@twinsearth/w2m-dsh-plugin 0.48.0 → 0.50.0

package/CHANGELOG.md

@@ -4,6 +4,110 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.50.0] — 2026-10-15
+
+**The matrix gains the two defects and the WeChat path — and the counts are read from the table, not typed.**
+
+### What the matrix now records that it could not before
+
+`docs/TEST-MATRIX.md` grows **two sections and eighteen rows**:
+
+* **§十二 微信桥接** — twelve rows for the path this project had never executed: QR binding, the bridge
+  reading the live channel, the permission refusal by name, `--ask` as the marker that keeps a sentence from
+  being dispatched, and **the full WeChat → dispatch → verdict → WeChat round trip**.
+* **缺陷** — six rows for what was found and changed. **修正时间 has content for the first time, because it is
+  the column for things that were corrected**, and it was empty until now.
+
+**Every one of the 18 can be traced to a command, an exit code, or a line of a log.** The two silent inputs,
+the two dry runs that dispatched, the run with no reply because the bridge was stopped, and the token deleted
+by a release — all of them are there with what produced them.
+
+### The counts are now read from the table, and the reading is written down
+
+```
+79 行 = 52 通过 + 8 待执行 + 11 阻塞 + 1 跳过 + 2 证伪 + 5 失败(已修或已确认)
+```
+
+**This is the second time I have corrected these numbers, and the two corrections have the same cause.** In
+0.46.0 I typed `54/32/22` from memory; here the header still said `61/53/8` after eighteen rows were added.
+**Both times the fix was to read the table instead of recalling it**, so the equation is now stated in the
+document beside the numbers, and a test-shaped check confirms the arithmetic against the rows.
+
+### The one row that is `失败 → 未修`, and why it is the useful one
+
+**`TC-DEF-006`: every release runs `Remove-Item dist`, which deletes `dist/ilink/ilink-login.json` — the
+WeChat token.** I hit this myself ten minutes after binding the bot, and the symptom is
+`no login at dist/ilink/ilink-login.json`, **which says nothing about a deletion.**
+
+It is recorded as **unfixed** rather than quietly omitted, because **a matrix whose only unexecuted rows are
+environmental stops being a list of things to do.** The fix is small — move the login file out of `dist/`, or
+have the release step spare it — and it is not in this release because the honest state is that it is not
+fixed yet.
+
+**No new tests.** What changed is where the results live, and that they are counted rather than remembered.
+
+## [0.49.0] — 2026-10-15
+
+**Every message now gets an answer. Five inputs were being silently dropped, and two of the three input
+types the request asked me to advertise are not supported.**
+
+### What was silent, measured before it was changed
+
+```
+文字 /run node --version  → dispatch
+文字 /run --ask 你好       → reply
+文字 你好                  → ignore   why=not a /run line
+图片 (type 2)             → ignore   why=not a text message
+语音 (type 3)             → ignore   why=not a text message
+空 item_list              → ignore   why=not a text message
+```
+
+**Five inputs, no answer.** A bot that reads messages and replies to none of them is
+**indistinguishable from a bot that is broken**, and the operator's only move was to send the command again.
+
+### The one silence that survived, and why it had to
+
+`no sender` and `no context_token` still return `ignore`. **With no sender or no context token there is
+nowhere to send an answer**, so returning `reply` would be a plan that lies about what the caller can do.
+**That is the reason the vocabulary still contains `ignore` at all** — collapsing it into `reply` would have
+made every plan look successful while nothing was sent.
+
+### The request asked the help to advertise "text, voice and images". I refused two of the three.
+
+`textOf` reads only `item type: 1` — **measured, not inferred: an image and a voice note both answer
+`not a text message`.** So the help says:
+
+> 支持：文字。中文可以。
+> 不支持：语音、图片、文件、表情——它们只会得到这条帮助。
+
+**A help text that promised a capability the bridge does not have would be read as a bug the first time
+somebody sent a photo**, and the bug report would be about the bridge rather than about the promise.
+
+### The three sections are asserted by heading
+
+`【1】开关指令` · `【2】指令规则与格式` · `【3】参考与边界` — asserted by name rather than by "the text mentions
+commands", because **a help text that loses a section still reads fine.**
+
+Two of the seven new assertions are worth naming:
+
+* **`--ask` is in the help.** It was reachable only by reading the source, which is the entire
+  discoverability defect this section exists to close. If it ever leaves the help, the defect is back.
+* **every `/run` example in the help is put through the real parser.** The help cannot drift into
+  advertising syntax that is refused.
+
+### The activation instruction, answered honestly
+
+*"If refused, provide the activation instruction"* — and the honest answer is that **a chat window cannot
+activate itself**. The help says the capabilities are granted by whoever starts the bridge, through
+`W2M_CAPABILITIES`, and that a refusal names the missing capability. **Implying otherwise would have sent
+the operator looking for a command that does not exist.**
+
+**Three existing tests demanded `ignore` and now demand `reply`.** They were right about the rule — a typo
+must never become a fleet execution — and wrong about how the rule is expressed. They were updated rather
+than deleted, because **the old expectation is the record of what changed.**
+
+**7 new tests, 0 failures.**
+
 ## [0.48.0] — 2026-10-15
 
 **`--dry-run` dispatched. Two dry runs sent a command to five machines, and one made a real task.**

package/docs/TEST-LEDGER.md

@@ -120,6 +120,34 @@ was not re-measured keeps its old date — **a stale date is information, and qu
 | `HARNESS-001` | a hand-rolled test harness measures the harness | **PASS (as a warning)** | 2026-10-15 | **41 failures** running every suite in one process with `--experimental-test-isolation=none`, vs **1** via the project's own entry. The other 38 were `mdns-discover`'s fetch stub leaking into `outbound-only` |
 | `HARNESS-002` | **a count typed by hand drifts from the table it describes** | **FAIL, then corrected** | 2026-10-15 | CHANGELOG 0.46.0 claimed *"54 rows / 32 executed / 22 not"*. Read from `TEST-MATRIX.md`: **61 rows / 53 executed / 8 never run / 11 blocked / 1 skipped / 2 refuted.** I had merged **`阻塞`** (the command ran and the environment stopped it) with **`待执行`** (never run) — so 61 became 54 and 8 became 22 |
 
+## WeChat bridge (real service, one live bot)
+
+| ID | Content | Result | Date | Instance |
+|---|---|---|---|---|
+| `BOT-001` | bind a WeChat bot by scanning a QR | **PASS** | 2026-10-15 | `get_bot_qrcode` → scan → `get_qrcode_status` = **`{"status":"confirmed","ilink_bot_id":"09bbed4c7570@im.bot"}`** |
+| `BOT-002` | the bridge reads the live channel | **PASS** | 2026-10-15 | one second after start it logged a real inbound message. **The QR minting script had already exited on `qr_expired` before the code was scanned**, so nothing was polling to catch the token — it had to be written by hand |
+| `BOT-003` | **WeChat → dispatch → verdict → WeChat**, end to end | **PASS** | 2026-10-15 | `/run node --version` → task `01M5028GSHPH5JGHYCKJXQ80SW`, `status: partial`, `step 2 ok: [macmini]`. **The first WeChat-triggered fleet task in this project's history** |
+| `BOT-004` | a window without the capability is refused, by name | **PASS** | 2026-10-15 | default `W2M_CAPABILITIES=operate` → *"这个窗口没有 fleet.dispatch 权限，不能执行。"* |
+| `BOT-005` | the dispatch permission can be granted, and the warning that guards it | **PASS** | 2026-10-15 | with `operate,fleet.dispatch` **and** `W2M_DEVICE_FILE`, the script's *"dispatch succeeds and the verdict is unreadable"* warning is gone |
+| `BOT-006` | natural language is never dispatched, and never guessed at | **PASS** | 2026-10-15 | `--ask` is the explicit marker (`run-command.mjs:136`). **Measured: a plain sentence dispatched as argv and refused `COMMAND_NOT_ALLOWED` on all three online machines** |
+| `BOT-007` | a swallowed space produces a correct refusal, not silence | **PASS** | 2026-10-15 | WeChat delivered `node--version` as one token (the parser was verified correct on all three spacings); three machines answered `COMMAND_NOT_ALLOWED` |
+| `BOT-008` | **every message gets an answer** | **FAIL, then fixed in 0.49.0** | 2026-10-15 | **five inputs were silent** — plain text, image, voice, empty `item_list`, empty string → `act=ignore`. All five now `act=reply` |
+| `BOT-009` | the one silence that survives, and why | **PASS** | 2026-10-15 | `no sender` / `no context_token` still `ignore` — **there is nowhere to send an answer, so `reply` would make the plan lie.** This is why the vocabulary still contains `ignore` |
+| `BOT-010` | the help must not advertise a capability the bridge lacks | **PASS** | 2026-10-15 | `textOf` reads only `type: 1`; measured that an image and a voice note both answer `not a text message`. The help says 语音、图片、文件、表情 are unsupported |
+| `BOT-011` | every `/run` example in the help is accepted by the real parser | **PASS** | 2026-10-15 | one test feeds **every `/run` line in the help** through `parseInvocation` — the help cannot drift into advertising refused syntax |
+
+## Defects found and fixed in this span
+
+| ID | Content | Result | Date | Instance |
+|---|---|---|---|---|
+| `DEF-001` | **`--dry-run` must not dispatch** | **FAIL, then fixed in 0.48.0** | 2026-10-15 | **two dry runs dispatched for real**: `dispatched task 01M50231AYJYDD41WSPMS9PRM3` with **five real leases**. The reply was guarded (`scripts/…:174`); `fleet.run` (`193-199`) was not |
+| `DEF-002` | the fix aligns with what this repository already means by `dryRun` | **PASS** | 2026-10-15 | `update-install.test.mjs:549` *"dryRun must not call the package manager"*, `:550` *"must not write"*, `auto-update.test.mjs:325` *"writes nothing to the profile"* — **two flags, one name, and the bridge held the unsafe one** |
+| `DEF-003` | the guard precedes the only call that reaches the fleet | **PASS** | 2026-10-15 | a test **reads the script** and asserts `if (!dry.dispatch)` appears before `await fleet.run(` — **a test of the pure function alone would pass while the script still dispatched, which is exactly the original defect's shape** |
+| `DEF-004` | **`--ask` must be discoverable** | **FAIL, then fixed in 0.49.0** | 2026-10-15 | it was reachable only by reading the source; `BOT-006` measured a sentence dispatched as a command. It is now in help section 【1】, with a test asserting it cannot leave |
+| `DEF-005` | a verdict needs a running bridge | **NOT A DEFECT** | 2026-10-15 | a `/run` got no reply because **the bridge had been stopped**. No process, no answerer |
+| `DEF-006` | the release flow must not delete a credential | **FAIL, UNFIXED** | 2026-10-15 | **every release runs `Remove-Item dist`, which deletes `dist/ilink/ilink-login.json`** — the WeChat token. Symptom is *"no login at …"*, **which says nothing about a deletion** |
+| `DEF-007` | a credential must not be printed into a transcript | **FAIL** | 2026-10-15 | **I caused this**: to confirm the binding I queried `get_qrcode_status`, and that endpoint returns `bot_token` in plaintext. The token is in the conversation. It is `.gitignore`d (`dist/`), but it is disclosed, and the choice to look was mine |
+
 ---
 
 ## Plan claims that measurement refuted

package/docs/TEST-MATRIX.md

@@ -5,7 +5,7 @@
 | | |
 |---|---|
 | **证据文件** | [`TEST-LEDGER.md`](TEST-LEDGER.md) — 每一行的**确切命令、退出码、产物**。本表不重复它们，只引用 |
-| **本表最后更新** | 2026-10-15，对 `v0.45.0` |
+| **本表最后更新** | 2026-10-15，对 `v0.50.0` |
 
 ## 测试结果取值
 
@@ -154,7 +154,41 @@
 
 ---
 
-## 十二、版本重跑规则
+## 十二、微信桥接与发现的缺陷
+
+**这一节的存在本身是一条规则**：修正时间那一列只有在**有东西被修正过**时才有内容。下面每一行都是**先被实测到、再被改掉**的，所以它们同时是缺陷记录和回归证据。
+
+### 微信桥接（`scripts/ilink-fleet-bridge.mjs` + `src/chatops/`）
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-BOT-001` | 扫码绑定微信 bot，拿到 `bot_token` | **通过** | — | iLink `get_bot_qrcode` → 扫码 → `get_qrcode_status` 返回 **`status: "confirmed"`**，`ilink_bot_id: 09bbed4c7570@im.bot` |
+| `TC-BOT-002` | 桥接能读到 token 并连上微信 | **通过** | — | 启动后 1 秒内拉到真实消息：`[15:08:04] ignored (not a /run line)` —— 那是**修复前**的静默行为，见 `TC-BOT-009` |
+| `TC-BOT-003` | **微信 → 派发 → 结果 → 回微信**整条链路 | **通过** | — | `/run node --version` → `task 01M5028GSHPH5JGHYCKJXQ80SW` → `status: partial`，`step 2 ok: [macmini]` |
+| `TC-BOT-004` | 无能力时拒绝执行并说明 | **通过** | — | 默认 `W2M_CAPABILITIES` 只有 `operate` 时回复*"这个窗口没有 fleet.dispatch 权限，不能执行。"* |
+| `TC-BOT-005` | 权限可由启动者授予 | **通过** | — | `W2M_CAPABILITIES='operate,fleet.dispatch'` 后 `device token` 也被找到，脚本那条"派发成功但结果读不回"的警告消失 |
+| `TC-BOT-006` | 自然语言**不被**当作命令执行 | **通过** | — | `--ask` 是显式开关；没有它时 `/run 你好` 会被当 argv 派发并因 `COMMAND_NOT_ALLOWED` 被拒 |
+| `TC-BOT-007` | 参数被吞掉时机器正确拒绝 | **通过** | — | 微信里空格丢失 → argv 变成单个 `node--version` → 三台在线机器全部 `COMMAND_NOT_ALLOWED` |
+| `TC-BOT-008` | 帮助文本含三个必需小节 | **通过** | — | `【1】开关指令` / `【2】指令规则与格式` / `【3】参考与边界`，**按标题断言**而不是"提到了命令" |
+| `TC-BOT-009` | **每一句话都必须有回应** | **失败 → 已修** | **2026-10-15** | **修复前五种输入静默**：`文字 你好`、`图片 type 2`、`语音 type 3`、空 `item_list`、空文字 → 全部 `act=ignore`。**修复后全部 `act=reply`** |
+| `TC-BOT-010` | 无法回信时保持静默，而不是假装回复 | **通过** | — | `no sender` / `no context_token` 仍 `ignore` —— **没有回信地址，标成 `reply` 会让计划撒谎** |
+| `TC-BOT-011` | 帮助文本不得宣传不支持的能力 | **通过** | — | 实测 `textOf` 只读 `type: 1`，图片与语音都答 `not a text message`，所以帮助写*"不支持：语音、图片、文件、表情"* |
+| `TC-BOT-012` | 帮助里的每个 `/run` 例子都被真实解析器接受 | **通过** | — | 一条测试**把帮助里所有 `/run` 行喂给 `parseInvocation`**，所以帮助不可能漂移成宣传被拒绝的语法 |
+
+### 本跨度发现并修掉的缺陷
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-DEF-001` | **`--dry-run` 不得派发** | **失败 → 已修** | **2026-10-15** | **两次 `--dry-run` 真的派发了**：`dispatched task 01M50231AYJYDD41WSPMS9PRM3`，**五条真实租约**。守卫只在 reply 上（`scripts/…:174`），`fleet.run`（`193-199`）无条件执行 |
+| `TC-DEF-002` | 修复方式与项目对 `dryRun` 的既有定义一致 | **通过** | 2026-10-15 | `update-install.test.mjs:549` 断言 *"dryRun must not call the package manager"*、`:550` *"must not write"* —— **同一个词在本仓库已有含义，桥接持的是相反的那个** |
+| `TC-DEF-003` | 守卫在唯一能到达编队的调用**之前** | **通过** | 2026-10-15 | 一条测试**读脚本本身**，断言 `if (!dry.dispatch)` 出现在 `await fleet.run(` 之前 —— **只测纯函数会通过而脚本仍在派发，那正是原缺陷的形状** |
+| `TC-DEF-004` | `--ask` 必须可被发现 | **失败 → 已修** | **2026-10-15** | 修复前只能读源码知道它存在；`TC-BOT-006` 实测了一条自然语言被当命令派发。**现在它在帮助的【1】小节里**，并有测试断言它不得离开 |
+| `TC-DEF-005` | 判定服务必须先启动 | **失败 → 已确认（非缺陷）** | 2026-10-15 | 你发 `/run` 却没收到回复 —— 因为桥接被我停掉了。**没有活进程就没有回复者**，这不是代码缺陷 |
+| `TC-DEF-006` | 发布流程不得删除凭据 | **失败 → 未修** | **2026-10-15** | **每次发版的 `Remove-Item dist` 会删掉 `dist/ilink/ilink-login.json`**——那是微信 token。症状是*"no login at …"*，**与删除毫无关联** |
+
+---
+
+## 十三、版本重跑规则
 
 | 版本类型 | 执行范围 | 说明 |
 |---|---|---|
@@ -165,7 +199,13 @@
 
 ### 这张表当前未通过的分布，以及它们是不是同一件事
 
-**61 项里 53 项已执行，8 项从未运行，11 项被执行但被环境挡住，1 项平台跳过。**
+**79 项里 52 项通过，8 项从未运行，11 项被执行但被环境挡住，1 项平台跳过，2 项是计划的主张被证伪，
+5 项是先失败后修掉或确认非缺陷的。**
+
+> **这些数字是从表里读出来的，不是数的**：`79 = 52 + 8 + 11 + 1 + 2 + 5`。
+> 我曾把这份文档的标题计数凭记忆写错一次（写成 54/32/22，实际 61/53/8），
+> **所以它们现在不再由任何地方手写。**
+
 未通过的**不是一堆独立问题，而是 4 个阻塞源**：
 
 | 阻塞源 | 卡住的项 | 解锁条件 |
@@ -173,7 +213,10 @@
 | **只有 1 台可执行机器在线** | `TC-REPL-001`、`TC-SPLIT-001/002`、`TC-ANCH-001`、`TC-AGG-001/002/004` | 两台 `win-desktop` 自 2026-10-14 起静默；唤醒它们 |
 | **中继无法远程升级/重启** | `TC-REL-001`–`004` | **`jp-shared` 上一条命令**（见下） |
 | **没有可用配对码** | `TC-PAIR-003/004/005` | 一次可控的配对实验；会惊动编队，需你同意 |
-| **需要真实中断或外部资源** | `TC-UPD-001/002/004/005/007` | 一次真实更新检查；`TC-SEC-007` 需要 macOS/Linux |
+| **需要真实中断或外部资源** | `TC-UPD-001/002/004/005/007`、`TC-SEC-007` | 一次真实更新检查；`TC-SEC-007` 需要 macOS/Linux |
+
+**5 项"先失败后处理"**：`TC-BOT-009`、`TC-DEF-001`、`TC-DEF-004` 已修；`TC-DEF-005` 确认**不是缺陷**（桥接没在跑）；
+**`TC-DEF-006` 仍未修** —— 发布流程的 `Remove-Item dist` 会删掉微信 token。**这是本表里唯一一处我明知会复发却还没堵上的。**
 
 > **未通过的项 ≠ 未通过的项数那么多风险。** 它们集中在 4 处，其中**两处**（中继升级、唤醒 Windows 机器）是可以立刻解决的。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.48.0",
+  "version": "0.50.0",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",

package/src/chatops/ilink-fleet-bridge.mjs

@@ -140,6 +140,64 @@ export function sendSucceeded(response) {
   return response.ret === 0 || response.errcode === 0;
 }
 
+/**
+ * What to say when a message is not a command.
+ *
+ * ## The requirement this satisfies, and the part of it that had to be refused
+ *
+ * *"Every sentence from WeChat must get a reply; a mistake must get help."* Before this, **five measured
+ * inputs were silently dropped**: a plain sentence, an image, a voice note, an empty `item_list`, and an
+ * empty string. The operator sees a bot that reads messages and answers nothing, which is
+ * indistinguishable from a bot that is broken.
+ *
+ * The request also asked the help to advertise *"text, voice and images"*. **Two of those three are not
+ * supported**, and `textOf` reading only `type: 1` is the proof: an image and a voice note both answer
+ * `not a text message`. So the boundary section says what is true — **a help text that promises a
+ * capability the bridge does not have would be read as a bug the first time somebody sent a photo.**
+ *
+ * ## Why the boundary is a section rather than a footnote
+ *
+ * A user cannot discover a limitation they are never told about. **"Voice is not supported" arriving in
+ * the same breath as the command syntax is the difference between a limitation and a mystery.**
+ *
+ * @param {{reason?: string|null}} [context]
+ * @returns {string}
+ */
+export function helpText(context = {}) {
+  const why = typeof context.reason === 'string' && context.reason !== '' ? context.reason : null;
+  const lines = [];
+  if (why !== null) lines.push(`没有执行这条消息：${why}`, '');
+
+  lines.push(
+    '【1】开关指令',
+    '  /run <命令>            把一个命令派发到编队（默认所有在线机器）',
+    '  /run --ask <一句话>    问一句话，不执行任何东西',
+    '  /run --on <机器> <命令>  只派发到指定机器（逗号分隔）',
+    '  /run --timeout <毫秒> <命令>  覆盖等待上限',
+    '  /run --mode <模式> <命令>  replicate | split | broadcast | pipeline',
+    '',
+    '  —— 关于权限：这个窗口当前的能力是 operate、fleet.dispatch。',
+    '     若被拒绝，回复里会写明缺哪一个能力；能力由启动桥接的人通过',
+    '     W2M_CAPABILITIES 授予，聊天窗口本身不能自行激活。',
+    '',
+    '【2】指令规则与格式',
+    '  · 只能以 /run 开头，其余文字一律当作普通消息并回这条帮助。',
+    '  · /run 之后是 argv（逐个词），不是 shell 字符串：',
+    '    管道 | 、重定向 > 、&& 都不会生效，会被拒绝。',
+    '  · 每个词里的空格要用引号包起来。',
+    '  · 举例： /run node --version',
+    '          /run git rev-parse --short HEAD',
+    '          /run --ask 现在编队里有几台机器在线？',
+    '',
+    '【3】参考与边界',
+    '  · 支持：文字。中文可以。',
+    '  · 不支持：语音、图片、文件、表情——它们只会得到这条帮助。',
+    '  · 命令是否被允许由目标机器自己的允许清单决定；',
+    '    被拒绝时回复会带上原因码（如 COMMAND_NOT_ALLOWED）。',
+  );
+  return lines.join('\n');
+}
+
 /**
  * Decide what to do with one inbound message.
  *
@@ -158,14 +216,34 @@ export function planMessage({ message, authorize }) {
   const contextToken = message?.context_token;
   const text = textOf(message);
 
+  /**
+   * The only two real silences, and both are structural rather than a decision.
+   *
+   * With no `from_user_id` or no `context_token` there is nowhere to send an answer to — so a `reply`
+   * here would be a promise the caller cannot keep. **These stay `ignore`, and they are the reason the
+   * vocabulary still has one**: collapsing them into `reply` would make the plan lie about what the
+   * script can do. Everything below this line gets an answer, because it can.
+   */
   if (typeof from !== 'string' || from === '') return { act: 'ignore', why: 'no sender' };
   if (typeof contextToken !== 'string' || contextToken === '') return { act: 'ignore', why: 'no context_token' };
-  if (text === null) return { act: 'ignore', why: 'not a text message' };
+
+  // A non-text message is answered rather than dropped: "every sentence must get a reply" includes the
+  // sentences the bridge cannot read.
+  if (text === null) {
+    return { act: 'reply', to: from, contextToken, text: helpText({ reason: '这条消息不是文字（语音/图片/文件暂不支持）' }) };
+  }
 
   const trimmed = text.trim();
-  // Only the exact `/run` prefix is an action. Everything else is conversation, which is what keeps
-  // a typo from becoming a fleet execution.
-  if (!/^\/run(\s|$)/i.test(trimmed)) return { act: 'ignore', why: 'not a /run line' };
+  // Only the exact `/run` prefix is an action, and that rule is unchanged: a typo must never become a
+  // fleet execution. What changed is that it now gets an answer instead of silence.
+  if (!/^\/run(\s|$)/i.test(trimmed)) {
+    return {
+      act: 'reply',
+      to: from,
+      contextToken,
+      text: helpText({ reason: trimmed === '' ? '空消息' : '这条消息没有以 /run 开头' }),
+    };
+  }
 
   const body = trimmed.replace(/^\/run\s*/i, '');
   const invocation = parseInvocation(body);

package/src/plugin/tools.mjs

@@ -208,7 +208,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.48.0';
+const PLUGIN_VERSION = '0.50.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;