@clawos-dev/clawd 0.2.424 → 0.2.425

package/dist/cli.cjs

@@ -5974,7 +5974,7 @@ var init_contact_remote_access = __esm({
 });
 
 // ../protocol/src/contact.ts
-var ContactSchema, ContactWireSchema, ContactRemoveArgsSchema, ContactRemoveOkSchema, ContactListOkSchema, ContactAddedFrameSchema, ContactRemovedFrameSchema, ContactPinArgsSchema, ContactPinOkSchema, ContactPinnedFrameSchema;
+var ContactSchema, ContactWireSchema, ContactRemoveArgsSchema, ContactRemoveOkSchema, ContactListOkSchema, ContactAddedFrameSchema, ContactRemovedFrameSchema, ContactPinArgsSchema, ContactSetNoteArgsSchema, ContactSetNoteOkSchema, ContactPinOkSchema, ContactPinnedFrameSchema;
 var init_contact = __esm({
   "../protocol/src/contact.ts"() {
     "use strict";
@@ -6015,7 +6015,17 @@ var init_contact = __esm({
        * 跨设备 exec 的总开关（peerExec:run handler 运行时判它）。default=false，owner 显式开。
        * 授权粒度 per-people (per-contact)：借用别人 persona 本来就带信任对方本人的前提。
        */
-      remoteAccessAllowed: external_exports.boolean().default(false)
+      remoteAccessAllowed: external_exports.boolean().default(false),
+      /**
+       * owner 给这台设备写的备注（2026-08-31）。**我对他那台机器的私记**，不上行、不同步给对方。
+       *
+       * 动机：一人多设备时卡片里只能显示 deviceId（`owner-8bf96a56-6b7e-…` 这种 uuid），
+       * 认不出哪台是哪台。备注让用户能写「老王的 MacBook」。
+       *
+       * 空串 = 没写。default('') 兼容老 contacts.json（无破坏性升级，不 orphan）。
+       * 跟 pinnedAt / remoteAccessAllowed 同类：owner 已配置状态，重复建联 upsert 必须保留。
+       */
+      note: external_exports.string().default("")
     }).strict();
     ContactWireSchema = ContactSchema;
     ContactRemoveArgsSchema = external_exports.object({
@@ -6041,6 +6051,16 @@ var init_contact = __esm({
       deviceId: external_exports.string().min(1),
       pinned: external_exports.boolean()
     }).strict();
+    ContactSetNoteArgsSchema = external_exports.object({
+      deviceId: external_exports.string().min(1),
+      /** 空串 = 清空备注 */
+      note: external_exports.string()
+    }).strict();
+    ContactSetNoteOkSchema = external_exports.object({
+      type: external_exports.literal("contact:setNote:ok"),
+      deviceId: external_exports.string().min(1),
+      note: external_exports.string()
+    }).strict();
     ContactPinOkSchema = external_exports.object({
       type: external_exports.literal("contact:pin:ok"),
       deviceId: external_exports.string().min(1),
@@ -8805,6 +8825,10 @@ var init_methods = __esm({
         summary: "\u7F6E\u9876 / \u53D6\u6D88\u7F6E\u9876\u8054\u7CFB\u4EBA",
         args: ContactPinArgsSchema
       },
+      "contact:setNote": {
+        summary: "\u7ED9\u8054\u7CFB\u4EBA\uFF08\u5BF9\u65B9\u8BBE\u5907\uFF09\u5199\u5907\u6CE8\u3002owner \u672C\u5730\u79C1\u8BB0\uFF0C\u4E0D\u540C\u6B65\u7ED9\u5BF9\u65B9\uFF1B\u4E00\u4EBA\u591A\u8BBE\u5907\u65F6\u7528\u6765\u533A\u5206\u54EA\u53F0\u662F\u54EA\u53F0",
+        args: ContactSetNoteArgsSchema
+      },
       "contact:remove": {
         summary: "\u5220\u9664\u8054\u7CFB\u4EBA\u5E76\u6E05\u6389\u5BF9\u5E94\u7684 inbox \u961F\u5217",
         args: ContactRemoveArgsSchema
@@ -57412,6 +57436,18 @@ var ContactStore = class {
     this.flush();
     return true;
   }
+  /**
+   * 更新单条 contact 的备注（2026-08-31，对齐 setPin pattern）。
+   * @param note 空串 = 清空备注
+   * @returns 是否命中：deviceId 不存在返 false；命中即 flush.
+   */
+  setNote(deviceId, note) {
+    const existing = this.contacts.get(deviceId);
+    if (!existing) return false;
+    this.contacts.set(deviceId, { ...existing, note });
+    this.flush();
+    return true;
+  }
   flush() {
     const file = path45.join(this.dataDir, FILE_NAME);
     const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
@@ -59751,6 +59787,11 @@ var LoginFlow = class {
       ttcTokenExpiresAt: Number.isFinite(expiresAtNum) ? expiresAtNum : null,
       loginAt: new Date(now).toISOString()
     });
+    void this.deps.syncOrgMesh?.().catch((err) => {
+      this.deps.logWarn?.("org-mesh: \u767B\u5F55\u540E\u540C\u6B65\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD\u767B\u5F55\uFF09", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    });
     return { ok: true, identity };
   }
   gcExpired(now) {
@@ -59974,6 +60015,219 @@ async function upsertDeviceBinding(opts) {
   }
 }
 
+// src/contact/org-mesh.ts
+var OrgMeshClientError = class extends Error {
+  constructor(code, message, cause) {
+    super(message);
+    this.code = code;
+    this.cause = cause;
+    this.name = "OrgMeshClientError";
+  }
+  code;
+  cause;
+};
+var DEFAULT_TIMEOUT_MS4 = 8e3;
+async function fetchOrgPeers(opts) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS4);
+  let res;
+  try {
+    res = await doFetch(`${opts.apiUrl}/api/device-bindings/org-peers`, {
+      method: "GET",
+      signal: ac.signal,
+      headers: {
+        authorization: `Bearer ${opts.apiKey}`,
+        "x-did": encodeURIComponent(opts.deviceId),
+        "x-name": encodeURIComponent(opts.displayName),
+        "x-scene": "daemon"
+      }
+    });
+  } catch (err) {
+    throw new OrgMeshClientError("NETWORK", `network error: ${err.message}`, err);
+  } finally {
+    clearTimeout(timer);
+  }
+  if (!res.ok) {
+    let detail = "";
+    try {
+      detail = JSON.stringify(await res.json());
+    } catch {
+    }
+    throw new OrgMeshClientError("API_ERROR", `org-peers failed: ${res.status} ${detail}`);
+  }
+  const body = await res.json();
+  return body.items ?? [];
+}
+async function syncOrgMesh(deps) {
+  const peers = await deps.fetchPeers();
+  if (peers.length === 0) {
+    deps.log("org-mesh: \u4E0D\u5728\u4EFB\u4F55\u7EC4\u7EC7\uFF08\u6216\u7EC4\u91CC\u53EA\u6709\u81EA\u5DF1\uFF09\uFF0C\u8DF3\u8FC7");
+    return { peers: 0, attempted: 0, connected: 0, failed: 0 };
+  }
+  const targets = [];
+  for (const p2 of peers) {
+    for (const d of p2.devices) {
+      if (deps.store.get(d.deviceId)) continue;
+      targets.push({ deviceId: d.deviceId, displayName: p2.displayName });
+    }
+  }
+  deps.log("org-mesh: \u5F00\u59CB\u540C\u6B65", { peers: peers.length, targets: targets.length });
+  let connected = 0;
+  let failed = 0;
+  for (const t of targets) {
+    try {
+      await deps.connectToDevice({ deviceId: t.deviceId, name: t.displayName });
+      connected += 1;
+      deps.log("org-mesh: \u5DF2\u5EFA\u8054", { deviceId: t.deviceId, name: t.displayName });
+    } catch (e) {
+      failed += 1;
+      deps.log("org-mesh: \u5EFA\u8054\u5931\u8D25\uFF0C\u8DF3\u8FC7", {
+        deviceId: t.deviceId,
+        name: t.displayName,
+        reason: e.message
+      });
+    }
+  }
+  deps.log("org-mesh: \u540C\u6B65\u5B8C\u6210", { peers: peers.length, attempted: targets.length, connected, failed });
+  return { peers: peers.length, attempted: targets.length, connected, failed };
+}
+
+// src/handlers/device.ts
+init_protocol();
+function ensureOwner(ctx) {
+  if (!ctx || ctx.principal.kind !== "owner") {
+    throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "UNAUTHORIZED: device:* requires owner ctx");
+  }
+}
+function rethrowLoginExpired(e) {
+  if (e instanceof CentralClientError && e.code === "UNAUTHORIZED") {
+    throw new ClawdError(
+      ERROR_CODES.VALIDATION_ERROR,
+      `${LOGIN_EXPIRED_ERROR_MARKER}: \u767B\u5F55\u51ED\u8BC1\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55`
+    );
+  }
+  throw e;
+}
+function createConnectToDevice(deps) {
+  const now = deps.now ?? Date.now;
+  return async (args) => {
+    const selfUrl = deps.selfUrl();
+    if (!selfUrl) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        "TUNNEL_REQUIRED: \u672C\u673A\u672A\u5F00 tunnel\uFF0C\u5F00\u542F\u540E\u91CD\u8BD5"
+      );
+    }
+    const exchanged = await deps.exchange(args.deviceId).catch(rethrowLoginExpired);
+    const url = args.url ?? exchanged.deviceUrl;
+    if (!url) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        "DEVICE_URL_UNKNOWN: \u5BF9\u65B9\u8BBE\u5907\u672A\u4E0A\u62A5\u5730\u5740\uFF08\u672A\u767B\u5F55\u6216\u672A\u5F00 tunnel\uFF09\uFF0C\u8BF7\u663E\u5F0F\u63D0\u4F9B url \u6216\u7B49\u5BF9\u65B9\u4E0A\u7EBF"
+      );
+    }
+    let conn;
+    try {
+      conn = await deps.connectRemote({ url, token: exchanged.token });
+    } catch (e) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        `DEVICE_UNREACHABLE: ${e.message}`
+      );
+    }
+    try {
+      let hs;
+      try {
+        hs = await conn.handshake(selfUrl);
+      } catch (e) {
+        const msg = e.message;
+        if (/unknown method|METHOD_NOT_ALLOWED/i.test(msg)) {
+          throw new ClawdError(
+            ERROR_CODES.VALIDATION_ERROR,
+            "REVERSE_UNSUPPORTED: \u5BF9\u65B9 clawd \u7248\u672C\u8FC7\u65E7\uFF0C\u8BF7\u8BA9\u5BF9\u65B9\u5347\u7EA7\u540E\u91CD\u8BD5"
+          );
+        }
+        if (msg.includes(PEER_LOGIN_EXPIRED_ERROR_MARKER)) {
+          throw new ClawdError(
+            ERROR_CODES.VALIDATION_ERROR,
+            `${PEER_LOGIN_EXPIRED_ERROR_MARKER}: \u5BF9\u65B9\u8BBE\u5907\u767B\u5F55\u5DF2\u8FC7\u671F\u6216\u672A\u767B\u5F55\uFF0C\u8BF7\u5BF9\u65B9\u5728 clawd \u91CD\u65B0\u767B\u5F55\u540E\u518D\u8BD5`
+          );
+        }
+        throw e;
+      }
+      const existing = deps.store.get(args.deviceId) ?? void 0;
+      const contact = {
+        deviceId: args.deviceId,
+        ownerId: hs.ownerId,
+        provider: hs.provider,
+        // 显示名优先用调用方传的 name：公共目录点击连接带 clawd_devices.name（对外展示名，
+        // 如"公共1"）；"输入标识"连接不带 name → 回落 handshake 报的对方 owner 真名。
+        // 归属人身份不丢（ownerId/provider 仍来自 handshake 背书）。
+        displayName: args.name || hs.displayName || args.deviceId,
+        remoteUrl: url,
+        // connectToken 存自包含签名 token（断线重连复用，30 天有效；
+        // 过期后对方拒 TOKEN_EXPIRED → 重新 device:connect 换新票）
+        connectToken: exchanged.token,
+        grants: hs.grants,
+        addedAt: now(),
+        pinnedAt: existing?.pinnedAt ?? null,
+        remoteAccessAllowed: existing?.remoteAccessAllowed ?? false,
+        // 备注是 owner 已配置状态，重复建联 upsert 必须保留（同 pinnedAt / remoteAccessAllowed）
+        note: existing?.note ?? ""
+      };
+      deps.store.upsert(contact);
+      deps.broadcast({ type: "contact:added", contact });
+      return contact;
+    } finally {
+      try {
+        conn.close();
+      } catch {
+      }
+    }
+  };
+}
+function buildDeviceHandlers(deps) {
+  const connectToDevice = createConnectToDevice(deps);
+  const list = async (_frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const devices = await deps.listDevices().catch(rethrowLoginExpired);
+    return {
+      response: { type: "device:list:ok", devices }
+    };
+  };
+  const connect = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = DeviceConnectArgsSchema.parse(rest);
+    const contact = await connectToDevice(args);
+    return {
+      response: {
+        type: "device:connect:ok",
+        // 返回连接的设备标识（= 请求的 args.deviceId）
+        deviceId: args.deviceId,
+        name: contact.displayName,
+        url: contact.remoteUrl
+      }
+    };
+  };
+  const connections = async (_frame, client, ctx) => {
+    ensureOwner(ctx);
+    const entries = deps.listOwnerConnections();
+    return {
+      response: {
+        type: "device:connections:ok",
+        connections: entries.map((e) => ({ ...e, self: e.clientId === client.id }))
+      }
+    };
+  };
+  return {
+    "device:list": list,
+    "device:connect": connect,
+    "device:connections": connections
+  };
+}
+
 // src/feishu-auth/verify-token.ts
 var crypto11 = __toESM(require("crypto"), 1);
 var CONNECT_TOKEN_PREFIX = "clawdtk1";
@@ -61655,7 +61909,9 @@ function upsertPeerContact(args) {
     grants,
     addedAt: now(),
     pinnedAt: existing?.pinnedAt ?? null,
-    remoteAccessAllowed: existing?.remoteAccessAllowed ?? false
+    remoteAccessAllowed: existing?.remoteAccessAllowed ?? false,
+    // 备注是 owner 已配置状态，重复建联 upsert 必须保留（同 pinnedAt / remoteAccessAllowed）
+    note: existing?.note ?? ""
   };
   args.store.upsert(base);
   args.broadcast({ type: "contact:added", contact: base });
@@ -61663,7 +61919,7 @@ function upsertPeerContact(args) {
 }
 
 // src/handlers/contact.ts
-function ensureOwner(ctx) {
+function ensureOwner2(ctx) {
   if (!ctx || ctx.principal.kind !== "owner") {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
@@ -61673,7 +61929,7 @@ function ensureOwner(ctx) {
 }
 function buildContactHandlers(deps) {
   const list = async (_frame, _client, ctx) => {
-    ensureOwner(ctx);
+    ensureOwner2(ctx);
     return {
       response: {
         type: "contact:list:ok",
@@ -61682,7 +61938,7 @@ function buildContactHandlers(deps) {
     };
   };
   const pin = async (frame, _client, ctx) => {
-    ensureOwner(ctx);
+    ensureOwner2(ctx);
     const args = parseArgs2(ContactPinArgsSchema, frame, "contact:pin");
     const pinnedAt = args.pinned ? deps.now() : null;
     const hit = deps.store.setPin(args.deviceId, pinnedAt);
@@ -61705,8 +61961,31 @@ function buildContactHandlers(deps) {
       }
     };
   };
+  const setNote = async (frame, _client, ctx) => {
+    ensureOwner2(ctx);
+    const args = parseArgs2(ContactSetNoteArgsSchema, frame, "contact:setNote");
+    const hit = deps.store.setNote(args.deviceId, args.note);
+    if (!hit) {
+      throw new ClawdError(
+        ERROR_CODES.CONTACT_NOT_FOUND,
+        `CONTACT_NOT_FOUND: contact ${args.deviceId} not in store`
+      );
+    }
+    deps.broadcast({
+      type: "contact:note-updated",
+      deviceId: args.deviceId,
+      note: args.note
+    });
+    return {
+      response: {
+        type: "contact:setNote:ok",
+        deviceId: args.deviceId,
+        note: args.note
+      }
+    };
+  };
   const remove = async (frame, _client, ctx) => {
-    ensureOwner(ctx);
+    ensureOwner2(ctx);
     const args = parseArgs2(ContactRemoveArgsSchema, frame, "contact:remove");
     deps.store.removeByDeviceId(args.deviceId);
     deps.broadcast({
@@ -61771,6 +62050,7 @@ function buildContactHandlers(deps) {
   return {
     "contact:list": list,
     "contact:pin": pin,
+    "contact:setNote": setNote,
     "contact:remove": remove,
     "contact:handshake": handshake
   };
@@ -61778,7 +62058,7 @@ function buildContactHandlers(deps) {
 
 // src/handlers/contact-remote-access.ts
 init_protocol();
-function ensureOwner2(ctx) {
+function ensureOwner3(ctx) {
   if (!ctx || ctx.principal.kind !== "owner") {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
@@ -61788,7 +62068,7 @@ function ensureOwner2(ctx) {
 }
 function buildContactRemoteAccessHandlers(deps) {
   const setRemoteAccess = async (frame, _client, ctx) => {
-    ensureOwner2(ctx);
+    ensureOwner3(ctx);
     const args = parseArgs2(ContactSetRemoteAccessArgsSchema, frame, "contact:setRemoteAccess");
     const hit = deps.store.setRemoteAccess(args.deviceId, {
       remoteAccessAllowed: args.remoteAccessAllowed
@@ -61921,132 +62201,6 @@ function buildFeishuAuthHandlers(deps) {
   };
 }
 
-// src/handlers/device.ts
-init_protocol();
-function ensureOwner3(ctx) {
-  if (!ctx || ctx.principal.kind !== "owner") {
-    throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "UNAUTHORIZED: device:* requires owner ctx");
-  }
-}
-function rethrowLoginExpired(e) {
-  if (e instanceof CentralClientError && e.code === "UNAUTHORIZED") {
-    throw new ClawdError(
-      ERROR_CODES.VALIDATION_ERROR,
-      `${LOGIN_EXPIRED_ERROR_MARKER}: \u767B\u5F55\u51ED\u8BC1\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55`
-    );
-  }
-  throw e;
-}
-function buildDeviceHandlers(deps) {
-  const now = deps.now ?? Date.now;
-  const list = async (_frame, _client, ctx) => {
-    ensureOwner3(ctx);
-    const devices = await deps.listDevices().catch(rethrowLoginExpired);
-    return {
-      response: { type: "device:list:ok", devices }
-    };
-  };
-  const connect = async (frame, _client, ctx) => {
-    ensureOwner3(ctx);
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = DeviceConnectArgsSchema.parse(rest);
-    const selfUrl = deps.selfUrl();
-    if (!selfUrl) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        "TUNNEL_REQUIRED: \u672C\u673A\u672A\u5F00 tunnel\uFF0C\u5F00\u542F\u540E\u91CD\u8BD5"
-      );
-    }
-    const exchanged = await deps.exchange(args.deviceId).catch(rethrowLoginExpired);
-    const url = args.url ?? exchanged.deviceUrl;
-    if (!url) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        "DEVICE_URL_UNKNOWN: \u5BF9\u65B9\u8BBE\u5907\u672A\u4E0A\u62A5\u5730\u5740\uFF08\u672A\u767B\u5F55\u6216\u672A\u5F00 tunnel\uFF09\uFF0C\u8BF7\u663E\u5F0F\u63D0\u4F9B url \u6216\u7B49\u5BF9\u65B9\u4E0A\u7EBF"
-      );
-    }
-    let conn;
-    try {
-      conn = await deps.connectRemote({ url, token: exchanged.token });
-    } catch (e) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `DEVICE_UNREACHABLE: ${e.message}`
-      );
-    }
-    try {
-      let hs;
-      try {
-        hs = await conn.handshake(selfUrl);
-      } catch (e) {
-        const msg = e.message;
-        if (/unknown method|METHOD_NOT_ALLOWED/i.test(msg)) {
-          throw new ClawdError(
-            ERROR_CODES.VALIDATION_ERROR,
-            "REVERSE_UNSUPPORTED: \u5BF9\u65B9 clawd \u7248\u672C\u8FC7\u65E7\uFF0C\u8BF7\u8BA9\u5BF9\u65B9\u5347\u7EA7\u540E\u91CD\u8BD5"
-          );
-        }
-        if (msg.includes(PEER_LOGIN_EXPIRED_ERROR_MARKER)) {
-          throw new ClawdError(
-            ERROR_CODES.VALIDATION_ERROR,
-            `${PEER_LOGIN_EXPIRED_ERROR_MARKER}: \u5BF9\u65B9\u8BBE\u5907\u767B\u5F55\u5DF2\u8FC7\u671F\u6216\u672A\u767B\u5F55\uFF0C\u8BF7\u5BF9\u65B9\u5728 clawd \u91CD\u65B0\u767B\u5F55\u540E\u518D\u8BD5`
-          );
-        }
-        throw e;
-      }
-      const existing = deps.store.get(args.deviceId) ?? void 0;
-      const contact = {
-        deviceId: args.deviceId,
-        ownerId: hs.ownerId,
-        provider: hs.provider,
-        // 显示名优先用调用方传的 name：公共目录点击连接带 clawd_devices.name（对外展示名，
-        // 如"公共1"）；"输入标识"连接不带 name → 回落 handshake 报的对方 owner 真名。
-        // 归属人身份不丢（ownerId/provider 仍来自 handshake 背书）。
-        displayName: args.name || hs.displayName || args.deviceId,
-        remoteUrl: url,
-        // connectToken 存自包含签名 token（断线重连复用，30 天有效；
-        // 过期后对方拒 TOKEN_EXPIRED → 重新 device:connect 换新票）
-        connectToken: exchanged.token,
-        grants: hs.grants,
-        addedAt: now(),
-        pinnedAt: existing?.pinnedAt ?? null,
-        remoteAccessAllowed: existing?.remoteAccessAllowed ?? false
-      };
-      deps.store.upsert(contact);
-      deps.broadcast({ type: "contact:added", contact });
-      return {
-        response: {
-          type: "device:connect:ok",
-          // 返回连接的设备标识（= 请求的 args.deviceId）
-          deviceId: args.deviceId,
-          name: contact.displayName,
-          url
-        }
-      };
-    } finally {
-      try {
-        conn.close();
-      } catch {
-      }
-    }
-  };
-  const connections = async (_frame, client, ctx) => {
-    ensureOwner3(ctx);
-    const entries = deps.listOwnerConnections();
-    return {
-      response: {
-        type: "device:connections:ok",
-        connections: entries.map((e) => ({ ...e, self: e.clientId === client.id }))
-      }
-    };
-  };
-  return {
-    "device:list": list,
-    "device:connect": connect,
-    "device:connections": connections
-  };
-}
-
 // src/handlers/meta.ts
 var import_node_os19 = __toESM(require("os"), 1);
 init_protocol();
@@ -62081,6 +62235,7 @@ var METHOD_GRANT_MAP = {
   // 写入路径在 device:connect / 自动反向；list / remove 作联系人读 / 删，owner-only。
   "contact:list": ADMIN_ANY,
   "contact:pin": ADMIN_ANY,
+  "contact:setNote": ADMIN_ANY,
   "contact:remove": ADMIN_ANY,
   // contact:setRemoteAccess (owner UI 配远程访问授权)：ADMIN_ANY
   //   (对齐 inbox:postMessage 的"能连上=有 auth，业务在 handler 校"模式)
@@ -62330,7 +62485,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.424".length > 0 ? "0.2.424" : "dev";
+var version = "0.2.425".length > 0 ? "0.2.425" : "dev";
 
 // src/cli-probe/probe.ts
 var fs65 = __toESM(require("fs"), 1);
@@ -65168,11 +65323,11 @@ init_protocol();
 // src/peer-ops/run-command.ts
 var import_node_child_process18 = require("child_process");
 var import_node_os23 = __toESM(require("os"), 1);
-var DEFAULT_TIMEOUT_MS4 = 3e4;
+var DEFAULT_TIMEOUT_MS5 = 3e4;
 var MAX_TIMEOUT_MS = 3e5;
 var MAX_OUTPUT_BYTES = 1048576;
 function runCommand(command, opts = {}) {
-  const timeoutMs = Math.min(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS4, MAX_TIMEOUT_MS);
+  const timeoutMs = Math.min(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS5, MAX_TIMEOUT_MS);
   return new Promise((resolve9) => {
     const child = (0, import_node_child_process18.spawn)("bash", ["-c", command], { cwd: import_node_os23.default.homedir() });
     const out = [];
@@ -65476,11 +65631,11 @@ var IosInterestClientError = class extends Error {
   code;
   cause;
 };
-var DEFAULT_TIMEOUT_MS5 = 8e3;
+var DEFAULT_TIMEOUT_MS6 = 8e3;
 async function submitIosInterest(opts) {
   const doFetch = opts.fetchImpl ?? fetch;
   const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS5);
+  const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS6);
   let res;
   try {
     res = await doFetch(`${opts.apiUrl}/api/ios-interest`, {
@@ -66831,6 +66986,41 @@ async function startDaemon(config) {
   const publishedChannelStore = new PublishedChannelStore(publishedChannelsFile());
   await publishedChannelStore.load();
   const bundleCache = new BundleCache(bundleCacheRoot());
+  const feishuDeviceDeps = {
+    store: contactStore,
+    exchange: async (deviceId) => {
+      const record3 = ownerIdentityStore.read();
+      if (!record3) {
+        throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "device:connect requires feishu login");
+      }
+      return centralExchange({
+        api: config.clawosApi ?? DEFAULT_CLAWOS_API,
+        jwt: record3.ttcToken,
+        provider: record3.identity.provider,
+        deviceId,
+        selfDeviceId: authFile.deviceId
+      });
+    },
+    listDevices: async () => {
+      const record3 = ownerIdentityStore.read();
+      if (!record3) {
+        throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "device:list requires feishu login");
+      }
+      return centralListDevices({
+        api: config.clawosApi ?? DEFAULT_CLAWOS_API,
+        ttcJwt: record3.ttcToken,
+        provider: record3.identity.provider
+      });
+    },
+    connectRemote,
+    broadcast: (frame) => wsServer?.broadcastToOwners(frame),
+    // 自动反向（spec 决策 #11）：本机可达地址 = tunnel URL（公网），出站连接时
+    // 透传让对方反向加我为联系人。无 tunnel（仅本机 ws）→ null，对方不自动反向（不造假数据）。
+    // 决策 #16：身份不自报——本机 deviceId/ownerId/provider 由 exchange 签进 token 背书。
+    selfUrl: () => currentTunnelUrl,
+    // device:connections 数据源。惰性闭包：wsServer 晚于本 deps 赋值，请求时才解引用。
+    listOwnerConnections: () => wsServer?.listOwnerConnections() ?? []
+  };
   const loginFlow = new LoginFlow({
     store: ownerIdentityStore,
     fetchUserInfo: (ttcToken) => fetchTtcUserInfo({ apiBase: TTC_HOSTS.api, token: ttcToken }),
@@ -66859,7 +67049,23 @@ async function startDaemon(config) {
         });
         throw err;
       }
-    }
+    },
+    // org auto-mesh（spec 2026-08-31）：登录成功后自动跟同组织的人建联。
+    // 不进 fail-hard 链——login-flow 内部 void + catch，组网失败不拖垮登录。
+    syncOrgMesh: () => syncOrgMesh({
+      store: contactStore,
+      fetchPeers: () => fetchOrgPeers({
+        apiUrl: config.clawosApi ?? DEFAULT_CLAWOS_API,
+        apiKey: resolveClawdTicketsApiKey(),
+        deviceId: authFile.deviceId,
+        displayName: ownerIdentityStore.read()?.identity.displayName ?? authFile.deviceId
+      }),
+      connectToDevice: createConnectToDevice(feishuDeviceDeps),
+      log: (msg, meta) => logger.info(msg, meta)
+    }),
+    // 组网整体失败（拉清单挂了）的出口：走 logger 才进 SLS——
+    // "自动组网悄悄没发生"正是要靠日志排查的场景，console.warn 只有 stdout。
+    logWarn: (msg, meta) => logger.warn(msg, meta)
   });
   const visitorStore = createVisitorStore({ dir: config.dataDir });
   const exchangeVisitorToken = buildVisitorLogin({
@@ -67065,41 +67271,7 @@ async function startDaemon(config) {
       // exchange/listDevices 包掉 owner ttcJwt（每次现读 store——热切换后立即用新身份）；
       // dispatcher 的 FEISHU_GATED_METHODS gate 已保证未登录时这些 RPC 到不了 handler，
       // 这里的 FEISHU_LOGIN_REQUIRED 抛错只是防御纵深。
-      feishuDevice: {
-        store: contactStore,
-        exchange: async (deviceId) => {
-          const record3 = ownerIdentityStore.read();
-          if (!record3) {
-            throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "device:connect requires feishu login");
-          }
-          return centralExchange({
-            api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-            jwt: record3.ttcToken,
-            provider: record3.identity.provider,
-            deviceId,
-            selfDeviceId: authFile.deviceId
-          });
-        },
-        listDevices: async () => {
-          const record3 = ownerIdentityStore.read();
-          if (!record3) {
-            throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "device:list requires feishu login");
-          }
-          return centralListDevices({
-            api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-            ttcJwt: record3.ttcToken,
-            provider: record3.identity.provider
-          });
-        },
-        connectRemote,
-        broadcast: (frame) => wsServer?.broadcastToOwners(frame),
-        // 自动反向（spec 决策 #11）：本机可达地址 = tunnel URL（公网），出站连接时
-        // 透传让对方反向加我为联系人。无 tunnel（仅本机 ws）→ null，对方不自动反向（不造假数据）。
-        // 决策 #16：身份不自报——本机 deviceId/ownerId/provider 由 exchange 签进 token 背书。
-        selfUrl: () => currentTunnelUrl,
-        // device:connections 数据源。惰性闭包：wsServer 晚于本 deps 赋值，请求时才解引用。
-        listOwnerConnections: () => wsServer?.listOwnerConnections() ?? []
-      },
+      feishuDevice: feishuDeviceDeps,
       // app-builder
       appBuilderStore,
       getProjectStore,