@clawos-dev/clawd 0.2.531 → 0.2.533

package/dist/app-builder-plugin/mcp-server.cjs

@@ -24625,6 +24625,39 @@ var SCAN_FILE = import_node_path3.default.join(".clawd", "deploy-scan.json");
 // src/deploy/templates.ts
 var CLAWOS_REPO = "ottin4ttc/clawos";
 var CLAWOS_REF = "release";
+var PLAN_STEP = [
+  "      - name: \u8BFB\u90E8\u7F72\u6587\u4EF6",
+  "        id: plan",
+  "        run: |",
+  "          node clawos/cloud-host/pipeline/deploy-file.mjs \\",
+  "            --persona-dir persona \\",
+  "            --repo-name '${{ github.event.repository.name }}' \\",
+  "            --sha '${{ github.sha }}' \\",
+  '            --image-repo "$VPC_REGISTRY/$IMAGE_NAME" \\',
+  '            --assets clawos/cloud-host/provision/manifests/assets.json >> "$GITHUB_OUTPUT"',
+  ""
+];
+var CONTRACT_STEPS = [
+  "      - name: Checkout persona\uFF08\u53EA\u8981 .clawd/ \u91CC\u7684\u90E8\u7F72\u6587\u4EF6\u4E0E persona.json\uFF09",
+  "        uses: actions/checkout@v4",
+  "        with:",
+  "          path: persona",
+  "          sparse-checkout: .clawd",
+  "",
+  "      - name: Checkout clawos\uFF08\u6D41\u6C34\u7EBF\u811A\u672C + \u5B83\u5F15\u7684 k8s \u540D\u5B57\u6E05\u6D17 / \u8D44\u4EA7\u6E05\u5355\uFF09",
+  "        uses: actions/checkout@v4",
+  "        with:",
+  "          repository: ${{ env.CLAWOS_REPO }}",
+  "          ref: ${{ env.CLAWOS_REF }}",
+  "          token: ${{ secrets.CLAWOS_READ_TOKEN }}",
+  "          path: clawos",
+  "          sparse-checkout: |",
+  "            cloud-host/pipeline",
+  "            cloud-host/k8s",
+  "            cloud-host/provision/manifests",
+  "",
+  ...PLAN_STEP
+];
 var L = [
   "name: clawd deploy",
   "",
@@ -24662,19 +24695,7 @@ var L = [
   "    name: build",
   "    runs-on: ubuntu-latest",
   "    timeout-minutes: 30",
-  "    outputs:",
-  "      tag: ${{ steps.plan.outputs.tag }}",
-  "      image: ${{ steps.plan.outputs.image }}",
-  "      persona_id: ${{ steps.plan.outputs.persona_id }}",
-  "      env_names: ${{ steps.plan.outputs.env_names }}",
-  // 云上跑哪个模型 = 发布这一刻 persona 配的（build 段从仓库里的 .clawd/persona.json 读）。
-  // smoke 与 deploy 都要：smoke 得用正式那份模型探活，否则验的不是将要上线的东西。
-  "      model: ${{ steps.plan.outputs.model }}",
-  "      effort: ${{ steps.plan.outputs.effort }}",
-  // 装了哪些连接器（JSON 数组）。gateway 按它决定要不要为任务签工牌、把授权链接拼进 prompt
-  //（design 2026-09-09-cloud-connector-credentials）。名字形状在 deploy-file.mjs 卡死成 [a-z0-9-]，
-  // 所以下面单引号包住直接拼进命令行是安全的。
-  "      connectors: ${{ steps.plan.outputs.connectors }}",
+  // 没有 outputs:——smoke / deploy 段自己读契约（文件头）。build 段整仓 checkout：构建器要拷整个 persona 目录。
   "    steps:",
   "      - name: Checkout persona",
   "        uses: actions/checkout@v4",
@@ -24689,16 +24710,7 @@ var L = [
   "          token: ${{ secrets.CLAWOS_READ_TOKEN }}",
   "          path: clawos",
   "",
-  "      - name: \u8BFB\u90E8\u7F72\u6587\u4EF6",
-  "        id: plan",
-  "        run: |",
-  "          node clawos/cloud-host/pipeline/deploy-file.mjs \\",
-  "            --persona-dir persona \\",
-  "            --repo-name '${{ github.event.repository.name }}' \\",
-  "            --sha '${{ github.sha }}' \\",
-  '            --image-repo "$VPC_REGISTRY/$IMAGE_NAME" \\',
-  '            --assets clawos/cloud-host/provision/manifests/assets.json >> "$GITHUB_OUTPUT"',
-  "",
+  ...PLAN_STEP,
   "      - name: \u51ED\u636E\u9F50\u4E0D\u9F50\uFF08\u7F3A\u54EA\u51E0\u4E2A\u540D\u5B57\u4E00\u6B21\u5217\u5168\uFF09",
   "        env:",
   "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
@@ -24776,30 +24788,25 @@ var L = [
   "    runs-on: ubuntu-latest",
   "    timeout-minutes: 20",
   "    steps:",
-  "      - name: Checkout clawos\uFF08\u53EA\u8981\u6D41\u6C34\u7EBF\u811A\u672C\uFF09",
-  "        uses: actions/checkout@v4",
-  "        with:",
-  "          repository: ${{ env.CLAWOS_REPO }}",
-  "          ref: ${{ env.CLAWOS_REF }}",
-  "          token: ${{ secrets.CLAWOS_READ_TOKEN }}",
-  "          path: clawos",
-  "          sparse-checkout: cloud-host/pipeline",
-  "",
+  ...CONTRACT_STEPS,
   "      - name: \u4E34\u65F6\u767B\u8BB0 \u2192 \u8D77\u4E00\u6B21 Pod \u2192 \u64A4\u9500",
   "        # \u767B\u8BB0\u6B63\u5F0F\u53EA\u662F\u5F80 gateway \u5199\u4E00\u884C\uFF0Cgateway \u4E0D\u78B0\u955C\u50CF\uFF1B\u96C6\u7FA4\u62C9\u955C\u50CF\u53D1\u751F\u5728\u7B2C\u4E00\u4E2A\u4EFB\u52A1\u5230\u6765\u65F6\u3002",
   "        # \u6CA1\u6709\u8FD9\u4E00\u6B65\uFF0C\u6D41\u6C34\u7EBF\u7EFF\u4E86\u53EA\u4EE3\u8868\u300C\u767B\u8BB0\u4E86\u300D\u3002",
+  // 模型 / 档位 / 连接器 smoke 也要：试跑那次要跟正式那次拿到同一份，否则验的不是将要上线的东西。
+  // 名字形状 deploy-file.mjs 已卡死（persona_id [a-z0-9-]、model / effort [A-Za-z0-9._-]、connectors 无单引号
+  // 无换行），所以单引号包住直接拼进命令行是安全的。
   "        env:",
   "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
   "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
   "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
-  "          CLAWD_ENV_NAMES: ${{ needs.build.outputs.env_names }}",
+  "          CLAWD_ENV_NAMES: ${{ steps.plan.outputs.env_names }}",
   "        run: |",
   "          node clawos/cloud-host/pipeline/smoke.mjs \\",
-  "            --image '${{ needs.build.outputs.image }}' \\",
-  "            --persona-id '${{ needs.build.outputs.persona_id }}' \\",
-  "            --model '${{ needs.build.outputs.model }}' \\",
-  "            --effort '${{ needs.build.outputs.effort }}' \\",
-  "            --connectors '${{ needs.build.outputs.connectors }}' \\",
+  "            --image '${{ steps.plan.outputs.image }}' \\",
+  "            --persona-id '${{ steps.plan.outputs.persona_id }}' \\",
+  "            --model '${{ steps.plan.outputs.model }}' \\",
+  "            --effort '${{ steps.plan.outputs.effort }}' \\",
+  "            --connectors '${{ steps.plan.outputs.connectors }}' \\",
   "            --run-number '${{ github.run_number }}'",
   "",
   "  deploy:",
@@ -24809,28 +24816,20 @@ var L = [
   "    # \u4ED3\u5E93\u914D\u4E86 production \u73AF\u5883\u7684\u300C\u987B\u5BA1\u6838\u4EBA\u6279\u51C6\u300D\uFF0Cjob \u5C31\u505C\u5728\u8FD9\u91CC\u7B49\u4EBA\u70B9\uFF1B\u6CA1\u914D\u5C31\u76F4\u63A5\u8FC7\u3002",
   "    environment: production",
   "    steps:",
-  "      - name: Checkout clawos\uFF08\u53EA\u8981\u6D41\u6C34\u7EBF\u811A\u672C\uFF09",
-  "        uses: actions/checkout@v4",
-  "        with:",
-  "          repository: ${{ env.CLAWOS_REPO }}",
-  "          ref: ${{ env.CLAWOS_REF }}",
-  "          token: ${{ secrets.CLAWOS_READ_TOKEN }}",
-  "          path: clawos",
-  "          sparse-checkout: cloud-host/pipeline",
-  "",
+  ...CONTRACT_STEPS,
   "      - name: \u767B\u8BB0\u6B63\u5F0F",
   "        env:",
   "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
   "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
   "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
-  "          CLAWD_ENV_NAMES: ${{ needs.build.outputs.env_names }}",
+  "          CLAWD_ENV_NAMES: ${{ steps.plan.outputs.env_names }}",
   "        run: |",
   "          node clawos/cloud-host/pipeline/register.mjs \\",
-  "            --image '${{ needs.build.outputs.image }}' \\",
-  "            --persona-id '${{ needs.build.outputs.persona_id }}' \\",
-  "            --model '${{ needs.build.outputs.model }}' \\",
-  "            --effort '${{ needs.build.outputs.effort }}' \\",
-  "            --connectors '${{ needs.build.outputs.connectors }}'",
+  "            --image '${{ steps.plan.outputs.image }}' \\",
+  "            --persona-id '${{ steps.plan.outputs.persona_id }}' \\",
+  "            --model '${{ steps.plan.outputs.model }}' \\",
+  "            --effort '${{ steps.plan.outputs.effort }}' \\",
+  "            --connectors '${{ steps.plan.outputs.connectors }}'",
   ""
 ];
 var WORKFLOW_TEMPLATE = L.join("\n");

package/dist/cli.cjs

@@ -59043,6 +59043,39 @@ function mergeGitignore(existing) {
   return `${base}${missing.join("\n")}
 `;
 }
+var PLAN_STEP = [
+  "      - name: \u8BFB\u90E8\u7F72\u6587\u4EF6",
+  "        id: plan",
+  "        run: |",
+  "          node clawos/cloud-host/pipeline/deploy-file.mjs \\",
+  "            --persona-dir persona \\",
+  "            --repo-name '${{ github.event.repository.name }}' \\",
+  "            --sha '${{ github.sha }}' \\",
+  '            --image-repo "$VPC_REGISTRY/$IMAGE_NAME" \\',
+  '            --assets clawos/cloud-host/provision/manifests/assets.json >> "$GITHUB_OUTPUT"',
+  ""
+];
+var CONTRACT_STEPS = [
+  "      - name: Checkout persona\uFF08\u53EA\u8981 .clawd/ \u91CC\u7684\u90E8\u7F72\u6587\u4EF6\u4E0E persona.json\uFF09",
+  "        uses: actions/checkout@v4",
+  "        with:",
+  "          path: persona",
+  "          sparse-checkout: .clawd",
+  "",
+  "      - name: Checkout clawos\uFF08\u6D41\u6C34\u7EBF\u811A\u672C + \u5B83\u5F15\u7684 k8s \u540D\u5B57\u6E05\u6D17 / \u8D44\u4EA7\u6E05\u5355\uFF09",
+  "        uses: actions/checkout@v4",
+  "        with:",
+  "          repository: ${{ env.CLAWOS_REPO }}",
+  "          ref: ${{ env.CLAWOS_REF }}",
+  "          token: ${{ secrets.CLAWOS_READ_TOKEN }}",
+  "          path: clawos",
+  "          sparse-checkout: |",
+  "            cloud-host/pipeline",
+  "            cloud-host/k8s",
+  "            cloud-host/provision/manifests",
+  "",
+  ...PLAN_STEP
+];
 var L2 = [
   "name: clawd deploy",
   "",
@@ -59080,19 +59113,7 @@ var L2 = [
   "    name: build",
   "    runs-on: ubuntu-latest",
   "    timeout-minutes: 30",
-  "    outputs:",
-  "      tag: ${{ steps.plan.outputs.tag }}",
-  "      image: ${{ steps.plan.outputs.image }}",
-  "      persona_id: ${{ steps.plan.outputs.persona_id }}",
-  "      env_names: ${{ steps.plan.outputs.env_names }}",
-  // 云上跑哪个模型 = 发布这一刻 persona 配的（build 段从仓库里的 .clawd/persona.json 读）。
-  // smoke 与 deploy 都要：smoke 得用正式那份模型探活，否则验的不是将要上线的东西。
-  "      model: ${{ steps.plan.outputs.model }}",
-  "      effort: ${{ steps.plan.outputs.effort }}",
-  // 装了哪些连接器（JSON 数组）。gateway 按它决定要不要为任务签工牌、把授权链接拼进 prompt
-  //（design 2026-09-09-cloud-connector-credentials）。名字形状在 deploy-file.mjs 卡死成 [a-z0-9-]，
-  // 所以下面单引号包住直接拼进命令行是安全的。
-  "      connectors: ${{ steps.plan.outputs.connectors }}",
+  // 没有 outputs:——smoke / deploy 段自己读契约（文件头）。build 段整仓 checkout：构建器要拷整个 persona 目录。
   "    steps:",
   "      - name: Checkout persona",
   "        uses: actions/checkout@v4",
@@ -59107,16 +59128,7 @@ var L2 = [
   "          token: ${{ secrets.CLAWOS_READ_TOKEN }}",
   "          path: clawos",
   "",
-  "      - name: \u8BFB\u90E8\u7F72\u6587\u4EF6",
-  "        id: plan",
-  "        run: |",
-  "          node clawos/cloud-host/pipeline/deploy-file.mjs \\",
-  "            --persona-dir persona \\",
-  "            --repo-name '${{ github.event.repository.name }}' \\",
-  "            --sha '${{ github.sha }}' \\",
-  '            --image-repo "$VPC_REGISTRY/$IMAGE_NAME" \\',
-  '            --assets clawos/cloud-host/provision/manifests/assets.json >> "$GITHUB_OUTPUT"',
-  "",
+  ...PLAN_STEP,
   "      - name: \u51ED\u636E\u9F50\u4E0D\u9F50\uFF08\u7F3A\u54EA\u51E0\u4E2A\u540D\u5B57\u4E00\u6B21\u5217\u5168\uFF09",
   "        env:",
   "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
@@ -59194,30 +59206,25 @@ var L2 = [
   "    runs-on: ubuntu-latest",
   "    timeout-minutes: 20",
   "    steps:",
-  "      - name: Checkout clawos\uFF08\u53EA\u8981\u6D41\u6C34\u7EBF\u811A\u672C\uFF09",
-  "        uses: actions/checkout@v4",
-  "        with:",
-  "          repository: ${{ env.CLAWOS_REPO }}",
-  "          ref: ${{ env.CLAWOS_REF }}",
-  "          token: ${{ secrets.CLAWOS_READ_TOKEN }}",
-  "          path: clawos",
-  "          sparse-checkout: cloud-host/pipeline",
-  "",
+  ...CONTRACT_STEPS,
   "      - name: \u4E34\u65F6\u767B\u8BB0 \u2192 \u8D77\u4E00\u6B21 Pod \u2192 \u64A4\u9500",
   "        # \u767B\u8BB0\u6B63\u5F0F\u53EA\u662F\u5F80 gateway \u5199\u4E00\u884C\uFF0Cgateway \u4E0D\u78B0\u955C\u50CF\uFF1B\u96C6\u7FA4\u62C9\u955C\u50CF\u53D1\u751F\u5728\u7B2C\u4E00\u4E2A\u4EFB\u52A1\u5230\u6765\u65F6\u3002",
   "        # \u6CA1\u6709\u8FD9\u4E00\u6B65\uFF0C\u6D41\u6C34\u7EBF\u7EFF\u4E86\u53EA\u4EE3\u8868\u300C\u767B\u8BB0\u4E86\u300D\u3002",
+  // 模型 / 档位 / 连接器 smoke 也要：试跑那次要跟正式那次拿到同一份，否则验的不是将要上线的东西。
+  // 名字形状 deploy-file.mjs 已卡死（persona_id [a-z0-9-]、model / effort [A-Za-z0-9._-]、connectors 无单引号
+  // 无换行），所以单引号包住直接拼进命令行是安全的。
   "        env:",
   "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
   "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
   "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
-  "          CLAWD_ENV_NAMES: ${{ needs.build.outputs.env_names }}",
+  "          CLAWD_ENV_NAMES: ${{ steps.plan.outputs.env_names }}",
   "        run: |",
   "          node clawos/cloud-host/pipeline/smoke.mjs \\",
-  "            --image '${{ needs.build.outputs.image }}' \\",
-  "            --persona-id '${{ needs.build.outputs.persona_id }}' \\",
-  "            --model '${{ needs.build.outputs.model }}' \\",
-  "            --effort '${{ needs.build.outputs.effort }}' \\",
-  "            --connectors '${{ needs.build.outputs.connectors }}' \\",
+  "            --image '${{ steps.plan.outputs.image }}' \\",
+  "            --persona-id '${{ steps.plan.outputs.persona_id }}' \\",
+  "            --model '${{ steps.plan.outputs.model }}' \\",
+  "            --effort '${{ steps.plan.outputs.effort }}' \\",
+  "            --connectors '${{ steps.plan.outputs.connectors }}' \\",
   "            --run-number '${{ github.run_number }}'",
   "",
   "  deploy:",
@@ -59227,28 +59234,20 @@ var L2 = [
   "    # \u4ED3\u5E93\u914D\u4E86 production \u73AF\u5883\u7684\u300C\u987B\u5BA1\u6838\u4EBA\u6279\u51C6\u300D\uFF0Cjob \u5C31\u505C\u5728\u8FD9\u91CC\u7B49\u4EBA\u70B9\uFF1B\u6CA1\u914D\u5C31\u76F4\u63A5\u8FC7\u3002",
   "    environment: production",
   "    steps:",
-  "      - name: Checkout clawos\uFF08\u53EA\u8981\u6D41\u6C34\u7EBF\u811A\u672C\uFF09",
-  "        uses: actions/checkout@v4",
-  "        with:",
-  "          repository: ${{ env.CLAWOS_REPO }}",
-  "          ref: ${{ env.CLAWOS_REF }}",
-  "          token: ${{ secrets.CLAWOS_READ_TOKEN }}",
-  "          path: clawos",
-  "          sparse-checkout: cloud-host/pipeline",
-  "",
+  ...CONTRACT_STEPS,
   "      - name: \u767B\u8BB0\u6B63\u5F0F",
   "        env:",
   "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
   "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
   "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
-  "          CLAWD_ENV_NAMES: ${{ needs.build.outputs.env_names }}",
+  "          CLAWD_ENV_NAMES: ${{ steps.plan.outputs.env_names }}",
   "        run: |",
   "          node clawos/cloud-host/pipeline/register.mjs \\",
-  "            --image '${{ needs.build.outputs.image }}' \\",
-  "            --persona-id '${{ needs.build.outputs.persona_id }}' \\",
-  "            --model '${{ needs.build.outputs.model }}' \\",
-  "            --effort '${{ needs.build.outputs.effort }}' \\",
-  "            --connectors '${{ needs.build.outputs.connectors }}'",
+  "            --image '${{ steps.plan.outputs.image }}' \\",
+  "            --persona-id '${{ steps.plan.outputs.persona_id }}' \\",
+  "            --model '${{ steps.plan.outputs.model }}' \\",
+  "            --effort '${{ steps.plan.outputs.effort }}' \\",
+  "            --connectors '${{ steps.plan.outputs.connectors }}'",
   ""
 ];
 var WORKFLOW_TEMPLATE = L2.join("\n");
@@ -67443,7 +67442,8 @@ function loadOrCreateAuthFile(opts) {
       token: existing.token,
       ownerPrincipalId: existing.ownerPrincipalId,
       deviceId: existing.deviceId,
-      createdAt: existing.createdAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
+      createdAt: existing.createdAt ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+      ...existing.tunnelDeviceKey ? { tunnelDeviceKey: existing.tunnelDeviceKey } : {}
     };
   }
   const token = existing?.token || generate();
@@ -67451,9 +67451,17 @@ function loadOrCreateAuthFile(opts) {
   const deviceId = ownerPrincipalId;
   const createdAt = existing?.createdAt || now().toISOString();
   const next = { token, ownerPrincipalId, deviceId, createdAt };
+  if (existing?.tunnelDeviceKey) next.tunnelDeviceKey = existing.tunnelDeviceKey;
   writeAuthFile(file, next);
   return next;
 }
+function loadOrCreateTunnelDeviceKey(opts) {
+  const current = loadOrCreateAuthFile(opts);
+  if (current.tunnelDeviceKey) return current.tunnelDeviceKey;
+  const tunnelDeviceKey = opts.derive();
+  writeAuthFile(authFilePath(opts.dataDir), { ...current, tunnelDeviceKey });
+  return tunnelDeviceKey;
+}
 function defaultGenerateToken() {
   return import_node_crypto15.default.randomBytes(32).toString("base64url");
 }
@@ -67472,6 +67480,7 @@ function readAuthFile(file) {
       ownerPrincipalId: typeof parsed.ownerPrincipalId === "string" && parsed.ownerPrincipalId.length > 0 ? parsed.ownerPrincipalId : void 0,
       deviceId: typeof parsed.deviceId === "string" && parsed.deviceId.length > 0 ? parsed.deviceId : void 0,
       createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : void 0,
+      tunnelDeviceKey: typeof parsed.tunnelDeviceKey === "string" && parsed.tunnelDeviceKey.length > 0 ? parsed.tunnelDeviceKey : void 0,
       // 单 secret 合并前的旧字段：出现即触发清理写回（值无所谓，硬切不再使用）
       hasLegacySecrets: "signSecret" in parsed || "visitorTokenSecret" in parsed
     };
@@ -67806,22 +67815,51 @@ var lastPeers = [];
 function getCachedOrgPeers() {
   return lastPeers;
 }
+function sameOrigin(a2, b3) {
+  const oa2 = toOrigin(a2);
+  const ob = toOrigin(b3);
+  return oa2 != null && ob != null ? oa2 === ob : a2 === b3;
+}
+function toOrigin(raw) {
+  const http2 = raw.replace(/^wss:\/\//i, "https://").replace(/^ws:\/\//i, "http://");
+  try {
+    const origin = new URL(http2).origin;
+    return origin === "null" ? null : origin;
+  } catch {
+    return null;
+  }
+}
 async function syncOrgMesh(deps) {
   const peers = await deps.fetchPeers();
   lastPeers = peers;
   if (peers.length === 0) {
     deps.log("org-mesh: \u4E0D\u5728\u4EFB\u4F55\u7EC4\u7EC7\uFF08\u6216\u7EC4\u91CC\u53EA\u6709\u81EA\u5DF1\uFF09\uFF0C\u8DF3\u8FC7");
     deps.onProgress?.({ total: 0, done: 0, connected: 0, failed: 0, active: false });
-    return { peers: 0, attempted: 0, connected: 0, failed: 0 };
+    return { peers: 0, attempted: 0, connected: 0, failed: 0, refreshed: 0 };
   }
   const targets = [];
+  let refreshed = 0;
   for (const p3 of peers) {
     for (const d2 of p3.devices) {
-      if (deps.store.get(d2.deviceId)) continue;
-      targets.push({ deviceId: d2.deviceId, displayName: p3.displayName });
+      const existing = deps.store.get(d2.deviceId);
+      if (!existing) {
+        targets.push({ deviceId: d2.deviceId, displayName: p3.displayName });
+        continue;
+      }
+      if (d2.url == null || sameOrigin(existing.remoteUrl, d2.url)) continue;
+      const updated = { ...existing, remoteUrl: d2.url };
+      deps.store.upsert(updated);
+      refreshed += 1;
+      deps.log("org-mesh: \u8054\u7CFB\u4EBA\u5730\u5740\u5DF2\u5237\u65B0", {
+        deviceId: d2.deviceId,
+        name: p3.displayName,
+        from: existing.remoteUrl,
+        to: d2.url
+      });
+      deps.onContactUpdated?.(updated);
     }
   }
-  deps.log("org-mesh: \u5F00\u59CB\u540C\u6B65", { peers: peers.length, targets: targets.length });
+  deps.log("org-mesh: \u5F00\u59CB\u540C\u6B65", { peers: peers.length, targets: targets.length, refreshed });
   let connected = 0;
   let failed = 0;
   deps.onProgress?.({
@@ -67852,8 +67890,14 @@ async function syncOrgMesh(deps) {
       active: connected + failed < targets.length
     });
   }
-  deps.log("org-mesh: \u540C\u6B65\u5B8C\u6210", { peers: peers.length, attempted: targets.length, connected, failed });
-  return { peers: peers.length, attempted: targets.length, connected, failed };
+  deps.log("org-mesh: \u540C\u6B65\u5B8C\u6210", {
+    peers: peers.length,
+    attempted: targets.length,
+    connected,
+    failed,
+    refreshed
+  });
+  return { peers: peers.length, attempted: targets.length, connected, failed, refreshed };
 }
 
 // src/handlers/device.ts
@@ -70370,7 +70414,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.531".length > 0 ? "0.2.531" : "dev";
+var version = "0.2.533".length > 0 ? "0.2.533" : "dev";
 
 // src/cli-probe/probe.ts
 var fs77 = __toESM(require("fs"), 1);
@@ -73728,7 +73772,10 @@ async function startDaemon(config) {
         connectToDevice: createConnectToDevice(feishuDeviceDeps),
         log: (msg, meta) => logger.info(msg, meta),
         // 进度上报：串行建联 20+ 台要几十秒，UI 靠这个帧渲染进度条
-        onProgress: (progress) => wsServer?.broadcastToOwners({ type: "org-mesh:progress", ...progress })
+        onProgress: (progress) => wsServer?.broadcastToOwners({ type: "org-mesh:progress", ...progress }),
+        // 已有联系人的地址被中心最新 url 刷新 → 复用 contact:added（UI reducer 按 deviceId upsert，
+        // auto-reverse 重握手也发这一帧），不新增帧
+        onContactUpdated: (contact) => wsServer?.broadcastToOwners({ type: "contact:added", contact })
       });
     } catch (err) {
       logger.warn("org-mesh sync failed (best-effort)", { err: err.message });
@@ -74479,7 +74526,12 @@ async function startDaemon(config) {
     tunnelMgr = new TunnelManager({
       dataDir: config.dataDir,
       clawosApi: config.clawosApi,
-      deviceKey: deriveStableDeviceKey({ dataDir: config.dataDir }),
+      // 子域指纹落盘于 auth.json，首次缺失才由 hostname+uid 算初值——改电脑名不再换对外地址
+      // （design 2026-09-16-tunnel-address-stability §3.1）
+      deviceKey: loadOrCreateTunnelDeviceKey({
+        dataDir: config.dataDir,
+        derive: () => deriveStableDeviceKey({ dataDir: config.dataDir })
+      }),
       frpcBinaryOverride: config.frpcBinary,
       noPersist: config.noTunnelPersist,
       logger,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.531",
+  "version": "0.2.533",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",