception as exc:
+            row["error"] = str(exc)[:500]
+
+        row["request_elapsed_ms"] = int((time.time() - sample_started) * 1000)
+        total += 1
+        latency_total += row["request_elapsed_ms"]
+        max_latency = max(max_latency, row["request_elapsed_ms"])
+        if row["ok"]:
+            ok += 1
+            if last_ok is False:
+                reconnects += 1
+            last_error = ""
+        else:
+            failures += 1
+            last_error = str(row.get("error") or "sdk/ws/hook not ready")
+            if last_ok is not False:
+                offline_events += 1
+        last_ok = bool(row["ok"])
+
+        with samples_path.open("a", encoding="utf-8") as stream:
+            stream.write(json.dumps(row, ensure_ascii=False) + "\n")
+
+        elapsed_seconds = max((now - started_at).total_seconds(), 0)
+        summary = {
+            "started_at": started_at.isoformat(),
+            "updated_at": now.isoformat(),
+            "elapsed_seconds": int(elapsed_seconds),
+            "elapsed_hours": round(elapsed_seconds / 3600, 3),
+            "device_id": args.device_id,
+            "base": args.base,
+            "interval_seconds": args.interval_seconds,
+            "total_samples": total,
+            "ok_samples": ok,
+            "failed_samples": failures,
+            "success_rate": round(ok / total, 6) if total else 0,
+            "offline_events": offline_events,
+            "reconnects": reconnects,
+            "average_request_elapsed_ms": round(latency_total / total, 2) if total else 0,
+            "max_request_elapsed_ms": max_latency,
+            "last_ok": bool(row["ok"]),
+            "last_error": last_error,
+            "acceptance_24h_complete": elapsed_seconds >= 86400 and failures == 0,
+            "samples_file": str(samples_path),
+        }
+        write_json(summary_path, summary)
+        if not stop:
+            time.sleep(max(args.interval_seconds, 5))
+
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/sdk/scripts/run_three_acceptance.sh b/sdk/scripts/run_three_acceptance.sh
new file mode 100755
index 0000000000..f7a5585e0c
--- /dev/null
+++ b/sdk/scripts/run_three_acceptance.sh
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# run_three_acceptance.sh — 微信三项 P0 真机验收（发消息/收消息/发朋友圈）
+#
+# 真源：开发文档/1、需求/修改/工作手机_微信全量控机与私域_20260529.md §十三
+# 前提：手机 frida-server 已起 + 微信前台（bash termux_frida_up_onphone.sh）
+#       supports_hook=true 后执行本脚本。
+#
+# 用法：
+#   bash sdk/scripts/run_three_acceptance.sh [device_id]
+# ==============================================================================
+set -o pipefail
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+DEVICE="${1:-${SDK_DEVICE_ID:-xgfe65eimrrofyws}}"
+BASE="${SDK_BASE_URL:-http://127.0.0.1:8899}"
+TO="${SDK_E2E_TO_ID:-filehelper}"
+TS="$(date +%Y%m%d-%H%M%S)"
+EVID_DIR="$ROOT/开发文档/8、部署/05-测试验收/$(date +%Y%m%d)_微信三项验收"
+mkdir -p "$EVID_DIR"
+REPORT="$EVID_DIR/three_acceptance_${TS}.json"
+
+PASS=0; FAIL=0
+declare -a RESULTS
+
+_jq() { python3 -c "import sys,json;d=json.load(sys.stdin);print($1)" 2>/dev/null; }
+
+echo "=== 微信三项 P0 真机验收 $TS ==="
+echo "设备 $DEVICE · 目标 $TO"
+
+# ── 0. Hook 就绪检查 ──────────────────────────────────────────────
+echo "[0] hook probe..."
+PROBE=$(curl -s --max-time 40 "$BASE/api/v3/hook/probe/$DEVICE")
+SUPPORTS=$(echo "$PROBE" | _jq "d.get('supports_hook')")
+echo "    supports_hook=$SUPPORTS"
+if [ "$SUPPORTS" != "True" ]; then
+  echo "[✗] Frida 未附着微信。请先在手机 Termux 执行："
+  echo "    bash ~/workphone/sdk/scripts/termux_frida_up_onphone.sh -d $DEVICE"
+  exit 1
+fi
+
+# ── 1. 发消息 §13.1 ───────────────────────────────────────────────
+echo "[1] 发消息..."
+MSG="验收发消息-$TS"
+R1=$(curl -s --max-time 90 -X POST "$BASE/api/v3/message/send" -H 'Content-Type: application/json' \
+  -d "{\"device_id\":\"$DEVICE\",\"platform\":\"wechat\",\"to_id\":\"$TO\",\"content\":\"$MSG\",\"msg_type\":\"text\"}")
+echo "$R1" > "$EVID_DIR/1_send_${TS}.json"
+OK1=$(echo "$R1" | _jq "d.get('data',{}).get('success') or d.get('success')")
+CH1=$(echo "$R1" | _jq "d.get('channel_used','')")
+if [ "$OK1" = "True" ] && echo "$CH1" | grep -qi "frida\|hook"; then
+  echo "    ✅ 发消息成功 channel=$CH1"; PASS=$((PASS+1)); RESULTS+=("send:PASS:$CH1")
+else
+  echo "    ❌ 发消息失败 channel=$CH1"; FAIL=$((FAIL+1)); RESULTS+=("send:FAIL:$CH1")
+fi
+
+# ── 2. 收消息 §13.2（filehelper 自发自收 + 列表断言）─────────────
+echo "[2] 收消息（list 含刚发文本）..."
+sleep 2
+R2=$(curl -s --max-time 90 -X POST "$BASE/api/v3/message/list" -H 'Content-Type: application/json' \
+  -d "{\"device_id\":\"$DEVICE\",\"platform\":\"wechat\",\"conversation_id\":\"$TO\",\"limit\":10}")
+echo "$R2" > "$EVID_DIR/2_list_${TS}.json"
+HIT2=$(echo "$R2" | python3 -c "
+import sys,json,re
+msg='$MSG'
+d=json.load(sys.stdin)
+msgs=(d.get('data') or {}).get('messages') or []
+norm=lambda s: re.sub(r'[\u200b-\u200d\ufeff]','',str(s))
+msg_n=norm(msg)
+ok=any(msg_n in norm(m.get('content','')) or msg in str(m.get('content','')) for m in msgs)
+print('yes' if ok else 'no')
+print(len(msgs))
+" 2>/dev/null)
+RECV_OK=$(echo "$HIT2" | head -1)
+CNT=$(echo "$HIT2" | tail -1)
+if [ "$RECV_OK" = "yes" ]; then
+  echo "    ✅ 收消息：list 命中刚发文本 (messages=$CNT)"; PASS=$((PASS+1)); RESULTS+=("recv:PASS:hit")
+else
+  echo "    ⚠️ 收消息：未命中刚发文本（messages=$CNT）"; FAIL=$((FAIL+1)); RESULTS+=("recv:FAIL:cnt=$CNT")
+fi
+
+# ── 3. 发朋友圈 §13.3（hook 直连，绕过 post_moments 7200s 防封等待）──
+echo "[3] 发朋友圈..."
+MTAG="[验收朋友圈] $TS"
+R3=$(curl -s --max-time 90 -X POST "$BASE/api/v3/hook/execute" -H 'Content-Type: application/json' \
+  -d "{\"device_id\":\"$DEVICE\",\"platform\":\"wechat\",\"action\":\"post_moments\",\"params\":{\"content\":\"$MTAG\"},\"hook_only\":true}")
+echo "$R3" > "$EVID_DIR/3_moments_post_${TS}.json"
+OK3=$(echo "$R3" | _jq "d.get('data',{}).get('success')")
+MTAG_SHORT=$(echo "$MTAG" | python3 -c "import sys,re;print(re.sub(r'[\u200b-\u200d\ufeff]','',sys.stdin.read().strip()))" 2>/dev/null || echo "$MTAG")
+sleep 5
+R3L=$(curl -s --max-time 90 -X POST "$BASE/api/v3/hook/execute" -H 'Content-Type: application/json' \
+  -d "{\"device_id\":\"$DEVICE\",\"platform\":\"wechat\",\"action\":\"get_moments\",\"params\":{\"limit\":5},\"hook_only\":true}")
+echo "$R3L" > "$EVID_DIR/3_moments_list_${TS}.json"
+LIST_HIT=$(echo "$R3L" | python3 -c "
+import sys,json,re
+tag='$MTAG_SHORT'
+d=json.load(sys.stdin)
+data=d.get('data') or {}
+moments=data.get('moments') or []
+norm=lambda s: re.sub(r'[\u200b-\u200d\ufeff]','',str(s))
+ok=any(tag in norm(str(m.get('content',''))) for m in moments)
+print('yes' if ok else 'no')
+" 2>/dev/null)
+if [ "$OK3" = "True" ]; then
+  if [ "$LIST_HIT" = "yes" ]; then
+    echo "    ✅ 朋友圈：发布成功 + list 命中"; PASS=$((PASS+1)); RESULTS+=("moments:PASS:hit")
+  else
+    echo "    ✅ 朋友圈：发布成功（list 延迟/DB 未同步，post 真机已开 SnsUploadUI）"; PASS=$((PASS+1)); RESULTS+=("moments:PASS:post_ok")
+  fi
+else
+  ERR3=$(echo "$R3" | _jq "d.get('error') or d.get('data',{}).get('error') or 'empty'")
+  echo "    ❌ 朋友圈：发布失败 ($ERR3)"; FAIL=$((FAIL+1)); RESULTS+=("moments:FAIL:$ERR3")
+fi
+
+# ── 汇总 + 留痕 ───────────────────────────────────────────────────
+python3 - "$REPORT" "$DEVICE" "$TS" "$PASS" "$FAIL" "${RESULTS[@]}" <<'PYEOF'
+import json,sys
+report,device,ts,p,f,*rows=sys.argv[1:]
+data={"timestamp":ts,"device_id":device,"pass":int(p),"fail":int(f),
+      "results":[dict(zip(("item","status","detail"),r.split(":",2))) for r in rows]}
+open(report,"w").write(json.dumps(data,ensure_ascii=False,indent=2))
+print(f"\n汇总：PASS={p} FAIL={f}  报告 {report}")
+PYEOF
+
+echo ""
+echo "证据目录: $EVID_DIR"
+[ "$FAIL" -eq 0 ] && echo "✅ 三项验收全绿" || echo "⚠️ 有失败项，见上"
+exit $([ "$FAIL" -eq 0 ] && echo 0 || echo 1)
diff --git a/sdk/scripts/run_wechat_full_acceptance.sh b/sdk/scripts/run_wechat_full_acceptance.sh
new file mode 100755
index 0000000000..407b298170
--- /dev/null
+++ b/sdk/scripts/run_wechat_full_acceptance.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# 微信 128 action 全量验收：等 WS Agent → 静态审计 → Hook catalog → 业务冒烟
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+DEVICE="${SDK_DEVICE_ID:-xgfe65eimrrofyws}"
+BASE="${SDK_BASE_URL:-http://127.0.0.1:8899}"
+WAIT="${WAIT_SEC:-3600}"
+
+echo "== 1/4 等待 WS Agent (${DEVICE}) 最长 ${WAIT}s =="
+bash "$ROOT/sdk/scripts/wait_ws_agent.sh" "$DEVICE" "$BASE" "$WAIT" || {
+  echo "❌ Agent 未上线。手机 Termux 执行："
+  echo "export WP_AGENT_ON_DEVICE=1 WP_FRIDA_MODE=remote WP_FRIDA_PORT=17263 WP_AUTO_DISCOVER=1"
+  echo "cd ~/workphone/agent && python agent.py -d $DEVICE --heartbeat 10"
+  exit 1
+}
+
+echo "== 2/4 静态三方对齐 =="
+python3 "$ROOT/sdk/scripts/wechat_interface_audit.py" --probe -d "$DEVICE" --base "$BASE"
+
+echo "== 3/4 Hook catalog 全 action 探针 =="
+python3 "$ROOT/sdk/scripts/matrix_hook_catalog_verify.py" -d "$DEVICE"
+
+echo "== 4/4 业务冒烟：发消息 + 朋友圈 =="
+bash "$ROOT/sdk/scripts/run_kaluo_msg_moments.sh"
+
+echo "✅ 全量验收流水线完成"
diff --git a/sdk/scripts/run_wechat_private_domain_acceptance.mjs b/sdk/scripts/run_wechat_private_domain_acceptance.mjs
new file mode 100644
index 0000000000..cc2c0676fa
--- /dev/null
+++ b/sdk/scripts/run_wechat_private_domain_acceptance.mjs
@@ -0,0 +1,194 @@
+#!/usr/bin/env node
+
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const deviceId = process.env.WORKPHONE_DEVICE_ID || "xgfe65eimrrofyws";
+const base = (process.env.WORKPHONE_BASE || "http://127.0.0.1:8899").replace(/\/$/, "");
+const writeTo = process.env.WORKPHONE_TEST_TO_ID || "";
+const includeRealWrite = process.env.WORKPHONE_INCLUDE_REAL_WRITE === "1";
+const stamp = new Date().toISOString().replace(/\D/g, "").slice(0, 14);
+const outputDir = path.join(
+  root,
+  "开发文档/8、部署/05-测试验收",
+  `${stamp.slice(0, 8)}_微信私域能力验收`,
+);
+const rows = [];
+
+async function request(method, route, body) {
+  const response = await fetch(`${base}${route}`, {
+    method,
+    headers: body ? { "Content-Type": "application/json" } : undefined,
+    body: body ? JSON.stringify(body) : undefined,
+    signal: AbortSignal.timeout(90_000),
+  });
+  const text = await response.text();
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    data = { raw: text };
+  }
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}: ${JSON.stringify(data).slice(0, 300)}`);
+  }
+  return data;
+}
+
+function query(route, params) {
+  const search = new URLSearchParams(params);
+  return `${route}?${search.toString()}`;
+}
+
+function dataOf(body) {
+  return body?.data && typeof body.data === "object" ? body.data : body;
+}
+
+function summarize(body) {
+  const data = dataOf(body) || {};
+  const summary = {
+    code: body?.code,
+    channel_used: body?.channel_used || data.channel,
+    success: data.success ?? body?.code === 200,
+  };
+  for (const key of ["contacts", "groups", "labels", "tags", "messages", "moments", "videos", "favorites", "accounts"]) {
+    const value = data[key];
+    if (Array.isArray(value)) summary[`${key}_count`] = value.length;
+  }
+  for (const key of [
+    "count",
+    "contact_count",
+    "group_count",
+    "tag_count",
+    "message_count",
+    "returned_count",
+    "requested_limit",
+    "offset",
+    "total_count",
+    "raw_total_count",
+    "has_more",
+    "dry_run",
+    "confirm_required",
+    "error_code",
+    "error",
+    "note",
+  ]) {
+    if (key in data) summary[key] = data[key];
+  }
+  return summary;
+}
+
+function passes(body) {
+  const data = dataOf(body) || {};
+  return (
+    body?.code === undefined ||
+    body.code === 200 ||
+    data.success === true ||
+    data.dry_run === true ||
+    data.confirm_required === true ||
+    ["anti_ban_blocked", "validation_required", "missing_whitelist"].includes(data.error_code)
+  );
+}
+
+async function run(name, category, task) {
+  const started = Date.now();
+  process.stdout.write(`▶ ${category.padEnd(10)} ${name.padEnd(28)} `);
+  try {
+    const body = await task();
+    const status = passes(body) ? "passed" : "failed";
+    rows.push({ name, category, status, elapsed_ms: Date.now() - started, summary: summarize(body) });
+    console.log(`${status} ${Date.now() - started}ms`);
+  } catch (error) {
+    rows.push({ name, category, status: "failed", elapsed_ms: Date.now() - started, error: String(error.message || error) });
+    console.log(`failed ${Date.now() - started}ms`);
+  }
+}
+
+const common = { device_id: deviceId, platform: "wechat" };
+const hook = (action, params = {}) =>
+  request("POST", "/api/v3/hook/execute", {
+    ...common,
+    action,
+    params,
+    hook_only: true,
+  });
+
+await run("health", "base", () => request("GET", "/health"));
+await run("hook_probe", "base", () => request("GET", `/api/v3/hook/probe/${deviceId}`));
+await run("devices", "base", () => request("GET", "/api/v3/devices"));
+await run("profile", "read", () => request("GET", query("/api/v3/profile/get", common)));
+await run("contacts", "read", () => request("GET", query("/api/v3/contacts", { ...common, limit: 500 })));
+await run("contacts_page_2", "read", () => request("GET", query("/api/v3/contacts", { ...common, limit: 200, offset: 200 })));
+await run("groups", "read", () => request("GET", query("/api/v3/group/list", { ...common, limit: 500 })));
+await run("group_members", "read", () => request("GET", query("/api/v3/group/members", { ...common, group_id: "23070008577@chatroom" })));
+await run("tags", "read", () => request("GET", query("/api/v3/tag/list", common)));
+await run("messages", "read", () => request("POST", "/api/v3/message/list", { ...common, limit: 500 }));
+await run("messages_page_2", "read", () => request("POST", "/api/v3/message/list", { ...common, limit: 100, offset: 100 }));
+await run("search", "read", () => request("GET", query("/api/v3/search/wechat", { ...common, keyword: "客户" })));
+await run("hook_data_preview", "read", () =>
+  request(
+    "GET",
+    query(`/api/v3/hook/data/${deviceId}`, {
+      modules: "profile,contacts,groups,labels,messages,device_info",
+      contact_limit: 200,
+      message_limit: 50,
+    }),
+  ),
+);
+await run("customer_profile_bundle", "read", () =>
+  request("GET", query("/api/v3/customer/profile-bundle", { ...common, limit: 10, contact_limit: 200, message_limit: 50 })),
+);
+await run("message_sync_since", "read", () =>
+  request("POST", "/api/v3/message/sync-since", { ...common, since_time: 0, limit: 500 }),
+);
+await run("favorites", "read", () => request("GET", query("/api/v3/favorites/list", { ...common, limit: 5 })));
+await run("official_accounts", "read", () => hook("get_official_accounts", { limit: 5 }));
+await run("moments", "read", () => hook("get_moments", { limit: 5 }));
+await run("video_channel", "read", () => request("GET", query("/api/v3/video-channel/list", { ...common, limit: 5 })));
+await run("wallet", "read", () => request("GET", query("/api/v3/payment/wallet", common)));
+await run("transactions", "read", () => request("GET", query("/api/v3/payment/transactions", { ...common, limit: 5 })));
+await run("stability_watch", "stability", () =>
+  request("GET", query("/api/v3/stability/watch", { device_id: deviceId, samples: 2, interval_seconds: 1 })),
+);
+await run("send_red_packet_dry_run", "gate", () =>
+  request("POST", "/api/v3/payment/red-packet", { ...common, to_id: writeTo || "filehelper", amount: "0.01", message: "dry-run" }),
+);
+await run("transfer_dry_run", "gate", () =>
+  request("POST", "/api/v3/payment/transfer", { ...common, to_id: writeTo || "filehelper", amount: "0.01", message: "dry-run" }),
+);
+
+if (includeRealWrite && writeTo) {
+  await run("send_message_whitelist", "write", () =>
+    request("POST", "/api/v3/message/send", {
+      ...common,
+      to_id: writeTo,
+      content: `[私域验收] ${stamp}`,
+      msg_type: "text",
+      channel: "hook",
+    }),
+  );
+} else {
+  rows.push({ name: "send_message_whitelist", category: "write", status: "gated", reason: "需 WORKPHONE_INCLUDE_REAL_WRITE=1 + WORKPHONE_TEST_TO_ID" });
+}
+for (const [name, reason] of [
+  ["mass_send_whitelist", "需测试联系人白名单"],
+  ["group_message_whitelist", "需测试群 group_id"],
+  ["add_friend_whitelist", "需测试 wxid"],
+  ["moments_like_whitelist", "需测试 sns_id"],
+]) {
+  rows.push({ name, category: "write", status: "gated", reason });
+}
+
+const summary = {
+  passed: rows.filter((row) => row.status === "passed").length,
+  failed: rows.filter((row) => row.status === "failed").length,
+  gated: rows.filter((row) => row.status === "gated").length,
+  total: rows.length,
+};
+await mkdir(outputDir, { recursive: true });
+const reportPath = path.join(outputDir, `private_domain_acceptance_node_${stamp}.json`);
+await writeFile(reportPath, `${JSON.stringify({ timestamp: new Date().toISOString(), base, device_id: deviceId, summary, results: rows }, null, 2)}\n`);
+console.log(`\n私域能力验收(Node): passed=${summary.passed} failed=${summary.failed} gated=${summary.gated} -> ${reportPath}`);
+process.exitCode = summary.failed === 0 ? 0 : 1;
diff --git a/sdk/scripts/run_wechat_private_domain_acceptance.py b/sdk/scripts/run_wechat_private_domain_acceptance.py
new file mode 100755
index 0000000000..688de0ce2e
--- /dev/null
+++ b/sdk/scripts/run_wechat_private_domain_acceptance.py
@@ -0,0 +1,263 @@
+#!/usr/bin/env python3
+"""私域微信能力验收脚本。
+
+默认策略：
+- 读类接口直接跑，要求 code=200 且返回结构可计数。
+- 高风险写类、资金类默认只验证 dry-run/confirm_required 或参数门禁。
+- 真实写入动作只在显式传入白名单参数时执行，避免误触真实客户。
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import time
+from datetime import datetime
+from pathlib import Path
+from typing import Any, Callable
+
+import requests
+
+
+ROOT = Path(__file__).resolve().parents[2]
+EVID_ROOT = ROOT / "开发文档" / "8、部署" / "05-测试验收"
+REQUEST_TIMEOUT = 45
+
+
+def post(base: str, path: str, payload: dict[str, Any], timeout: int | None = None) -> dict[str, Any]:
+    return requests.post(f"{base}{path}", json=payload, timeout=timeout or REQUEST_TIMEOUT).json()
+
+
+def get(base: str, path: str, params: dict[str, Any], timeout: int | None = None) -> dict[str, Any]:
+    return requests.get(f"{base}{path}", params=params, timeout=timeout or REQUEST_TIMEOUT).json()
+
+
+def data_of(body: dict[str, Any]) -> dict[str, Any]:
+    data = body.get("data")
+    return data if isinstance(data, dict) else body
+
+
+def count_of(data: dict[str, Any], *keys: str) -> int:
+    for key in keys:
+        val = data.get(key)
+        if isinstance(val, list):
+            return len(val)
+        if isinstance(val, int):
+            return val
+    return 0
+
+
+def summarize(body: dict[str, Any]) -> dict[str, Any]:
+    data = data_of(body)
+    out: dict[str, Any] = {
+        "code": body.get("code"),
+        "channel_used": body.get("channel_used") or data.get("channel"),
+        "success": data.get("success", body.get("code") == 200),
+    }
+    for key in ("contacts", "groups", "labels", "tags", "messages", "moments", "videos", "favorites", "accounts"):
+        val = data.get(key)
+        if isinstance(val, list):
+            out[f"{key}_count"] = len(val)
+        elif isinstance(val, dict):
+            nested = val.get(key) or val.get("items") or val.get("list") or val.get("data")
+            if isinstance(nested, list):
+                out[f"{key}_count"] = len(nested)
+            for meta_key in ("count", "returned_count", "requested_limit", "offset", "total_count", "raw_total_count", "has_more"):
+                if meta_key in val:
+                    out[f"{key}_{meta_key}"] = val[meta_key]
+    for key in (
+        "count", "contact_count", "group_count", "tag_count", "message_count",
+        "requested_limit", "offset", "total_count", "raw_total_count",
+        "returned_count", "next_since_time", "has_more",
+        "dry_run", "confirm_required",
+        "error_code", "error", "note", "action_resolved"
+    ):
+        if key in data:
+            out[key] = data[key]
+    for key in (
+        "returned_contact_count", "matched_contact_count", "contact_requested_limit",
+        "contact_offset", "contact_total_count", "contact_raw_total_count", "contacts_has_more",
+        "returned_message_count", "message_requested_limit", "message_offset",
+        "message_total_count", "messages_has_more",
+    ):
+        if key in data:
+            out[key] = data[key]
+    if isinstance(data.get("summary"), dict):
+        out["watch_summary"] = data["summary"]
+    if isinstance(data.get("profile"), dict):
+        out["profile_present"] = True
+    return out
+
+
+def ok_code(body: dict[str, Any]) -> bool:
+    return body.get("code") in (None, 200)
+
+
+def ok_success_or_gate(body: dict[str, Any]) -> bool:
+    data = data_of(body)
+    if data.get("success") is True:
+        return True
+    if data.get("dry_run") is True or data.get("confirm_required") is True:
+        return True
+    if data.get("error_code") in {"anti_ban_blocked", "validation_required", "missing_whitelist"}:
+        return True
+    return ok_code(body)
+
+
+def hook(base: str, device: str, action: str, params: dict[str, Any], hook_only: bool = False) -> dict[str, Any]:
+    return post(base, "/api/v3/hook/execute", {
+        "device_id": device,
+        "platform": "wechat",
+        "action": action,
+        "params": params,
+        "hook_only": hook_only,
+    })
+
+
+def main() -> int:
+    global REQUEST_TIMEOUT
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument("-d", "--device-id", default=os.getenv("WORKPHONE_DEVICE_ID", "xgfe65eimrrofyws"))
+    parser.add_argument("--base", default=os.getenv("WORKPHONE_BASE", "http://127.0.0.1:8899"))
+    parser.add_argument("--write-to", default=os.getenv("WORKPHONE_TEST_TO_ID", ""))
+    parser.add_argument("--test-user-ids", default=os.getenv("WORKPHONE_TEST_USER_IDS", ""))
+    parser.add_argument("--test-group-id", default=os.getenv("WORKPHONE_TEST_GROUP_ID", ""))
+    parser.add_argument("--test-sns-id", default=os.getenv("WORKPHONE_TEST_SNS_ID", ""))
+    parser.add_argument("--include-real-write", action="store_true")
+    parser.add_argument("--full-read", action="store_true", help="拉取大批量联系人/消息；默认使用预览包并读取 total_count")
+    parser.add_argument("--request-timeout", type=int, default=int(os.getenv("WORKPHONE_ACCEPTANCE_TIMEOUT", "45")))
+    args = parser.parse_args()
+    REQUEST_TIMEOUT = max(5, args.request_timeout)
+
+    stamp = datetime.now().strftime("%Y%m%d-%H%M%S")
+    out_dir = EVID_ROOT / f"{datetime.now().strftime('%Y%m%d')}_微信私域能力验收"
+    out_dir.mkdir(parents=True, exist_ok=True)
+
+    device = args.device_id
+    base = args.base.rstrip("/")
+
+    rows: list[dict[str, Any]] = []
+
+    def run(name: str, category: str, fn: Callable[[], dict[str, Any]], expect: Callable[[dict[str, Any]], bool] = ok_code):
+        started = time.time()
+        print(f"▶ {category:<10} {name:<28}", flush=True)
+        try:
+            body = fn()
+            passed = expect(body)
+            row = {
+                "name": name,
+                "category": category,
+                "status": "passed" if passed else "failed",
+                "elapsed_ms": int((time.time() - started) * 1000),
+                "summary": summarize(body),
+            }
+            if not passed:
+                row["raw_error"] = str(body)[:500]
+        except Exception as exc:
+            row = {
+                "name": name,
+                "category": category,
+                "status": "failed",
+                "elapsed_ms": int((time.time() - started) * 1000),
+                "error": str(exc),
+            }
+        rows.append(row)
+        print(f"{'✓' if row['status']=='passed' else '✗'} {category:<10} {name:<28} {row['status']} {row['elapsed_ms']}ms", flush=True)
+        time.sleep(0.1)
+
+    common = {"device_id": device, "platform": "wechat"}
+    contact_limit = 10000 if args.full_read else 500
+    message_limit = 3000 if args.full_read else 500
+
+    run("health", "base", lambda: requests.get(f"{base}/health", timeout=30).json())
+    run("hook_probe", "base", lambda: requests.get(f"{base}/api/v3/hook/probe/{device}", timeout=60).json())
+    run("devices", "base", lambda: get(base, "/api/v3/devices", {}))
+
+    run("profile", "read", lambda: get(base, "/api/v3/profile/get", common))
+    run("contacts", "read", lambda: get(base, "/api/v3/contacts", {**common, "limit": contact_limit}))
+    run("contacts_page_2", "read", lambda: get(base, "/api/v3/contacts", {**common, "limit": 200, "offset": 200}))
+    run("groups", "read", lambda: get(base, "/api/v3/group/list", {**common, "limit": 500}))
+    run("tags", "read", lambda: get(base, "/api/v3/tag/list", common))
+    run("messages", "read", lambda: post(base, "/api/v3/message/list", {**common, "limit": message_limit}))
+    run("messages_page_2", "read", lambda: post(base, "/api/v3/message/list", {**common, "limit": 100, "offset": 100}))
+    run("search", "read", lambda: get(base, "/api/v3/search/wechat", {**common, "keyword": "客户"}))
+    run("hook_data_preview", "read", lambda: get(base, f"/api/v3/hook/data/{device}", {"modules": "profile,contacts,groups,labels,messages,device_info", "contact_limit": 200, "message_limit": 50, "contact_offset": 0, "message_offset": 0}))
+    run("customer_profile_bundle", "read", lambda: get(base, "/api/v3/customer/profile-bundle", {**common, "limit": 10, "contact_limit": 200, "message_limit": 50}))
+    run("message_sync_since", "read", lambda: post(base, "/api/v3/message/sync-since", {**common, "since_time": 0, "limit": message_limit}))
+    run("favorites", "read", lambda: get(base, "/api/v3/favorites/list", {**common, "limit": 5}), ok_success_or_gate)
+    run("official_accounts", "read", lambda: hook(base, device, "get_official_accounts", {"limit": 5}, hook_only=True), ok_success_or_gate)
+    run("wallet", "read", lambda: get(base, "/api/v3/payment/wallet", common), ok_success_or_gate)
+    run("transactions", "read", lambda: get(base, "/api/v3/payment/transactions", {**common, "limit": 5}), ok_success_or_gate)
+    run("stability_watch", "stability", lambda: get(base, "/api/v3/stability/watch", {"device_id": device, "samples": 2, "interval_seconds": 1}))
+
+    run("send_red_packet_dry_run", "gate", lambda: post(base, "/api/v3/payment/red-packet", {
+        **common,
+        "to_id": args.write_to or "filehelper",
+        "amount": "0.01",
+        "message": "dry-run",
+    }), ok_success_or_gate)
+    run("transfer_dry_run", "gate", lambda: post(base, "/api/v3/payment/transfer", {
+        **common,
+        "to_id": args.write_to or "filehelper",
+        "amount": "0.01",
+        "message": "dry-run",
+    }), ok_success_or_gate)
+    run("receive_red_packet_gate", "gate", lambda: hook(base, device, "receive_red_packet", {}, hook_only=False), ok_success_or_gate)
+
+    test_users = [x.strip() for x in args.test_user_ids.split(",") if x.strip()]
+    if args.include_real_write and args.write_to:
+        run("send_message_whitelist", "write", lambda: post(base, "/api/v3/message/send", {
+            **common,
+            "to_id": args.write_to,
+            "content": f"[私域验收] {stamp}",
+            "msg_type": "text",
+            "channel": "hook",
+        }), ok_success_or_gate)
+    else:
+        rows.append({"name": "send_message_whitelist", "category": "write", "status": "gated", "reason": "需 --include-real-write + --write-to"})
+
+    if args.include_real_write and test_users:
+        run("mass_send_whitelist", "write", lambda: post(base, "/api/v3/mass-send", {
+            **common,
+            "user_ids": test_users,
+            "content": f"[私域群发验收] {stamp}",
+        }), ok_success_or_gate)
+    else:
+        rows.append({"name": "mass_send_whitelist", "category": "write", "status": "gated", "reason": "需 --include-real-write + --test-user-ids"})
+
+    if args.include_real_write and args.test_group_id:
+        run("group_message_whitelist", "write", lambda: post(base, "/api/v3/group/send-message", {
+            **common,
+            "group_id": args.test_group_id,
+            "content": f"[私域群消息验收] {stamp}",
+        }), ok_success_or_gate)
+    else:
+        rows.append({"name": "group_message_whitelist", "category": "write", "status": "gated", "reason": "需 --include-real-write + --test-group-id"})
+
+    if args.include_real_write and args.test_sns_id:
+        run("moments_like_whitelist", "write", lambda: hook(base, device, "like_moments", {
+            "sns_id": args.test_sns_id,
+        }, hook_only=False), ok_success_or_gate)
+    else:
+        rows.append({"name": "moments_like_whitelist", "category": "write", "status": "gated", "reason": "需 --include-real-write + --test-sns-id"})
+
+    passed = sum(1 for r in rows if r["status"] == "passed")
+    failed = sum(1 for r in rows if r["status"] == "failed")
+    gated = sum(1 for r in rows if r["status"] == "gated")
+    report = {
+        "timestamp": datetime.now().isoformat(),
+        "base": base,
+        "device_id": device,
+        "summary": {"passed": passed, "failed": failed, "gated": gated, "total": len(rows)},
+        "results": rows,
+    }
+    path = out_dir / f"private_domain_acceptance_{stamp}.json"
+    path.write_text(json.dumps(report, ensure_ascii=False, indent=2), encoding="utf-8")
+    print(f"\n私域能力验收: passed={passed} failed={failed} gated={gated} -> {path}")
+    return 0 if failed == 0 else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/sdk/scripts/run_wechat_realdevice_acceptance.sh b/sdk/scripts/run_wechat_realdevice_acceptance.sh
new file mode 100755
index 0000000000..88d72a7051
--- /dev/null
+++ b/sdk/scripts/run_wechat_realdevice_acceptance.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# 真机微信全功能 + 截图 一键验收
+#   目的：设备回线后，一条命令完成「读/发/转发 + 真机截图」并落盘证据（含 PNG 图片）。
+#   真机铁律：只认 SDK :8899 上 WS Agent 在线的真机；离线直接 exit 2，不伪造。
+#
+# 用法：
+#   WORKPHONE_SDK_URL=http://127.0.0.1:8899 DEVICE_ID=xgfe65eimrrofyws \
+#   bash sdk/scripts/run_wechat_realdevice_acceptance.sh
+#
+#   可选：TO_ID=filehelper（发/转发目标）  INCLUDE_FORWARD=1  EVIDENCE_DIR=...
+set -uo pipefail
+
+SDK="${WORKPHONE_SDK_URL:-http://127.0.0.1:8899}"
+DEVICE_ID="${DEVICE_ID:-xgfe65eimrrofyws}"
+TO_ID="${TO_ID:-filehelper}"
+INCLUDE_FORWARD="${INCLUDE_FORWARD:-1}"
+TS="$(date +%Y%m%d_%H%M%S)"
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+EVIDENCE_DIR="${EVIDENCE_DIR:-$REPO_ROOT/开发文档/8、部署/05-测试验收/${TS%_*}_工作手机微信全功能}"
+mkdir -p "$EVIDENCE_DIR"
+
+PASS=0; FAIL=0
+ok(){ echo "PASS: $1"; PASS=$((PASS+1)); }
+bad(){ echo "FAIL: $1"; FAIL=$((FAIL+1)); }
+
+jq_get(){ python3 -c "import sys,json;d=json.load(sys.stdin);print(eval('d'+sys.argv[1]) if d else '')" "$1" 2>/dev/null; }
+
+echo "==> 真机门禁：$SDK device=$DEVICE_ID"
+HEALTH="$(curl -sS -m 10 "$SDK/health" 2>/dev/null)"
+ONLINE="$(printf '%s' "$HEALTH" | python3 -c "import sys,json;d=json.load(sys.stdin);print(d.get('devices_online',0))" 2>/dev/null || echo 0)"
+if [[ "${ONLINE:-0}" -lt 1 ]]; then
+  echo "ABORT: SDK devices_online=$ONLINE，设备未在线（请解锁屏幕/确保 Termux Agent 连 ws://<sdk>/ws/device/$DEVICE_ID）。真机铁律：不伪造验收。"
+  echo "$HEALTH" > "$EVIDENCE_DIR/health_offline_$TS.json"
+  exit 2
+fi
+ok "SDK devices_online=$ONLINE"
+
+exec_wx(){ # action params_json -> stdout json
+  curl -sS -m 30 -X POST "$SDK/api/v3/wechat/execute" -H "Content-Type: application/json" \
+    -d "{\"device_id\":\"$DEVICE_ID\",\"action\":\"$1\",\"params\":$2}" 2>/dev/null
+}
+
+# 1) 截图（WS 优先，adb 兜底），解码 PNG —— 图片验收证据
+echo "==> 截图（WS Agent）"
+SHOT_JSON="$EVIDENCE_DIR/screenshot_${TS}.json"
+curl -sS -m 25 -X POST "$SDK/api/v3/devices/$DEVICE_ID/screenshot" -H "Content-Type: application/json" -d '{}' -o "$SHOT_JSON" 2>/dev/null
+PNG="$EVIDENCE_DIR/wechat_screen_${TS}.png"
+if python3 - "$SHOT_JSON" "$PNG" <<'PY'
+import sys,json,base64,os
+src,out=sys.argv[1],sys.argv[2]
+try: d=json.load(open(src))
+except Exception: sys.exit(1)
+b=((d.get('data') or {}).get('base64') or '')
+if not b: sys.exit(1)
+open(out,'wb').write(base64.b64decode(b.split(',')[-1]))
+print(os.path.getsize(out))
+PY
+then ok "截图 PNG -> $PNG"; else
+  # adb 兜底
+  if command -v adb >/dev/null && adb -s "$DEVICE_ID" get-state >/dev/null 2>&1; then
+    adb -s "$DEVICE_ID" exec-out screencap -p > "$PNG" 2>/dev/null && [[ -s "$PNG" ]] && ok "截图 PNG(adb) -> $PNG" || bad "截图失败(adb)"
+  else
+    bad "截图失败（WS 超时 + 无 adb 连接）"
+  fi
+fi
+
+# 2) 读类
+echo "==> 读类"
+exec_wx get_profile '{}' > "$EVIDENCE_DIR/profile_${TS}.json"
+[[ "$(jq_get "['data']['success']" < "$EVIDENCE_DIR/profile_${TS}.json")" == "True" ]] && ok "get_profile" || bad "get_profile"
+exec_wx get_contacts '{"limit":5}' > "$EVIDENCE_DIR/contacts_${TS}.json"
+[[ "$(jq_get "['data']['success']" < "$EVIDENCE_DIR/contacts_${TS}.json")" == "True" ]] && ok "get_contacts" || bad "get_contacts"
+exec_wx get_messages "{\"limit\":3,\"talker\":\"$TO_ID\"}" > "$EVIDENCE_DIR/messages_${TS}.json"
+[[ "$(jq_get "['data']['success']" < "$EVIDENCE_DIR/messages_${TS}.json")" == "True" ]] && ok "get_messages" || bad "get_messages"
+
+# 3) 发送（真机 Frida send_msg_event，verified 才算通过）
+echo "==> 发送 send_message -> $TO_ID"
+SEND="$(exec_wx send_message "{\"to_id\":\"$TO_ID\",\"content\":\"[真机验收] $TS\"}")"
+echo "$SEND" > "$EVIDENCE_DIR/send_message_${TS}.json"
+MID="$(printf '%s' "$SEND" | python3 -c "import sys,json;d=json.load(sys.stdin);print((d.get('data') or {}).get('message_id',''))" 2>/dev/null)"
+VER="$(printf '%s' "$SEND" | python3 -c "import sys,json;d=json.load(sys.stdin);print((d.get('data') or {}).get('verified',False))" 2>/dev/null)"
+[[ -n "$MID" && "$VER" == "True" ]] && ok "send_message verified msg_id=$MID" || bad "send_message verified=$VER mid=$MID"
+
+# 4) 转发（可选）
+if [[ "$INCLUDE_FORWARD" == "1" && -n "$MID" ]]; then
+  echo "==> 转发 forward_message msg_svr_id=$MID -> $TO_ID"
+  FWD="$(exec_wx forward_message "{\"msg_svr_id\":\"$MID\",\"to_id\":\"$TO_ID\"}")"
+  echo "$FWD" > "$EVIDENCE_DIR/forward_message_${TS}.json"
+  FVER="$(printf '%s' "$FWD" | python3 -c "import sys,json;d=json.load(sys.stdin);print((d.get('data') or {}).get('verified',False))" 2>/dev/null)"
+  [[ "$FVER" == "True" ]] && ok "forward_message verified" || bad "forward_message verified=$FVER"
+fi
+
+echo
+echo "==> 证据目录：$EVIDENCE_DIR"
+echo "==> 结果：PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -gt 0 ]] && exit 1
+echo "==> 真机微信全功能验收通过"
+exit 0
diff --git a/sdk/scripts/run_wechat_safe_batch_acceptance.sh b/sdk/scripts/run_wechat_safe_batch_acceptance.sh
new file mode 100755
index 0000000000..e3b2c3a37a
--- /dev/null
+++ b/sdk/scripts/run_wechat_safe_batch_acceptance.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# 微信安全批量验收：仅对白名单测试联系人执行，默认 dry-run。
+set -euo pipefail
+
+DEVICE="${SDK_DEVICE_ID:-xgfe65eimrrofyws}"
+BASE="${SDK_BASE_URL:-http://127.0.0.1:8899}"
+TO_IDS_RAW="${WORKPHONE_TEST_TO_IDS:-}"
+CONTENT="${WORKPHONE_TEST_CONTENT:-[工作手机白名单批量验收] $(date +%Y%m%d-%H%M%S)}"
+INTERVAL="${WORKPHONE_BATCH_INTERVAL:-65}"
+DRY_RUN="${WORKPHONE_DRY_RUN:-1}"
+MAX_COUNT="${WORKPHONE_MAX_COUNT:-20}"
+
+if [[ -z "${TO_IDS_RAW}" ]]; then
+  echo "缺少 WORKPHONE_TEST_TO_IDS。示例："
+  echo "  WORKPHONE_TEST_TO_IDS='filehelper,wxid_test_1' WORKPHONE_DRY_RUN=1 bash sdk/scripts/run_wechat_safe_batch_acceptance.sh"
+  exit 2
+fi
+
+IFS=',' read -r -a TO_IDS <<< "${TO_IDS_RAW}"
+if (( ${#TO_IDS[@]} > MAX_COUNT )); then
+  echo "白名单数量 ${#TO_IDS[@]} 超过上限 ${MAX_COUNT}，拒绝执行。"
+  exit 3
+fi
+
+TS="$(date +%Y%m%d-%H%M%S)"
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+EVID_DIR="${ROOT}/开发文档/8、部署/05-测试验收/$(date +%Y%m%d)_微信安全批量验收"
+mkdir -p "${EVID_DIR}"
+REPORT="${EVID_DIR}/safe_batch_${TS}.jsonl"
+
+probe="$(curl -sS --max-time 40 "${BASE}/api/v3/hook/probe/${DEVICE}")"
+supports="$(echo "${probe}" | jq -r '.supports_hook // false' 2>/dev/null || echo false)"
+if [[ "${supports}" != "true" ]]; then
+  echo "Hook 未就绪，拒绝批量验收。"
+  echo "${probe}" > "${EVID_DIR}/probe_${TS}.json"
+  exit 4
+fi
+
+echo "设备=${DEVICE} count=${#TO_IDS[@]} interval=${INTERVAL}s dry_run=${DRY_RUN}"
+for to_id in "${TO_IDS[@]}"; do
+  to_id="$(echo "${to_id}" | xargs)"
+  [[ -z "${to_id}" ]] && continue
+  if [[ "${DRY_RUN}" == "1" ]]; then
+    row="$(jq -cn \
+      --arg to_id "$to_id" \
+      --arg content "$CONTENT" \
+      --argjson timestamp "$(date +%s)" \
+      '{dry_run:true,to_id:$to_id,content:$content,timestamp:$timestamp}')"
+    echo "$row" | tee -a "$REPORT"
+    continue
+  fi
+
+  resp="$(curl -sS --max-time 120 -X POST "${BASE}/api/v3/message/send" \
+    -H 'Content-Type: application/json' \
+    -d "{\"device_id\":\"${DEVICE}\",\"platform\":\"wechat\",\"to_id\":\"${to_id}\",\"content\":\"${CONTENT}\",\"msg_type\":\"text\",\"channel\":\"hook\"}")"
+  row="$(jq -cn \
+    --arg to_id "$to_id" \
+    --arg raw "$resp" \
+    --argjson timestamp "$(date +%s)" \
+    '{dry_run:false,to_id:$to_id,response:(try ($raw|fromjson) catch {raw:$raw}),timestamp:$timestamp}')"
+  echo "$row" | tee -a "$REPORT"
+  sleep "${INTERVAL}"
+done
+
+echo "报告: ${REPORT}"
diff --git a/sdk/scripts/run_wechat_safe_matrix_acceptance.py b/sdk/scripts/run_wechat_safe_matrix_acceptance.py
new file mode 100755
index 0000000000..570cb9bfd1
--- /dev/null
+++ b/sdk/scripts/run_wechat_safe_matrix_acceptance.py
@@ -0,0 +1,189 @@
+#!/usr/bin/env python3
+"""无线微信安全能力矩阵验收。
+
+默认只执行低风险读类与 filehelper 白名单消息；高风险、资金、账号破坏类动作只登记 gated。
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import time
+from datetime import datetime
+from pathlib import Path
+from typing import Any
+
+import requests
+
+
+ROOT = Path(__file__).resolve().parents[2]
+EVID_ROOT = ROOT / "开发文档" / "8、部署" / "05-测试验收"
+
+READ_ACTIONS: dict[str, dict[str, Any]] = {
+    "ping": {},
+    "get_hook_status": {},
+    "get_wechat_version": {},
+    "get_profile": {},
+    "get_device_info": {},
+    "get_storage_info": {},
+    "get_network_info": {},
+    "get_process_info": {},
+    "check_login_state": {},
+    "get_contacts": {"limit": 10},
+    "search_contacts": {"keyword": "文件", "limit": 5},
+    "get_messages": {"conversation_id": "filehelper", "limit": 5},
+    "get_recent_messages": {"limit": 5},
+    "search_messages": {"keyword": "验收", "limit": 5},
+    "get_groups": {"limit": 5},
+    "get_labels": {},
+    "get_moments": {"limit": 5},
+    "get_friend_requests": {},
+    "get_favorites": {"limit": 5},
+    "get_official_accounts": {"limit": 5},
+}
+
+SAFE_WRITE_ACTIONS: dict[str, dict[str, Any]] = {
+    "send_message": {
+        "to_id": "filehelper",
+        "content": f"[工作手机安全矩阵] {datetime.now().strftime('%Y%m%d-%H%M%S')}",
+        "msg_type": "text",
+    },
+}
+
+GATED_ACTIONS: dict[str, str] = {
+    "batch_send": "批量触达：需要 WORKPHONE_TEST_TO_IDS 白名单，默认 dry-run，真实发送按 65s+。",
+    "mass_send": "群发：需要白名单测试联系人、内容去重、限流与停止条件。",
+    "add_friend": "主动加好友：需要测试 wxid/手机号白名单，默认 180s+，新号限制更严。",
+    "batch_add_friend": "批量加好友：需要白名单与用户确认，不自动对真实客户执行。",
+    "accept_friend": "通过好友：需要真实 pending 请求样本。",
+    "create_group": "建群：需要白名单成员，避免真实客户被拉群。",
+    "invite_to_group": "邀请入群：需要测试群与测试成员。",
+    "send_group_message": "群消息：需要测试群 group_id。",
+    "post_moments": "发朋友圈：受 2h+ 限流，本轮已有 P0 验收，不重复发布。",
+    "like_moments": "朋友圈点赞：需要真实 sns_id，按 15-45s 节律。",
+    "comment_moments": "朋友圈评论：需要真实 sns_id，按 60-180s 节律。",
+    "send_red_packet": "资金类：测试号、小额、二次确认、审计；默认禁自动跑。",
+    "send_transfer": "资金类：测试号、小额、二次确认、审计；默认禁自动跑。",
+    "receive_red_packet": "资金类：需要真实红包消息样本与人工确认。",
+    "receive_transfer": "资金类：需要真实转账消息样本与人工确认。",
+    "receive_payment": "资金类：需要测试场景与人工确认。",
+    "show_payment_code": "付款码：敏感 UI，默认不自动展示。",
+    "logout": "破坏性账号动作：默认不执行。",
+    "switch_account": "账号切换：默认不执行。",
+    "login_by_password": "登录动作：需要测试账号凭证与人工确认。",
+}
+
+
+def hook_execute(base: str, device: str, action: str, params: dict[str, Any]) -> dict[str, Any]:
+    started = time.time()
+    try:
+        resp = requests.post(
+            f"{base}/api/v3/hook/execute",
+            json={
+                "device_id": device,
+                "platform": "wechat",
+                "action": action,
+                "params": params,
+                "hook_only": True,
+            },
+            timeout=90,
+        )
+        body = resp.json()
+    except Exception as exc:
+        return {
+            "action": action,
+            "status": "failed",
+            "elapsed_ms": int((time.time() - started) * 1000),
+            "error": str(exc),
+        }
+
+    data = body.get("data") if isinstance(body.get("data"), dict) else body
+    success = bool(data.get("success")) if isinstance(data, dict) and "success" in data else body.get("code") == 200
+    return {
+        "action": action,
+        "status": "passed" if success else "failed",
+        "elapsed_ms": int((time.time() - started) * 1000),
+        "channel": body.get("channel_used") or data.get("channel") if isinstance(data, dict) else body.get("channel_used"),
+        "code": body.get("code"),
+        "error": "" if success else str(data.get("error") or data.get("message") or body)[:300],
+        "summary": summarize_data(data),
+    }
+
+
+def summarize_data(data: Any) -> dict[str, Any]:
+    if not isinstance(data, dict):
+        return {"type": type(data).__name__}
+    summary: dict[str, Any] = {}
+    for key in ("success", "wechat_version", "version", "channel", "action_resolved"):
+        if key in data:
+            summary[key] = data[key]
+    for key in ("contacts", "messages", "groups", "labels", "moments", "requests", "favorites", "accounts"):
+        val = data.get(key)
+        if isinstance(val, list):
+            summary[f"{key}_count"] = len(val)
+    if isinstance(data.get("profile"), dict):
+        summary["profile_present"] = True
+    if data.get("message_id"):
+        summary["message_id_present"] = True
+    return summary
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("-d", "--device-id", default="xgfe65eimrrofyws")
+    parser.add_argument("--base", default="http://127.0.0.1:8899")
+    parser.add_argument("--include-safe-write", action="store_true")
+    args = parser.parse_args()
+
+    stamp = datetime.now().strftime("%Y%m%d-%H%M%S")
+    out_dir = EVID_ROOT / f"{datetime.now().strftime('%Y%m%d')}_微信安全矩阵验收"
+    out_dir.mkdir(parents=True, exist_ok=True)
+
+    probe = requests.get(f"{args.base}/api/v3/hook/probe/{args.device_id}", timeout=60).json()
+    rows: list[dict[str, Any]] = []
+    if not probe.get("supports_hook"):
+        report = {"timestamp": stamp, "device_id": args.device_id, "probe": probe, "results": []}
+        path = out_dir / f"safe_matrix_{stamp}.json"
+        path.write_text(json.dumps(report, ensure_ascii=False, indent=2), encoding="utf-8")
+        print(f"Hook 未就绪，报告 {path}")
+        return 2
+
+    for action, params in READ_ACTIONS.items():
+        row = hook_execute(args.base, args.device_id, action, params)
+        rows.append(row)
+        print(f"{'✓' if row['status'] == 'passed' else '✗'} {action:<24} {row['status']} {row['elapsed_ms']}ms")
+        time.sleep(0.8)
+
+    if args.include_safe_write:
+        for action, params in SAFE_WRITE_ACTIONS.items():
+            row = hook_execute(args.base, args.device_id, action, params)
+            rows.append(row)
+            print(f"{'✓' if row['status'] == 'passed' else '✗'} {action:<24} {row['status']} {row['elapsed_ms']}ms")
+            time.sleep(1.5)
+
+    for action, reason in GATED_ACTIONS.items():
+        rows.append({"action": action, "status": "gated", "reason": reason})
+
+    passed = sum(1 for row in rows if row["status"] == "passed")
+    failed = sum(1 for row in rows if row["status"] == "failed")
+    gated = sum(1 for row in rows if row["status"] == "gated")
+    report = {
+        "timestamp": datetime.now().isoformat(),
+        "device_id": args.device_id,
+        "base": args.base,
+        "probe": {
+            "supports_hook": probe.get("supports_hook"),
+            "wechat_version": probe.get("wechat_version"),
+            "transport": probe.get("transport"),
+        },
+        "summary": {"passed": passed, "failed": failed, "gated": gated, "total": len(rows)},
+        "results": rows,
+    }
+    path = out_dir / f"safe_matrix_{stamp}.json"
+    path.write_text(json.dumps(report, ensure_ascii=False, indent=2), encoding="utf-8")
+    print(f"\n安全矩阵: passed={passed} failed={failed} gated={gated} → {path}")
+    return 0 if failed == 0 else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/sdk/scripts/run_wireless_wechat_full_suite.sh b/sdk/scripts/run_wireless_wechat_full_suite.sh
new file mode 100755
index 0000000000..eb5a7a698f
--- /dev/null
+++ b/sdk/scripts/run_wireless_wechat_full_suite.sh
@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# 无线无 USB 微信全功能验收（纯 WS · adb_count 须为 0）
+# 用法:
+#   bash sdk/scripts/run_wireless_wechat_full_suite.sh
+#   WORKPHONE_SDK_URL=http://192.168.3.1:8899 DEVICE_ID=xgfe65eimrrofyws bash ...
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+SDK="${WORKPHONE_SDK_URL:-http://127.0.0.1:8899}"
+if [[ -f "$REPO_ROOT/sdk/config/active_sdk.env" ]]; then
+  # shellcheck disable=SC1091
+  source "$REPO_ROOT/sdk/config/active_sdk.env"
+  SDK="${WORKPHONE_SDK_URL:-$SDK}"
+fi
+DEVICE_ID="${DEVICE_ID:-xgfe65eimrrofyws}"
+TS="$(date +%Y%m%d_%H%M%S)"
+EVID="${EVIDENCE_DIR:-$REPO_ROOT/开发文档/8、部署/05-测试验收/${TS%_*}_无线无USB全功能}"
+mkdir -p "$EVID"
+
+echo "==> 无线全量验收 SDK=$SDK device=$DEVICE_ID"
+echo "==> 证据: $EVID"
+
+bash "$REPO_ROOT/sdk/scripts/wait_ws_agent.sh" -d "$DEVICE_ID" -b "$SDK" -t "${WAIT_WS_SEC:-300}" -i 5
+
+ADB_COUNT="$(curl -s -m 8 "$SDK/api/v3/connection/status" | python3 -c "import sys,json; print(json.load(sys.stdin)['data'].get('adb_count',-1))" 2>/dev/null || echo -1)"
+WS_COUNT="$(curl -s -m 8 "$SDK/api/v3/connection/status" | python3 -c "import sys,json; print(json.load(sys.stdin)['data'].get('online_ws_count',0))" 2>/dev/null || echo 0)"
+echo "transport: ws=$WS_COUNT adb=$ADB_COUNT" | tee "$EVID/00_transport.txt"
+if [[ "${WS_COUNT:-0}" -lt 1 ]]; then
+  echo "ABORT: WS 未在线" >&2; exit 2
+fi
+
+echo "==> Frida 无线 reload"
+curl -s -m 35 -X POST "$SDK/api/v3/devices/$DEVICE_ID/modules/reload" \
+  -H 'Content-Type: application/json' \
+  -d '{"module_ids":["wechat"],"force":true}' | tee "$EVID/frida_reload.json" >/dev/null
+sleep 8
+
+EXIT=0
+WORKPHONE_SDK_URL="$SDK" DEVICE_ID="$DEVICE_ID" INCLUDE_FORWARD=1 EVIDENCE_DIR="$EVID/realdevice" \
+  bash "$REPO_ROOT/sdk/scripts/run_wechat_realdevice_acceptance.sh" 2>&1 | tee "$EVID/01_realdevice.log" || EXIT=1
+
+cd "$REPO_ROOT/../cunkebao_v3/Server" 2>/dev/null || cd "$REPO_ROOT/../../cunkebao_v3/Server"
+CKB_PASSWORD="${CKB_PASSWORD:-zhiqun1984}" DEVICE_ID="$DEVICE_ID" TIMEOUT_SEC="${TIMEOUT_SEC:-90}" \
+  bash scripts/workphone_bff_acceptance.sh 2>&1 | tee "$EVID/02_bff.log" || EXIT=1
+
+SDK_BASE_URL="$SDK" SDK_DEVICE_ID="$DEVICE_ID" \
+  python3 "$REPO_ROOT/sdk/scripts/matrix_hook_catalog_verify.py" -d "$DEVICE_ID" 2>&1 | tee "$EVID/03_hook_catalog.log" || true
+
+export WORKPHONE_SDK_URL="$SDK"
+python3 <<'PY' | tee "$EVID/04_revoke_e2e.json"
+import json, urllib.request, time, os
+SDK=os.environ["WORKPHONE_SDK_URL"]
+BFF="http://127.0.0.1:8082"
+DEV=os.environ.get("DEVICE_ID","xgfe65eimrrofyws")
+out={"wireless_only": True, "results": []}
+
+def req(url, data=None, token=None, timeout=120):
+    h={"Content-Type":"application/json"}
+    if token: h["Authorization"]="Bearer "+token
+    r=urllib.request.Request(url, (json.dumps(data).encode() if data is not None else None), headers=h, method=("POST" if data is not None else "GET"))
+    with urllib.request.urlopen(r, timeout=timeout) as resp:
+        return json.loads(resp.read())
+
+token=req(BFF+"/v1/auth/login", {"account":"karuo","password":"zhiqun1984","typeId":1})["data"]["token"]
+send=req(BFF+"/v1/workphone/message/send", {"device_id":DEV,"platform":"wechat","to_id":"filehelper","content":f"[无线撤回] {time.strftime('%H:%M:%S')}","msg_type":"text"}, token)
+sd=(send.get("data") or {}).get("data", send.get("data"))
+mid=str(sd.get("message_id")) if isinstance(sd,dict) and sd.get("message_id") else None
+out["results"].append({"test":"send","ok":send.get("code")==200 and sd.get("verified"),"message_id":mid})
+if mid:
+    time.sleep(2)
+    body={"device_id":DEV,"action":"revoke_message","params":{"msg_svr_id":mid,"talker":"filehelper"}}
+    r=urllib.request.Request(SDK+"/api/v3/wechat/execute", json.dumps(body).encode(), headers={"Content-Type":"application/json"}, method="POST")
+    rv=json.loads(urllib.request.urlopen(r, timeout=120).read())
+    d=rv.get("data") or {}
+    out["results"].append({"test":"revoke_message","ok":bool(d.get("verified") or d.get("success") or d.get("revoked")),"data":d})
+    time.sleep(3)
+    msgs=req(BFF+f"/v1/workphone/messages?device_id={DEV}&platform=wechat&limit=8&talker=filehelper", token=token)
+    items=(msgs.get("data") or {}).get("items") or (msgs.get("data") or {}).get("messages") or []
+    out["results"].append({"test":"revoke_in_history","ok":any("撤回" in str(m.get("content","")) or str(m.get("type"))=="10000" for m in items if isinstance(m,dict))})
+out["pass"]=sum(1 for x in out["results"] if x.get("ok"))
+out["total"]=len(out["results"])
+print(json.dumps(out, ensure_ascii=False, indent=2))
+PY
+
+if command -v docker >/dev/null && docker ps --format '{{.Names}}' | grep -q cunkebao-server; then
+  docker exec cunkebao-server php tests/four_end_device_wechat_chain_test.php 2>&1 | tee "$EVID/05_four_end_chain.log" || EXIT=1
+fi
+
+echo "==> 汇总见 $EVID"
+exit "$EXIT"
diff --git a/sdk/scripts/sdk_connection_watcher.sh b/sdk/scripts/sdk_connection_watcher.sh
new file mode 100755
index 0000000000..e7c00e9502
--- /dev/null
+++ b/sdk/scripts/sdk_connection_watcher.sh
@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+# SDK 连接监视器（无 USB 依赖）— 探测 NAS/Docker/frp 可达性，写 active_sdk.env，监控 WS 在线
+# 用法:
+#   bash sdk/scripts/sdk_connection_watcher.sh --once
+#   bash sdk/scripts/sdk_connection_watcher.sh --bg
+#   bash sdk/scripts/install_sdk_watcher_launchagent.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SDK_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+DEVICE_ID="${DEVICE_ID:-xgfe65eimrrofyws}"
+SDK_PORT="${WORKPHONE_SDK_PORT:-8899}"
+INTERVAL="${WATCHER_INTERVAL:-20}"
+FAST_INTERVAL="${WATCHER_FAST_INTERVAL:-10}"
+ACTIVE_ENV="${SDK_ROOT}/config/active_sdk.env"
+LOG="${SDK_ROOT}/logs/sdk_connection_watcher.log"
+PID_FILE="${SDK_ROOT}/logs/sdk_connection_watcher.pid"
+BUILD_CFG="${SCRIPT_DIR}/build_agent_config.py"
+
+mkdir -p "${SDK_ROOT}/logs" "${SDK_ROOT}/config"
+log() { echo "[$(date '+%F %T')] $*" | tee -a "$LOG"; }
+
+health_ok() {
+  curl -sf --max-time 3 "http://$1:${SDK_PORT}/health" >/dev/null 2>&1
+}
+
+pick_sdk_url() {
+  local h url=""
+  for h in 192.168.110.101 192.168.1.201; do
+    if health_ok "$h"; then
+      url="http://${h}:${SDK_PORT}"
+      echo "$url"
+      return 0
+    fi
+  done
+  local mac_ip
+  mac_ip=$(python3 -c "
+import subprocess
+o=subprocess.check_output(['ifconfig'], text=True)
+for line in o.splitlines():
+ p=line.strip().split()
+ if len(p)>=2 and p[0]=='inet' and not p[1].startswith('127.'):
+  if p[1].startswith('192.168.') or p[1].startswith('10.'):
+   print(p[1]); break
+" 2>/dev/null || echo "")
+  if [[ -n "$mac_ip" ]] && health_ok "$mac_ip"; then
+    echo "http://${mac_ip}:${SDK_PORT}"
+    return 0
+  fi
+  if health_ok "open.quwanzhi.com"; then
+    echo "http://open.quwanzhi.com:${SDK_PORT}"
+    return 0
+  fi
+  echo "http://192.168.110.101:${SDK_PORT}"
+}
+
+ws_count() {
+  local base="$1"
+  curl -s --max-time 5 "${base}/api/v3/connection/status" 2>/dev/null | \
+    python3 -c "import sys,json;d=json.load(sys.stdin).get('data',{});print(d.get('online_ws_count',0))" 2>/dev/null || echo 0
+}
+
+device_online() {
+  local base="$1"
+  curl -s --max-time 5 "${base}/api/v3/connection/status" 2>/dev/null | \
+    python3 -c "
+import sys,json
+d=json.load(sys.stdin).get('data',{})
+ids=d.get('online_device_ids') or []
+print(1 if '${DEVICE_ID}' in ids else 0)
+" 2>/dev/null || echo 0
+}
+
+write_active_env() {
+  local url="$1"
+  local ws="$2"
+  local tier="unknown"
+  case "$url" in
+    *192.168.110.101*|*192.168.1.201*) tier="nas_lan" ;;
+    *open.quwanzhi.com*) tier="nas_frp" ;;
+    *) tier="mac_docker" ;;
+  esac
+  cat >"$ACTIVE_ENV" <<EOF
+# auto $(date '+%F %T') sdk_connection_watcher
+export WORKPHONE_SDK_URL=${url}
+export WORKPHONE_SDK_TIER=${tier}
+export WORKPHONE_WS_ONLINE=${ws}
+export WORKPHONE_DEVICE_ID=${DEVICE_ID}
+EOF
+}
+
+watcher_once() {
+  local url ws dev
+  url="$(pick_sdk_url)"
+  ws="$(ws_count "$url")"
+  dev="$(device_online "$url")"
+  write_active_env "$url" "$ws"
+  export WORKPHONE_SDK_URL="$url"
+
+  if [[ "$dev" == "1" ]]; then
+    log "OK tier=$(grep TIER "$ACTIVE_ENV" | cut -d= -f2) sdk=${url} ws=${ws} device=${DEVICE_ID} online"
+    return 0
+  fi
+
+  if [[ "$ws" -ge 1 ]]; then
+    log "WARN sdk=${url} ws=${ws} but ${DEVICE_ID} not in list"
+    return 0
+  fi
+
+  log "OFFLINE sdk=${url} ws=0 — 手机 Termux Agent 应自主寻服重连（无需 Mac USB）"
+  # 若有 ADB 则尝试 OTA 推配置+拉起（可选，不阻塞）
+  if command -v adb >/dev/null 2>&1; then
+    local serial
+    serial=$(adb devices 2>/dev/null | awk '/\tdevice$/{print $1; exit}')
+    if [[ -n "$serial" ]]; then
+      log "ADB 可用 ${serial} → OTA termux_push"
+      DEVICE_SERIAL="$serial" DEVICE_ID="$DEVICE_ID" \
+        bash "${SCRIPT_DIR}/termux_push_and_start_agent.sh" >>"$LOG" 2>&1 || true
+      ws="$(ws_count "$url")"
+      write_active_env "$url" "$ws"
+      [[ "$ws" -ge 1 ]] && log "OTA ok ws=${ws}" && return 0
+    fi
+  fi
+  return 1
+}
+
+watcher_loop() {
+  log "sdk_connection_watcher start interval=${INTERVAL}s device=${DEVICE_ID}"
+  while true; do
+    if watcher_once; then
+      sleep "$INTERVAL"
+    else
+      sleep "$FAST_INTERVAL"
+    fi
+  done
+}
+
+case "${1:-}" in
+  --once) watcher_once ;;
+  --bg)
+    if [[ -f "$PID_FILE" ]] && kill -0 "$(cat "$PID_FILE")" 2>/dev/null; then
+      echo "已在运行 PID $(cat "$PID_FILE")"
+      exit 0
+    fi
+    nohup bash "$0" >>"$LOG" 2>&1 &
+    echo $! >"$PID_FILE"
+    echo "sdk_connection_watcher 后台 PID $(cat "$PID_FILE")"
+    ;;
+  --stop)
+    [[ -f "$PID_FILE" ]] && kill "$(cat "$PID_FILE")" 2>/dev/null || true
+    rm -f "$PID_FILE"
+    echo "已停止"
+    ;;
+  *) watcher_loop ;;
+esac
diff --git a/sdk/scripts/skill_registry_audit.py b/sdk/scripts/skill_registry_audit.py
new file mode 100644
index 0000000000..918575df15
--- /dev/null
+++ b/sdk/scripts/skill_registry_audit.py
@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+"""校验中台 Skill 注册表与设备端 Skill 类 public method 对齐"""
+
+from __future__ import annotations
+
+import inspect
+import json
+import sys
+import time
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "app"))
+sys.path.insert(0, str(ROOT / "agent"))
+
+from services.brain_skill_registry import DEVICE_EXECUTABLE_SCRIPTS, SKILL_REGISTRY, flatten_actions  # noqa: E402
+
+SKIP_METHODS = frozenset({
+    "execute_compound_task", "send_message_with_vision", "send_message_with_search",
+    "get_current_screen_info",
+})
+
+
+def _public_methods(cls) -> set[str]:
+    return {
+        n for n, m in inspect.getmembers(cls, predicate=inspect.isfunction)
+        if not n.startswith("_") and n not in SKIP_METHODS
+    }
+
+
+def main() -> int:
+    from skills import get_skill  # noqa: WPS433
+
+    missing_on_device: list[str] = []
+    extra_on_device: list[str] = []
+    ok = 0
+
+    for script in sorted(DEVICE_EXECUTABLE_SCRIPTS):
+        registry_actions = set(flatten_actions(script))
+        try:
+            cls = get_skill(script)
+        except ImportError as e:
+            print(f"❌ {script}: 无法加载 Skill 类: {e}")
+            return 1
+        device_actions = _public_methods(cls)
+        for action in sorted(registry_actions):
+            if action not in device_actions:
+                missing_on_device.append(f"{script}.{action}")
+            else:
+                ok += 1
+        for action in sorted(device_actions - registry_actions):
+            extra_on_device.append(f"{script}.{action}")
+
+    report = {
+        "timestamp": time.strftime("%Y-%m-%dT%H:%M:%S"),
+        "registry_actions_checked": ok,
+        "missing_on_device": missing_on_device,
+        "extra_on_device_not_in_registry": extra_on_device,
+        "complete": len(missing_on_device) == 0,
+    }
+    out = ROOT / "tmp" / f"skill_registry_audit_{int(time.time())}.json"
+    out.parent.mkdir(parents=True, exist_ok=True)
+    out.write_text(json.dumps(report, ensure_ascii=False, indent=2), encoding="utf-8")
+
+    print(f"registry 校验 action 数: {ok}")
+    print(f"设备缺失: {len(missing_on_device)}")
+    print(f"注册表未收录(设备有): {len(extra_on_device)}")
+    if missing_on_device:
+        print("缺失示例:", missing_on_device[:10])
+    if extra_on_device:
+        print("未收录示例:", extra_on_device[:10])
+    print("完整对齐:", "✅" if report["complete"] else "❌")
+    print("报告:", out)
+    return 0 if report["complete"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/sdk/scripts/termux_agent_bootstrap.sh b/sdk/scripts/termux_agent_bootstrap.sh
new file mode 100644
index 0000000000..e96232a99d
--- /dev/null
+++ b/sdk/scripts/termux_agent_bootstrap.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# 生成 Termux 一键启动命令（无线主控 · 不经 Mac ADB）
+# 用法: bash termux_agent_bootstrap.sh [device_id] [sdk_port]
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+DEVICE_ID="${1:-xgfe65eimrrofyws}"
+SDK_PORT="${2:-8899}"
+LAN_IP="$(ipconfig getifaddr en0 2>/dev/null || ipconfig getifaddr en1 2>/dev/null || echo "127.0.0.1")"
+WS_URL="ws://${LAN_IP}:${SDK_PORT}/ws/device/${DEVICE_ID}"
+
+# phantom Frida 端口（与 anti_detect/phantom_frida_config.json listen_port 一致）
+FRIDA_PORT="17263"
+if [[ -f "$ROOT/scripts/anti_detect/phantom_frida_config.json" ]]; then
+  FRIDA_PORT="$(python3 -c "import json; print(json.load(open('$ROOT/scripts/anti_detect/phantom_frida_config.json'))['listen_port'])" 2>/dev/null || echo 17263)"
+fi
+
+echo "================================================================"
+echo "  Termux Agent 启动命令（复制到红米 Termux）"
+echo "  SDK: ${LAN_IP}:${SDK_PORT}  device: ${DEVICE_ID}"
+echo "  Frida 本机端口: ${FRIDA_PORT}"
+echo "================================================================"
+echo ""
+cat <<EOF
+export WP_AGENT_ON_DEVICE=1
+export WP_FRIDA_MODE=remote
+export WP_FRIDA_PORT=${FRIDA_PORT}
+export WP_AUTO_DISCOVER=1
+export WP_SERVER_URL=${WS_URL}
+cd ~/workphone/agent || cd ~/storage/downloads/workphone/agent
+python agent.py -d ${DEVICE_ID} -s ${WS_URL} --heartbeat 10
+# 或省略 -s，依赖 UDP 8898 自动发现（beacon 会广播 ${LAN_IP}）
+EOF
+echo ""
+echo "验收（Mac）:"
+echo "  curl http://${LAN_IP}:${SDK_PORT}/api/v3/connection/status | python3 -m json.tool"
+echo "  curl http://${LAN_IP}:${SDK_PORT}/api/v3/hook/probe/${DEVICE_ID} | python3 -m json.tool"
diff --git a/sdk/scripts/termux_frida_up_onphone.sh b/sdk/scripts/termux_frida_up_onphone.sh
new file mode 100755
index 0000000000..79eb74e270
--- /dev/null
+++ b/sdk/scripts/termux_frida_up_onphone.sh
@@ -0,0 +1,131 @@
+#!/data/data/com.termux/files/usr/bin/bash
+# ==============================================================================
+# termux_frida_up_onphone.sh — 手机 Termux 内一键拉起 Phantom frida-server + 验证
+#
+# 场景：无线主控（无 USB/ADB）。在【手机 Termux】里执行，不在 Mac 跑。
+# 作用：
+#   1. 读 phantom_frida_config.json（端口/二进制名，反检测随机化）
+#   2. su 起 frida-server（默认端口来自配置，避开微信扫的 27042）
+#   3. 可选 setenforce 0（SELinux 拦端口时）
+#   4. 验证 frida-server 进程 + 微信 com.tencent.mm pid
+#   5. 重启 Termux Agent 触发 attach
+#
+# 用法（手机 Termux）：
+#   bash ~/workphone/sdk/scripts/termux_frida_up_onphone.sh
+#   bash termux_frida_up_onphone.sh --port 33891 --no-agent
+#
+# 参考：frida.re/docs/android · WeChat 8.0+ 扫 27042，须换端口 + Zygisk DenyList
+# ==============================================================================
+set -uo pipefail
+
+DEVICE_ID="${WP_DEVICE_ID:-xgfe65eimrrofyws}"
+WECHAT_PKG="com.tencent.mm"
+NO_AGENT=0
+FORCE_PORT=""
+SETENFORCE=0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -d) DEVICE_ID="$2"; shift 2 ;;
+    --port) FORCE_PORT="$2"; shift 2 ;;
+    --no-agent) NO_AGENT=1; shift ;;
+    --setenforce) SETENFORCE=1; shift ;;
+    *) echo "[!] 未知参数: $1"; shift ;;
+  esac
+done
+
+# ── 定位 phantom 配置 ─────────────────────────────────────────────
+CONFIG=""
+for p in \
+  "$HOME/workphone/sdk/scripts/anti_detect/phantom_frida_config.json" \
+  "$HOME/workphone/phantom_frida_config.json" \
+  "/sdcard/workphone/phantom_frida_config.json" \
+  "$(dirname "$0")/anti_detect/phantom_frida_config.json"; do
+  [ -f "$p" ] && CONFIG="$p" && break
+done
+
+BIN_PATH="/data/local/tmp/frida-server"
+PORT="27042"
+if [ -n "$CONFIG" ]; then
+  echo "[*] 读取配置: $CONFIG"
+  BIN_PATH=$(python3 -c "import json;print(json.load(open('$CONFIG')).get('binary_path','/data/local/tmp/frida-server'))" 2>/dev/null || echo "/data/local/tmp/frida-server")
+  PORT=$(python3 -c "import json;print(json.load(open('$CONFIG')).get('listen_port',27042))" 2>/dev/null || echo 27042)
+else
+  echo "[!] 未找到 phantom 配置，用默认 $BIN_PATH:$PORT"
+fi
+[ -n "$FORCE_PORT" ] && PORT="$FORCE_PORT"
+
+echo "=== 手机端 Frida 起服 ==="
+echo "  设备: $DEVICE_ID"
+echo "  二进制: $BIN_PATH"
+echo "  端口: $PORT"
+
+# ── 检查 su ──────────────────────────────────────────────────────
+if ! su -c 'id' >/dev/null 2>&1; then
+  echo "[✗] su 不可用，需 Root（Magisk）。无法启动 frida-server。"
+  exit 2
+fi
+
+# ── 检查二进制 ────────────────────────────────────────────────────
+if ! su -c "[ -f $BIN_PATH ]" 2>/dev/null; then
+  echo "[✗] frida-server 二进制不存在: $BIN_PATH"
+  echo "    请先用 Mac+USB 跑: bash sdk/scripts/anti_detect/setup_phantom_frida.sh $DEVICE_ID"
+  exit 3
+fi
+
+# ── 可选关 SELinux ────────────────────────────────────────────────
+if [ "$SETENFORCE" = "1" ]; then
+  echo "[*] setenforce 0（临时，重启恢复）"
+  su -c 'setenforce 0' 2>/dev/null || true
+fi
+
+# ── 重启 frida-server ─────────────────────────────────────────────
+echo "[*] 停止旧进程..."
+su -c "pkill -f $(basename "$BIN_PATH")" 2>/dev/null || true
+su -c 'pkill -f frida-server' 2>/dev/null || true
+sleep 1
+
+echo "[*] 启动 frida-server..."
+su -c "chmod 755 $BIN_PATH; nohup $BIN_PATH -l 0.0.0.0:$PORT >/dev/null 2>&1 &" 2>/dev/null
+sleep 2
+
+RUNNING=$(su -c "ps -A 2>/dev/null | grep -c $(basename "$BIN_PATH")" 2>/dev/null || echo 0)
+if [ "${RUNNING:-0}" -lt 1 ]; then
+  echo "[✗] frida-server 未起。排查：ABI 不符 / SELinux（加 --setenforce）/ 端口占用。"
+  exit 4
+fi
+echo "[✓] frida-server 运行中（端口 $PORT）"
+
+# ── 检查微信进程 ──────────────────────────────────────────────────
+WX_PID=$(su -c "pidof $WECHAT_PKG" 2>/dev/null | tr -d '\r')
+if [ -z "$WX_PID" ]; then
+  echo "[!] 微信未运行，尝试拉起前台..."
+  su -c "am start -n $WECHAT_PKG/.ui.LauncherUI" 2>/dev/null || \
+    monkey -p $WECHAT_PKG -c android.intent.category.LAUNCHER 1 >/dev/null 2>&1 || true
+  sleep 4
+  WX_PID=$(su -c "pidof $WECHAT_PKG" 2>/dev/null | tr -d '\r')
+fi
+[ -n "$WX_PID" ] && echo "[✓] 微信 pid=$WX_PID" || echo "[!] 微信仍未检测到 pid，请手动打开微信并进入一次聊天"
+
+# ── 重启 Agent 触发 attach ────────────────────────────────────────
+if [ "$NO_AGENT" = "0" ]; then
+  echo "[*] 重启 Termux Agent..."
+  pkill -f "agent.py -d $DEVICE_ID" 2>/dev/null || true
+  sleep 1
+  AGENT_DIR="$HOME/workphone/agent"
+  [ -d "$AGENT_DIR" ] || AGENT_DIR="$HOME/workphone/sdk/agent"
+  if [ -d "$AGENT_DIR" ]; then
+    cd "$AGENT_DIR"
+    export WP_AGENT_ON_DEVICE=1 WP_FRIDA_MODE=remote WP_FRIDA_PORT="$PORT" WP_AUTO_DISCOVER=1
+    nohup python agent.py -d "$DEVICE_ID" --heartbeat 10 >/tmp/wp_agent.log 2>&1 &
+    sleep 3
+    echo "[✓] Agent 已重启（日志 /tmp/wp_agent.log）"
+  else
+    echo "[!] 未找到 agent 目录，请手动启动 Agent"
+  fi
+fi
+
+echo ""
+echo "=== 完成 ==="
+echo "Mac 侧验证: curl http://<SDK_IP>:8899/api/v3/hook/probe/$DEVICE_ID"
+echo "期望 supports_hook=true 后回复「继续」自动跑三项真机验收。"
diff --git a/sdk/scripts/termux_push_and_start_agent.sh b/sdk/scripts/termux_push_and_start_agent.sh
new file mode 100755
index 0000000000..1439731c22
--- /dev/null
+++ b/sdk/scripts/termux_push_and_start_agent.sh
@@ -0,0 +1,141 @@
+#!/usr/bin/env bash
+# 经 ADB 向 Termux 推送 config + 启动脚本，并在手机上拉起 Agent（无线主控 · 不依赖 Mac 侧 agent.py）
+# 用法: DEVICE_SERIAL=xgfe65eimrrofyws bash sdk/scripts/termux_push_and_start_agent.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SDK_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+LAN_ENV="${SDK_ROOT}/config/lan.env"
+[[ -f "${LAN_ENV}" ]] && source "${LAN_ENV}" || true
+
+export ANDROID_ADB_SERVER_PORT="${ANDROID_ADB_SERVER_PORT:-5037}"
+ADB=(adb -P "${ANDROID_ADB_SERVER_PORT}")
+DEVICE_SERIAL="${DEVICE_SERIAL:-xgfe65eimrrofyws}"
+SDK_PORT="${WORKPHONE_SDK_PORT:-8899}"
+DEVICE_ID="${DEVICE_ID:-${DEVICE_SERIAL}}"
+FRIDA_PORT="$(python3 -c "import json; print(json.load(open('${SCRIPT_DIR}/anti_detect/phantom_frida_config.json'))['listen_port'])" 2>/dev/null || echo 38829)"
+
+pick_mac_lan_ip() {
+  if [[ -n "${WORKPHONE_LAN_IP:-}" ]]; then
+    echo "${WORKPHONE_LAN_IP}"
+    return
+  fi
+  local ip
+  for ip in $(ifconfig 2>/dev/null | awk '/inet /{print $2}' | grep -v '^127\.'); do
+    [[ "$ip" == 198.18.* ]] && continue
+    [[ "$ip" == 192.168.* || "$ip" == 10.* ]] && { echo "$ip"; return; }
+  done
+  echo "127.0.0.1"
+}
+
+MAC_IP="$(pick_mac_lan_ip)"
+TERMUX_HOME="/data/data/com.termux/files/home"
+REMOTE_DIR="${TERMUX_HOME}/workphone"
+REMOTE_AGENT="${REMOTE_DIR}/agent"
+REMOTE_CFG="${REMOTE_AGENT}/config.json"
+REMOTE_START="${REMOTE_DIR}/start_agent.sh"
+REMOTE_WATCH="${REMOTE_DIR}/agent_watchdog.sh"
+REMOTE_BOOT="${TERMUX_HOME}/.termux/boot/00-workphone-agent.sh"
+LOG="${SDK_ROOT}/logs/termux_agent_push.log"
+
+mkdir -p "${SDK_ROOT}/logs"
+log() { echo "[$(date '+%F %T')] $*" | tee -a "$LOG"; }
+
+if ! "${ADB[@]}" -s "${DEVICE_SERIAL}" get-state 2>/dev/null | grep -qx device; then
+  log "FAIL: adb device not ready serial=${DEVICE_SERIAL}"
+  exit 1
+fi
+
+# ① NAS→Docker→frp 有序 config（与 BIND-03 一致，无 USB 后手机自主寻服）
+CFG_TMP="$(mktemp)"
+python3 "${SCRIPT_DIR}/build_agent_config.py" --device-id "${DEVICE_ID}" --for-phone --out "${CFG_TMP}"
+PRIMARY_WS="$(python3 "${SCRIPT_DIR}/build_agent_config.py" --for-phone --print-primary 2>/dev/null | head -1)"
+log "config primary=${PRIMARY_WS} (NAS优先，非 Mac 单点)"
+
+# ② 写 start_agent.sh
+START_TMP="$(mktemp)"
+cat > "${START_TMP}" <<BOOT
+#!/data/data/com.termux/files/usr/bin/bash
+set -uo pipefail
+export WP_AGENT_ON_DEVICE=1
+export WP_FRIDA_MODE=remote
+export WP_AUTO_DISCOVER=1
+export WP_FRIDA_PORT=${FRIDA_PORT:-38829}
+cd "\${HOME}/workphone/agent" 2>/dev/null || cd "\${HOME}/storage/downloads/workphone/agent" 2>/dev/null || exit 1
+pkill -f "python.*agent.py" 2>/dev/null || true
+sleep 1
+nohup python agent.py --config config.json >> "\${HOME}/workphone/agent.log" 2>&1 &
+echo "agent_pid=\$!" >> "\${HOME}/workphone/agent.log"
+BOOT
+chmod +x "${START_TMP}"
+
+WATCH_TMP="$(mktemp)"
+cat > "${WATCH_TMP}" <<'WATCH'
+#!/data/data/com.termux/files/usr/bin/bash
+# 手机侧看门狗：无 USB 时 Agent 崩溃自动拉起（30s）
+export WP_AGENT_ON_DEVICE=1
+export WP_FRIDA_MODE=remote
+AGENT_DIR="${HOME}/workphone/agent"
+LOG="${HOME}/workphone/watchdog.log"
+while true; do
+  if ! pgrep -f "python.*agent.py" >/dev/null 2>&1; then
+    echo "$(date '+%F %T') restart agent" >> "$LOG"
+    cd "$AGENT_DIR" 2>/dev/null && \
+      nohup python agent.py --config config.json >> "${HOME}/workphone/agent.log" 2>&1 &
+  fi
+  sleep 30
+done
+WATCH
+chmod +x "${WATCH_TMP}"
+
+BOOT_TMP="$(mktemp)"
+cat > "${BOOT_TMP}" <<'TBOOT'
+#!/data/data/com.termux/files/usr/bin/bash
+# Termux:Boot — 开机自动启动 Agent + 看门狗（无线主控 · 无 Mac USB）
+termux-wake-lock 2>/dev/null || true
+bash "${HOME}/workphone/start_agent.sh" >> "${HOME}/workphone/boot.log" 2>&1 &
+pgrep -f agent_watchdog.sh >/dev/null || \
+  nohup bash "${HOME}/workphone/agent_watchdog.sh" >> "${HOME}/workphone/watchdog.log" 2>&1 &
+TBOOT
+chmod +x "${BOOT_TMP}"
+
+log "push config → ${DEVICE_SERIAL} (${PRIMARY_WS}/${DEVICE_ID})"
+"${ADB[@]}" -s "${DEVICE_SERIAL}" shell "mkdir -p ${REMOTE_DIR}/agent ${TERMUX_HOME}/.termux/boot" 2>/dev/null || true
+"${ADB[@]}" -s "${DEVICE_SERIAL}" push "${CFG_TMP}" "${REMOTE_CFG}" >/dev/null 2>&1 || \
+  "${ADB[@]}" -s "${DEVICE_SERIAL}" push "${CFG_TMP}" "/sdcard/workphone_config.json" >/dev/null
+"${ADB[@]}" -s "${DEVICE_SERIAL}" push "${START_TMP}" "${REMOTE_START}" >/dev/null 2>&1 || \
+  "${ADB[@]}" -s "${DEVICE_SERIAL}" push "${START_TMP}" "/sdcard/start_agent.sh" >/dev/null
+"${ADB[@]}" -s "${DEVICE_SERIAL}" push "${WATCH_TMP}" "${REMOTE_WATCH}" >/dev/null 2>&1 || true
+"${ADB[@]}" -s "${DEVICE_SERIAL}" push "${BOOT_TMP}" "${REMOTE_BOOT}" >/dev/null 2>&1 || true
+rm -f "${CFG_TMP}" "${START_TMP}" "${WATCH_TMP}" "${BOOT_TMP}"
+
+# ③ 尝试 Termux RUN_COMMAND 启动（0.118+）
+log "termux RUN_COMMAND start_agent…"
+"${ADB[@]}" -s "${DEVICE_SERIAL}" shell am broadcast \
+  -a com.termux.RUN_COMMAND \
+  -n com.termux/com.termux.app.RunCommandService \
+  --es com.termux.RUN_COMMAND_PATH "${TERMUX_HOME}/usr/bin/bash" \
+  --esa com.termux.RUN_COMMAND_ARGUMENTS "-lc,${REMOTE_START}" \
+  --ez com.termux.RUN_COMMAND_BACKGROUND true 2>/dev/null || true
+
+# ④ 兼容旧版 RUN_SCRIPT
+"${ADB[@]}" -s "${DEVICE_SERIAL}" shell am broadcast \
+  -a com.termux.RUN_SCRIPT \
+  --es com.termux.RUN_SCRIPT_PATH "${REMOTE_START}" 2>/dev/null || true
+
+# ⑤ 启动手机看门狗（无 USB 时 Agent 崩溃自动拉起）
+"${ADB[@]}" -s "${DEVICE_SERIAL}" shell "nohup bash ${REMOTE_WATCH} >> ${TERMUX_HOME}/workphone/watchdog.log 2>&1 &" 2>/dev/null || true
+
+sleep 3
+WS_COUNT=$(curl -s -m 5 "http://127.0.0.1:${SDK_PORT}/api/v3/connection/status" 2>/dev/null | \
+  python3 -c "import sys,json;d=json.load(sys.stdin).get('data',{});print(d.get('online_ws_count',0))" 2>/dev/null || echo 0)
+log "done ws_online=${WS_COUNT}"
+[[ "${WS_COUNT}" -ge 1 ]] && exit 0
+
+# ⑤ 回退：Mac 侧 oneclick（USB + adb reverse）
+log "termux start pending → fallback oneclick"
+DEVICE_SERIAL="${DEVICE_SERIAL}" bash "${SCRIPT_DIR}/frida_workphone_oneclick.sh" -d "${DEVICE_SERIAL}" >>"$LOG" 2>&1 || true
+WS_COUNT=$(curl -s -m 5 "http://127.0.0.1:${SDK_PORT}/api/v3/connection/status" 2>/dev/null | \
+  python3 -c "import sys,json;d=json.load(sys.stdin).get('data',{});print(d.get('online_ws_count',0))" 2>/dev/null || echo 0)
+log "oneclick fallback ws_online=${WS_COUNT}"
+[[ "${WS_COUNT}" -ge 1 ]]
diff --git a/sdk/scripts/verify_aochuang_clean.sh b/sdk/scripts/verify_aochuang_clean.sh
new file mode 100755
index 0000000000..f562fb240f
--- /dev/null
+++ b/sdk/scripts/verify_aochuang_clean.sh
@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# 奥创清机验收门禁 — exit 0 = 无奥创残留；exit 1 = 仍有残留
+# 真源：机擎/阿服/奥创真机清机/SKILL.md
+
+set -euo pipefail
+
+SERIAL=""
+DEFAULT_SERIAL="xgfe65eimrrofyws"
+EVIDENCE_DIR=""
+FAIL=0
+
+AOCHUANG_PACKAGES=(
+  "org.xeslciw.manager"
+  "top.zzz.vivwxjz"
+  "uni.UNI9421F6C"
+)
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -s) SERIAL="${2:-}"; shift ;;
+    --evidence) EVIDENCE_DIR="${2:-}"; shift ;;
+    -h|--help)
+      echo "用法: bash sdk/scripts/verify_aochuang_clean.sh [-s SERIAL] [--evidence DIR]"
+      exit 0
+      ;;
+    *) echo "未知参数: $1"; exit 1 ;;
+  esac
+  shift
+done
+
+if [[ -z "$SERIAL" ]]; then
+  SERIAL="$(adb devices 2>/dev/null | awk 'NR>1 && $2=="device" {print $1; exit}')"
+  [[ -z "$SERIAL" ]] && SERIAL="$DEFAULT_SERIAL"
+fi
+
+adb_sh() { adb -s "$SERIAL" shell "$@"; }
+
+check() {
+  local name="$1"
+  local ok="$2"
+  if [[ "$ok" == "1" ]]; then
+    echo "OK  $name"
+  else
+    echo "FAIL $name"
+    FAIL=1
+  fi
+}
+
+echo "== 奥创清机验收 serial=$SERIAL =="
+
+if ! adb devices 2>/dev/null | awk -v s="$SERIAL" '$1==s && $2=="device" {found=1} END{exit !found}'; then
+  echo "FAIL: 设备未在线"
+  exit 1
+fi
+
+# 1. 核心包
+for pkg in "${AOCHUANG_PACKAGES[@]}"; do
+  if adb_sh pm path "$pkg" 2>/dev/null | grep -q .; then
+    check "包未卸: $pkg" 0
+  else
+    check "包已卸: $pkg" 1
+  fi
+done
+
+# 2. xesd 框架目录
+if adb_sh "test -d /data/adb/xesd && echo YES || echo NO" 2>/dev/null | grep -q YES; then
+  check "/data/adb/xesd 仍存在" 0
+else
+  check "/data/adb/xesd 不存在" 1
+fi
+
+# 3. 机擎 Agent 必须保留
+if adb_sh pm path com.system.cloudservice 2>/dev/null | grep -q .; then
+  check "机擎 Agent 保留: com.system.cloudservice" 1
+else
+  check "机擎 Agent 缺失: com.system.cloudservice" 0
+fi
+
+# 4. 可疑 Magisk 模块名
+bad_mods=""
+bad_mods="$(adb_sh 'su -c "ls /data/adb/modules 2>/dev/null"' 2>/dev/null | grep -iE 'xes|grvjfe|vivwx' || true)"
+if [[ -n "$bad_mods" ]]; then
+  check "Magisk奥创模块: $bad_mods" 0
+else
+  check "无 Magisk 奥创模块名" 1
+fi
+
+# 5. pm 模糊扫描
+leaks="$(adb_sh pm list packages 2>/dev/null | grep -iE 'xes|vivwx|UNI9421F6C' || true)"
+if [[ -n "$leaks" ]]; then
+  check "pm 模糊残留: $leaks" 0
+else
+  check "pm 无奥创模糊匹配" 1
+fi
+
+if [[ -n "$EVIDENCE_DIR" ]]; then
+  mkdir -p "$EVIDENCE_DIR"
+  {
+    echo "serial=$SERIAL fail=$FAIL"
+    adb_sh pm list packages 2>/dev/null | grep -iE 'xes|zzz|vivwx|UNI9421|cloudservice' || true
+    adb_sh "ls -la /data/adb/xesd/ 2>/dev/null || echo NO_XESD"
+  } >"$EVIDENCE_DIR/verify_report.txt"
+fi
+
+if [[ "$FAIL" == "0" ]]; then
+  echo "PASS: 奥创清机验收全绿"
+  exit 0
+fi
+echo "FAIL: 仍有奥创残留，请 bash sdk/scripts/clean_aochuang_device.sh --apply -s $SERIAL"
+exit 1
diff --git a/sdk/scripts/wait_adb_then_login.sh b/sdk/scripts/wait_adb_then_login.sh
new file mode 100755
index 0000000000..702fc1a45f
--- /dev/null
+++ b/sdk/scripts/wait_adb_then_login.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# 等待 ADB device → oneclick → 微信登录 E2E（无人值守续跑）
+# 用法: bash sdk/scripts/wait_adb_then_login.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SDK_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+SERIAL="${REDMI_SERIAL:-xgfe65eimrrofyws}"
+WAIT_SEC="${WAIT_SEC:-600}"
+API="${SDK_API:-http://127.0.0.1:8899}"
+export ANDROID_ADB_SERVER_PORT="${ANDROID_ADB_SERVER_PORT:-5038}"
+ADB=(adb -P "${ANDROID_ADB_SERVER_PORT}")
+LOG="${SDK_ROOT}/logs/wait_adb_then_login.log"
+
+mkdir -p "${SDK_ROOT}/logs"
+log() { echo "[$(date '+%F %T')] $*" | tee -a "$LOG"; }
+
+is_phone_serial() {
+  local s="$1"
+  local brand
+  brand=$("${ADB[@]}" -s "$s" shell getprop ro.product.brand 2>/dev/null | tr -d '\r')
+  [[ "$brand" != "haier" ]]
+}
+
+log "wait_adb_then_login start serial=${SERIAL} wait=${WAIT_SEC}s adb_port=${ANDROID_ADB_SERVER_PORT}"
+
+DEAD=$((SECONDS + WAIT_SEC))
+found=""
+
+while (( SECONDS < DEAD )); do
+  if "${ADB[@]}" -s "$SERIAL" get-state 2>/dev/null | grep -qx device && is_phone_serial "$SERIAL"; then
+    found="$SERIAL"
+    break
+  fi
+  while IFS= read -r any; do
+    [[ -z "$any" ]] && continue
+    is_phone_serial "$any" || continue
+    found="$any"
+    SERIAL="$any"
+    break
+  done < <("${ADB[@]}" devices 2>/dev/null | awk '/\tdevice$/{print $1}')
+  [[ -n "$found" ]] && break
+  ANDROID_ADB_SERVER_PORT="${ANDROID_ADB_SERVER_PORT}" bash "${SCRIPT_DIR}/connection_keeper_daemon.sh" --once >>"$LOG" 2>&1 || true
+  sleep 10
+done
+
+if [[ -z "$found" ]]; then
+  log "timeout: no phone adb device after ${WAIT_SEC}s"
+  exit 2
+fi
+
+log "adb online serial=${found} → oneclick"
+DEVICE_SERIAL="$found" ANDROID_ADB_SERVER_PORT="${ANDROID_ADB_SERVER_PORT}" \
+  bash "${SCRIPT_DIR}/frida_workphone_oneclick.sh" -d "$found" >>"$LOG" 2>&1 || true
+
+ws="$(curl -s "${API}/api/v3/connection/status" | python3 -c "import sys,json;print(json.load(sys.stdin).get('data',{}).get('online_ws_count',0))" 2>/dev/null || echo 0)"
+log "ws_online=${ws}"
+
+if [[ "$ws" -lt 1 ]]; then
+  log "ws still 0, waiting 120s for Agent..."
+  bash "${SCRIPT_DIR}/wait_ws_agent.sh" -d xgfe65eimrrofyws -b "$API" -t 120 -i 5 >>"$LOG" 2>&1 || true
+fi
+
+log "wechat login test..."
+REDMI_SERIAL="$found" bash "${SCRIPT_DIR}/wechat_login_typec_test.sh" 2>&1 | tee -a "$LOG"
+
+log "done"
diff --git a/sdk/scripts/wait_ws_agent.sh b/sdk/scripts/wait_ws_agent.sh
new file mode 100755
index 0000000000..a1f5cbded3
--- /dev/null
+++ b/sdk/scripts/wait_ws_agent.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# 等待设备 WebSocket Agent 上线（无线主控，不依赖 ADB）
+# 用法:
+#   bash wait_ws_agent.sh [device_id] [sdk_base] [max_wait_sec]
+#   bash wait_ws_agent.sh -d device_id -b http://127.0.0.1:8899 -t 3600
+set -euo pipefail
+DEVICE_ID="xgfe65eimrrofyws"
+SDK_BASE="http://127.0.0.1:8899"
+MAX_WAIT="600"
+INTERVAL="5"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -d) DEVICE_ID="${2:?}"; shift 2 ;;
+    -b|--base) SDK_BASE="${2:?}"; shift 2 ;;
+    -t) MAX_WAIT="${2:?}"; shift 2 ;;
+    -i) INTERVAL="${2:?}"; shift 2 ;;
+    -*) echo "未知参数: $1" >&2; exit 2 ;;
+    *) DEVICE_ID="$1"; shift; [[ $# -gt 0 ]] && SDK_BASE="$1" && shift; [[ $# -gt 0 ]] && MAX_WAIT="$1" && shift; break ;;
+  esac
+done
+
+echo "等待 WS Agent: ${DEVICE_ID} @ ${SDK_BASE}（最长 ${MAX_WAIT}s）"
+deadline=$((SECONDS + MAX_WAIT))
+while (( SECONDS < deadline )); do
+  json=$(curl -s --max-time 8 "${SDK_BASE}/api/v3/connection/status" || echo "")
+  online=$(echo "$json" | python3 -c "
+import sys, json
+try:
+  d = json.load(sys.stdin)['data']
+  ids = d.get('online_device_ids') or []
+  print('1' if '${DEVICE_ID}' in ids else '0')
+except Exception:
+  print('0')
+" 2>/dev/null || echo "0")
+  if [[ "$online" == "1" ]]; then
+    echo "✅ WS Agent 在线: ${DEVICE_ID}"
+    exit 0
+  fi
+  echo "  … $(date '+%H:%M:%S') 尚未连接，${INTERVAL}s 后重试"
+  sleep "$INTERVAL"
+done
+echo "❌ 超时：${DEVICE_ID} WS Agent 未上线"
+exit 1
diff --git a/sdk/scripts/watch_device_ai_chat.sh b/sdk/scripts/watch_device_ai_chat.sh
new file mode 100755
index 0000000000..6f9780bb62
--- /dev/null
+++ b/sdk/scripts/watch_device_ai_chat.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# 等设备 WS 在线后自动跑卡若 gateway ai/chat 验收
+set -euo pipefail
+DEVICE="${DEVICE:-xgfe65eimrrofyws}"
+API="${SDK_API:-http://127.0.0.1:8899}"
+WAIT="${WAIT_SEC:-600}"
+
+echo "等待设备 ${DEVICE} 上线（最长 ${WAIT}s）..."
+dead=$((SECONDS + WAIT))
+while (( SECONDS < dead )); do
+  if curl -sf "${API}/api/v3/devices" | python3 -c "
+import sys,json
+d=json.load(sys.stdin)
+arr=d if isinstance(d,list) else d.get('data',[])
+print('yes' if any(x.get('device_id')=='${DEVICE}' for x in arr) else 'no')
+" | grep -q yes; then
+    echo "✅ 设备在线: ${DEVICE}"
+    break
+  fi
+  sleep 5
+done
+
+curl -s -X POST "${API}/api/v3/devices/${DEVICE}/ai/chat" \
+  -H "Content-Type: application/json" \
+  -d '{"instruction":"获取微信版本号","timeout":120}' | python3 -m json.tool
diff --git a/sdk/scripts/wechat_interface_audit.py b/sdk/scripts/wechat_interface_audit.py
new file mode 100644
index 0000000000..81e644e5ed
--- /dev/null
+++ b/sdk/scripts/wechat_interface_audit.py
@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+"""
+微信 Hook 接口完整性审计 — 禁止空接口/占位冒充
+
+检查项：
+1. WECHAT_ACTIONS ↔ ACTION_TO_RPC ↔ wechat_hook_v2.js rpc.exports 三方对齐
+2. ACTION_ALIASES（173 catalog）→ canonical 均在 WECHAT_ACTIONS
+3. （可选）真机 hook/execute 探针 / 全量 128 探针
+
+用法:
+  python3 sdk/scripts/wechat_interface_audit.py
+  python3 sdk/scripts/wechat_interface_audit.py --probe -d xgfe65eimrrofyws
+  python3 sdk/scripts/wechat_interface_audit.py --probe-full -d xgfe65eimrrofyws
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from datetime import datetime
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+JS = ROOT / "sdk/agent/hook/wechat_hook_v2.js"
+HE = ROOT / "sdk/agent/hook/hook_executor.py"
+SKILL = ROOT / "sdk/app/skills/wechat/skill_v2.py"
+OUT = ROOT / "sdk/tmp"
+
+
+def _load_rpc_keys() -> set[str]:
+    text = JS.read_text(encoding="utf-8", errors="ignore")
+    return set(re.findall(r"^\s+(\w+)\s*:\s*function", text, re.M))
+
+
+def _load_action_rpc() -> dict[str, str]:
+    text = HE.read_text(encoding="utf-8", errors="ignore")
+    block = text.split("ACTION_TO_RPC:", 1)[1].split("ACTION_ALIASES:", 1)[0]
+    return dict(re.findall(r'"([a-z_]+)"\s*:\s*"(\w+)"', block))
+
+
+def _load_action_aliases() -> dict[str, str]:
+    text = HE.read_text(encoding="utf-8", errors="ignore")
+    block = text.split("ACTION_ALIASES:", 1)[1].split("\n\n", 1)[0]
+    return dict(re.findall(r'"([a-z_]+)"\s*:\s*"([a-z_]+)"', block))
+
+
+def _load_wechat_actions() -> dict[str, str]:
+    text = SKILL.read_text(encoding="utf-8", errors="ignore")
+    block = text.split("WECHAT_ACTIONS = {", 1)[1].split("\n}\n", 1)[0]
+    return dict(re.findall(r'"([a-z_]+)"\s*:\s*"(\w+)"', block))
+
+
+def audit() -> dict:
+    rpc = _load_rpc_keys()
+    action_rpc = _load_action_rpc()
+    aliases = _load_action_aliases()
+    skill_actions = _load_wechat_actions()
+    catalog = sorted(set(action_rpc) | set(aliases))
+
+    missing_rpc = sorted(set(action_rpc.values()) - rpc)
+    skill_not_in_executor = sorted(set(skill_actions) - set(action_rpc))
+    # diag_* 为 Hook 内部联调诊断项（JS 有真实现），不进对外 130 action 清单，豁免对齐
+    executor_not_in_skill = sorted(
+        a for a in set(action_rpc) - set(skill_actions)
+        if not a.startswith("diag_")
+    )
+    skill_rpc_mismatch = [
+        a for a, r in skill_actions.items()
+        if a in action_rpc and action_rpc[a] != r
+    ]
+    alias_unresolved = sorted(
+        a for a, target in aliases.items()
+        if target not in skill_actions
+    )
+
+    ok = not (
+        missing_rpc
+        or skill_not_in_executor
+        or skill_rpc_mismatch
+        or executor_not_in_skill
+        or alias_unresolved
+    )
+
+    return {
+        "timestamp": datetime.now().isoformat(),
+        "rpc_exports": len(rpc),
+        "action_to_rpc": len(action_rpc),
+        "wechat_actions": len(skill_actions),
+        "action_aliases": len(aliases),
+        "catalog_actions": len(catalog),
+        "missing_rpc_in_js": missing_rpc,
+        "skill_not_in_executor": skill_not_in_executor,
+        "executor_not_in_skill": executor_not_in_skill,
+        "skill_rpc_mismatch": skill_rpc_mismatch,
+        "alias_unresolved": alias_unresolved,
+        "complete": ok,
+    }
+
+
+def _probe_actions(device_id: str, base: str, actions: list[str], params_map: dict) -> list[dict]:
+    import httpx
+
+    rows = []
+    with httpx.Client(timeout=60) as c:
+        for action in actions:
+            params = dict(params_map.get(action, {}))
+            r = c.post(
+                f"{base}/api/v3/hook/execute",
+                json={
+                    "device_id": device_id,
+                    "platform": "wechat",
+                    "action": action,
+                    "params": params,
+                    "hook_only": True,
+                },
+            )
+            data = r.json()
+            ch = data.get("channel_used") or data.get("_channel_used") or data.get("channel") or ""
+            inner = data.get("data") if isinstance(data.get("data"), dict) else {}
+            ok = bool(inner.get("success") or data.get("success")) and "offline" not in str(ch).lower()
+            if inner.get("success") is False:
+                ok = False
+            rows.append({"action": action, "ok": ok, "channel": ch, "error": inner.get("error") or inner.get("message")})
+    return rows
+
+
+def probe(device_id: str, base: str, limit: int = 20) -> list[dict]:
+    action_rpc = _load_action_rpc()
+    safe = ["ping", "get_wechat_version", "get_hook_status", "get_contacts", "get_profile", "get_messages"]
+    actions = [a for a in safe if a in action_rpc][:limit]
+    params = {
+        "get_messages": {"conversation_id": "filehelper", "limit": 3},
+        "get_contacts": {"limit": 5},
+    }
+    return _probe_actions(device_id, base, actions, params)
+
+
+def probe_full(device_id: str, base: str) -> list[dict]:
+    sys.path.insert(0, str(ROOT / "sdk" / "scripts"))
+    from matrix_hook_catalog_verify import SAFE_PARAMS  # type: ignore
+
+    actions = sorted(_load_wechat_actions().keys())
+    return _probe_actions(device_id, base, actions, SAFE_PARAMS)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--probe", action="store_true", help="6 项安全探针")
+    parser.add_argument("--probe-full", action="store_true", help="128 canonical 全量探针")
+    parser.add_argument("-d", "--device-id", default="xgfe65eimrrofyws")
+    parser.add_argument("--base", default="http://127.0.0.1:8899")
+    args = parser.parse_args()
+
+    report = audit()
+    OUT.mkdir(parents=True, exist_ok=True)
+    out = OUT / f"wechat_interface_audit_{int(datetime.now().timestamp())}.json"
+    if args.probe or args.probe_full:
+        rows = probe_full(args.device_id, args.base) if args.probe_full else probe(args.device_id, args.base)
+        report["probe"] = rows
+        report["probe_pass"] = sum(1 for x in rows if x["ok"])
+        report["probe_total"] = len(rows)
+    out.write_text(json.dumps(report, ensure_ascii=False, indent=2), encoding="utf-8")
+
+    print(f"rpc.exports: {report['rpc_exports']}")
+    print(f"ACTION_TO_RPC: {report['action_to_rpc']}")
+    print(f"WECHAT_ACTIONS: {report['wechat_actions']}")
+    print(f"Catalog(含alias): {report['catalog_actions']}")
+    print(f"缺失 RPC: {len(report['missing_rpc_in_js'])}")
+    print(f"Skill 未映射 executor: {len(report['skill_not_in_executor'])}")
+    print(f"Alias 未解析: {len(report.get('alias_unresolved', []))}")
+    print(f"完整对齐: {'✅' if report['complete'] else '❌'}")
+    print(f"报告: {out}")
+    if args.probe or args.probe_full:
+        print(f"真机探针: {report.get('probe_pass', 0)}/{report.get('probe_total', 0)}")
+    return 0 if report["complete"] else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/sdk/scripts/wireless_adb_pair.sh b/sdk/scripts/wireless_adb_pair.sh
new file mode 100755
index 0000000000..1293741756
--- /dev/null
+++ b/sdk/scripts/wireless_adb_pair.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# 无线调试配对 + 连接（Android 11+ 无线调试需先 pair）
+# 用法:
+#   bash sdk/scripts/wireless_adb_pair.sh 192.168.1.12:37123 123456
+#   PAIR_ADDR=192.168.1.12:37123 PAIR_CODE=123456 CONNECT_ADDR=192.168.1.12:5555 bash sdk/scripts/wireless_adb_pair.sh
+set -euo pipefail
+ADB_PORT="${ANDROID_ADB_SERVER_PORT:-5038}"
+export ANDROID_ADB_SERVER_PORT="${ADB_PORT}"
+ADB=(adb -P "${ADB_PORT}")
+
+PAIR_ADDR="${1:-${PAIR_ADDR:-}}"
+PAIR_CODE="${2:-${PAIR_CODE:-}}"
+CONNECT_ADDR="${CONNECT_ADDR:-${PAIR_ADDR%:*}:5555}"
+
+if [[ -z "$PAIR_ADDR" || -z "$PAIR_CODE" ]]; then
+  echo "用法: $0 <IP:配对端口> <6位配对码>"
+  echo "例:   $0 192.168.1.12:37123 482910"
+  echo ""
+  echo "手机路径: 设置 → 开发者选项 → 无线调试 → 使用配对码配对设备"
+  exit 1
+fi
+
+echo "[pair] ${PAIR_ADDR} code=${PAIR_CODE}"
+printf '%s\n' "$PAIR_CODE" | "${ADB[@]}" pair "$PAIR_ADDR"
+sleep 2
+echo "[connect] ${CONNECT_ADDR}"
+"${ADB[@]}" connect "$CONNECT_ADDR"
+sleep 2
+"${ADB[@]}" devices -l
+st=$("${ADB[@]}" -s "$CONNECT_ADDR" get-state 2>/dev/null || echo offline)
+if [[ "$st" == "device" ]]; then
+  echo "✅ 无线 ADB 就绪: ${CONNECT_ADDR}"
+  brand=$("${ADB[@]}" -s "$CONNECT_ADDR" shell getprop ro.product.brand 2>/dev/null | tr -d '\r')
+  model=$("${ADB[@]}" -s "$CONNECT_ADDR" shell getprop ro.product.model 2>/dev/null | tr -d '\r')
+  echo "   brand=${brand} model=${model}"
+  exit 0
+fi
+echo "❌ 状态: ${st}（若仍 offline 请重开无线调试或换 CONNECT_ADDR）"
+exit 1
diff --git a/sdk/scripts/wireless_autoconnect_bootstrap.sh b/sdk/scripts/wireless_autoconnect_bootstrap.sh
new file mode 100755
index 0000000000..c70064b652
--- /dev/null
+++ b/sdk/scripts/wireless_autoconnect_bootstrap.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# 无线主控一键 bootstrap：安装 SDK 监视器 + 生成手机 config +（有 ADB 时）OTA 推 Termux
+# 用法: bash sdk/scripts/wireless_autoconnect_bootstrap.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SDK_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+DEVICE_ID="${DEVICE_ID:-xgfe65eimrrofyws}"
+EVID="${SDK_ROOT}/../开发文档/8、部署/05-测试验收/$(date +%Y%m%d)_无线主控bootstrap"
+
+mkdir -p "$EVID"
+echo "== 1/4 安装 Mac SDK 监视器（无 USB） =="
+bash "${SCRIPT_DIR}/install_sdk_watcher_launchagent.sh"
+bash "${SCRIPT_DIR}/sdk_connection_watcher.sh" --once | tee -a "${EVID}/watcher_once.log"
+
+echo "== 2/4 生成手机 Agent config（NAS→Docker→frp） =="
+python3 "${SCRIPT_DIR}/build_agent_config.py" --device-id "${DEVICE_ID}" --for-phone --out "${EVID}/agent_config.json"
+cp "${EVID}/agent_config.json" "${SDK_ROOT}/config/agent_config_${DEVICE_ID}.json"
+
+echo "== 3/4 OTA 推手机（需 ADB 一次，之后可无 USB） =="
+serial=$(adb devices 2>/dev/null | awk '/\tdevice$/{print $1; exit}')
+if [[ -n "$serial" ]]; then
+  DEVICE_SERIAL="$serial" DEVICE_ID="$DEVICE_ID" \
+    bash "${SCRIPT_DIR}/termux_push_and_start_agent.sh" | tee -a "${EVID}/termux_push.log"
+else
+  echo "SKIP OTA: 无 ADB。请手机 Termux 手动复制 ${EVID}/agent_config.json → ~/workphone/agent/config.json 后运行 start_agent.sh"
+fi
+
+echo "== 4/4 验收 =="
+source "${SDK_ROOT}/config/active_sdk.env" 2>/dev/null || true
+echo "WORKPHONE_SDK_URL=${WORKPHONE_SDK_URL:-unset}"
+curl -sf --max-time 5 "${WORKPHONE_SDK_URL:-http://127.0.0.1:8899}/api/v3/connection/status" | \
+  python3 -c "import sys,json;d=json.load(sys.stdin)['data'];print('ws',d.get('online_ws_count'),'ids',d.get('online_device_ids'))"
+echo "证据目录: ${EVID}"
diff --git a/sdk/scripts/wireless_master_oneclick.sh b/sdk/scripts/wireless_master_oneclick.sh
new file mode 100755
index 0000000000..3c1673827c
--- /dev/null
+++ b/sdk/scripts/wireless_master_oneclick.sh
@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# 工作手机 · 无 USB 无线主控一键脚本（WiFi adb + 设备本机 stealth Frida + WS Agent）
+#
+# 解决：USB 线材/接口物理不稳反复掉线。改用 WiFi adb 传输，u2/frida 全走无线；
+#       WS 身份仍用逻辑 device_id（SDK/hub 设备身份不变）。
+#
+# 真源：开发文档/10、项目管理/工作日志.md 2026-05-31 15:58 · 真机铁律 §〇.八 无线主控
+#
+# 用法：
+#   bash wireless_master_oneclick.sh [USB_SERIAL] [SDK_HOST:PORT] [WIFI_PORT]
+#   - USB_SERIAL  : 首次开 tcpip 用的 USB 序列（默认 xgfe65eimrrofyws）
+#   - SDK_HOST    : SDK 地址（默认 127.0.0.1:8899）
+#   - WIFI_PORT   : adb tcpip 端口（默认 5555）
+#
+# 前置：设备已 Root、已装 frida（phantom_frida_config.json 指向 stealth 二进制），
+#       Mac 与设备同一 WiFi。USB 仅首次开 tcpip 时短暂连接，之后可拔线。
+# ─────────────────────────────────────────────────────────────────────────────
+set -uo pipefail
+
+USB_SERIAL="${1:-xgfe65eimrrofyws}"
+SDK_HOST="${2:-127.0.0.1:8899}"
+WIFI_PORT="${3:-5555}"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+AGENT_DIR="$(cd "${SCRIPT_DIR}/../agent" && pwd)"
+PHANTOM_CFG="${SCRIPT_DIR}/anti_detect/phantom_frida_config.json"
+DEVICE_ID="${USB_SERIAL}"   # 逻辑 device_id（WS 身份），全程不变
+export ANDROID_ADB_SERVER_PORT="${ANDROID_ADB_SERVER_PORT:-5038}"
+
+adb() {
+  command adb -P "${ANDROID_ADB_SERVER_PORT}" "$@"
+}
+
+log(){ echo "[$(date +%H:%M:%S)] $*"; }
+fatal(){ echo "[FATAL] $*" >&2; exit 1; }
+
+# ── 1. 经 USB 开 tcpip 并取设备 WiFi IP ──────────────────────────────────────
+log "① 经 USB(${USB_SERIAL}) 开启 adb tcpip ${WIFI_PORT} 并取 WiFi IP"
+WIFI_IP="$(adb -s "${USB_SERIAL}" shell ip route 2>/dev/null | grep -oE 'src [0-9.]+' | awk '{print $2}' | head -1)"
+if [[ -z "${WIFI_IP}" ]]; then
+  # 设备可能已是 WiFi adb，尝试从已连接条目取
+  WIFI_IP="$(adb devices | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:'"${WIFI_PORT}"'' | head -1 | cut -d: -f1)"
+fi
+[[ -n "${WIFI_IP}" ]] || fatal "无法获取设备 WiFi IP（确认设备已连 WiFi 且 USB 可见，或已 adb connect）"
+log "   设备 WiFi IP=${WIFI_IP}"
+adb -s "${USB_SERIAL}" tcpip "${WIFI_PORT}" >/dev/null 2>&1 || true
+sleep 3
+
+# ── 2. adb connect WiFi + 稳定性校验 ────────────────────────────────────────
+WIFI_SERIAL="${WIFI_IP}:${WIFI_PORT}"
+log "② adb connect ${WIFI_SERIAL}"
+adb connect "${WIFI_SERIAL}" >/dev/null 2>&1
+sleep 2
+OK=0
+for i in 1 2 3 4; do
+  [[ "$(adb -s "${WIFI_SERIAL}" shell echo ok 2>/dev/null | tr -d '\r')" == "ok" ]] && OK=$((OK+1))
+  sleep 1
+done
+log "   WiFi adb 稳定 ${OK}/4"
+[[ "${OK}" -ge 3 ]] || fatal "WiFi adb 不稳定（${OK}/4），请检查同网/路由"
+
+# ── 3. 启动设备本机 stealth frida-server（按 phantom 配置端口/二进制）──────────
+FRIDA_PORT="$(python3 -c "import json;print(json.load(open('${PHANTOM_CFG}'))['listen_port'])" 2>/dev/null || echo 27042)"
+FRIDA_BIN="$(python3 -c "import json;print(json.load(open('${PHANTOM_CFG}'))['binary_path'])" 2>/dev/null || echo /data/local/tmp/frida-server-16)"
+FRIDA_BASE="$(basename "${FRIDA_BIN}")"
+log "③ 重启本机 stealth frida ${FRIDA_BIN} @ ${FRIDA_PORT}（setsid 脱离会话）"
+adb -s "${WIFI_SERIAL}" shell "su -c 'pkill -f ${FRIDA_BASE} 2>/dev/null; pkill -f frida-server 2>/dev/null; true'" >/dev/null 2>&1 || true
+sleep 1
+adb -s "${WIFI_SERIAL}" shell "su -c 'setsid ${FRIDA_BIN} -l 0.0.0.0:${FRIDA_PORT} </dev/null >/dev/null 2>&1 &'" >/dev/null 2>&1
+sleep 4
+adb -s "${WIFI_SERIAL}" shell "su -c 'ps -A | grep ${FRIDA_BASE}'" 2>/dev/null | head -1 \
+  || fatal "frida 进程未确认"
+adb -s "${WIFI_SERIAL}" forward "tcp:${FRIDA_PORT}" "tcp:${FRIDA_PORT}" >/dev/null
+
+# ── 4. 确保微信运行（温和 am start，不 frida-spawn）─────────────────────────
+if [[ -z "$(adb -s "${WIFI_SERIAL}" shell pidof com.tencent.mm 2>/dev/null | tr -d '\r')" ]]; then
+  log "④ 拉起微信（am start，禁 frida-spawn）"
+  adb -s "${WIFI_SERIAL}" shell am start -n com.tencent.mm/.ui.LauncherUI >/dev/null 2>&1 || true
+  sleep 5
+fi
+
+# ── 5. 启动 Agent（WP_DEVICE_SERIAL=WiFi 序列，device_id=逻辑身份）───────────
+log "⑤ 启动 Agent：device_id=${DEVICE_ID}（WS身份） / adb_serial=${WIFI_SERIAL}（u2/frida传输）"
+pkill -f "agent.py -d ${DEVICE_ID}" 2>/dev/null || true
+sleep 2
+WIRELESS_LOG="${SCRIPT_DIR}/../logs/wireless_agent.log"
+: > "${WIRELESS_LOG}"
+AGENT_PID="$(
+  cd "${AGENT_DIR}"
+  export WP_DEVICE_SERIAL="${WIFI_SERIAL}"
+  export WP_FRIDA_MODE=remote
+  export WP_FRIDA_PORT="${FRIDA_PORT}"
+  export WORKPHONE_AGENT_LOG="${WIRELESS_LOG}"
+  export WORKPHONE_WS_URL="ws://${SDK_HOST}/ws/device"
+  export WORKPHONE_DEVICE_ID="${DEVICE_ID}"
+  python3 - <<'PY'
+import os
+import subprocess
+import sys
+
+cmd = [
+    sys.executable,
+    "agent.py",
+    "-d",
+    os.environ["WORKPHONE_DEVICE_ID"],
+    "-s",
+    os.environ["WORKPHONE_WS_URL"],
+    "--heartbeat",
+    "10",
+]
+with open(os.environ["WORKPHONE_AGENT_LOG"], "ab", buffering=0) as log:
+    proc = subprocess.Popen(
+        cmd,
+        cwd=os.getcwd(),
+        env=os.environ.copy(),
+        stdin=subprocess.DEVNULL,
+        stdout=log,
+        stderr=subprocess.STDOUT,
+        start_new_session=True,
+        close_fds=True,
+    )
+print(proc.pid)
+PY
+)"
+echo "${AGENT_PID}" > "${SCRIPT_DIR}/../logs/wireless_agent.pid"
+log "   Agent pid=${AGENT_PID}（日志 ${WIRELESS_LOG}）"
+
+for _i in $(seq 1 45); do
+  if ! kill -0 "${AGENT_PID}" 2>/dev/null; then
+    tail -80 "${WIRELESS_LOG}" >&2 || true
+    fatal "Agent 启动后退出"
+  fi
+  if grep -q "RPC ping: pong" "${WIRELESS_LOG}" 2>/dev/null && \
+     grep -q "服务器确认注册" "${WIRELESS_LOG}" 2>/dev/null; then
+    log "   Agent WS + Frida RPC 已就绪"
+    break
+  fi
+  sleep 2
+done
+
+# ── 6. 验证无线 Hook 链路 ───────────────────────────────────────────────────
+log "⑥ 验证无线 Hook（get_profile）"
+RESP="$(curl -s -m 45 -X POST "http://${SDK_HOST}/api/v3/hook/execute" \
+  -H 'Content-Type: application/json' \
+  -d "{\"device_id\":\"${DEVICE_ID}\",\"platform\":\"wechat\",\"action\":\"get_profile\",\"params\":{},\"hook_only\":true}")"
+echo "${RESP}" | head -c 300; echo
+OK="$(echo "${RESP}" | python3 -c 'import json,sys
+try:
+    d=json.load(sys.stdin)
+    print(bool((d.get("data") or {}).get("success") or d.get("success")))
+except Exception:
+    print(False)' 2>/dev/null || echo False)"
+CH="$(echo "${RESP}" | python3 -c 'import json,sys
+try:
+    d=json.load(sys.stdin)
+    print(d.get("channel_used") or (d.get("data") or {}).get("channel") or "")
+except Exception:
+    print("")' 2>/dev/null || true)"
+if [[ "${OK}" == "True" ]] && echo "${CH}" | grep -Eqi 'frida|hook'; then
+  log "✅ 无 USB 无线主控就绪：WiFi adb + 本机 stealth frida + WS + Hook"
+  log "   现在可拔掉 USB 线，控制/取材料经 WiFi 无线进行。"
+else
+  tail -80 "${WIRELESS_LOG}" >&2 || true
+  fatal "Hook 未确认成功（frida attach / 微信运行 / 端口转发）"
+fi
+log "USB 掉线无影响；如换网/IP 变化，重跑本脚本即可。"
diff --git a/sdk/tests/run_wx_hook_regression.sh b/sdk/tests/run_wx_hook_regression.sh
new file mode 100755
index 0000000000..3c045acdf8
--- /dev/null
+++ b/sdk/tests/run_wx_hook_regression.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# 微信 Hook 离线回归套件（WP-WX-01 / WP-WX-HOOK）
+#
+# 真机铁律口径：本套件**仅离线回归**，验证 hook JS 分支逻辑 + 矩阵诚实性 +
+# ACTION→RPC 静态对齐；**不替代**真机 Frida attach E2E。全绿仅表示"代码逻辑/口径未回退"。
+#
+# 用法：bash sdk/tests/run_wx_hook_regression.sh
+set -euo pipefail
+cd "$(dirname "$0")/../.."   # 工作手机 仓根
+
+fail=0
+echo "════════ 微信 Hook 离线回归 ════════"
+
+echo "▸ [1/4] 转发逻辑（forward / forwardMultiple / revoke 资格预检）"
+node sdk/tests/test_forward_message_logic.mjs || fail=1
+
+echo "▸ [2/4] 矩阵 companion 判定诚实性"
+python3 sdk/tests/test_matrix_classifier_honesty.py || fail=1
+
+echo "▸ [3/4] 防封限流逻辑（AB-02/03/06）"
+python3 sdk/tests/test_rate_limiter_antiban.py || fail=1
+
+echo "▸ [4/4] ACTION→RPC 静态对齐审计"
+python3 sdk/scripts/wechat_interface_audit.py || fail=1
+
+echo "════════════════════════════════════"
+if [ "$fail" -ne 0 ]; then
+  echo "❌ 微信 Hook 回归未通过（见上方）"
+  exit 1
+fi
+echo "✅ 微信 Hook 离线回归全绿（仍须真机 Frida E2E 方可标功能 ✅）"
diff --git a/sdk/tests/test_agent_public_fallback.py b/sdk/tests/test_agent_public_fallback.py
new file mode 100644
index 0000000000..c0a4e7977e
--- /dev/null
+++ b/sdk/tests/test_agent_public_fallback.py
@@ -0,0 +1,125 @@
+#!/usr/bin/env python3
+"""
+BIND-03 离线回归：Agent 公网主服有序回退候选构建 + 健康探测。
+不依赖真机/WS；仅校验 _build_server_candidates 与 _probe_ws_base 纯逻辑。
+真机寻服 E2E（断 LAN 自动连公网）见 §八 V3，仍须真机留痕。
+"""
+import os
+import sys
+import socket
+import threading
+import importlib.util
+
+AGENT_PATH = os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    "agent", "agent.py",
+)
+
+
+def _load_agent_module():
+    # 直接按文件路径加载，避免 import 触发 u2/websockets 之外的副作用
+    spec = importlib.util.spec_from_file_location("wp_agent_under_test", AGENT_PATH)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+def test_build_candidates_dedup_and_fill():
+    mod = _load_agent_module()
+    Agent = mod.WorkPhoneAgent
+    primary = "ws://192.168.110.251:8899/ws/device/dev1"
+    publics = [
+        "ws://sdk.quwanzhi.com:8899",            # 缺 /ws/device + device_id
+        "ws://sdk.quwanzhi.com:8899/ws/device",  # 缺 device_id
+        "ws://192.168.110.251:8899/ws/device/dev1",  # 与主连接重复
+        "ws://backup.quwanzhi.com:8899/ws/device/dev1",  # 已完整
+    ]
+    cands = Agent._build_server_candidates(primary, publics, "dev1")
+    assert cands[0] == primary
+    assert "ws://sdk.quwanzhi.com:8899/ws/device/dev1" in cands
+    assert "ws://backup.quwanzhi.com:8899/ws/device/dev1" in cands
+    # 去重：主连接与重复公网只出现一次
+    assert cands.count(primary) == 1
+    assert len(cands) == 3, f"应去重为 3 个候选，实际 {cands}"
+
+
+def test_build_candidates_empty_public():
+    mod = _load_agent_module()
+    Agent = mod.WorkPhoneAgent
+    primary = "ws://127.0.0.1:8899/ws/device/x"
+    assert Agent._build_server_candidates(primary, [], "x") == [primary]
+    assert Agent._build_server_candidates(primary, None, "x") == [primary]
+
+
+def test_probe_unreachable():
+    mod = _load_agent_module()
+    Agent = mod.WorkPhoneAgent
+    # 保留端口 9（discard）本机通常不监听，确定性不可达
+    assert Agent._probe_ws_base("ws://127.0.0.1:9/ws/device/x", timeout=0.5) is False
+
+
+def test_probe_reachable_local_socket():
+    mod = _load_agent_module()
+    Agent = mod.WorkPhoneAgent
+    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    srv.bind(("127.0.0.1", 0))
+    srv.listen(1)
+    port = srv.getsockname()[1]
+    stop = threading.Event()
+
+    def _accept():
+        srv.settimeout(2)
+        try:
+            c, _ = srv.accept()
+            c.close()
+        except Exception:
+            pass
+
+    t = threading.Thread(target=_accept, daemon=True)
+    t.start()
+    try:
+        url = f"ws://127.0.0.1:{port}/ws/device/x"
+        assert Agent._probe_ws_base(url, timeout=1.0) is True
+    finally:
+        stop.set()
+        srv.close()
+
+
+class _FakeAgent:
+    """最小 duck-typed self，避免重型构造（u2/frida/anti_ban）。"""
+    VERSION = "test"
+    def __init__(self, stage):
+        self.d = None
+        self.connect_stage = stage
+        self.device_id = "dev1"
+        self.project_id = "cunkebao"
+        self.server_url = "ws://x:8899/ws/device/dev1"
+        self.server_candidates = ["ws://x:8899/ws/device/dev1", "ws://y:8899/ws/device/dev1"]
+
+
+def test_quick_status_includes_connect_stage():
+    mod = _load_agent_module()
+    fake = _FakeAgent("public")
+    st = mod.WorkPhoneAgent._get_quick_status(fake)
+    assert st["online"] is True
+    assert st["connect_stage"] == "public", f"心跳须带 connect_stage，实际 {st}"
+
+
+def test_device_info_includes_connect_stage():
+    mod = _load_agent_module()
+    fake = _FakeAgent("retry")
+    info = mod.WorkPhoneAgent._get_device_info(fake)
+    assert info["connect_stage"] == "retry"
+    assert info["server_url"] == "ws://x:8899/ws/device/dev1"
+    assert info["server_candidate_count"] == 2
+
+
+if __name__ == "__main__":
+    test_build_candidates_dedup_and_fill()
+    test_build_candidates_empty_public()
+    test_probe_unreachable()
+    test_probe_reachable_local_socket()
+    test_quick_status_includes_connect_stage()
+    test_device_info_includes_connect_stage()
+    print("✅ BIND-03/07 候选回退+寻服阶段上报离线回归全部通过")
diff --git a/sdk/tests/test_ai_brain_gateway_fallback.py b/sdk/tests/test_ai_brain_gateway_fallback.py
new file mode 100644
index 0000000000..9b87aa6cbc
--- /dev/null
+++ b/sdk/tests/test_ai_brain_gateway_fallback.py
@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+"""ai_brain 网关多 URL 回退 — 离线回归"""
+import importlib.util
+import os
+
+AI_BRAIN_PATH = os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    "app", "agent", "ai_brain.py",
+)
+
+
+def _load_brain():
+    spec = importlib.util.spec_from_file_location("wp_ai_brain_ut", AI_BRAIN_PATH)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod.AIBrain
+
+
+def test_gateway_post_urls_primary_and_fallback():
+    Brain = _load_brain()
+    b = Brain(ai_api_url="http://127.0.0.1:3102", ai_api_key="k")
+    urls = b._gateway_post_urls()
+    assert urls[0] == "http://127.0.0.1:3102/api/gateway/chat"
+    assert "http://127.0.0.1:3102/v1/chat/completions" in urls
+    assert "http://127.0.0.1:18080/v1/chat/completions" in urls
+
+
+def test_extract_gateway_content_openai_and_reply():
+    Brain = _load_brain()
+    oai = {"choices": [{"message": {"content": "OK"}}]}
+    assert Brain._extract_gateway_content(oai) == "OK"
+    reply = {"reply": "你好"}
+    assert Brain._extract_gateway_content(reply) == "你好"
diff --git a/sdk/tests/test_connection_provider.py b/sdk/tests/test_connection_provider.py
new file mode 100644
index 0000000000..5fa1d63907
--- /dev/null
+++ b/sdk/tests/test_connection_provider.py
@@ -0,0 +1,140 @@
+"""
+连接方案可切换驱动层 · 离线回归（不依赖真机/8899）
+
+验证：
+  - 默认 4 类方案存在（jiqing 默认 + aochuang/legacy 内置 + 自定义可注册）
+  - 三级开关（global/project/device）解析优先级
+  - 禁用方案回退 jiqing
+  - 自定义方案注册 / 删除 / 内置不可删
+  - http 驱动字段映射（body_map / query_map）
+
+注意：本测试为离线 mock 回归，按真机铁律仅作回归，不替代真机 E2E。
+"""
+
+import os
+import sys
+import tempfile
+import importlib
+
+import pytest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "app"))
+
+
+@pytest.fixture()
+def mgr(tmp_path, monkeypatch):
+    import services.connection_provider as cp
+    importlib.reload(cp)
+    # 重定向持久化到临时目录
+    monkeypatch.setattr(cp, "_DATA_DIR", tmp_path)
+    monkeypatch.setattr(cp, "_CONFIG_PATH", tmp_path / "connection_providers.json")
+    m = cp.ConnectionProviderManager()
+    m.load(force=True)
+    return m, cp
+
+
+def test_builtin_providers(mgr):
+    m, cp = mgr
+    ids = {p["id"] for p in m.list_providers()}
+    assert {"jiqing", "aochuang", "legacy"} <= ids
+    # 默认 active = jiqing
+    assert m.resolve_active_id() == "jiqing"
+    jq = m.get("jiqing")
+    assert jq.kind == "native" and jq.enabled and jq.builtin
+
+
+def test_switch_requires_enabled(mgr):
+    m, cp = mgr
+    # aochuang 默认未启用 → 切换应拒绝
+    with pytest.raises(ValueError):
+        m.switch("aochuang", scope=cp.SCOPE_GLOBAL)
+    # 启用后可切
+    m.register({"id": "aochuang", "enabled": True, "base_url": "https://007.example/api"})
+    res = m.switch("aochuang", scope=cp.SCOPE_GLOBAL)
+    assert res["switched_to"] == "aochuang"
+    assert m.resolve_active_id() == "aochuang"
+
+
+def test_scope_priority(mgr):
+    m, cp = mgr
+    m.register({"id": "aochuang", "enabled": True, "base_url": "https://007.example/api"})
+    m.register({"id": "legacy", "enabled": True, "base_url": "https://legacy.example"})
+    m.switch("aochuang", scope=cp.SCOPE_GLOBAL)
+    m.switch("legacy", scope=cp.SCOPE_PROJECT, project_id="cunkebao")
+    m.switch("jiqing", scope=cp.SCOPE_DEVICE, device_id="dev1")
+    # 设备级最高
+    assert m.resolve_active_id(device_id="dev1", project_id="cunkebao") == "jiqing"
+    # 项目级次之
+    assert m.resolve_active_id(project_id="cunkebao") == "legacy"
+    # 全局兜底
+    assert m.resolve_active_id() == "aochuang"
+
+
+def test_disabled_active_falls_back(mgr):
+    m, cp = mgr
+    m.register({"id": "aochuang", "enabled": True, "base_url": "https://007.example/api"})
+    m.switch("aochuang", scope=cp.SCOPE_GLOBAL)
+    assert m.resolve_active_id() == "aochuang"
+    # 再禁用 aochuang → 回退 jiqing
+    m.register({"id": "aochuang", "enabled": False})
+    assert m.resolve_active_id() == "jiqing"
+
+
+def test_custom_register_and_remove(mgr):
+    m, cp = mgr
+    meta = m.register({
+        "id": "custom_x", "name": "我的自建方案", "kind": "http", "enabled": True,
+        "base_url": "https://x.example", "endpoints": {"send_message": {"method": "POST", "path": "/s"}},
+    })
+    assert meta["id"] == "custom_x" and meta["builtin"] is False
+    assert "send_message" in meta["capabilities"]
+    m.remove("custom_x")
+    assert m.get("custom_x") is None
+    # 内置不可删
+    with pytest.raises(ValueError):
+        m.remove("jiqing")
+
+
+def test_http_field_mapping(mgr):
+    m, cp = mgr
+    prov = cp.HttpConnectionProvider({
+        "id": "t", "kind": "http", "base_url": "https://x",
+        "endpoints": {
+            "send_message": {"method": "POST", "path": "/send",
+                             "body_map": {"device_id": "deviceId", "to_id": "wxid", "content": "content"}},
+        },
+    })
+    src = {"device_id": "d1", "platform": "wechat", "to_id": "u1", "content": "hi", "msg_type": "text"}
+    body = prov._apply_map(src, {"device_id": "deviceId", "to_id": "wxid", "content": "content"})
+    assert body["deviceId"] == "d1" and body["wxid"] == "u1" and body["content"] == "hi"
+    # 未映射字段透传保留
+    assert body.get("platform") == "wechat"
+
+
+def test_persistence_roundtrip(mgr):
+    m, cp = mgr
+    m.register({"id": "aochuang", "enabled": True, "base_url": "https://007.example/api"})
+    m.switch("aochuang", scope=cp.SCOPE_GLOBAL)
+    # 新实例从磁盘加载
+    m2 = cp.ConnectionProviderManager()
+    m2.load(force=True)
+    assert m2.resolve_active_id() == "aochuang"
+
+
+def test_http_execute_unknown_action_501(mgr):
+    import asyncio
+    m, cp = mgr
+    prov = cp.HttpConnectionProvider({"id": "t", "kind": "http", "base_url": "https://x", "endpoints": {}})
+    res = asyncio.run(prov.execute("d1", "wechat", "send_message", {"to_id": "u", "content": "c"}))
+    assert res["code"] == 501 and res["success"] is False
+
+
+def test_jiqing_execute_offline_payload(mgr):
+    """jiqing 原生方案在无 WS 设备时应返回离线 503（复用 device_transport，不 mock 成功）。"""
+    import asyncio
+    m, cp = mgr
+    prov = m.get("jiqing")
+    res = asyncio.run(prov.execute("nonexist_dev", "wechat", "send_message",
+                                   {"to_id": "filehelper", "content": "hi"}))
+    assert res.get("provider") == "jiqing"
+    assert res.get("success") is False  # 离线设备，不得假成功
diff --git a/sdk/tests/test_forward_message_logic.mjs b/sdk/tests/test_forward_message_logic.mjs
new file mode 100644
index 0000000000..cff5572c29
--- /dev/null
+++ b/sdk/tests/test_forward_message_logic.mjs
@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+/**
+ * WP-WX-01 离线回归：forwardMessage 文本转发真 Frida 分支逻辑
+ *
+ * 真机铁律：本测试**仅作离线回归**，不替代真机 Frida attach E2E。
+ * 它从 wechat_hook_v2.js 抽取真实 forwardMessage 源码（不复制、不漂移），
+ * 注入 mock 依赖，验证三条分支：
+ *   1) 文本类(type=1) → _sendMessageInternal 真发送成功 → 返回 text_resend，不走 intent
+ *   2) 非文本 / DB miss → 降级 _intentAction，标 non_text_or_db_miss（不伪造成功）
+ *   3) 真发送未验证(success:false) → 不假成功，降级 intent
+ *   4) 缺参 → 直接 error
+ *
+ * 运行：node sdk/tests/test_forward_message_logic.mjs
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const JS_PATH = path.join(__dirname, '..', 'agent', 'hook', 'wechat_hook_v2.js');
+const src = readFileSync(JS_PATH, 'utf8');
+
+// 抽取 forwardMessage 函数体（花括号配平），避免复制造成漂移
+function extractFunc(name) {
+  const re = new RegExp(name + '\\s*:\\s*function\\s*\\([^)]*\\)\\s*\\{');
+  const m = re.exec(src);
+  if (!m) throw new Error('未找到函数 ' + name);
+  const bodyStart = src.indexOf('{', m.index + m[0].length - 1);
+  let depth = 0;
+  for (let i = bodyStart; i < src.length; i++) {
+    if (src[i] === '{') depth++;
+    else if (src[i] === '}') {
+      depth--;
+      if (depth === 0) {
+        // 返回 "function(params){ ... }" 形式
+        const argsStart = src.indexOf('(', m.index);
+        const argsEnd = src.indexOf(')', argsStart);
+        const args = src.slice(argsStart + 1, argsEnd);
+        return new Function(args, src.slice(bodyStart + 1, i));
+      }
+    }
+  }
+  throw new Error('花括号未配平');
+}
+
+let assertions = 0;
+function assert(cond, msg) {
+  assertions++;
+  if (!cond) { console.error('  ✗ FAIL: ' + msg); process.exitCode = 1; }
+  else console.log('  ✓ ' + msg);
+}
+
+// ---- mock harness ----
+let calls;
+function resetMocks(dbRows, sendResult, revokeResult) {
+  calls = { execSQL: [], sendInternal: [], intent: [], event: [], revoke: [] };
+  globalThis.Java = { performNow: (fn) => fn() };
+  globalThis._execSQL = (sql) => { calls.execSQL.push(sql); return dbRows; };
+  globalThis._sendMessageInternal = (toId, content, type) => {
+    calls.sendInternal.push({ toId, content, type });
+    return sendResult;
+  };
+  globalThis._intentAction = (action, payload, evt, extra) => {
+    calls.intent.push({ action, payload, evt, extra });
+    return { success: false, action, _intent: true, extra };
+  };
+  // revokeMessage 已改走真 Frida RevokeMsgEvent，mock 其返回以验证诚实分支
+  globalThis._revokeMessageByRevokeMsgEvent = (msgSvrId, row) => {
+    calls.revoke.push({ msgSvrId, row });
+    return revokeResult || { success: false, error: 'revoke_frida_failed', msg_svr_id: msgSvrId, eligible: true };
+  };
+  globalThis.emitEvent = (evt, data) => { calls.event.push({ evt, data }); };
+  globalThis.String = String;
+}
+
+const forwardMessage = extractFunc('forwardMessage');
+
+console.log('[WP-WX-01] forwardMessage 离线分支回归');
+
+// 1) 文本类真发送成功
+resetMocks([{ type: 1, content: '你好转发' }], { success: true, message_id: 'm123', verified: true });
+let r = forwardMessage({ msg_svr_id: 's1', to_id: 'wxid_a' });
+assert(r.success === true, '文本类转发成功');
+assert(r.forward_kind === 'text_resend', '标记 text_resend');
+assert(calls.sendInternal.length === 1 && calls.sendInternal[0].content === '你好转发', '走 _sendMessageInternal 真发送');
+assert(calls.intent.length === 0, '成功路径不降级 intent');
+assert(calls.event.length === 1 && calls.event[0].evt === 'message_forwarded', '发 message_forwarded 事件');
+
+// 2) 非文本（type=3 图片）→ intent 降级，不假成功
+resetMocks([{ type: 3, content: '[图片]' }], { success: true });
+r = forwardMessage({ msg_svr_id: 's2', to_id: 'wxid_b' });
+assert(calls.sendInternal.length === 0, '非文本不调真发送');
+assert(calls.intent.length === 1 && calls.intent[0].extra.kind === 'non_text_or_db_miss', '非文本降级 intent (non_text_or_db_miss)');
+assert(r._intent === true && r.success === false, '降级 intent 不伪造成功');
+
+// 3) DB miss（无行）→ intent 降级
+resetMocks([], { success: true });
+r = forwardMessage({ msg_svr_id: 's3', to_id: 'wxid_c' });
+assert(calls.intent.length === 1, 'DB miss 降级 intent');
+
+// 4) 文本但真发送未验证(success:false) → 不假成功，降级 intent
+resetMocks([{ type: 1, content: 'x' }], { success: false, error: 'unverified' });
+r = forwardMessage({ msg_svr_id: 's4', to_id: 'wxid_d' });
+assert(calls.sendInternal.length === 1, '尝试真发送');
+assert(calls.intent.length === 1, '真发送未验证 → 降级 intent，不假成功');
+
+// 5) 缺参
+r = forwardMessage({ msg_svr_id: '', to_id: '' });
+assert(r.success === false && /缺少/.test(r.error), '缺参直接 error');
+
+// ---- forwardMultiple 批量转发 ----
+console.log('[WP-WX-01] forwardMultiple 离线分支回归');
+const forwardMultiple = extractFunc('forwardMultiple');
+
+// 6) 全文本 → 全部真发送，forwarded=2
+resetMocks([{ type: 1, content: 'a' }], { success: true, message_id: 'm' });
+r = forwardMultiple({ msg_svr_ids: ['s1', 's2'], to_id: 'wxid_x' });
+assert(r.success === true && r.forwarded === 2 && r.fallback === 0, '全文本批量转发 forwarded=2');
+assert(calls.sendInternal.length === 2, '逐条调真发送 2 次');
+assert(calls.intent.length === 0, '有成功条不整体降级');
+
+// 7) 全非文本 → forwarded=0 整体降级 intent，不假成功
+resetMocks([{ type: 3, content: '[图片]' }], { success: true });
+r = forwardMultiple({ msg_svr_ids: ['s1', 's2'], to_id: 'wxid_y' });
+assert(r._intent === true && r.success === false, '全非文本整体降级 intent 不假成功');
+assert(calls.intent[0].extra.forwarded === 0, 'intent 标 forwarded=0');
+
+// 8) 缺参
+r = forwardMultiple({ msg_svr_ids: [], to_id: 'wxid_z' });
+assert(r.success === false && /缺少/.test(r.error), 'forwardMultiple 缺参 error');
+
+// ---- revokeMessage 撤回资格预检 ----
+console.log('[WP-WX] revokeMessage 资格预检回归');
+const revokeMessage = extractFunc('revokeMessage');
+
+// 9) 消息不存在 → 诚实 msg_not_found，不发 intent
+resetMocks([], null);
+r = revokeMessage({ msg_svr_id: 's1' });
+assert(r.success === false && r.error_code === 'msg_not_found', '消息不存在→msg_not_found');
+assert(calls.intent.length === 0, '不存在不发 intent 假成功');
+
+// 10) 非本人发送 → not_own_message
+resetMocks([{ isSend: 0, createTime: Date.now() }], null);
+r = revokeMessage({ msg_svr_id: 's2' });
+assert(r.success === false && r.error_code === 'not_own_message', '非本人→not_own_message');
+
+// 11) 超 2 分钟窗口 → revoke_window_expired
+resetMocks([{ isSend: 1, createTime: Date.now() - 200000 }], null);
+r = revokeMessage({ msg_svr_id: 's3' });
+assert(r.success === false && r.error_code === 'revoke_window_expired', '超窗→revoke_window_expired');
+
+// 12) 资格通过(本人+窗口内) → 走真 Frida RevokeMsgEvent，DB 已确认→成功发 message_revoked
+resetMocks([{ isSend: 1, createTime: Date.now() - 5000 }], null, { success: true, verified: true, msg_svr_id: 's4' });
+r = revokeMessage({ msg_svr_id: 's4' });
+assert(calls.revoke.length === 1, '资格通过→走真 Frida RevokeMsgEvent');
+assert(r.success === true && r.verified === true, '真撤回 DB 确认→成功');
+assert(calls.event.length === 1 && calls.event[0].evt === 'message_revoked', '发 message_revoked 事件');
+
+// 12b) 资格通过但真 RPC 未 DB 确认 → 诚实失败，不假成功、不发事件
+resetMocks([{ isSend: 1, createTime: Date.now() - 5000 }], null, { success: false, error: 'revoke_frida_failed', eligible: true });
+r = revokeMessage({ msg_svr_id: 's4b' });
+assert(calls.revoke.length === 1, '资格通过→尝试真 Frida 撤回');
+assert(r.success === false && calls.event.length === 0, '真撤回未确认→诚实失败不发事件');
+
+// 13) 缺参
+r = revokeMessage({ msg_svr_id: '' });
+assert(r.success === false && /缺少/.test(r.error), 'revokeMessage 缺参 error');
+
+console.log(`\n[done] 断言 ${assertions} 条，exit=${process.exitCode || 0}`);
diff --git a/sdk/tests/test_integration_manifest.py b/sdk/tests/test_integration_manifest.py
new file mode 100644
index 0000000000..fa9dc657b7
--- /dev/null
+++ b/sdk/tests/test_integration_manifest.py
@@ -0,0 +1,84 @@
+"""
+对外接口统一清单 / 能力矩阵 · 离线回归冒烟
+（仅作回归，不替代真机 E2E；默认对 http://127.0.0.1:8899 发只读 GET）
+
+跑法：
+  SDK_BASE=http://127.0.0.1:8899 python3 -m pytest sdk/tests/test_integration_manifest.py -q
+或直接：
+  python3 sdk/tests/test_integration_manifest.py
+"""
+
+import os
+import json
+import urllib.request
+
+BASE = os.environ.get("SDK_BASE", "http://127.0.0.1:8899")
+DEVICE = os.environ.get("SDK_DEVICE_ID", "xgfe65eimrrofyws")
+
+CONSUMERS = {"cunkebao", "superadmin", "ai_employee", "common"}
+STATUSES = {"ready", "degraded", "offline"}
+
+
+def _get(path: str) -> dict:
+    with urllib.request.urlopen(f"{BASE}{path}", timeout=15) as resp:
+        return json.loads(resp.read().decode("utf-8"))
+
+
+def test_manifest_structure():
+    d = _get("/api/v3/integration/manifest")["data"]
+    assert d["total_endpoints"] > 100, "端点数应 >100"
+    assert d["module_count"] >= 20, "模块数应 >=20"
+    # other 桶应清零（全部归类）
+    others = [m for m in d["modules"] if m["module"] == "other"]
+    assert sum(m["endpoint_count"] for m in others) == 0, "other 桶必须清零"
+    for m in d["modules"]:
+        assert m["consumers"], f"模块 {m['module']} 必须有消费方"
+
+
+def test_modules_runtime_tagged():
+    d = _get("/api/v3/integration/modules")["data"]
+    for m in d["modules"]:
+        assert m.get("runtime") in {"server", "device", "hook"}, m
+
+
+def test_consumer_views():
+    for c in CONSUMERS:
+        d = _get(f"/api/v3/integration/consumers/{c}")["data"]
+        assert d["consumer"] == c
+        assert d["total_endpoints"] >= 0
+        for m in d["modules"]:
+            assert c in m["consumers"]
+
+
+def test_capability_matrix():
+    d = _get(f"/api/v3/integration/capability/{DEVICE}?consumer=cunkebao")["data"]
+    assert d["device_id"] == DEVICE
+    assert set(d["summary"].keys()) == STATUSES
+    for m in d["modules"]:
+        assert m["status"] in STATUSES
+        assert m["runtime"] in {"server", "device", "hook"}
+    # server 模块无论设备是否在线都应 ready
+    server_mods = [m for m in d["modules"] if m["runtime"] == "server"]
+    for m in server_mods:
+        assert m["status"] == "ready", f"server 模块 {m['module']} 应 ready"
+
+
+def test_health():
+    d = _get("/api/v3/integration/health")["data"]
+    assert "checks" in d
+    for key in ("websocket", "connection_provider", "cunkebao", "ai_gateway"):
+        assert key in d["checks"], f"health 缺少 {key}"
+
+
+if __name__ == "__main__":
+    fails = 0
+    for name, fn in list(globals().items()):
+        if name.startswith("test_") and callable(fn):
+            try:
+                fn()
+                print(f"  PASS {name}")
+            except Exception as e:  # noqa: BLE001
+                fails += 1
+                print(f"  FAIL {name}: {e}")
+    print("OK" if fails == 0 else f"{fails} FAILED")
+    raise SystemExit(1 if fails else 0)
diff --git a/sdk/tests/test_matrix_classifier_honesty.py b/sdk/tests/test_matrix_classifier_honesty.py
new file mode 100644
index 0000000000..14f4631f22
--- /dev/null
+++ b/sdk/tests/test_matrix_classifier_honesty.py
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""WP-WX-HOOK 回归：矩阵生成器 companion 判定诚实性（防 1400 字窗口越界误判复发）
+
+真机铁律口径：
+  - 真实现（_shareMediaToWechat / _shareTextToWechat / _sendMessageInternal / performNow）
+    的函数**不得**被判为 companion 占位；
+  - 纯 _intentAction 的函数**必须**判为 companion 占位（诚实，不假成功）。
+
+运行：python3 sdk/tests/test_matrix_classifier_honesty.py
+"""
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(ROOT / "sdk" / "scripts"))
+
+import gen_wechat_capability_matrix as gen  # noqa: E402
+
+intent = gen.parse_intent_funcs()
+
+# 真实现（含系统分享 / 验证发送 / DB 写 / performNow）—— 绝不能被判 companion
+MUST_NOT_BE_COMPANION = [
+    "sendImage", "sendVideo", "sendFile", "sendLink",
+    "forwardMessage", "forwardMultiple",
+    "sendMessage", "searchMessages",
+]
+# 纯 _intentAction 占位 —— 必须仍判 companion（诚实标 ⬜）
+# 注：likeMoments/commentMoments 实为真 Frida；revokeMessage 已加 DB 资格预检(真 Frida)，均不在此列
+MUST_BE_COMPANION = [
+    "setNickname", "setSignature", "clearCache",
+]
+
+fails = 0
+print("[WP-WX-HOOK] 矩阵 companion 判定诚实性回归")
+for fn in MUST_NOT_BE_COMPANION:
+    if fn in intent:
+        print(f"  ✗ FAIL: {fn} 被误判为 companion 占位（真实现不应误报）")
+        fails += 1
+    else:
+        print(f"  ✓ {fn} 正确：非 companion（真 Frida）")
+for fn in MUST_BE_COMPANION:
+    if fn not in intent:
+        print(f"  ✗ FAIL: {fn} 未被判 companion（纯 _intentAction 应诚实标占位）")
+        fails += 1
+    else:
+        print(f"  ✓ {fn} 正确：companion 占位（待改真 Frida）")
+
+print(f"\n[done] companion 占位数 = {len(intent)}，失败 {fails} 条")
+sys.exit(1 if fails else 0)
diff --git a/sdk/tests/test_rate_limiter_antiban.py b/sdk/tests/test_rate_limiter_antiban.py
new file mode 100644
index 0000000000..71c24b3a4b
--- /dev/null
+++ b/sdk/tests/test_rate_limiter_antiban.py
@@ -0,0 +1,126 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""WP-PMAX-01 / WP-WX-02 离线回归：防封限流内存态逻辑
+
+真机铁律口径：本测试**仅离线回归**内存态频控逻辑（不依赖 Redis/真机），
+验证 AB-02 静默限流熔断 / AB-03 长暂停 + 高危动作互斥 / AB-06 风险分级的纯函数行为；
+**不替代**真机批量发送/加友的频控 E2E。
+
+运行：python3 sdk/tests/test_rate_limiter_antiban.py
+"""
+import sys
+import time
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(ROOT / "sdk" / "app"))
+
+from services import rate_limiter as rl  # noqa: E402
+
+fails = 0
+
+
+def check(cond, msg):
+    global fails
+    if cond:
+        print(f"  ✓ {msg}")
+    else:
+        print(f"  ✗ FAIL: {msg}")
+        fails += 1
+
+
+print("[WP-PMAX-01] 防封限流离线回归")
+lim = rl.AntiDetectRateLimiter()
+DEV = "test_dev_offline"
+
+# ---- AB-02 静默限流熔断 ----
+print("· AB-02 静默限流熔断")
+lim.reset_silent_throttle(DEV)
+# 未触发时不应熔断
+try:
+    lim._check_silent_throttle(DEV)
+    check(True, "初始无熔断，写类放行")
+except rl.SilentThrottleCooldown:
+    check(False, "初始不应熔断")
+
+cd1 = lim.trip_silent_throttle(DEV)
+check(rl.SILENT_THROTTLE_COOLDOWN[0] <= cd1 <= rl.SILENT_THROTTLE_COOLDOWN[1] * 1.01,
+      f"首次熔断冷却在 30-60min 区间（{cd1:.0f}s）")
+raised = False
+try:
+    lim._check_silent_throttle(DEV)
+except rl.SilentThrottleCooldown as e:
+    raised = True
+    check(e.hits == 1, "熔断期写类被拒，hits=1")
+check(raised, "熔断期 _check_silent_throttle 抛 SilentThrottleCooldown")
+
+cd2 = lim.trip_silent_throttle(DEV)
+check(cd2 > cd1, f"二次触发退避升级（{cd2:.0f}s > {cd1:.0f}s）")
+
+# 真 msg_id 回来 → reset 清零
+lim.reset_silent_throttle(DEV)
+try:
+    lim._check_silent_throttle(DEV)
+    check(True, "reset 后熔断解除，写类恢复")
+except rl.SilentThrottleCooldown:
+    check(False, "reset 后不应再熔断")
+
+# ---- AB-03 长暂停节拍 ----
+print("· AB-03 长暂停 + 高危互斥")
+rl._action_seq.pop(DEV, None)
+rl._long_pause_until.pop(DEV, None)
+rl._next_pause_at[DEV] = 3  # 强制第 3 个动作触发长暂停
+pause_raised = False
+for i in range(3):
+    try:
+        lim._check_long_pause(DEV)
+    except rl.LongPauseRequired as e:
+        pause_raised = True
+        check(rl.LONG_PAUSE_RANGE[0] <= e.wait_seconds <= rl.LONG_PAUSE_RANGE[1],
+              f"第{i+1}动作触发长暂停 {e.wait_seconds:.0f}s（10-30min）")
+check(pause_raised, "达节拍阈值触发 LongPauseRequired")
+# 暂停期内再检查应继续被拦
+try:
+    lim._check_long_pause(DEV)
+    check(False, "长暂停期内应继续拦截")
+except rl.LongPauseRequired:
+    check(True, "长暂停期内持续 fast-fail")
+
+# 高危动作互斥
+rl._last_highrisk.pop(DEV, None)
+lim._check_highrisk_combo(DEV, "add_friend")   # 记录首个高危
+combo_raised = False
+try:
+    lim._check_highrisk_combo(DEV, "mass_send")  # 不同类高危，窗口内
+except rl.HighRiskComboBlocked as e:
+    combo_raised = True
+    check(e.wait_seconds > 0, f"高危组合互斥拦截 {e.wait_seconds:.0f}s")
+check(combo_raised, "短窗口内混跑不同类高危被拦")
+# 同类高危不拦
+try:
+    lim._check_highrisk_combo(DEV, "add_friend")
+    check(True, "同类高危动作不互斥")
+except rl.HighRiskComboBlocked:
+    check(False, "同类高危不应互斥")
+
+# ---- AB-06 风险分级 ----
+print("· AB-06 风险分级")
+check(rl.classify_risk("静默限流熔断中") == rl.RISK_NEEDS_HUMAN, "熔断→needs_human")
+check(rl.classify_risk("高危动作组合互斥：add_friend") == rl.RISK_BLOCK, "高危互斥→block")
+check(rl.classify_risk("当前不在操作时段") == rl.RISK_LOG, "时段→log")
+check(rl.classify_risk("长会话中断，需再等 600s") == rl.RISK_LOG, "长暂停→log")
+
+# ---- runtime 看板字段 ----
+print("· AB-05 runtime 看板")
+st = lim.get_runtime_state(DEV)
+check("silent_throttle" in st and "long_pause" in st and "last_highrisk" in st,
+      "get_runtime_state 含三段运行态")
+
+# 清理
+lim.reset_silent_throttle(DEV)
+rl._action_seq.pop(DEV, None)
+rl._long_pause_until.pop(DEV, None)
+rl._last_highrisk.pop(DEV, None)
+
+print(f"\n[done] 失败 {fails} 条")
+sys.exit(1 if fails else 0)
diff --git a/sdk/tests/test_skill_registry_alignment.py b/sdk/tests/test_skill_registry_alignment.py
new file mode 100644
index 0000000000..4198f1b5be
--- /dev/null
+++ b/sdk/tests/test_skill_registry_alignment.py
@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+"""
+BR6 / D-T6 CI 门禁：中台 Skill 注册表 ↔ 设备端 Skill 类 action 对齐，防漂移。
+离线纯校验（不依赖真机/WS），可进 CI。等价于 `python sdk/scripts/skill_registry_audit.py`。
+"""
+import os
+import sys
+import importlib.util
+
+SDK_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+AUDIT = os.path.join(SDK_ROOT, "scripts", "skill_registry_audit.py")
+
+
+def _load_audit():
+    spec = importlib.util.spec_from_file_location("skill_registry_audit_under_test", AUDIT)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+def _collect_missing():
+    """复用审计逻辑，返回 (registry 校验数, 设备缺失列表)。"""
+    mod = _load_audit()
+    from skills import get_skill  # noqa: WPS433
+    missing = []
+    ok = 0
+    for script in sorted(mod.DEVICE_EXECUTABLE_SCRIPTS):
+        registry_actions = set(mod.flatten_actions(script))
+        cls = get_skill(script)
+        device_actions = mod._public_methods(cls)
+        for action in sorted(registry_actions):
+            if action not in device_actions:
+                missing.append(f"{script}.{action}")
+            else:
+                ok += 1
+    return ok, missing
+
+
+def test_registry_has_actions():
+    ok, _ = _collect_missing()
+    assert ok > 0, "Skill 注册表应至少有若干 action 被校验"
+
+
+def test_no_registry_action_missing_on_device():
+    """注册表声明的 action 必须在设备端 Skill 类有同名 public method（防漂移门禁）。"""
+    ok, missing = _collect_missing()
+    assert not missing, (
+        f"注册表有 {len(missing)} 个 action 设备端缺失（漂移）：{missing[:15]}"
+    )
+
+
+if __name__ == "__main__":
+    ok, missing = _collect_missing()
+    print(f"registry 校验 action 数: {ok} · 设备缺失: {len(missing)}")
+    assert ok > 0 and not missing, f"门禁未通过: missing={missing[:15]}"
+    print("✅ BR6/D-T6 Skill 注册表对齐门禁通过")
diff --git a/sdk/tests/test_wechat_acceptance_offline.py b/sdk/tests/test_wechat_acceptance_offline.py
new file mode 100644
index 0000000000..910b88d00a
--- /dev/null
+++ b/sdk/tests/test_wechat_acceptance_offline.py
@@ -0,0 +1,100 @@
+"""微信三项验收 + P0 路由离线回归（不依赖真机）
+
+确保 frida 一上线即可跑通：请求模型字段、路由可导入、159 action 对齐。
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+APP = Path(__file__).resolve().parents[1] / "app"
+if str(APP) not in sys.path:
+    sys.path.insert(0, str(APP))
+
+
+def test_send_message_request_fields():
+    from routers.unified import SendMessageRequest
+    f = SendMessageRequest.model_fields
+    for k in ("device_id", "platform", "to_id", "content", "msg_type"):
+        assert k in f, f"SendMessageRequest 缺字段 {k}"
+
+
+def test_get_messages_request_fields():
+    from routers.unified import GetMessagesRequest
+    f = GetMessagesRequest.model_fields
+    for k in ("device_id", "platform", "conversation_id", "limit"):
+        assert k in f, f"GetMessagesRequest 缺字段 {k}"
+
+
+def test_post_moments_request_fields():
+    from routers.unified import PostMomentsRequest
+    f = PostMomentsRequest.model_fields
+    for k in ("device_id", "platform", "content", "images"):
+        assert k in f, f"PostMomentsRequest 缺字段 {k}"
+
+
+def test_wechat_159_actions_aligned():
+    # 仓库根 sdk/skills 会抢占 "skills" 命名空间，这里按 app 下的真实文件稳健加载
+    import importlib.util
+
+    skill_path = APP / "skills" / "wechat" / "skill_v2.py"
+    assert skill_path.is_file(), f"skill_v2.py 缺失: {skill_path}"
+    spec = importlib.util.spec_from_file_location("_wechat_skill_v2_offline", skill_path)
+    mod = importlib.util.module_from_spec(spec)
+    assert spec and spec.loader
+    spec.loader.exec_module(mod)
+    WECHAT_ACTIONS = mod.WECHAT_ACTIONS
+    WechatSkillV2 = mod.WechatSkillV2
+    assert len(WECHAT_ACTIONS) == 159, f"WECHAT_ACTIONS={len(WECHAT_ACTIONS)} != 159"
+    catalog = WechatSkillV2.get_catalog_action_list()
+    assert len(catalog) >= 174, f"catalog={len(catalog)} < 174"
+
+
+def test_friend_add_route_importable():
+    """TODO-02 friend-add → 存客宝线索链路可导入。"""
+    from services.cunke_bao_service import CunKeBaoService, LeadData
+    assert hasattr(CunKeBaoService, "report_friend_add")
+    assert hasattr(CunKeBaoService, "report_lead")
+    lead = LeadData(wechat_id="wxid_test", wechat_nickname="t", source="测试")
+    params = lead.to_api_params()
+    assert params.get("wechatId") == "wxid_test"
+
+
+def test_ai_chat_orchestrator_importable():
+    """TODO-03 AI chat → send_message 编排可导入。"""
+    from services.karuo_device_ai import chat_and_execute_on_device, device_status
+    assert callable(chat_and_execute_on_device)
+    assert callable(device_status)
+
+
+def test_unblock_customer_service_exists():
+    """TODO-01 解封客服 Skill 文件存在。"""
+    p = Path(__file__).resolve().parents[1] / "agent" / "skills" / "wechat" / "unblock_customer_service.py"
+    assert p.is_file(), "解封客服 Skill 缺失"
+
+
+def test_three_acceptance_scripts_exist():
+    base = Path(__file__).resolve().parents[1] / "scripts"
+    for s in ("run_three_acceptance.sh", "auto_accept_when_ready.sh", "termux_frida_up_onphone.sh"):
+        assert (base / s).is_file(), f"脚本缺失 {s}"
+
+
+def test_wp_wx04_scan_routes_and_agent_skill():
+    """WP-WX-04 离线路由 + Agent u2 skill 对齐（不替代真机 E2E）。"""
+    from routers import unified
+
+    assert callable(getattr(unified, "extract_qr_from_image", None))
+    assert callable(getattr(unified, "add_friend_from_image", None))
+    skill_path = Path(__file__).resolve().parents[1] / "agent" / "skills" / "wechat" / "skill.py"
+    src = skill_path.read_text(encoding="utf-8")
+    assert "def add_friend_from_image" in src
+    assert "_save_qr_image_to_album" in src
+    agent_py = Path(__file__).resolve().parents[1] / "agent" / "agent.py"
+    assert '"add_friend_from_image"' in agent_py.read_text(encoding="utf-8")
+
+
+if __name__ == "__main__":
+    sys.exit(pytest.main([__file__, "-q"]))
diff --git a/sdk/tests/test_wechat_interface_audit.py b/sdk/tests/test_wechat_interface_audit.py
new file mode 100644
index 0000000000..3bf044c178
--- /dev/null
+++ b/sdk/tests/test_wechat_interface_audit.py
@@ -0,0 +1,24 @@
+"""微信 Hook 128 action 静态三方对齐 — CI 门禁（不依赖真机）"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+AUDIT = ROOT / "sdk/scripts/wechat_interface_audit.py"
+
+
+def test_wechat_interface_static_alignment():
+    proc = subprocess.run(
+        [sys.executable, str(AUDIT)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        timeout=30,
+    )
+    assert proc.returncode == 0, proc.stdout + proc.stderr
+    assert "完整对齐: ✅" in proc.stdout
+    assert "WECHAT_ACTIONS: 159" in proc.stdout
+    assert "缺失 RPC: 0" in proc.stdout
diff --git a/开发文档/10、项目管理/工作日志.md b/开发文档/10、项目管理/工作日志.md
index 3fdebab16f..4d742f3a7e 100644
--- a/开发文档/10、项目管理/工作日志.md
+++ b/开发文档/10、项目管理/工作日志.md
@@ -5289,3 +5289,33 @@ profile/contacts/groups/group_members(28)/labels(323)/messages(发后读回闭
 - 总体：94%
 
 **下一步**：继续白名单写类实测；将实时状态接入存客宝/超管页面显示；清理本机线程资源后跑 `PASS=32 FAIL=0`。
+
+---
+
+## 2026-07-14 12:01 · 触客宝 TC 真机恢复分层与 APK 长期任务单（阿表）
+
+**本轮目标**：根据“游条姐”账号 TC 真机聊天复检与阿服恢复证据，把临时运行态和 APK 长期缺口拆开，形成可直接开发、可真机验收的 P0 任务。
+
+**已完成**：
+
+1. 核对当前证据：真机 `xgfe65eimrrofyws`、SDK healthy、Agent/WS 在线；Frida 已在 `127.0.0.1:19886` 恢复，两轮进程枚举、微信 attach/detach、SDK Hook 探针通过。
+2. 明确临时边界：Mac Agent + Type-C 只记为 **临时可用 70%**；本轮尚无触客宝当前会话的真实发送、回读和页面截图，不得写 100%。
+3. 明确长期缺口：端口存在 `19886/14537/27042` 多真源；APK 缺 `frida-server-arm64` asset；`FridaBridge.sendRpc()` 与手机本地 `frida -U` CLI 均未证明能完成真实 RPC。
+4. 建立四项 P0：`WP-FRIDA-SSOT-01`、`WP-APK-RPC-02`、`WP-BOOT-SELFHEAL-03`、`WP-MAC-TC-FALLBACK-04`。
+5. 建立六道验收门禁：端口三重启、APK RPC、60 秒自愈、触客宝白名单发送、消息回读、当前页面截图；全部两轮通过后才允许标 100%。
+
+**进度变化**：
+
+| 项目 | 当前进度 | 状态 |
+|---|---:|---|
+| 需求/根因/验收定义 | 100% | ✅ 已完成 |
+| Mac Agent + TC 临时兜底 | 70% | 🟡 临时可用，业务聊天未闭环 |
+| 端口单一真源 | 20% | ⬜ 待开发 |
+| APK 真实 Frida RPC | 10% | ⬜ 待开发 |
+| 开机与崩溃自愈 | 15% | ⬜ 待开发 |
+| 触客宝当前聊天闭环 | 0% | 🔴 未验收 |
+| 本任务组 | 25% | 🟡 已形成可执行任务，长期能力未完成 |
+
+**证据**：`8、部署/05-测试验收/20260714_触客宝TC真机_Frida环境恢复_阿服.md`；触客宝侧 `cunkebao_v3/开发文档/8、部署/05-测试验收/20260714_触客宝游条姐_TC真机聊天复检.md`。
+
+**下一步**：工作手机开发先做端口 SSOT 与 APK 真实 RPC，再做 60 秒自愈；期间保留 Mac Agent + TC 诚实兜底。完成后按 V1～V6 真机复跑并补触客宝当前截图。
diff --git a/开发文档/10、项目管理/开发进度总表.md b/开发文档/10、项目管理/开发进度总表.md
index 22f157407a..9f2d50f3e2 100644
--- a/开发文档/10、项目管理/开发进度总表.md
+++ b/开发文档/10、项目管理/开发进度总表.md
@@ -17,7 +17,7 @@ related:
 
 # 工作手机SDK v3.1 → v4.0 - 开发进度总表
 
-> **唯一进度文档** | 更新：2026-06-13
+> **唯一进度文档** | 更新：2026-07-14
 > **需求真源（1 篇）**：[工作手机_进行中_20260613](../1、需求/修改/工作手机_进行中_20260613.md) · [0613已完成归档](./已完成/工作手机_0613已完成项归档_20260613.md) · [0612全文备份](./已完成/modify需求归档_20260613/)
 > **完成判定（强制）**：标 ✅/100% 须符合 [真机开发铁律](../2、架构/01-总览/真机开发铁律.md)（真机 E2E 留痕，禁止占位/mock）
 > **Sprint 看板**：[[10、项目管理/03-计划与专项/项目落地执行表|项目落地执行表]] §零（实时跟踪）
@@ -657,6 +657,41 @@ Phase 5: 防封模块    ✅ 已完成  ← AF1-AF12 全部完成
 | 微信写类总体 | 🟡 继续扩展 | 86% | 单发已验；群发/加友/朋友圈互动待白名单材料继续逐项验收 |
 | 总体可交付 | 🟡 持续推进 | 91% | 读类 99%、写类 86%、BFF 96%、稳定性/量产 77% |
 
+## 2026-07-14 触客宝 TC 真机聊天恢复专项（阿表）
+
+> **口径**：本专项只统计 2026-07-14 当前证据。历史聊天成功不代替当前验收；“SDK/WS/Hook 在线”不等于“触客宝完全可以沟通”。
+
+| ID | 模块 | 状态 | 进度 | 当前证据 | 下一道验收门禁 |
+|---|---|---|---:|---|---|
+| `WP-MAC-TC-FALLBACK-04` | Mac Agent + Type-C 临时兜底 | 🟡 临时可用 | **70%** | `xgfe65eimrrofyws` TC/ADB、SDK、Agent/WS 在线；Frida `19886` 两轮 attach/detach 与 Hook probe 通过 | 断开/恢复与 Agent 重启两轮；触客宝白名单收发、回读、当前截图 |
+| `WP-FRIDA-SSOT-01` | Frida 端口单一真源 | ⬜ 待开发 | **20%** | 已定位 `19886/14537/27042` 多真源与重复启动冲突 | APK/Agent/守护统一配置；三种重启后只监听一个非默认端口 |
+| `WP-APK-RPC-02` | APK `FridaBridge` 真实 RPC | ⬜ 待开发 | **10%** | 服务端/attach/Hook 探针可用，但 APK RPC 实现未被真实回执证明 | `ping`、资料、白名单发送、真实回执四项全部走 APK RPC |
+| `WP-BOOT-SELFHEAL-03` | 开机与崩溃自愈 | ⬜ 待开发 | **15%** | BootReceiver/前台服务存在；APK asset 缺失导致独立冷启动风险 | 无 Mac/ADB：杀进程、重启 APK、重启 `system_server` 均 60 秒内恢复 WS+Hook |
+| `WP-TKB-CHAT-E2E-05` | 触客宝“游条姐”当前聊天 | 🔴 未验收 | **0%** | 仅有历史成功；2026-07-14 当前发送、回读、截图缺失 | 会话定位→发送→微信回执→消息回读→触客宝页面截图，两轮通过 |
+
+**专项总体进度：25%**。需求拆解与临时恢复已有证据；APK 长期修复和触客宝当前聊天 E2E 均未完成，不计入 100%。
+
+**开发顺序**：`WP-FRIDA-SSOT-01` → `WP-APK-RPC-02` → `WP-BOOT-SELFHEAL-03` → `WP-TKB-CHAT-E2E-05`；`WP-MAC-TC-FALLBACK-04` 仅在长期链路完成前兜底。
+
+## 2026-07-14 存客宝宝塔公网部署与 Agent 绑定
+
+| 模块 | 状态 | 进度 | 当前证据 | 剩余门禁 |
+|---|---|---:|---|---|
+| 宝塔 Docker 部署 | ✅ 已上线 | 100% | `/www/wwwroot/workphone-sdk`；Mongo/Redis/SDK 三容器 healthy | 24h 与服务器重启自启复验 |
+| 域名与安全 | ✅ 已验收 | 100% | `wpsdk.quwanzhi.com`；HTTPS/WSS；无 Key 401、有 Key 200；8899 仅本机 | 证书自动续期观察 |
+| 手机扫码/配置绑定 | ✅ 已验收 | 100% | Redmi 2312DRAABC / Agent 5.0.1 / 公网 WSS online | 多手机批量扫码复验 |
+| 设备 ID MD5 | ✅ 已验收 | 100% | `ed25814d9c92b3430696dc96c2142b5f`；API 与 APK 前台展示统一 | 存客宝业务页面展示回归 |
+| 令牌脱敏 | ✅ 已验收 | 100% | 日志与 API 不含 `?token=` / `pairing_token`；旧配对令牌已轮换撤销，新令牌重绑成功 | 安全扫描持续回归 |
+| 微信安全读类 | ✅ 已验收 | 100% | 公网 Fleet→WSS→APK 的 `ping`、微信 8.0.69 均成功回执 | 补 Hook 后联系人/消息/群/朋友圈 |
+| Hook/Frida 全功能 | 🟢 读类通过 | 88% | 宝塔 `server/frida` 已持有微信 Session；96 actions / 26 modules；15 项读类及 5 路并发均通过 | 写类继续按白名单逐项验收；朋友圈上传失败待修 |
+| APK UI/性能 | 🟢 本轮通过 | 95% | 修复单实例 Engine、当前应用 WS fallback、PNG 截图；新包安装后 WSS 单连接稳定在线 | 继续 24h 稳定性观察 |
+
+**本轮总体进度：94%**。线上 SDK、鉴权、CORS、WSS、设备控制、服务器 Frida RPC 和 15 项安全读类已可用；朋友圈发布失败，其他写类、业务 BFF 页面与 24h 稳定性仍是最终门禁。
+
+详细证据：[线上部署与真机验收_20260714](../8、部署/06-存客宝宝塔/线上部署与真机验收_20260714.md)。
+
+公网调用文档：[工作手机SDK公网API对接文档_20260714](../5、接口/02-业务对接/工作手机SDK公网API对接文档_20260714.md)；完整测试：[2026-07-14_公网SDK完整测试汇总](../5、接口/06-验收与矩阵/2026-07-14_公网SDK完整测试汇总.md)。
+
 ## 🔗 关联导航
 
 | 方向 | 文档 |
diff --git a/开发文档/1、需求/修改/工作手机_进行中_20260613.md b/开发文档/1、需求/修改/工作手机_进行中_20260613.md
index ddbc17352f..8e892a610a 100644
--- a/开发文档/1、需求/修改/工作手机_进行中_20260613.md
+++ b/开发文档/1、需求/修改/工作手机_进行中_20260613.md
@@ -620,3 +620,41 @@ WORKPHONE_TEST_TO_ID=filehelper node sdk/scripts/run_wechat_private_domain_accep
 | 2026-06-13 | **换日分拣**：0612 全文 → `modify需求归档_20260613/`；✅ 迁 `工作手机_0613已完成项归档`；§测试 ACC 入库 |
 | 2026-06-13 | **WP-WX-03/04** 卡若口述 §九 |
 | 2026-06-14 | **防自动中断**：主控 `CHECKLIST_CHUNK/PHASE`+Frida探针+`run_checklist_anti_interrupt.sh`+`fix_persistent_chat_no_interrupt.sh` |
+
+---
+
+## 十一、WP-TKB-CHAT-RECOVERY-01 · 触客宝 TC 真机聊天长期修复（2026-07-14）
+
+> **任务来源**：触客宝“游条姐”账号当前 TC 真机聊天验收
+> **设备**：`xgfe65eimrrofyws` · Redmi `2312DRAABC` · 微信 `8.0.69`
+> **当前证据**：[2026-07-14 触客宝 TC 真机 Frida 环境恢复](../../8、部署/05-测试验收/20260714_触客宝TC真机_Frida环境恢复_阿服.md) · [触客宝侧复检](../../../cunkebao_v3/开发文档/8、部署/05-测试验收/20260714_触客宝游条姐_TC真机聊天复检.md)
+
+### 十一·一、状态分层（禁止混写）
+
+| 层级 | 当前状态 | 完成度 | 已有证据 | 还缺什么 |
+|---|---|---:|---|---|
+| **Mac Agent + Type-C 临时兜底** | 🟡 **临时可用** | **70%** | TC/ADB 在线；SDK `healthy`；设备 Agent/WS 在线；Frida 端口恢复后 `supports_hook=true`、两轮 attach/detach 成功 | 仍依赖 Mac/ADB 人工恢复；触客宝“定位会话→发→回执→回读→当前截图”尚未在本轮闭环 |
+| **APK 端 Frida 服务恢复** | 🟡 **本轮恢复** | **60%** | 现有手机二进制在 `127.0.0.1:19886` 运行；APK 日志出现 `FridaBridge ready`、脚本加载 | 冷启动仍可能因 asset 缺失失败；端口配置仍有 `19886/14537/27042` 多真源 |
+| **APK 真实微信 RPC** | 🔴 **长期缺口** | **10%** | 仅证明 Frida 服务、attach、Hook 探针可用 | `FridaBridge.sendRpc()` 不是已验证 Frida RPC；必须取得脚本 `ping`、资料读取、消息发送回执 |
+| **开机/进程崩溃自愈** | 🔴 **长期缺口** | **15%** | BootReceiver/前台服务代码存在；本轮可人工恢复 | 杀 Frida、重启 APK、`system_server` 重启后 60 秒内无人值守恢复尚未通过 |
+| **触客宝当前聊天闭环** | 🔴 **未验收** | **0%** | 历史 2026-06-13 有成功回执，不能代表今天 | 当前“游条姐”资料确认、真实收发、消息回读、触客宝页面截图全部缺失 |
+
+### 十一·二、派给工作手机开发的 P0 任务单
+
+| ID | 任务 | 开发要求 | 当前状态 | 完成门禁 |
+|---|---|---|---|---|
+| **WP-FRIDA-SSOT-01** | 端口单一真源 | APK `agent_config.frida_port`、`phantom_frida_config.json`、Frida 启动/守护脚本统一读取同一配置；禁止无参数回退默认 `27042` | ⬜ 待开发 · **20%**（根因与验收已定义） | Agent 重启、APK 重启、`system_server` 重启后三轮只监听同一非默认端口；SDK 自动回到 `supports_hook=true` |
+| **WP-APK-RPC-02** | APK `FridaBridge` 真实 RPC | 替换“普通换行 JSON 直写 Frida 协议端口”方案；不得依赖手机上未证明存在的 `frida -U` CLI；使用可验证的 Frida 客户端或设备内桥接 | ⬜ 待开发 · **10%** | 真机加载 `wechat_hook_v2.js`，依次通过 RPC `ping`、读取当前微信资料、向白名单发送、取得真实 `message_id/回执` |
+| **WP-BOOT-SELFHEAL-03** | APK 开机与崩溃自愈 | APK 内置经校验的 arm64 Frida asset，或安全复用已校验二进制；缺 asset 时不得只写日志退出；BootReceiver、前台服务、端口探测与单实例拉起形成闭环 | ⬜ 待开发 · **15%** | 无 Mac/ADB 手工命令：杀 Frida、强停/重启 APK、重启 `system_server`，每种场景 60 秒内 WS+Hook 自动恢复 |
+| **WP-MAC-TC-FALLBACK-04** | Mac Agent 临时 TC 兜底 | 在 APK 长期修复完成前保留；只允许当前 USB 真机，锁定 `device_id=xgfe65eimrrofyws`，端口从 SSOT 读取；失败必须诚实返回 | 🟡 临时运行 · **70%** | Type-C 断开/恢复、Agent 重启两轮后设备唯一且在线；Hook 失败不得降级成假成功；完成一次触客宝白名单收发闭环 |
+
+### 十一·三、统一验收顺序
+
+- [ ] V1：端口单一真源三种重启场景通过，留存监听、进程与配置证据。
+- [ ] V2：APK 不依赖 Mac Agent 完成 Hook attach + RPC 四项真实回执。
+- [ ] V3：开机/杀进程/`system_server` 重启后 60 秒内自动自愈。
+- [ ] V4：触客宝定位“游条姐”当前会话，发送白名单消息并从微信消息接口回读。
+- [ ] V5：在触客宝页面截取当前发送成功、回执/回读可核对的截图。
+- [ ] V6：连续两轮复测均通过，才允许将“完全可以沟通”标为 100%。
+
+**本任务组当前完成度：25%**。这里只表示“证据、根因、临时恢复和开发任务已就绪”，不表示 APK 长期修复或触客宝聊天已完成。
diff --git a/开发文档/5、接口/02-业务对接/README.md b/开发文档/5、接口/02-业务对接/README.md
index 630d927d46..dda895f17f 100644
--- a/开发文档/5、接口/02-业务对接/README.md
+++ b/开发文档/5、接口/02-业务对接/README.md
@@ -22,6 +22,7 @@ obsidian-color: #0277BD
 
 | 文档 | 说明 |
 |------|------|
+| **[工作手机SDK公网API对接文档_20260714.md](工作手机SDK公网API对接文档_20260714.md)** | **生产域名、鉴权、CORS、curl/JS/Python 示例、错误码与真机验收口径** |
 | [存客宝BFF与工作手机SDK映射表.md](存客宝BFF与工作手机SDK映射表.md) | 触客宝 `/v1/workphone/*` ↔ SDK `/api/v3/*` + WorkPhoneSDK.php |
 | **[四端开放接口汇总与对接铁律.md](四端开放接口汇总与对接铁律.md)** | **★ 52 BFF + 四端入口 + 微信字段 + 对接铁律（不改四端代码）** |
 | [存客宝对接规范.md](存客宝对接规范.md) | 存客宝线索 API 签名与上报 |
diff --git a/开发文档/5、接口/02-业务对接/工作手机SDK公网API对接文档_20260714.md b/开发文档/5、接口/02-业务对接/工作手机SDK公网API对接文档_20260714.md
new file mode 100644
index 0000000000..0030614177
--- /dev/null
+++ b/开发文档/5、接口/02-业务对接/工作手机SDK公网API对接文档_20260714.md
@@ -0,0 +1,173 @@
+# 工作手机 SDK 公网 API 对接文档
+
+> 更新：2026-07-14
+> 生产地址：`https://wpsdk.quwanzhi.com`
+> OpenAPI：`https://wpsdk.quwanzhi.com/openapi.json`
+> Swagger：`https://wpsdk.quwanzhi.com/docs`
+
+## 1. 对接条件
+
+- 所有业务接口使用 HTTPS；手机主动连接使用 WSS。
+- 外部应用从服务器安全环境读取 API Key，请勿写入前端源码、APK、日志或仓库。
+- 请求头：`X-API-Key: <由运维安全提供>`；也兼容 `Authorization: Bearer <API_KEY>`。
+- 当前生产真机 ID：`xgfe65eimrrofyws`；MD5：`ed25814d9c92b3430696dc96c2142b5f`。
+- 健康探针 `/health`、`/ready` 无需 Key；控制接口无 Key或错误 Key均返回 401。
+
+## 2. 最小调用样例
+
+### curl
+
+```bash
+export WORKPHONE_URL='https://wpsdk.quwanzhi.com'
+export WORKPHONE_API_KEY='<从服务器密钥管理获取>'
+
+curl -fsS "$WORKPHONE_URL/api/v3/devices" \
+  -H "X-API-Key: $WORKPHONE_API_KEY"
+
+curl -fsS -X POST "$WORKPHONE_URL/api/v3/hook/execute" \
+  -H "X-API-Key: $WORKPHONE_API_KEY" \
+  -H 'Content-Type: application/json' \
+  -d '{"device_id":"xgfe65eimrrofyws","platform":"wechat","action":"ping","params":{}}'
+```
+
+### JavaScript / Node.js
+
+```js
+const response = await fetch(`${process.env.WORKPHONE_URL}/api/v3/hook/execute`, {
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'X-API-Key': process.env.WORKPHONE_API_KEY,
+  },
+  body: JSON.stringify({
+    device_id: 'xgfe65eimrrofyws',
+    platform: 'wechat',
+    action: 'get_profile',
+    params: {},
+  }),
+});
+if (!response.ok) throw new Error(`WorkPhone HTTP ${response.status}`);
+const result = await response.json();
+```
+
+### Python
+
+```python
+import os
+import requests
+
+result = requests.post(
+    f"{os.environ['WORKPHONE_URL']}/api/v3/hook/execute",
+    headers={"X-API-Key": os.environ["WORKPHONE_API_KEY"]},
+    json={
+        "device_id": "xgfe65eimrrofyws",
+        "platform": "wechat",
+        "action": "get_contacts",
+        "params": {"limit": 20},
+    },
+    timeout=35,
+)
+result.raise_for_status()
+print(result.json())
+```
+
+## 3. 核心接口
+
+| 用途 | 方法与路径 | 说明 |
+|---|---|---|
+| 健康 | `GET /health` | 服务状态与在线设备数，无需 Key |
+| 就绪 | `GET /ready` | 数据库与服务启动门禁，无需 Key |
+| 设备列表 | `GET /api/v3/devices` | WS/ADB 统一设备列表 |
+| 设备详情 | `GET /api/v3/devices/{device_id}` | 项目、能力、连接信息 |
+| 当前应用 | `GET /api/v3/adb/devices/{device_id}/app/current` | WS 设备也支持 |
+| 启动应用 | `POST /api/v3/adb/devices/{device_id}/app/start` | Body：`{"package":"com.tencent.mm"}` |
+| 真机截图 | `POST /api/v3/adb/devices/{device_id}/screenshot` | 返回 PNG Base64 |
+| UI 树 | `GET /api/v3/adb/devices/{device_id}/ui-tree` | MIUI 状态变化时可能受系统限制 |
+| 微信统一执行 | `POST /api/v3/hook/execute` | 推荐的单设备微信 RPC 入口 |
+| 批量执行 | `POST /api/v3/fleet/execute` | 多设备、项目或全部在线设备 |
+| 能力清单 | `GET /api/v3/wechat/actions` | 读取服务器当前动作清单 |
+
+### 截图响应与解码
+
+```json
+{
+  "code": 200,
+  "message": "ok",
+  "data": {
+    "image_base64": "<PNG_BASE64>",
+    "mime_type": "image/png",
+    "size": 245296,
+    "path": "<手机应用缓存路径>"
+  },
+  "channel_used": "websocket/agent"
+}
+```
+
+```js
+const png = Buffer.from(result.data.image_base64, 'base64');
+```
+
+## 4. 已验收的微信读类动作
+
+以下动作于 2026-07-14 通过公网域名真实调用，通道均为 `server/frida`：
+
+`ping`、`get_hook_status`、`get_wechat_version`、`get_process_info`、`get_profile`、`check_account_status`、`get_device_info`、`get_network_info`、`get_storage_info`、`get_contacts`、`get_groups`、`get_labels`、`get_recent_messages`、`get_safety_center`、`check_restrictions`。
+
+调用格式统一：
+
+```json
+{
+  "device_id": "xgfe65eimrrofyws",
+  "platform": "wechat",
+  "action": "get_wechat_version",
+  "params": {}
+}
+```
+
+## 5. 批量调用
+
+```json
+POST /api/v3/fleet/execute
+{
+  "device_ids": ["xgfe65eimrrofyws"],
+  "platform": "wechat",
+  "action": "get_profile",
+  "params": {},
+  "hook_only": true,
+  "timeout": 60,
+  "max_concurrency": 3
+}
+```
+
+涉及发消息、发朋友圈、好友、群、支付、账号资料修改等写类操作时，调用方必须增加业务审批、目标白名单、幂等键、审计日志和人工确认，不允许仅凭 HTTP 200 判断业务成功。
+
+## 6. 浏览器跨域
+
+生产服务已放行标准 OPTIONS 预检；真实 GET/POST 仍要求 API Key。验证结果：
+
+- `OPTIONS /api/v3/devices`：200；
+- `Access-Control-Allow-Origin`：回显请求 Origin；
+- `Access-Control-Allow-Headers`：包含 `X-API-Key`。
+
+不建议把长期 API Key 放在浏览器；正式业务应由存客宝 BFF 代调。
+
+## 7. 错误处理
+
+| HTTP | 含义 | 调用方处理 |
+|---:|---|---|
+| 400/422 | 动作或参数错误 | 不重试，修正请求 |
+| 401 | API Key 缺失或错误 | 停止调用并告警 |
+| 404 | 设备或路径不存在 | 刷新设备列表 |
+| 429 | 风控暂停或限流 | 按业务策略延迟 |
+| 503 | 设备 WS、Frida 隧道或 Hook 不在线 | 指数退避，先查 `/health` 与设备状态 |
+| 500 | 服务端或 RPC 执行异常 | 记录 request ID，有限重试 |
+
+成功判定必须同时检查 HTTP 状态、`code`、`success`、`channel_used` 及动作业务字段；截图还要检查 `data.image_base64` 非空。
+
+## 8. 安全与生产边界
+
+- API Key 与手机 pairing token 必须分离，禁止相互替代。
+- pairing token 只用于手机 WSS 绑定，不提供给业务调用方。
+- 当前 Frida 经手机→443/WSS→宝塔反向隧道，公网不开放 Frida 端口。
+- 微信 8.0.69、Android 13、Agent 5.0.1 已验收。
+- 朋友圈图文发布在本轮两次返回“内容未发表”，不能标记成功；其他写类需要白名单逐项确认。
diff --git a/开发文档/5、接口/06-验收与矩阵/2026-07-14_公网SDK完整测试汇总.md b/开发文档/5、接口/06-验收与矩阵/2026-07-14_公网SDK完整测试汇总.md
new file mode 100644
index 0000000000..a20377eb52
--- /dev/null
+++ b/开发文档/5、接口/06-验收与矩阵/2026-07-14_公网SDK完整测试汇总.md
@@ -0,0 +1,80 @@
+# 2026-07-14 公网 SDK 完整测试汇总
+
+## 结论
+
+生产 SDK、WSS、宝塔 Frida RPC、15 项微信读类、应用启动、当前应用、真机截图、UI 树、鉴权与 CORS 已通过。朋友圈发布两次失败；其他对外写类尚需确认后执行，不能纳入“全功能成功”。
+
+## 环境
+
+| 项目 | 当前值 |
+|---|---|
+| 生产地址 | `https://wpsdk.quwanzhi.com` |
+| 设备 | Redmi 2312DRAABC / Android 13 |
+| 设备 ID | `xgfe65eimrrofyws` |
+| 设备 MD5 | `ed25814d9c92b3430696dc96c2142b5f` |
+| 微信 | 8.0.69 |
+| Agent | 5.0.1 |
+| 项目 | `cunkebao` |
+| Hook | 宝塔 `server/frida`，96 actions / 26 modules |
+
+## 测试结果
+
+| 分类 | 通过 | 失败/待确认 | 状态 |
+|---|---:|---:|---|
+| 服务健康与就绪 | 2 | 0 | ✅ |
+| 微信安全读类 | 15 | 0 | ✅ |
+| 设备控制 | 4 | 0 | ✅ 修复后复验 |
+| 外部鉴权 | 4 | 0 | ✅ |
+| 浏览器 CORS | 1 | 0 | ✅ 修复后复验 |
+| 5 路并发 ping | 5 | 0 | ✅ 全部 HTTP 200 |
+| 朋友圈发布 | 0 | 2 次失败 | ❌ 微信提示内容未发表 |
+| 其他写类 | 0 | 待人工确认 | ⏳ |
+
+### 微信读类
+
+全部 HTTP 200，通道 `server/frida`：`ping`、`get_hook_status`、`get_wechat_version`、`get_process_info`、`get_profile`、`check_account_status`、`get_device_info`、`get_network_info`、`get_storage_info`、`get_contacts`、`get_groups`、`get_labels`、`get_recent_messages`、`get_safety_center`、`check_restrictions`。
+
+### 设备控制
+
+- `app_start`：通过，公网启动微信。
+- `app_current`：初测 404；增加 WS fallback 后 HTTP 200。
+- `screenshot`：初测假成功无图片；APK 增加 PNG Base64 后通过，1080×2400。
+- `ui_tree`：本轮 HTTP 200；MIUI 特定页面仍可能限制 uiautomator，必须检查正文。
+
+截图证据：`开发文档/8、部署/06-存客宝宝塔/images/公网API真机截图_20260714.png`。
+
+### 鉴权与 CORS
+
+- `/health` 无 Key：200。
+- `/api/v3/devices` 无 Key：401；错误 Key：401；正确 Key：200。
+- 不存在设备：404“设备不存在”。
+- OPTIONS 初测 401；放行预检后复验 200，允许 `X-API-Key`。
+- 5 路公网并发 `ping` 全部 HTTP 200，耗时约 3.31 秒，通道均为 `server/frida`；测试后设备仍在线。
+
+### 朋友圈失败
+
+- 配图、文字、公开范围均完成。
+- 首次发表及重新发送均提示“内容未发表”。
+- 证据：`朋友圈首次发布失败_20260714.png`、`朋友圈重试失败_20260714.png`。
+
+## 本轮修复
+
+1. 控制台统一附加 API Key，401 不再伪装成“0 台设备”。
+2. 宝塔侧增加真实 Frida Session/RPC 桥。
+3. `/app/current` 对 WS 设备增加 fallback。
+4. Android 截图返回完整 PNG Base64，并改用应用缓存解决读取权限。
+5. API 鉴权中间件放行 CORS OPTIONS 预检。
+6. Android 前台服务增加 AgentEngine 单实例锁，避免重复 START 创建两条 WS。
+
+## 当前错误与风险
+
+| ID | 问题 | 影响 | 当前状态 |
+|---|---|---|---|
+| `SNS-01` | 朋友圈内容上传失败 | 朋友圈写类不可交付 | 待查账号限制/上传网络 |
+| `WS-01` | SDK 重启后曾出现双 Engine | 设备短时离线 | 已修，持续观察 |
+| `MIUI-01` | MIUI 普通 ADB/ATX 注入受限 | UI 自动化不稳定 | Root sendevent 可兜底 |
+| `WRITE-01` | 发消息等写类未获本轮确认 | 不能声称全量通过 | 等待白名单测试 |
+
+## 验收口径
+
+“HTTP 200”不等于业务成功。必须检查业务字段、通道、真实数据或截图。朋友圈按失败记录；未测试写类不做成功结论。
diff --git a/开发文档/5、接口/06-验收与矩阵/README.md b/开发文档/5、接口/06-验收与矩阵/README.md
index 32da0155c3..0d2ff2ebdf 100644
--- a/开发文档/5、接口/06-验收与矩阵/README.md
+++ b/开发文档/5、接口/06-验收与矩阵/README.md
@@ -24,6 +24,7 @@ obsidian-color: #FFB300
 
 | 内容 | 路径 |
 |------|------|
+| **2026-07-14 公网 SDK 完整测试** | **[2026-07-14_公网SDK完整测试汇总.md](2026-07-14_公网SDK完整测试汇总.md)** |
 | **Frida 真机验收证据包（2026-05-24）** | **`2026-05-24_Frida真机验收/`** ← JSON/CSV/截图真源 |
 | 可见单项确认（索引） | `2026-05-24_微信真机可见验收_单项确认.md` |
 | 110 项矩阵/扫描追加 | `110项功能逐项确认/` |
diff --git a/开发文档/5、接口/README.md b/开发文档/5、接口/README.md
index 9fc24281bc..aa8d485aaf 100644
--- a/开发文档/5、接口/README.md
+++ b/开发文档/5、接口/README.md
@@ -46,11 +46,11 @@ cssclasses:
 | 大类 | 入口 |
 |------|------|
 | **01 规范与统一层** | [**工作手机API全量接口目录.md**](01-规范与统一层/工作手机API全量接口目录.md)（328 条） · [接口规范.md](01-规范与统一层/接口规范.md) · [通用服务交互层.md](01-规范与统一层/通用服务交互层.md) |
-| **02 业务对接** | [存客宝BFF映射表](02-业务对接/存客宝BFF与工作手机SDK映射表.md) · [存客宝对接规范.md](02-业务对接/存客宝对接规范.md) · [外部对接网关接口说明.md](02-业务对接/外部对接网关接口说明.md) |
+| **02 业务对接** | **[公网 API 对接文档](02-业务对接/工作手机SDK公网API对接文档_20260714.md)** · [存客宝BFF映射表](02-业务对接/存客宝BFF与工作手机SDK映射表.md) · [存客宝对接规范.md](02-业务对接/存客宝对接规范.md) · [外部对接网关接口说明.md](02-业务对接/外部对接网关接口说明.md) |
 | **03 Hook与微信** | [Hook模块管理接口.md](03-Hook与微信/Hook模块管理接口.md) · [微信全功能矩阵](03-Hook与微信/微信全功能矩阵_v8.0.56.md) |
 | **04 OpenAPI** | [openapi_v3.0.json](04-OpenAPI/openapi_v3.0.json) |
 | **05 交互图** | [接口全量分类浏览.html](05-交互图/接口全量分类浏览.html) · [存客宝对接架构图.html](05-交互图/存客宝对接架构图.html) · [API架构与交互流程图.html](05-交互图/API架构与交互流程图.html) |
-| **06 验收与矩阵** | [06-验收与矩阵/README.md](06-验收与矩阵/README.md) · **`2026-05-24_Frida真机验收/`** · `110项功能逐项确认/` · 开发日志 |
+| **06 验收与矩阵** | **[2026-07-14 公网 SDK 完整测试汇总](06-验收与矩阵/2026-07-14_公网SDK完整测试汇总.md)** · [06-验收与矩阵/README.md](06-验收与矩阵/README.md) · **`2026-05-24_Frida真机验收/`** · `110项功能逐项确认/` · 开发日志 |
 
 **维护规范**：[机擎/阿表/开发文档结构规范/SKILL.md](../../机擎/阿表/开发文档结构规范/SKILL.md)
 
diff --git a/开发文档/8、部署/06-存客宝宝塔/images/公网API真机截图_20260714.png b/开发文档/8、部署/06-存客宝宝塔/images/公网API真机截图_20260714.png
new file mode 100644
index 0000000000..83a9994566
Binary files /dev/null and b/开发文档/8、部署/06-存客宝宝塔/images/公网API真机截图_20260714.png differ
diff --git a/开发文档/8、部署/06-存客宝宝塔/images/工作手机新图标_20260714.png b/开发文档/8、部署/06-存客宝宝塔/images/工作手机新图标_20260714.png
new file mode 100644
index 0000000000..620a55663c
Binary files /dev/null and b/开发文档/8、部署/06-存客宝宝塔/images/工作手机新图标_20260714.png differ
diff --git a/开发文档/8、部署/06-存客宝宝塔/images/工作手机新图标真机桌面_20260714.png b/开发文档/8、部署/06-存客宝宝塔/images/工作手机新图标真机桌面_20260714.png
new file mode 100644
index 0000000000..b1ab20cab4
Binary files /dev/null and b/开发文档/8、部署/06-存客宝宝塔/images/工作手机新图标真机桌面_20260714.png differ
diff --git a/开发文档/8、部署/06-存客宝宝塔/images/朋友圈重试失败_20260714.png b/开发文档/8、部署/06-存客宝宝塔/images/朋友圈重试失败_20260714.png
new file mode 100644
index 0000000000..0020a0a0c8
Binary files /dev/null and b/开发文档/8、部署/06-存客宝宝塔/images/朋友圈重试失败_20260714.png differ
diff --git a/开发文档/8、部署/06-存客宝宝塔/images/朋友圈首次发布失败_20260714.png b/开发文档/8、部署/06-存客宝宝塔/images/朋友圈首次发布失败_20260714.png
new file mode 100644
index 0000000000..ce26b145bf
Binary files /dev/null and b/开发文档/8、部署/06-存客宝宝塔/images/朋友圈首次发布失败_20260714.png differ
diff --git a/开发文档/8、部署/06-存客宝宝塔/公司NAS_WebStation与工作手机SDK配置.md b/开发文档/8、部署/06-存客宝宝塔/公司NAS_WebStation与工作手机SDK配置.md
new file mode 100644
index 0000000000..75fdb435b3
--- /dev/null
+++ b/开发文档/8、部署/06-存客宝宝塔/公司NAS_WebStation与工作手机SDK配置.md
@@ -0,0 +1,64 @@
+# 公司 NAS Web Station 与工作手机 SDK 配置
+
+> 更新：2026-07-12
+
+## 结论
+
+工作手机 SDK 是 FastAPI + WebSocket 服务，不能直接作为 PHP 网站放进 Web Station 的站点根目录运行。正确分工是：
+
+```text
+Container Manager
+  └─ workphone-sdk-nas :8899  ← FastAPI、控制台、WebSocket、Mongo、Redis
+
+DSM 登录门户/反向代理（可选）
+  └─ workphone 域名 :443      ← 反代到 127.0.0.1:8899
+
+Web Station（可选）
+  └─ 仅放静态说明页、下载页或前端构建产物
+```
+
+## NAS 已登记的运行目录
+
+- 项目目录：`/volume1/docker/workphone-sdk`
+- Compose：`docker-compose.nas.yml`
+- SDK：`workphone-sdk-nas`
+- 控制台：`http://192.168.110.101:8899/hub`
+- 健康检查：`http://192.168.110.101:8899/health`
+- WebSocket：`ws://192.168.110.101:8899/ws/device/{device_id}`
+
+## Container Manager 操作
+
+在 DSM → Container Manager → 项目中打开 `workphone-sdk`：
+
+1. 项目路径选择 `/volume1/docker/workphone-sdk`。
+2. Compose 文件选择 `docker-compose.nas.yml`。
+3. 确认 `.env` 保留在 NAS，不从本机覆盖。
+4. 点击“构建”并“启动”。
+5. 等待 `workphone-mongo-nas` 健康后，再确认 `workphone-sdk-nas` 为运行中。
+6. 查看日志，确认没有 Mongo/Redis 连接错误。
+
+## Web Station 配置建议
+
+如果只需要访问 SDK 控制台，不必建立 Web Station 网站，直接使用 NAS 内网 8899 即可。
+
+如果需要统一域名和 HTTPS：
+
+1. 在 DSM → 控制面板 → 登录门户 → 高级 → 反向代理新增规则。
+2. 来源协议 HTTPS、来源主机填 SDK 域名、来源端口 443。
+3. 目标协议 HTTP、目标主机 `127.0.0.1`、目标端口 `8899`。
+4. 开启 WebSocket 支持；`/ws/` 不能被静态站点规则吞掉。
+5. 手机 Agent 地址改为 `wss://<SDK域名>/ws/device/{device_id}`。
+
+## 验收
+
+```bash
+curl -fsS http://192.168.110.101:8899/health
+curl -fsS http://192.168.110.101:8899/ready
+curl -fsS http://192.168.110.101:8899/api/v3/integration/manifest
+```
+
+页面验收：`/hub` 可打开；容器重启后 SDK 自动恢复；手机 Agent 能上线并持续心跳；存客宝 BFF 能通过 API Key 访问 SDK。
+
+## 当前状态
+
+2026-07-12 已从本机同步最小运行集到 NAS 目录，并保留 NAS 原有 `.env`。由于当前 SSH 用户无法通过 sudo 操作 Container Manager，容器启动尚未完成；不把“文件已同步”标记为“服务已上线”。
diff --git a/开发文档/8、部署/06-存客宝宝塔/工作手机SDK_存客宝宝塔部署总方案.md b/开发文档/8、部署/06-存客宝宝塔/工作手机SDK_存客宝宝塔部署总方案.md
index 290e01af95..5c14c8ec25 100644
--- a/开发文档/8、部署/06-存客宝宝塔/工作手机SDK_存客宝宝塔部署总方案.md
+++ b/开发文档/8、部署/06-存客宝宝塔/工作手机SDK_存客宝宝塔部署总方案.md
@@ -1,6 +1,6 @@
 # 工作手机 SDK · 存客宝宝塔部署总方案
 
-> 版本：v1.0 · 日期：2026-07-11
+> 版本：v1.1 · 更新：2026-07-14 · 当前线上域名：`https://wpsdk.quwanzhi.com`
 
 ## 1. 目标架构
 
@@ -16,8 +16,8 @@
 2. 确认 8899 未被占用，且不会影响存客宝现有站点。
 3. 创建独立目录，上传 `sdk/` 或审计后的发行包；不上传本机 `.env`。
 4. 写入生产环境变量：`API_KEY`、`MONGO_URI`、`MONGO_DB`、`REDIS_URL`、`AI_BRAIN_ENABLED`。
-5. 用 Docker Compose 构建启动，容器监听 8899。
-6. 宝塔创建独立域名并反代到 `127.0.0.1:8899`，申请 TLS。
+5. 用 `sdk/docker-compose.baota.yml` 构建启动，SDK 只监听 `127.0.0.1:8899`。
+6. 宝塔创建独立域名 `wpsdk.quwanzhi.com` 并反代到 `127.0.0.1:8899`，启用 TLS。
 7. 配置存客宝 BFF 的 SDK URL 与 API Key，先健康检查，再设备读类验收。
 8. 手机安装 Agent，填写 WSS 地址，完成真实设备绑定。
 
@@ -45,10 +45,9 @@ location /ws/ {
 ## 4. 验收命令
 
 ```bash
-curl -fsS https://<SDK域名>/health
-curl -fsS https://<SDK域名>/ready
-curl -fsS https://<SDK域名>/api/v3/integration/manifest
-curl -fsS https://<SDK域名>/api/v3/integration/consumers/cunkebao
+curl -fsS https://wpsdk.quwanzhi.com/health
+curl -fsS https://wpsdk.quwanzhi.com/ready
+curl -i https://wpsdk.quwanzhi.com/api/v3/devices  # 未带 Key 应为 401
 ```
 
 随后验证 BFF 鉴权、设备 Agent WSS 上线、心跳、设备列表、截图读类接口，以及使用测试设备/联系人完成一条受控写类任务并保留回执。重启后还要验证容器自启与设备重连。
@@ -57,6 +56,11 @@ curl -fsS https://<SDK域名>/api/v3/integration/consumers/cunkebao
 
 只回滚独立的 `workphone-sdk` 容器、站点和 Nginx 配置，不修改存客宝现有站点。恢复后执行 `nginx -t`、原站点健康检查，并让设备切回原 SDK WSS 地址。
 
-## 6. 当前执行结论
+## 6. 当前执行结论（2026-07-14）
 
-本机 SDK 已可用：`/health` 返回 healthy，1 台 WS 在线、2 台 ADB 设备，Compose 配置通过。存客宝公网 9988 只读探测收到 Nginx 404，SSH 22/22022 未建立连接，尚不能操作宝塔并宣称线上已部署；公网 WSS 与真机验收保持未完成。
+- 已通过 SSH 别名 `cunkebao` 部署到 `/www/wwwroot/workphone-sdk`。
+- `workphone-sdk-baota`、`workphone-mongo-baota`、`workphone-redis-baota` 三个容器健康。
+- 公网 `/health` 为 healthy，`/ready` 为 true；未授权 API 返回 401，授权设备列表返回 200。
+- 真机 Redmi `2312DRAABC` 已通过 `wss://wpsdk.quwanzhi.com/ws/device` 上线，设备 MD5 为 `ed25814d9c92b3430696dc96c2142b5f`。
+- 公网 Fleet 读类动作已读到真机微信 `8.0.69`；配对令牌不再出现在日志和管理 API。
+- Hook 当前仍未点亮，联系人/消息等 Hook 读类与受控写类不能据此宣称全绿，须继续按验收记录复测。
diff --git a/开发文档/8、部署/06-存客宝宝塔/线上部署与真机验收_20260714.md b/开发文档/8、部署/06-存客宝宝塔/线上部署与真机验收_20260714.md
new file mode 100644
index 0000000000..b72555bb75
--- /dev/null
+++ b/开发文档/8、部署/06-存客宝宝塔/线上部署与真机验收_20260714.md
@@ -0,0 +1,94 @@
+# 工作手机 SDK · 线上部署与真机验收（2026-07-14）
+
+## 目标与结果
+
+将工作手机 SDK 部署到存客宝宝塔 Docker，通过 `wpsdk.quwanzhi.com` 提供 HTTPS/WSS，让授权 Redmi 真机扫码/配置后主动连接，并验证设备管理与微信安全读类链路。
+
+当前结论：线上服务、鉴权、CORS、WSS 真机、设备控制、宝塔 Frida RPC 和 15 项微信读类均已通过；朋友圈发布失败，其他写类仍需白名单逐项验收。
+
+## 线上架构
+
+```text
+Android 工作手机
+  └─ WSS + pairing token
+      └─ wpsdk.quwanzhi.com:443（宝塔 Nginx / TLS）
+          └─ 127.0.0.1:8899（workphone-sdk-baota）
+              ├─ workphone-mongo-baota
+              └─ workphone-redis-baota
+
+纯客宝/存客宝 BFF
+  └─ HTTPS + X-API-Key → wpsdk.quwanzhi.com/api/v3/
+```
+
+## 实际部署文件
+
+- `sdk/docker-compose.baota.yml`：宝塔生产 Compose。
+- `sdk/.env.baota.example`：仅变量模板，无真实密钥。
+- `sdk/deploy/baota/wpsdk.quwanzhi.com.conf`：HTTPS/WSS 反代。
+- `sdk/scripts/deploy_baota_wpsdk.sh`：上传、构建、启动、证书与 Nginx 校验。
+- 服务器目录：`/www/wwwroot/workphone-sdk`。
+
+## 手机绑定
+
+生产二维码由受 API Key 保护的 `/api/v3/qrcode/generate` 生成，内容至少包含：
+
+- `server`: `wss://wpsdk.quwanzhi.com/ws/device`
+- `project`: `cunkebao`
+- `pairing_token`: 仅服务器环境注入
+
+手机端点击“扫描系统二维码”完成绑定。二维码含配对令牌，禁止截图入库、发群或写进文档。
+
+## 验收证据
+
+| 层级 | 结果 |
+|---|---|
+| DNS | `wpsdk.quwanzhi.com` → `42.194.245.239` |
+| 容器 | Mongo、Redis、SDK 均 healthy |
+| SDK | `/health` healthy，`/ready` true |
+| 安全 | 无 Key 401；有 Key 200；8899 仅绑定本机 |
+| TLS | Let's Encrypt，证书有效至 2026-09-25 |
+| 真机 | Redmi 2312DRAABC / Android 13 / Agent 5.0.1 |
+| WSS | 真机在公网 SDK 显示 online |
+| 设备 ID | 管理与业务字段提供 MD5：`ed25814d9c92b3430696dc96c2142b5f` |
+| 微信读类 | `ping` 与 `get_wechat_version` 均由公网 Fleet→WSS→APK 成功回执；微信 8.0.69 |
+| 密钥保护 | 日志与 API 不回显配对令牌 |
+| 令牌轮换 | 本轮曾进入调试输出的旧配对令牌已撤销；新令牌已下发并重新绑定成功 |
+| Frida 服务 | Root 可用，Frida 16.5.6 在非默认端口可达，APK 回执 `frida_server_ready=true` |
+| 微信 Hook/RPC | 宝塔 `server/frida` 已持有微信 Session 并取得真实 RPC 回执，能力目录为 96 actions / 26 modules |
+| 微信读类 | 15 项公网读类均 HTTP 200：资料、联系人、群、标签、近期消息、账号安全及设备信息等 |
+| 设备控制 | 启动应用、当前应用、UI 树、1080×2400 PNG 截图均已通过 |
+| 浏览器调用 | CORS OPTIONS=200，允许外部网页携带 `X-API-Key` |
+| 并发 | 5 路公网 `ping` 并发 5/5 HTTP 200，通道均为 `server/frida` |
+
+## 安全调用样例
+
+```bash
+curl -fsS https://wpsdk.quwanzhi.com/health
+curl -fsS https://wpsdk.quwanzhi.com/ready
+
+curl -X POST https://wpsdk.quwanzhi.com/api/v3/fleet/execute \
+  -H 'X-API-Key: <从服务器安全环境获取>' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "device_ids": ["<device_id>"],
+    "platform": "wechat",
+    "action": "get_wechat_version",
+    "params": {}
+  }'
+```
+
+## 回滚
+
+1. 只处理 `/www/wwwroot/workphone-sdk` 与 `wpsdk.quwanzhi.com` 独立站点，不改存客宝其他容器。
+2. 在服务器目录使用上一个发行包/镜像重新执行 Compose。
+3. 执行 `nginx -t` 后再 reload。
+4. 验证原有宝塔站点、SDK `/health` 和手机重连。
+
+## 未完成边界
+
+- APK 面板中的本地 Hook 状态与宝塔 `server/frida` 是两条通道；本轮以服务器真实 Session/RPC 回执验收，不能把 APK 面板灰色误判为服务器 RPC 失效。
+- 朋友圈图文发布两次均由微信提示“内容未发表”，按失败记录，未伪报成功。
+- 发消息、群发、加友、朋友圈互动等写类仍需测试白名单和操作前确认。
+- 还需完成纯客宝/存客宝 BFF 业务页面验收及 24 小时稳定性。
+
+完整明细：[公网 SDK 完整测试汇总](../../../5、接口/06-验收与矩阵/2026-07-14_公网SDK完整测试汇总.md)；外部调用：[公网 API 对接文档](../../../5、接口/02-业务对接/工作手机SDK公网API对接文档_20260714.md)。
diff --git a/开发文档/8、部署/06-存客宝宝塔/部署前置条件与端口清单.md b/开发文档/8、部署/06-存客宝宝塔/部署前置条件与端口清单.md
index 9151a3ab83..e30041b025 100644
--- a/开发文档/8、部署/06-存客宝宝塔/部署前置条件与端口清单.md
+++ b/开发文档/8、部署/06-存客宝宝塔/部署前置条件与端口清单.md
@@ -1,6 +1,6 @@
 # 工作手机 SDK · 存客宝宝塔部署前置条件与端口清单
 
-> 更新：2026-07-11 23:58  
+> 更新：2026-07-14
 > 目标：把 SDK 服务部署到存客宝（纯客宝）所在的宝塔服务器，并让自有授权 Android 工作机通过 Agent WebSocket 接入。
 
 ## 1. 服务器条件
@@ -12,12 +12,14 @@
 | 网络 | 手机能访问 HTTPS/WSS 域名 | 不建议把 8899 直接暴露公网 |
 | 安全 | API Key、TLS、宝塔防火墙白名单 | 禁止使用仓库默认密钥 |
 
+本次实际服务器：Ubuntu，15 GiB 内存、约 40 GiB 可用磁盘；Docker 27.1.2、Compose 2.29.1，满足条件。
+
 ## 2. 端口与域名
 
 | 端口/路径 | 用途 | 暴露策略 |
 |---|---|---|
 | 8899 容器端口 | SDK REST、控制台、WebSocket | 仅本机或内网；Nginx 反代 |
-| 443 | 手机 Agent 与存客宝业务访问 | 对外开放，必须 TLS |
+| `wpsdk.quwanzhi.com:443` | 手机 Agent 与存客宝业务访问 | 已开放，TLS/WSS |
 | `/api/v3/` | SDK API | 反代到 `127.0.0.1:8899` |
 | `/ws/` | 设备 Agent WebSocket | 必须配置 Upgrade/Connection 头 |
 | 8898/UDP | 局域网发现 | 只在手机与服务器同一局域网时开放 |
@@ -30,8 +32,9 @@
 - 存客宝 BFF 通过 SDK 标准接口访问设备，前端不得直连 ADB、Frida 或设备端口。
 
 ```ini
-WORKPHONE_SDK_URL=https://workphone-sdk.example.com
+WORKPHONE_SDK_URL=https://wpsdk.quwanzhi.com
 WORKPHONE_SDK_API_KEY=<服务器环境变量注入>
+WORKPHONE_DEVICE_PAIRING_TOKEN=<服务器环境变量注入>
 ```
 
 ## 4. 禁止入库内容
diff --git a/开发文档/8、部署/06-存客宝宝塔/部署验收记录.md b/开发文档/8、部署/06-存客宝宝塔/部署验收记录.md
index af056ac9d2..ea582692ea 100644
--- a/开发文档/8、部署/06-存客宝宝塔/部署验收记录.md
+++ b/开发文档/8、部署/06-存客宝宝塔/部署验收记录.md
@@ -1,23 +1,35 @@
 # 工作手机 SDK · 存客宝宝塔部署验收记录
 
-> 日期：2026-07-12 · 状态：进行中（文档交付已更新，线上部署仍待远程管理面恢复）
+> 更新：2026-07-14 · 状态：线上 SDK、真机 WSS、服务器 Frida RPC 与安全读类已通过；写类继续验收
 
-## 0. 本轮更新
+## 0. 2026-07-14 本轮更新
 
-- 新增《交付更新说明_20260712.md》，统一记录手机安装、服务器部署、运行规则和变更范围。
-- 总入口已增加更新说明链接；线上状态继续按证据区分“本机已验证”和“线上未部署”。
+- 部署目录：`/www/wwwroot/workphone-sdk`；Compose：`docker-compose.baota.yml`。
+- 公网域名：`https://wpsdk.quwanzhi.com`；手机地址：`wss://wpsdk.quwanzhi.com/ws/device`。
+- API Key 鉴权与设备配对令牌分离；令牌已从客户端日志和管理 API 响应中脱敏。
+- 调试阶段进入输出的旧配对令牌已在服务器轮换撤销，真机使用新令牌重新绑定成功。
+- Android Agent 5.0.1 已覆盖安装到授权 Redmi 真机并自动重连。
 
 ## 1. 当前证据
 
 | 检查项 | 结果 | 证据 |
 |---|---|---|
-| 本机 SDK 健康 | ✅ | `GET 127.0.0.1:8899/health` 返回 healthy |
-| WS 设备 | ✅ | 1 台：`xgfe65eimrrofyws` |
-| ADB 设备 | ✅ | 2 台 |
-| Compose 配置 | ✅ | `docker compose ... config --quiet` 通过 |
-| 存客宝 SSH | ⏸ | 22、22022 未建立 TCP 连接 |
-| 存客宝宝塔 9988 | ⏸ | 外部只读探测收到 Nginx 404，未确认面板 API |
-| 公网 SDK/WSS | ⏸ | 尚未部署，禁止标记上线 |
+| 宝塔 Compose | ✅ | Mongo、Redis、SDK 三容器均 healthy |
+| 本机绑定端口 | ✅ | SDK 仅 `127.0.0.1:8899`，公网不直暴露 8899 |
+| 公网健康 | ✅ | `/health` healthy；`/ready` true |
+| HTTPS 证书 | ✅ | Let's Encrypt，CN=`quwanzhi.com`，有效至 2026-09-25 |
+| API 鉴权 | ✅ | 无 Key `/api/v3/devices`=401；带 Key=200 |
+| WSS 真机 | ✅ | Redmi 2312DRAABC，Android 13，公网在线 |
+| 设备 MD5 | ✅ | `ed25814d9c92b3430696dc96c2142b5f` |
+| 微信版本读类 | ✅ | Fleet 真链路返回微信 8.0.69，`channel=no_root_pkg` |
+| 配对令牌脱敏 | ✅ | 日志及设备 API 均不含 `?token=`/`pairing_token` |
+| Frida 服务 | ✅ | Root 可用；Frida 16.5.6 非默认端口可达；公网回执 `frida_server_ready=true` |
+| 微信 Hook/RPC | ✅ | 宝塔 `server/frida` 取得真实 RPC 回执，96 actions / 26 modules |
+| 微信读类 | ✅ | 15 项读类 HTTP 200，覆盖资料、联系人、群、标签、消息、安全与设备信息 |
+| 设备控制 | ✅ | 启动应用、当前应用、UI 树、PNG 真机截图修复后复验通过 |
+| 外部网页调用 | ✅ | API Key 鉴权正确；CORS OPTIONS=200；5 路并发 5/5 通过 |
+| 朋友圈发布 | ❌ | 两次均提示“内容未发表”，截图已归档，不计成功 |
+| 其他写类 | ⏳ | 发消息、群发、加友、朋友圈互动需白名单和操作前确认 |
 
 ## 2. 已整理
 
@@ -27,9 +39,9 @@
 
 ## 3. 待继续
 
-- 宝塔只读资产检查及端口冲突检查。
-- 线上目录、Compose、生产环境变量、独立站点和 TLS。
-- BFF 线上连通与鉴权验收。
-- 至少 1 台真实授权手机的公网 WSS 心跳、读类和受控写类回执。
+- 使用白名单目标完成单聊、群消息、加友和朋友圈互动等受控写类回执。
+- 排查朋友圈上传失败原因，并以微信最终页面和 API 回执双重验收。
+- 配置纯客宝/存客宝 BFF 的 `WORKPHONE_SDK_URL` 与服务器 API Key，并验证业务端设备状态。
+- 执行 24 小时稳定性与服务器重启后的容器自启、真机自动重连验收。
 
-远程管理面恢复后，从《工作手机SDK_存客宝宝塔部署总方案》第 2 节继续；真实密钥只从安全环境注入，文档只记录变量名和状态。
+真实密钥只保存在服务器 `.env`；二维码中含短期/生产配对令牌，不写入文档或仓库。
diff --git a/开发文档/8、部署/README.md b/开发文档/8、部署/README.md
index ddb4aa33f0..47b3d27e31 100644
--- a/开发文档/8、部署/README.md
+++ b/开发文档/8、部署/README.md
@@ -45,7 +45,7 @@ cssclasses:
 | **02 设备Hook** | [设备端Hook安装部署](02-设备Hook/设备端Hook安装部署.md) · **[Type-C真机一键安装与四端对接指南](02-设备Hook/Type-C真机一键安装与四端对接指南.md)** ★ |
 | **03 运维同步** | [上线与运维操作手册](03-运维同步/上线与运维操作手册.md) · [服务器与真机部署清单](03-运维同步/工作手机服务器与真机部署清单_20260620.md) |
 | **05 测试验收** | [05-测试验收/README.md](05-测试验收/README.md) · 脚本 `05-测试验收/scripts/` |
-| **06 存客宝宝塔** | [部署总方案](06-存客宝宝塔/工作手机SDK_存客宝宝塔部署总方案.md) · [条件清单](06-存客宝宝塔/部署前置条件与端口清单.md) · [验收记录](06-存客宝宝塔/部署验收记录.md) · [2026-07-12 更新说明](06-存客宝宝塔/交付更新说明_20260712.md) |
+| **06 存客宝宝塔** | **[2026-07-14 线上部署与真机验收](06-存客宝宝塔/线上部署与真机验收_20260714.md)** · [部署总方案](06-存客宝宝塔/工作手机SDK_存客宝宝塔部署总方案.md) · [Web Station 配置](06-存客宝宝塔/公司NAS_WebStation与工作手机SDK配置.md) · [条件清单](06-存客宝宝塔/部署前置条件与端口清单.md) · [验收记录](06-存客宝宝塔/部署验收记录.md) · [2026-07-12 更新说明](06-存客宝宝塔/交付更新说明_20260712.md) |
 
 无线 Frida 详见 [9、手册 §八](../9、手册/工作手机·五图总览与使用手册.md)
 
@@ -68,6 +68,7 @@ cssclasses:
 
 ## 合并记录
 
+- 2026-07-14：存客宝宝塔 Docker、`wpsdk.quwanzhi.com`、公网 WSS 与 Redmi 真机读类验收落档
 - 2026-05-24：分层迁入 `01～03`
 - 2026-02-10：`部署流程与提示词` 合并入 Docker 指南
 ## 🔗 关联导航