@clawos-dev/clawd 0.2.530 → 0.2.532

package/dist/app-builder-plugin/mcp-server.cjs

@@ -21947,6 +21947,11 @@ var AuthApiKeyRegenerateResponseSchema = external_exports.object({
   createdAt: external_exports.string().min(1),
   gatewayUrl: GatewayUrl
 });
+var AuthApiKeyRevokeResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:apiKey:revoke:ok"),
+  /** 之前有没有那把——没发过也算成功（幂等） */
+  revoked: external_exports.boolean()
+});
 var AuthLoginDoneEventSchema = external_exports.object({
   type: external_exports.literal("auth:login:done"),
   identity: FeishuIdentitySchema
@@ -24494,6 +24499,10 @@ var METHOD_DOCS = {
     summary: "\u6362\u4E00\u628A\u65B0\u7684\u4E91 persona \u8C03\u7528 key\uFF0C**\u65E7\u7684\u5F53\u573A\u5931\u6548**\uFF08\u4E00\u4EBA\u4E00\u628A\uFF0C\u4E2D\u5FC3\u6309 union_id \u8986\u76D6\uFF09\u3002owner-only",
     args: NO_ARGS
   },
+  "auth:apiKey:revoke": {
+    summary: "\u64A4\u9500\u81EA\u5DF1\u7684\u4E91 persona \u8C03\u7528 key\uFF1A\u4E2D\u5FC3\u5220\u6389\u90A3\u4E00\u884C\u3001**\u4E0D\u53D1\u65B0\u7684**\u3002gateway \u53EA\u5728\u5F00\u4F1A\u8BDD\u548C\u6BCF\u6B21\u4E0A\u884C\u65F6\u9A8C key\uFF0C\u6240\u4EE5\u5F00\u7740\u7684\u4E91\u4F1A\u8BDD\u4E0B\u4E00\u6761\u6D88\u606F\u624D\u53D1\u4E0D\u51FA\u53BB\u3001\u6B63\u5728\u8DD1\u7684\u90A3\u4E00\u8F6E\u4F1A\u8DD1\u5B8C\u3002\u6CA1\u53D1\u8FC7\u4E5F\u56DE ok\uFF08revoked:false\uFF09\u3002owner-only",
+    args: NO_ARGS
+  },
   "device:list": {
     summary: "\u5217\u51FA\u516C\u5171\u8BBE\u5907\u76EE\u5F55\u91CC\u53EF\u8FDE\u63A5\u7684\u8BBE\u5907\uFF08daemon \u4EE3\u7406\u4E2D\u5FC3 server\uFF09\u3002owner-only",
     args: NO_ARGS

package/dist/cli.cjs

@@ -6431,7 +6431,7 @@ var init_contact = __esm({
 });
 
 // ../protocol/src/feishu-auth.ts
-var FEISHU_GATED_METHODS, LOGIN_EXPIRED_ERROR_MARKER, DeviceEntrySchema, DeviceListResponseSchema, DeviceConnectArgsSchema, DeviceConnectResponseSchema, FeishuIdentitySchema, AuthLoginStartResponseSchema, AuthGetIdentityResponseSchema, AuthLogoutResponseSchema, GatewayUrl, AuthApiKeyGetResponseSchema, AuthApiKeyRegenerateResponseSchema, AuthLoginDoneEventSchema, AuthLoginFailedEventSchema;
+var FEISHU_GATED_METHODS, LOGIN_EXPIRED_ERROR_MARKER, DeviceEntrySchema, DeviceListResponseSchema, DeviceConnectArgsSchema, DeviceConnectResponseSchema, FeishuIdentitySchema, AuthLoginStartResponseSchema, AuthGetIdentityResponseSchema, AuthLogoutResponseSchema, GatewayUrl, AuthApiKeyGetResponseSchema, AuthApiKeyRegenerateResponseSchema, AuthApiKeyRevokeResponseSchema, AuthLoginDoneEventSchema, AuthLoginFailedEventSchema;
 var init_feishu_auth = __esm({
   "../protocol/src/feishu-auth.ts"() {
     "use strict";
@@ -6538,6 +6538,11 @@ var init_feishu_auth = __esm({
       createdAt: external_exports.string().min(1),
       gatewayUrl: GatewayUrl
     });
+    AuthApiKeyRevokeResponseSchema = external_exports.object({
+      type: external_exports.literal("auth:apiKey:revoke:ok"),
+      /** 之前有没有那把——没发过也算成功（幂等） */
+      revoked: external_exports.boolean()
+    });
     AuthLoginDoneEventSchema = external_exports.object({
       type: external_exports.literal("auth:login:done"),
       identity: FeishuIdentitySchema
@@ -9311,6 +9316,10 @@ var init_methods = __esm({
         summary: "\u6362\u4E00\u628A\u65B0\u7684\u4E91 persona \u8C03\u7528 key\uFF0C**\u65E7\u7684\u5F53\u573A\u5931\u6548**\uFF08\u4E00\u4EBA\u4E00\u628A\uFF0C\u4E2D\u5FC3\u6309 union_id \u8986\u76D6\uFF09\u3002owner-only",
         args: NO_ARGS
       },
+      "auth:apiKey:revoke": {
+        summary: "\u64A4\u9500\u81EA\u5DF1\u7684\u4E91 persona \u8C03\u7528 key\uFF1A\u4E2D\u5FC3\u5220\u6389\u90A3\u4E00\u884C\u3001**\u4E0D\u53D1\u65B0\u7684**\u3002gateway \u53EA\u5728\u5F00\u4F1A\u8BDD\u548C\u6BCF\u6B21\u4E0A\u884C\u65F6\u9A8C key\uFF0C\u6240\u4EE5\u5F00\u7740\u7684\u4E91\u4F1A\u8BDD\u4E0B\u4E00\u6761\u6D88\u606F\u624D\u53D1\u4E0D\u51FA\u53BB\u3001\u6B63\u5728\u8DD1\u7684\u90A3\u4E00\u8F6E\u4F1A\u8DD1\u5B8C\u3002\u6CA1\u53D1\u8FC7\u4E5F\u56DE ok\uFF08revoked:false\uFF09\u3002owner-only",
+        args: NO_ARGS
+      },
       "device:list": {
         summary: "\u5217\u51FA\u516C\u5171\u8BBE\u5907\u76EE\u5F55\u91CC\u53EF\u8FDE\u63A5\u7684\u8BBE\u5907\uFF08daemon \u4EE3\u7406\u4E2D\u5FC3 server\uFF09\u3002owner-only",
         args: NO_ARGS
@@ -62214,6 +62223,16 @@ async function centralIssueApiKey(opts) {
     gatewayUrl: typeof body.gatewayUrl === "string" ? body.gatewayUrl : null
   };
 }
+async function centralRevokeApiKey(opts) {
+  const body = await centralRequest(opts, "/api/persona-cloud/api-key", {
+    method: "DELETE",
+    bearer: opts.loginPass
+  });
+  if (typeof body.revoked !== "boolean") {
+    throw new CentralClientError("BAD_RESPONSE", "api-key: revoked must be boolean");
+  }
+  return { revoked: body.revoked };
+}
 async function centralListDevices(opts) {
   const body = await centralRequest(opts, "/api/clawd-identity/devices", {
     method: "GET",
@@ -62278,6 +62297,12 @@ var GATEWAY_ROUTES = {
   thread: (threadId) => `/threads/${encodeURIComponent(threadId)}`
 };
 var trimSlash = (u2) => u2.replace(/\/+$/, "");
+var CloudApiKeyRequiredError = class extends Error {
+  constructor() {
+    super("\u8FD8\u6CA1\u751F\u6210\u4E91 persona \u7684\u8C03\u7528 key\u3002\u5230\u300C\u8BBE\u7F6E \u2192 \u8D26\u53F7\u300D\u6216\u8FD9\u4E2A persona \u7684\u5361\u7247\u4E0A\u751F\u6210\u4E00\u628A\uFF0C\u518D\u5F00\u4F1A\u8BDD");
+    this.name = "CloudApiKeyRequiredError";
+  }
+};
 var CLOUD_PERSONA_ID_SUFFIX = "-cloud";
 function cloudPersonaToFile(p3) {
   const at3 = p3.registeredAt ?? 0;
@@ -62315,7 +62340,7 @@ var CloudGatewayClient = class {
   }
   async credentials() {
     const { apiKey, gatewayUrl } = await this.locate();
-    if (!apiKey) throw new Error("\u8FD8\u6CA1\u751F\u6210\u4E91 persona \u7684\u8C03\u7528 key\uFF0C\u53BB\u300C\u8BBE\u7F6E \u2192 \u4E91\u4E0A persona\u300D\u751F\u6210\u4E00\u628A");
+    if (!apiKey) throw new CloudApiKeyRequiredError();
     return { apiKey, gatewayUrl };
   }
   async listPersonas() {
@@ -62435,7 +62460,9 @@ function openHttpLineStream(opts) {
       }
       if (!res.ok) {
         logger?.warn("cloud session send failed", { status: res.status });
-        fail(`\u4E0A\u884C\u53D1\u4E0D\u51FA\u53BB\uFF08gateway \u56DE ${res.status}\uFF09\uFF0C\u8FD9\u6761\u4F1A\u8BDD\u65AD\u4E86`);
+        fail(
+          res.status === 401 ? "\u8C03\u7528 key \u5DF2\u5931\u6548\uFF08\u64A4\u9500\u6216\u91CD\u65B0\u751F\u6210\u8FC7\uFF09\uFF0C\u8FD9\u6761\u4F1A\u8BDD\u65AD\u4E86\u3002\u5230\u300C\u8BBE\u7F6E \u2192 \u8D26\u53F7\u300D\u6216\u8FD9\u4E2A persona \u7684\u5361\u7247\u4E0A\u751F\u6210\u4E00\u628A\uFF0C\u518D\u5F00\u65B0\u4F1A\u8BDD" : `\u4E0A\u884C\u53D1\u4E0D\u51FA\u53BB\uFF08gateway \u56DE ${res.status}\uFF09\uFF0C\u8FD9\u6761\u4F1A\u8BDD\u65AD\u4E86`
+        );
       }
     }).catch((e) => {
       if (closed) return;
@@ -62726,7 +62753,7 @@ function createCloudCodexSession(ctx, sink, deps) {
       stream.attach(channel);
     },
     (e) => {
-      sink.onError(`\u8FDE\u4E0D\u4E0A\u4E91 gateway\uFF1A${e.message}`);
+      sink.onError(e instanceof CloudApiKeyRequiredError ? e.message : `\u8FDE\u4E0D\u4E0A\u4E91 gateway\uFF1A${e.message}`);
       stream.close();
     }
   );
@@ -67416,7 +67443,8 @@ function loadOrCreateAuthFile(opts) {
       token: existing.token,
       ownerPrincipalId: existing.ownerPrincipalId,
       deviceId: existing.deviceId,
-      createdAt: existing.createdAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
+      createdAt: existing.createdAt ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+      ...existing.tunnelDeviceKey ? { tunnelDeviceKey: existing.tunnelDeviceKey } : {}
     };
   }
   const token = existing?.token || generate();
@@ -67424,9 +67452,17 @@ function loadOrCreateAuthFile(opts) {
   const deviceId = ownerPrincipalId;
   const createdAt = existing?.createdAt || now().toISOString();
   const next = { token, ownerPrincipalId, deviceId, createdAt };
+  if (existing?.tunnelDeviceKey) next.tunnelDeviceKey = existing.tunnelDeviceKey;
   writeAuthFile(file, next);
   return next;
 }
+function loadOrCreateTunnelDeviceKey(opts) {
+  const current = loadOrCreateAuthFile(opts);
+  if (current.tunnelDeviceKey) return current.tunnelDeviceKey;
+  const tunnelDeviceKey = opts.derive();
+  writeAuthFile(authFilePath(opts.dataDir), { ...current, tunnelDeviceKey });
+  return tunnelDeviceKey;
+}
 function defaultGenerateToken() {
   return import_node_crypto15.default.randomBytes(32).toString("base64url");
 }
@@ -67445,6 +67481,7 @@ function readAuthFile(file) {
       ownerPrincipalId: typeof parsed.ownerPrincipalId === "string" && parsed.ownerPrincipalId.length > 0 ? parsed.ownerPrincipalId : void 0,
       deviceId: typeof parsed.deviceId === "string" && parsed.deviceId.length > 0 ? parsed.deviceId : void 0,
       createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : void 0,
+      tunnelDeviceKey: typeof parsed.tunnelDeviceKey === "string" && parsed.tunnelDeviceKey.length > 0 ? parsed.tunnelDeviceKey : void 0,
       // 单 secret 合并前的旧字段：出现即触发清理写回（值无所谓，硬切不再使用）
       hasLegacySecrets: "signSecret" in parsed || "visitorTokenSecret" in parsed
     };
@@ -67779,22 +67816,51 @@ var lastPeers = [];
 function getCachedOrgPeers() {
   return lastPeers;
 }
+function sameOrigin(a2, b3) {
+  const oa2 = toOrigin(a2);
+  const ob = toOrigin(b3);
+  return oa2 != null && ob != null ? oa2 === ob : a2 === b3;
+}
+function toOrigin(raw) {
+  const http2 = raw.replace(/^wss:\/\//i, "https://").replace(/^ws:\/\//i, "http://");
+  try {
+    const origin = new URL(http2).origin;
+    return origin === "null" ? null : origin;
+  } catch {
+    return null;
+  }
+}
 async function syncOrgMesh(deps) {
   const peers = await deps.fetchPeers();
   lastPeers = peers;
   if (peers.length === 0) {
     deps.log("org-mesh: \u4E0D\u5728\u4EFB\u4F55\u7EC4\u7EC7\uFF08\u6216\u7EC4\u91CC\u53EA\u6709\u81EA\u5DF1\uFF09\uFF0C\u8DF3\u8FC7");
     deps.onProgress?.({ total: 0, done: 0, connected: 0, failed: 0, active: false });
-    return { peers: 0, attempted: 0, connected: 0, failed: 0 };
+    return { peers: 0, attempted: 0, connected: 0, failed: 0, refreshed: 0 };
   }
   const targets = [];
+  let refreshed = 0;
   for (const p3 of peers) {
     for (const d2 of p3.devices) {
-      if (deps.store.get(d2.deviceId)) continue;
-      targets.push({ deviceId: d2.deviceId, displayName: p3.displayName });
+      const existing = deps.store.get(d2.deviceId);
+      if (!existing) {
+        targets.push({ deviceId: d2.deviceId, displayName: p3.displayName });
+        continue;
+      }
+      if (d2.url == null || sameOrigin(existing.remoteUrl, d2.url)) continue;
+      const updated = { ...existing, remoteUrl: d2.url };
+      deps.store.upsert(updated);
+      refreshed += 1;
+      deps.log("org-mesh: \u8054\u7CFB\u4EBA\u5730\u5740\u5DF2\u5237\u65B0", {
+        deviceId: d2.deviceId,
+        name: p3.displayName,
+        from: existing.remoteUrl,
+        to: d2.url
+      });
+      deps.onContactUpdated?.(updated);
     }
   }
-  deps.log("org-mesh: \u5F00\u59CB\u540C\u6B65", { peers: peers.length, targets: targets.length });
+  deps.log("org-mesh: \u5F00\u59CB\u540C\u6B65", { peers: peers.length, targets: targets.length, refreshed });
   let connected = 0;
   let failed = 0;
   deps.onProgress?.({
@@ -67825,8 +67891,14 @@ async function syncOrgMesh(deps) {
       active: connected + failed < targets.length
     });
   }
-  deps.log("org-mesh: \u540C\u6B65\u5B8C\u6210", { peers: peers.length, attempted: targets.length, connected, failed });
-  return { peers: peers.length, attempted: targets.length, connected, failed };
+  deps.log("org-mesh: \u540C\u6B65\u5B8C\u6210", {
+    peers: peers.length,
+    attempted: targets.length,
+    connected,
+    failed,
+    refreshed
+  });
+  return { peers: peers.length, attempted: targets.length, connected, failed, refreshed };
 }
 
 // src/handlers/device.ts
@@ -69976,12 +70048,19 @@ function buildFeishuAuthHandlers(deps) {
       response: { type: "auth:apiKey:regenerate:ok", apiKey, createdAt, gatewayUrl }
     };
   };
+  const apiKeyRevoke = async () => {
+    const { revoked } = await deps.apiKeyClient.revoke(requireLogin());
+    return {
+      response: { type: "auth:apiKey:revoke:ok", revoked }
+    };
+  };
   return {
     "auth:login:start": loginStart,
     "auth:getIdentity": getIdentity,
     "auth:logout": logout,
     "auth:apiKey:get": apiKeyGet,
-    "auth:apiKey:regenerate": apiKeyRegenerate
+    "auth:apiKey:regenerate": apiKeyRegenerate,
+    "auth:apiKey:revoke": apiKeyRevoke
   };
 }
 
@@ -70281,6 +70360,7 @@ var METHOD_GRANT_MAP = {
   // 云 persona 调用 key：本机主人自己的东西，guest 一律够不着
   "auth:apiKey:get": ADMIN_ANY,
   "auth:apiKey:regenerate": ADMIN_ANY,
+  "auth:apiKey:revoke": ADMIN_ANY,
   // ---- device:* 设备目录 + 连接（决策 #15，owner-only） ----
   // 设备目录 / 连接都是 owner 本机操作（用本机登录票找中心 server），guest 不可调
   "device:list": ADMIN_ANY,
@@ -70335,7 +70415,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.530".length > 0 ? "0.2.530" : "dev";
+var version = "0.2.532".length > 0 ? "0.2.532" : "dev";
 
 // src/cli-probe/probe.ts
 var fs77 = __toESM(require("fs"), 1);
@@ -73693,7 +73773,10 @@ async function startDaemon(config) {
         connectToDevice: createConnectToDevice(feishuDeviceDeps),
         log: (msg, meta) => logger.info(msg, meta),
         // 进度上报：串行建联 20+ 台要几十秒，UI 靠这个帧渲染进度条
-        onProgress: (progress) => wsServer?.broadcastToOwners({ type: "org-mesh:progress", ...progress })
+        onProgress: (progress) => wsServer?.broadcastToOwners({ type: "org-mesh:progress", ...progress }),
+        // 已有联系人的地址被中心最新 url 刷新 → 复用 contact:added（UI reducer 按 deviceId upsert，
+        // auto-reverse 重握手也发这一帧），不新增帧
+        onContactUpdated: (contact) => wsServer?.broadcastToOwners({ type: "contact:added", contact })
       });
     } catch (err) {
       logger.warn("org-mesh sync failed (best-effort)", { err: err.message });
@@ -73971,7 +74054,8 @@ async function startDaemon(config) {
         // 凭证不出 ws —— UI 只拿到 key 本身，跟 exchange / listDevices 同一条纪律。
         apiKeyClient: {
           get: (args) => centralGetApiKey({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args }),
-          issue: (args) => centralIssueApiKey({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args })
+          issue: (args) => centralIssueApiKey({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args }),
+          revoke: (args) => centralRevokeApiKey({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args })
         }
       },
       // 云 persona 卡片上的连接器区（design 2026-09-11-mcp-connector §3.8）：装了什么以 gateway 登记行为真源，
@@ -74443,7 +74527,12 @@ async function startDaemon(config) {
     tunnelMgr = new TunnelManager({
       dataDir: config.dataDir,
       clawosApi: config.clawosApi,
-      deviceKey: deriveStableDeviceKey({ dataDir: config.dataDir }),
+      // 子域指纹落盘于 auth.json，首次缺失才由 hostname+uid 算初值——改电脑名不再换对外地址
+      // （design 2026-09-16-tunnel-address-stability §3.1）
+      deviceKey: loadOrCreateTunnelDeviceKey({
+        dataDir: config.dataDir,
+        derive: () => deriveStableDeviceKey({ dataDir: config.dataDir })
+      }),
       frpcBinaryOverride: config.frpcBinary,
       noPersist: config.noTunnelPersist,
       logger,

package/dist/dispatch/mcp-server.cjs

@@ -21762,6 +21762,11 @@ var AuthApiKeyRegenerateResponseSchema = external_exports.object({
   createdAt: external_exports.string().min(1),
   gatewayUrl: GatewayUrl
 });
+var AuthApiKeyRevokeResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:apiKey:revoke:ok"),
+  /** 之前有没有那把——没发过也算成功（幂等） */
+  revoked: external_exports.boolean()
+});
 var AuthLoginDoneEventSchema = external_exports.object({
   type: external_exports.literal("auth:login:done"),
   identity: FeishuIdentitySchema
@@ -24309,6 +24314,10 @@ var METHOD_DOCS = {
     summary: "\u6362\u4E00\u628A\u65B0\u7684\u4E91 persona \u8C03\u7528 key\uFF0C**\u65E7\u7684\u5F53\u573A\u5931\u6548**\uFF08\u4E00\u4EBA\u4E00\u628A\uFF0C\u4E2D\u5FC3\u6309 union_id \u8986\u76D6\uFF09\u3002owner-only",
     args: NO_ARGS
   },
+  "auth:apiKey:revoke": {
+    summary: "\u64A4\u9500\u81EA\u5DF1\u7684\u4E91 persona \u8C03\u7528 key\uFF1A\u4E2D\u5FC3\u5220\u6389\u90A3\u4E00\u884C\u3001**\u4E0D\u53D1\u65B0\u7684**\u3002gateway \u53EA\u5728\u5F00\u4F1A\u8BDD\u548C\u6BCF\u6B21\u4E0A\u884C\u65F6\u9A8C key\uFF0C\u6240\u4EE5\u5F00\u7740\u7684\u4E91\u4F1A\u8BDD\u4E0B\u4E00\u6761\u6D88\u606F\u624D\u53D1\u4E0D\u51FA\u53BB\u3001\u6B63\u5728\u8DD1\u7684\u90A3\u4E00\u8F6E\u4F1A\u8DD1\u5B8C\u3002\u6CA1\u53D1\u8FC7\u4E5F\u56DE ok\uFF08revoked:false\uFF09\u3002owner-only",
+    args: NO_ARGS
+  },
   "device:list": {
     summary: "\u5217\u51FA\u516C\u5171\u8BBE\u5907\u76EE\u5F55\u91CC\u53EF\u8FDE\u63A5\u7684\u8BBE\u5907\uFF08daemon \u4EE3\u7406\u4E2D\u5FC3 server\uFF09\u3002owner-only",
     args: NO_ARGS