@twinsearth/w2m-dsh-plugin 1.1.14 → 1.1.15

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.1.14"
+    "version": "1.1.15"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.1.14",
+      "version": "1.1.15",
       "author": {
         "name": "TwinsEarth"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.1.14",
+  "version": "1.1.15",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -2,6 +2,57 @@
 
 All notable changes to this project are documented here.
 
+## [1.1.15] — 2026-10-17
+
+**A machine that cannot join the old way now proves its account, asks to join, and waits for an answer -- and the
+executed command finally learns which machine and which slice it is.**
+
+### The fallback path is connected end to end
+
+v1.1.14 shipped the server half. This release connects the client:
+
+* \`pairNow\` classifies its failure and, for **only** the three degradable reasons (invalid pairing code, unreachable
+  relay, timeout), calls the new chain: challenge -> sign with the account key -> submit proof -> poll until a terminal
+  state. Anything else still needs a human and still does not change mechanisms;
+* **a rejection is final.** The chain stops on \`rejected\`; re-asking would turn a decision into a notification queue;
+* **an unfinished wait is reported, never hung on**: \`STILL_PENDING\` after the poll budget, \`expired\` when the relay
+  says so;
+* the seed for the account key is the **fleet key, never the account code** -- the account code is written to the log,
+  and deriving a signing key from a value anyone can read would hand out the account's identity;
+* the machine id comes from the agent object in scope, **not** from device.json: this machine never paired, which is the
+  entire situation.
+
+### Polling without a device token
+
+The asking machine has no device token -- that is why it is asking. The request response therefore carries a
+\`poll_token\`, and \`GET /v1/fleet/admission/{id}?poll_token=\` is reachable **ahead of** the device-token gate. A wrong
+token returns 404 rather than revealing whether the request exists.
+
+### The command learns where it is (P1)
+
+\`runArgv\` accepts an environment, and every executed command receives \`W2M_INDEX\`, \`W2M_INDEX_TOTAL\`,
+\`W2M_STAGE_INDEX\`, \`W2M_TASK_ID\`, \`W2M_MODE\`, \`W2M_MACHINE_ID\`, \`W2M_MACHINE_NAME\`. Values come from the OFFER,
+never from argv, so one machine cannot reshape a fleet-wide split. The variables are merged over \`process.env\` rather
+than replacing it -- PATH must survive, or no interpreter is found. \`W2M_STAGE_INDEX\` is deliberately separate from
+\`W2M_INDEX\`: for a split over four machines each runs one stage (0) but they are machines 0..3.
+
+This makes the operator's acceptance shape possible: \`process.exit(Number(process.env.W2M_INDEX)+1)\` yields 1/2/3/4
+across four machines. The single-machine half is tested here; the four-machine run needs the fleet and is **not yet
+verified**.
+
+### NOT shipped, stated plainly
+
+* **The approval UI** (10s popup with countdown plus a standing dialog) is not written. The server enforces the rules it
+  must: no automatic approval with zero members online, and a rejection beats the ten seconds;
+* **no end-to-end run**: new install -> popup -> admitted has not been executed, so \`agent.runtime.machineId\` being
+  non-empty on a real machine is **UNVERIFIED** -- if it is empty the fallback logs and does not fire;
+* the fleet chat / broadcast channel is designed (FLEET-CHAT-DESIGN.md) and not implemented.
+
+### Verified
+
+Full gate GREEN (final pass, 15 of 15). Suites touched: tools 115, account-join 6, account-identity 6, join-challenge 8,
+join-degradation 3, admission 16, admission-routes 3, relay 163, broadcast 19.
+
 ## [1.1.14] — 2026-10-17
 
 **A new machine joins by itself, and a machine that cannot join the old way can now prove its account and ask.**

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.14", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.15", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.1.14",
+  "version": "1.1.15",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "main": "lib/index.js",
@@ -129,13 +129,13 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:admission": "node --test --test-force-exit test/admission.test.mjs",
     "test:admission-routes": "node --test --test-force-exit test/admission-routes.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs",
     "test:approval-gate": "node --test --test-force-exit test/approval-gate.test.mjs",
     "test:approval-index": "node --test --test-force-exit test/approval-index.test.mjs",
     "test:authority": "node --test --test-force-exit test/authority.test.mjs",
@@ -173,7 +173,9 @@
     "test:test-report": "node --test --test-force-exit test/test-report.test.mjs",
     "test:tools": "node --test --test-force-exit test/tools.test.mjs",
     "verify": "node scripts/check-entrypoints.mjs && node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/tools.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/p2p-node.test.mjs test/p2p-agent.test.mjs test/client-bundle.test.mjs test/loader-entry.test.mjs",
-    "verify:join": "node scripts/verify-join.mjs"
+    "verify:join": "node scripts/verify-join.mjs",
+    "test:exec-env": "node --test --test-force-exit test/exec-env-injection.test.mjs",
+    "test:account-join": "node --test --test-force-exit test/account-join.test.mjs"
   },
   "keywords": [
     "dsh-bundle",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.1.14",
+  "version": "1.1.15",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/agent/agent.mjs

@@ -3011,11 +3011,28 @@ export function createAgent(options) {
           break;
         }
 
+        /**
+         * v1.1.15 (P1): the executed command learns which machine and which slice it is.
+         *
+         * Values come from the OFFER, never from argv, so a fleet-wide split cannot be reshaped by one machine.
+         * W2M_STAGE_INDEX is separate from W2M_INDEX: for a split over four machines, each runs one stage (0) but they
+         * are machines 0..3, and conflating the two would make "print my index" print 0 everywhere.
+         */
+        const taskEnv = {
+          W2M_INDEX: String(Number.isInteger(offer.index) ? offer.index : 0),
+          W2M_INDEX_TOTAL: String(Number.isInteger(offer.index_total) ? offer.index_total : 1),
+          W2M_STAGE_INDEX: String(Number.isInteger(stage.index) ? stage.index : 0),
+          W2M_TASK_ID: String(offer.task_id ?? ''),
+          W2M_MODE: String(offer.mode ?? ''),
+          W2M_MACHINE_ID: String(offer.machine_id ?? ''),
+          W2M_MACHINE_NAME: String(offer.machine_name ?? ''),
+        };
         const ran = await runArgv(stage.command_argv, {
           cwd: stageCwdOutcome.cwd,
           timeoutMs: remainingMs,
           maxOutputBytes,
           signal: controller.signal,
+          env: taskEnv,
         });
         execution = ran;
         for (const warning of ran.warnings) if (!warnings.includes(warning)) warnings.push(warning);

package/src/plugin/account-join.mjs

@@ -0,0 +1,86 @@
+/**
+ * The fallback joining path, as the client actually walks it.
+ *
+ * ## Why this is a separate, injectable function
+ *
+ * The old path fails for three named reasons only (see join-degradation.mjs), and then this runs: ask for a challenge,
+ * sign it with the account key, submit the proof, wait for a human (or the ten-second popup) to decide. Every one of
+ * those steps can be slow or refuse, and the whole thing must be testable without a relay, a fleet, or a person.
+ *
+ * ## The two rules this encodes, both learned the hard way
+ *
+ * - **A rejection is final.** Re-asking after a "no" turns a decision into a notification queue and harasses the members
+ *   who said no. Only a caller that explicitly resets may try again.
+ * - **Give up loudly.** If the request is never decided, the caller must be told which state it ended in (expired,
+ *   pending past the deadline) rather than being left with a promise that never settles.
+ */
+import { signChallenge } from '../util/account-identity.mjs';
+
+/** Terminal states from the relay. \`pending\` is NOT terminal: it means "still waiting". */
+const TERMINAL = new Set(['approved', 'rejected', 'expired']);
+
+/**
+ * @param {{request: Function, identity: {fingerprint: string, privateKey: unknown},
+ *          machine: {machine_id: string, machine_name?: string},
+ *          basePath?: string, pollIntervalMs?: number, maxPolls?: number, sleep?: Function,
+ *          now?: () => number}} deps
+ * @returns {Promise<{ok: boolean, state: string, device_token?: string, request_id?: string, code?: string}>}
+ */
+export async function joinByAccount({
+  request,
+  identity,
+  machine,
+  basePath = '',
+  pollIntervalMs = 1000,
+  maxPolls = 30,
+  sleep = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); }),
+}) {
+  if (typeof request !== 'function') throw new TypeError('request must be a function');
+  if (!identity || typeof identity.fingerprint !== 'string') throw new TypeError('identity with a fingerprint is required');
+  if (!machine || typeof machine.machine_id !== 'string' || machine.machine_id === '') throw new TypeError('machine.machine_id is required');
+
+  const challenge = await request({
+    method: 'GET',
+    pathname: basePath + '/v1/fleet/admission/challenge',
+    query: { fingerprint: identity.fingerprint, machine_id: machine.machine_id },
+  });
+  if (challenge?.ok !== true) {
+    return { ok: false, state: 'error', code: challenge?.error?.code ?? 'CHALLENGE_REFUSED' };
+  }
+  const signature = signChallenge(identity, [challenge.json.challenge_id, challenge.json.nonce, identity.fingerprint, machine.machine_id].join('|'));
+
+  const submitted = await request({
+    method: 'POST',
+    pathname: basePath + '/v1/fleet/admission/request',
+    body: { machine_id: machine.machine_id, machine_name: machine.machine_name ?? null, challenge_id: challenge.json.challenge_id, signature },
+  });
+  if (submitted?.ok !== true) {
+    return { ok: false, state: 'error', code: submitted?.error?.code ?? 'REQUEST_REFUSED' };
+  }
+  let state = submitted.json.state ?? 'pending';
+  const requestId = submitted.json.request_id ?? null;
+  const pollToken = submitted.json.poll_token ?? null;
+
+  for (let attempt = 0; attempt < maxPolls && !TERMINAL.has(state); attempt += 1) {
+    if (attempt > 0) await sleep(pollIntervalMs);
+    const polled = await request({
+      method: 'GET',
+      pathname: basePath + '/v1/fleet/admission/' + encodeURIComponent(requestId ?? ''),
+      query: { poll_token: pollToken ?? '' },
+    });
+    if (polled?.ok !== true) {
+      return { ok: false, state: 'error', code: polled?.error?.code ?? 'POLL_REFUSED' };
+    }
+    state = polled.json.state ?? state;
+    if (TERMINAL.has(state)) {
+      return { ok: state === 'approved', state, request_id: requestId, device_token: polled.json.device_token };
+    }
+  }
+  // Not terminal within the budget: report the state we ended in rather than hanging.
+  return { ok: false, state, request_id: requestId, code: TERMINAL.has(state) ? undefined : 'STILL_PENDING' };
+}
+
+/** True only for a state a caller may treat as an answer. Exported so callers do not re-derive it. */
+export function isTerminalAdmissionState(state) {
+  return TERMINAL.has(state);
+}

package/src/plugin/tools.mjs

@@ -108,6 +108,8 @@ import { acceptWithAuthority } from '../agent/field-authority.mjs';
 // exhaustively, without a profile or a relay.
 import { mergeMemory } from './fleet-merge.mjs';
 import { shouldDegrade } from './join-degradation.mjs';
+import { deriveAccountKeypair } from '../util/account-identity.mjs';
+import { joinByAccount } from './account-join.mjs';
 
 // The base-address rules live in one place (§2), shared with the agent side. Importing the - rather
 // than re-deriving them her - is what stops the plugin and the agent from disagreeing about what
@@ -212,7 +214,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.1.14';
+const PLUGIN_VERSION = '1.1.15';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -6716,6 +6718,44 @@ async function startLocalStack(ctx, cfg) {
          */
         const reason = error?.reason_code ?? error?.code ?? null;
         const degrade = shouldDegrade(reason);
+        if (degrade === true && key !== null) {
+          /**
+           * v1.1.15: the fallback path, finally called.
+           *
+           * Two invariants are load-bearing here:
+           *
+           * 1. the seed is the FLEET KEY, never the account code -- the account code is written to the log two
+           *    hundred lines above, and deriving a signing key from a value anyone can read would hand out the
+           *    account's identity;
+           * 2. the machine id comes from the agent object that is already in this scope, not from device.json --
+           *    this machine never paired, so it has no device.json, which is the entire situation.
+           *
+           * A failure here does not change the outcome of the old attempt: the caller still sees
+           * `{paired: false, degrade: true}` and can retry later. It must not throw out of this catch block.
+           */
+          try {
+            const localMachineId = typeof agent?.runtime?.machineId === 'string' ? agent.runtime.machineId
+              : (typeof agent?.machineId === 'string' ? agent.machineId : '');
+            if (localMachineId !== '') {
+              const joined = await joinByAccount({
+                request,
+                identity: deriveAccountKeypair(key),
+                machine: { machine_id: localMachineId, machine_name: cfg.machineName ?? null },
+                maxPolls: 10,
+              });
+              if (joined.ok === true && typeof joined.device_token === 'string') {
+                saveDeviceToken(joined.device_token, identityOptions);
+                ctx.logger?.info?.('w2m: joined by account admission (' + joined.state + ')');
+                return { paired: true, by: 'account-admission' };
+              }
+              ctx.logger?.warn?.('w2m: account admission did not admit this machine (' + joined.state + (joined.code ? '/' + joined.code : '') + ')');
+            } else {
+              ctx.logger?.warn?.('w2m: no local machine id, so the account-admission fallback cannot ask to join');
+            }
+          } catch (fallbackError) {
+            ctx.logger?.warn?.('w2m: account-admission fallback failed: ' + (fallbackError instanceof Error ? fallbackError.message : String(fallbackError)));
+          }
+        }
         ctx.logger?.warn?.(`w2m: pairing by ${by} failed${reason === null ? '' : ' (' + String(reason) + ')'}: ${error instanceof Error ? error.message : String(error)}`);
         return { paired: false, by, reason_code: reason, degrade };
       }

package/src/relay/admission.mjs

@@ -1,3 +1,4 @@
+import { randomBytes } from 'node:crypto';
 /**
  * Fleet admission: who may join a fleet, who may be removed, and by how many votes.
  *
@@ -111,8 +112,9 @@ export function createAdmission(options = {}) {
       request_id, machine_id, machine_name, account_fingerprint, fleet_id,
       state: ADMISSION.PENDING, requested_at_ms: now(), decided_at_ms: null,
       decided_by: null, auto: false,
+      poll_token: randomBytes(16).toString('hex'),
     });
-    return { ok: true, request_id, state: ADMISSION.PENDING };
+    return { ok: true, request_id, state: ADMISSION.PENDING, poll_token: requests.get(request_id).poll_token };
   }
 
   function getRequest(request_id) {
@@ -231,9 +233,18 @@ export function createAdmission(options = {}) {
     return r === undefined ? null : { removal_id: r.removal_id, target_machine_id: r.target_machine_id, state: r.state, need: r.need, snapshot: [...r.snapshot], yes: [...r.votes.values()].filter((v) => v === 'yes').length, no: [...r.votes.values()].filter((v) => v === 'no').length, votes: r.votes.size };
   }
 
+  /** Poll without a device token: the asking machine has none. The token is the credential, and it is not guessable from the id. */
+  function poll(request_id, poll_token) {
+    const r = requests.get(request_id);
+    if (r === undefined || typeof poll_token !== 'string' || poll_token === '' || r.poll_token !== poll_token) {
+      return { ok: false, code: 'NOT_FOUND' };
+    }
+    return { ok: true, request_id, state: r.state };
+  }
+
   function pendingFor() {
     return [...requests.values()].filter((r) => r.state === ADMISSION.PENDING).map((r) => ({ ...r }));
   }
 
-  return { requestAdmission, decide, tick, getRequest, pendingFor, remove, vote, getRemoval, isMember, memberOf, setOnline, seedFounder, _members: members };
+  return { requestAdmission, decide, tick, getRequest, pendingFor, poll, remove, vote, getRemoval, isMember, memberOf, setOnline, seedFounder, _members: members };
 }