general: Remove SSH-ramdisk CFW install path; host-mount is the sole flow

The ramdisk-based install (build/send an SSH ramdisk, iproxy-forward, then
push CFW files over SSH and flip the boot snapshot with snaputil in-VM) has
been fully replaced by the host-mount path: cfw_install_host.sh mounts the
VM's Disk.img on the host, places every file locally, and flips the boot
snapshot offline via tools/apfs_snap_rename.py. This removes all remaining
ramdisk generation, delivery, and usage — no legacy fallback.

Deleted:
  - scripts/ramdisk_build.py, scripts/ramdisk_send.sh
Renamed:
  - scripts/cfw_host_mode.sh -> scripts/cfw_transport.sh (was a conditional
    "host-mode override"; now the sole, unconditionally-sourced transport)

setup_machine.sh: drop the USE_RAMDISK_CFW=1 branch and every iproxy/ramdisk
helper (usbmux UDID resolution, port picking, start/stop iproxy, wait-for-
ramdisk-ssh), all RAMDISK_*/IPROXY_* vars, the cleanup() iproxy handling, and
the orphaned cfw_install_target var. Only the host-mount cfw_install_host call
remains.

cfw_install{,_dev,_jb,_exp}.sh: delete the SSH transport (SSH_* vars, SSH_OPTS,
sshpass prereq/_sshpass/_ssh_retry, ssh_cmd/scp_to/scp_from/remote_file_exists/
remote_mount, wait_for_device_ssh_ready) and the dead ramdisk-mechanism body
blocks (snaputil snapshot flip, dropbearkey host-key pre-generation, halt-over-
SSH, CFW_SKIP_HALT). The transport is now sourced unconditionally from
cfw_transport.sh. dropbear -R generates host keys at first boot; the offline
apfs_snap_rename.py does the boot-source flip. Dropped the vestigial
CFW_HOST_MODE gate.

Also: pymobiledevice3_bridge.py (ramdisk-send command already gone), Makefile
(ramdisk targets/help/IRECOVERY_ECID removed), README + ja/ko/zh (install flow
rewritten to host-mount), AGENTS.md/CLAUDE.md architecture tree, and stale
comments in vphone_jb_setup.sh, VPhoneCLI.swift, apfs_snap_rename.py,
cfw_patch_post_restore_dt.py.

Verified booting via make setup_machine.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XZVS9oqVNmHJzpb8mFtKJx

Author: zqxwce

AGENTS.md

@@ -98,11 +98,11 @@ scripts/
 ├── patches/                      # Build-time patches (libirecovery)
 ├── fw_prepare.sh                 # Download IPSWs, merge cloudOS into iPhone
 ├── fw_manifest.py                # Generate hybrid BuildManifest/Restore plists
-├── ramdisk_build.py              # Build SSH ramdisk with trustcache (reuses Swift patch-component for TXM/base kernel)
-├── ramdisk_send.sh               # Send ramdisk to device via irecovery
 ├── cfw_install.sh                # Install CFW (regular)
 ├── cfw_install_dev.sh            # Regular + rpcserver daemon
 ├── cfw_install_jb.sh             # Regular + jetsam fix + procursus
+├── cfw_install_exp.sh            # JB + experimental research patches (hv_vmm rename, DT identity)
+├── cfw_install_host.sh           # Host-mount CFW driver (attaches Disk.img, VM off; re-execs sudo)
 ├── vm_create.sh                  # Create VM directory
 ├── setup_machine.sh              # Full automation (setup → first boot)
 ├── setup_tools.sh                # Install deps, build toolchain from submodules, create venv
@@ -111,6 +111,9 @@ scripts/
 ├── setup_libimobiledevice.sh     # Build libimobiledevice stack from scripts/repos submodules
 └── tail_jb_patch_logs.sh         # Tail JB patch log output
 
+tools/
+└── apfs_snap_rename.py           # Offline APFS boot-snapshot flip (used by cfw_install_host.sh)
+
 research/                         # Detailed firmware/patch documentation
 ```
 

Makefile

@@ -17,7 +17,6 @@ BACKUP_INCLUDE_IPSW ?= 0
 FORCE       ?= 0
 RESTORE_UDID ?=           # UDID for restore operations
 RESTORE_ECID ?=           # ECID for restore operations
-IRECOVERY_ECID ?=         # ECID for ramdisk send operations
 
 # ─── Build info ──────────────────────────────────────────────────
 GIT_HASH    := $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
@@ -121,17 +120,12 @@ help:
 	@echo "  make restore                 Restore to device (pymobiledevice3 backend)"
 	@echo "  make restore_offline         Restore offline — decrypts AEA images in place, uses cached .shsh blob"
 	@echo ""
-	@echo "Ramdisk:"
-	@echo "  make ramdisk_build           Build signed SSH ramdisk"
-	@echo "  make ramdisk_send            Send ramdisk to device"
-	@echo ""
-	@echo "CFW:"
-	@echo "  make cfw_install             Install CFW mods via SSH"
-	@echo "  make cfw_install_dev         Install CFW mods via SSH (dev mode)"
+	@echo "CFW (host-mount install; VM must be off, re-execs sudo):"
+	@echo "  make cfw_install             Install base CFW mods"
+	@echo "  make cfw_install_dev         Install CFW mods (dev mode)"
 	@echo "  make cfw_install_jb          Install CFW + JB extensions (jetsam/procursus/basebin)"
 	@echo "  make cfw_install_exp         Install CFW + JB + EXP experimental (hv_vmm rename, post-restore DT, build spoof)"
-	@echo "  make cfw_install_host        Ramdisk-free install: host-mount files + offline snapshot flip"
-	@echo "    Options: VARIANT=regular|dev|jb|exp (default exp)  SPOOF_BUILD=<id> (exp)"
+	@echo "  make cfw_install_host        Select variant: VARIANT=regular|dev|jb|exp (default exp)  SPOOF_BUILD=<id> (exp)"
 	@echo ""
 	@echo "Variables: VM_DIR=$(VM_DIR) CPU=$(CPU) MEMORY=$(MEMORY) DISK_SIZE=$(DISK_SIZE)"
 
@@ -463,39 +457,26 @@ restore_offline:
 		$(if $(RESTORE_UDID),--udid $(RESTORE_UDID),) \
 		--ecid "$$ECID"
 
-# ═══════════════════════════════════════════════════════════════════
-# Ramdisk
-# ═══════════════════════════════════════════════════════════════════
-
-.PHONY: ramdisk_build ramdisk_send
-
-ramdisk_build: patcher_build
-	cd $(VM_DIR) && RAMDISK_UDID="$(RAMDISK_UDID)" $(PYTHON) "$(CURDIR)/$(SCRIPTS)/ramdisk_build.py" .
-
-ramdisk_send:
-	cd $(VM_DIR) && PMD3_BRIDGE="$(PMD3_BRIDGE)" PYTHON="$(PYTHON)" IRECOVERY_ECID="$(IRECOVERY_ECID)" RAMDISK_UDID="$(RAMDISK_UDID)" RESTORE_UDID="$(RESTORE_UDID)" \
-		zsh "$(CURDIR)/$(SCRIPTS)/ramdisk_send.sh"
-
 # ═══════════════════════════════════════════════════════════════════
 # CFW
 # ═══════════════════════════════════════════════════════════════════
 
 .PHONY: cfw_install cfw_install_dev cfw_install_jb cfw_install_exp cfw_install_host
 
 cfw_install:
-	cd $(VM_DIR) && $(if $(SSH_PORT),SSH_PORT="$(SSH_PORT)") _VPHONE_PATH="$$PATH" zsh "$(CURDIR)/$(SCRIPTS)/cfw_install.sh" .
+	$(MAKE) cfw_install_host VARIANT=regular
 
 cfw_install_dev:
-	cd $(VM_DIR) && $(if $(SSH_PORT),SSH_PORT="$(SSH_PORT)") _VPHONE_PATH="$$PATH" zsh "$(CURDIR)/$(SCRIPTS)/cfw_install_dev.sh" .
+	$(MAKE) cfw_install_host VARIANT=dev
 
 cfw_install_jb:
-	cd $(VM_DIR) && $(if $(SSH_PORT),SSH_PORT="$(SSH_PORT)") _VPHONE_PATH="$$PATH" zsh "$(CURDIR)/$(SCRIPTS)/cfw_install_jb.sh" .
+	$(MAKE) cfw_install_host VARIANT=jb
 
 cfw_install_exp:
-	cd $(VM_DIR) && $(if $(SSH_PORT),SSH_PORT="$(SSH_PORT)") $(if $(SPOOF_BUILD),SPOOF_BUILD="$(SPOOF_BUILD)") _VPHONE_PATH="$$PATH" zsh "$(CURDIR)/$(SCRIPTS)/cfw_install_exp.sh" .
+	$(MAKE) cfw_install_host VARIANT=exp SPOOF_BUILD="$(SPOOF_BUILD)"
 
-# Ramdisk-free CFW install: place files via host mount + flip boot snapshot
-# offline. No boot_dfu/ramdisk_send/iproxy/SSH. VM must be off. Re-execs sudo.
+# CFW install: place files via host mount + flip the boot snapshot offline.
+# VM must be off; re-execs under sudo.
 #   Options: VARIANT=regular|dev|jb|exp (default exp)  SPOOF_BUILD=<id> (exp)
 cfw_install_host:
 	$(if $(SPOOF_BUILD),SPOOF_BUILD="$(SPOOF_BUILD)") zsh "$(CURDIR)/$(SCRIPTS)/cfw_install_host.sh" --variant $(if $(VARIANT),$(VARIANT),exp) "$(VM_DIR_ABS)"

README.md

@@ -115,7 +115,7 @@ git clone --recurse-submodules https://github.com/Lakr233/vphone-cli.git
 ## Quick Start
 
 ```bash
-make setup_machine            # full automation through "First Boot" (includes restore/ramdisk/CFW)
+make setup_machine            # full automation through "First Boot" (includes restore/CFW)
 # options: NON_INTERACTIVE=1 SUDO_PASSWORD=...
 # LESS=1 for patchless variant (- AMFI, SSV, Img4, TXM bypasses) 
 # DEV=1 for dev variant (+ TXM entitlement/debug bypasses)
@@ -182,37 +182,23 @@ make restore                  # flash firmware via pymobiledevice3 restore backe
 
 ## Install Custom Firmware
 
-Stop the DFU boot in terminal 1 (Ctrl+C), then boot into DFU again for the ramdisk:
+Once the restore completes, stop the DFU boot in terminal 1 (Ctrl+C) so the VM is
+fully powered off. The installer mounts the VM's `Disk.img` on the host, places
+all CFW files, and flips the boot snapshot offline — no DFU, ramdisk, or SSH — so
+it needs exclusive access to the disk.
 
 ```bash
-# terminal 1
-make boot_dfu                 # keep running
-```
-
-```bash
-# terminal 2
-sudo make ramdisk_build       # build signed SSH ramdisk
-make ramdisk_send             # send to device
-```
-
-Once the ramdisk is running (you should see `Running server` in the output), open a **third terminal** for the usbmux tunnel, then install CFW from terminal 2:
-
-```bash
-# terminal 3 — keep running
-python3 -m pymobiledevice3 usbmux forward 2222 22
-```
-
-```bash
-# terminal 2
+# terminal 2 (re-execs under sudo automatically)
 make cfw_install
+# or: make cfw_install_dev       # development variant
 # or: make cfw_install_jb        # jailbreak variant
 # or: make cfw_install_exp       # experimental variant (JB + research stack)
 # or: SPOOF_BUILD=23F77 make cfw_install_exp   # additionally rewrite ProductBuildVersion
 ```
 
 ## First Boot
 
-Stop the DFU boot in terminal 1 (Ctrl+C), then:
+With the DFU boot stopped and CFW installed, boot the VM normally:
 
 ```bash
 make boot

docs/README_ja.md

@@ -103,7 +103,7 @@ git clone --recurse-submodules https://github.com/Lakr233/vphone-cli.git
 ## クイックスタート
 
 ```bash
-make setup_machine            # 初回起動までを完全自動化（復元/ラムディスク/CFWを含む）
+make setup_machine            # 初回起動までを完全自動化（復元/CFWを含む）
 # オプション：NON_INTERACTIVE=1 SUDO_PASSWORD=...
 # LESS=1 で patchless バリアント（- AMFI, SSV, Img4, TXM バイパス）
 # DEV=1 で開発バリアント（+ TXM entitlement/デバッグバイパス）
@@ -170,37 +170,20 @@ make restore                  # pymobiledevice3 restore バックエンドでフ
 
 ## カスタムファームウェアのインストール
 
-ターミナル 1 の DFU 起動を停止し（Ctrl+C）、Ramdisk 用に再び DFU で起動します：
+復元が完了したら、ターミナル 1 の DFU 起動を停止（Ctrl+C）して VM を完全に電源オフにします。インストーラは VM の `Disk.img` をホスト側でマウントし、すべての CFW ファイルを配置してブートスナップショットをオフラインで切り替えます（DFU / Ramdisk / SSH は不要）。そのためディスクへの排他アクセスが必要です。
 
 ```bash
-# ターミナル 1
-make boot_dfu                 # 実行したままにする
-```
-
-```bash
-# ターミナル 2
-sudo make ramdisk_build       # 署名済みSSH Ramdisk のビルド
-make ramdisk_send             # デバイスへ送信
-```
-
-Ramdisk が起動したら（出力に `Running server` と表示されるはずです）、usbmux トンネル用に **3つ目のターミナル** を開き、ターミナル 2 から CFW をインストールします：
-
-```bash
-# ターミナル 3 — 実行したままにする
-python3 -m pymobiledevice3 usbmux forward 2222 22
-```
-
-```bash
-# ターミナル 2
+# ターミナル 2（自動的に sudo で再実行されます）
 make cfw_install
+# または: make cfw_install_dev       # 開発バリアント
 # または: make cfw_install_jb        # 脱獄バリアント
 # または: make cfw_install_exp       # 実験バリアント（脱獄 + リサーチパッチスタック）
 # または: SPOOF_BUILD=23F77 make cfw_install_exp   # ProductBuildVersion も書き換え
 ```
 
 ## 初回起動
 
-ターミナル 1 の DFU 起動を停止し（Ctrl+C）、以下を実行します：
+DFU 起動を停止し CFW をインストールしたら、VM を通常起動します：
 
 ```bash
 make boot

docs/README_ko.md

@@ -103,7 +103,7 @@ git clone --recurse-submodules https://github.com/Lakr233/vphone-cli.git
 ## 빠른 시작
 
 ```bash
-make setup_machine            # "First Boot"까지의 전체 과정 자동화 (복원/Ramdisk/커스텀 펌웨어 포함)
+make setup_machine            # "First Boot"까지의 전체 과정 자동화 (복원/커스텀 펌웨어 포함)
 # 옵션: NON_INTERACTIVE=1 SUDO_PASSWORD=...
 # LESS=1 Patchless 변형 (- AMFI, SSV, Img4, TXM 우회)
 # DEV=1 개발 변형 (+ TXM 권한/디버그 우회)
@@ -170,37 +170,20 @@ make restore                  # pymobiledevice3 restore 백엔드로 펌웨어 
 
 ## 커스텀 펌웨어 설치
 
-터미널 1의 DFU 부팅을 중단(Ctrl+C)한 다음, 램디스크를 위해 다시 DFU로 부팅합니다:
+복원이 완료되면 터미널 1의 DFU 부팅을 중단(Ctrl+C)하여 VM을 완전히 종료합니다. 설치 프로그램은 VM의 `Disk.img`를 호스트에 마운트하여 모든 CFW 파일을 배치하고 부팅 스냅샷을 오프라인으로 전환합니다(DFU / 램디스크 / SSH 불필요). 따라서 디스크에 대한 독점 액세스가 필요합니다.
 
 ```bash
-# 터미널 1
-make boot_dfu                 # 계속 실행 유지
-```
-
-```bash
-# 터미널 2
-sudo make ramdisk_build       # 서명된 SSH 램디스크 빌드
-make ramdisk_send             # 장치로 전송
-```
-
-램디스크가 실행되면(출력에 `Running server`가 표시됨), **세 번째 터미널**을 열어 usbmux 터널을 시작한 후, 터미널 2에서 커스텀 펌웨어를 설치합니다:
-
-```bash
-# 터미널 3 — 계속 실행 유지
-python3 -m pymobiledevice3 usbmux forward 2222 22
-```
-
-```bash
-# 터미널 2
+# 터미널 2 (자동으로 sudo로 재실행됨)
 make cfw_install
+# 또는: make cfw_install_dev       # 개발 변형
 # 또는: make cfw_install_jb        # 탈옥 변형
 # 또는: make cfw_install_exp       # 실험 변형 (탈옥 + 연구 패치 스택)
 # 또는: SPOOF_BUILD=23F77 make cfw_install_exp   # 추가로 ProductBuildVersion 재작성
 ```
 
 ## 첫 부팅
 
-터미널 1의 DFU 부팅을 중단(Ctrl+C)한 후 다음을 실행합니다:
+DFU 부팅을 중단하고 CFW를 설치한 후, VM을 정상 부팅합니다:
 
 ```bash
 make boot

docs/README_zh.md

@@ -103,7 +103,7 @@ git clone --recurse-submodules https://github.com/Lakr233/vphone-cli.git
 ## 快速开始
 
 ```bash
-make setup_machine            # 完全自动化完成"首次启动"流程（包含 restore/ramdisk/CFW）
+make setup_machine            # 完全自动化完成"首次启动"流程（包含 restore/CFW）
 # 选项：NON_INTERACTIVE=1 SUDO_PASSWORD=...
 # LESS=1 patchless 变体（- AMFI、SSV、Img4、TXM 绕过）
 # DEV=1 开发变体（+ TXM 权限/调试绕过）
@@ -170,37 +170,20 @@ make restore                  # 通过 pymobiledevice3 restore 后端刷写固
 
 ## 安装自定义固件
 
-在终端 1 中停止 DFU 引导（Ctrl+C），然后再次进入 DFU，用于 ramdisk：
+恢复完成后，在终端 1 中停止 DFU 引导（Ctrl+C），使 VM 完全关机。安装程序会在主机上挂载 VM 的 `Disk.img`，放置所有 CFW 文件，并离线切换启动快照（无需 DFU / ramdisk / SSH），因此需要对磁盘的独占访问。
 
 ```bash
-# 终端 1
-make boot_dfu                 # 保持运行
-```
-
-```bash
-# 终端 2
-sudo make ramdisk_build       # 构建签名的 SSH ramdisk
-make ramdisk_send             # 发送到设备
-```
-
-当 ramdisk 运行后（输出中应显示 `Running server`），打开**第三个终端**运行 usbmux 隧道，然后在终端 2 安装 CFW：
-
-```bash
-# 终端 3 —— 保持运行
-python3 -m pymobiledevice3 usbmux forward 2222 22
-```
-
-```bash
-# 终端 2
+# 终端 2（会自动通过 sudo 重新执行）
 make cfw_install
+# 或：make cfw_install_dev       # 开发变体
 # 或：make cfw_install_jb        # 越狱变体
 # 或：make cfw_install_exp       # 实验变体（越狱 + 研究补丁栈）
 # 或：SPOOF_BUILD=23F77 make cfw_install_exp   # 同时改写 ProductBuildVersion
 ```
 
 ## 首次启动
 
-在终端 1 中停止 DFU 引导（Ctrl+C），然后：
+停止 DFU 引导并完成 CFW 安装后，正常启动 VM：
 
 ```bash
 make boot