@twinsearth/w2m-dsh-plugin 1.1.15 → 1.1.17

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.1.15"
+    "version": "1.1.17"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.1.15",
+      "version": "1.1.17",
       "author": {
         "name": "TwinsEarth"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.1.15",
+  "version": "1.1.17",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -2,6 +2,118 @@
 
 All notable changes to this project are documented here.
 
+## [1.1.17] — 2026-10-18
+
+**Fleet chat: messages live in a session, are refused by a byte budget rather than silently dropped, are stored
+encrypted and split across the fleet's own machines, and reach the agent as a tool.**
+
+### The store, and the rule it refuses to break
+
+`src/relay/fleet-messages.mjs` keeps messages per **session** -- the operator's scope: deleting the session deletes the
+history, and a machine joining or leaving changes who reads the flow, never what was said.
+
+The budget is the operator's formula, not a round number:
+
+    limit = min(200 MB, max(100 MB, used-in-7-days))
+
+A message over it is **refused** with the current usage attached (`FLEET_QUOTA_EXCEEDED`); nothing is silently dropped
+and nobody else's words are evicted to make room. Text only: non-strings, control characters and messages over 4 KiB are
+refused by name. Every timestamp comes from the relay's clock, because client clocks in this fleet disagree by tens of
+seconds.
+
+### Encrypted sharding with the three rules that keep it from losing data
+
+`src/relay/message-shards.mjs` seals a day's messages with AES-256-GCM under a key derived from the fleet key (domain
+separated, no new long-lived secret) and splits the result across the fleet:
+
+- **rebuildable** -- the metadata says which machine holds which part, so a reader never guesses;
+- **offline tolerated** -- every part gets **two replicas on two different machines**; one machine being down is the
+  normal case;
+- **integrity** -- each shard carries sha256 of its own bytes. A corrupt shard fails as `SHARD_CORRUPT` naming the part
+  and machine; a missing one fails as `MISSING_SHARDS` naming **which** parts; a wrong key fails as `AUTH_FAILED`
+  without returning partial plaintext.
+
+### HTTP and the notification that carries no text
+
+`POST /v1/fleet/messages` and `GET /v1/fleet/messages` sit behind the device gate: the author is the token holder, never
+a body field. Every read returns the fleet's current usage so a client can warn before a write is refused.
+`GET /v1/fleet/messages/stream` is SSE and emits **only** `{session_id, message_id, machine_id, at_ms}` -- the text is
+always fetched through the authenticated read, because a broadcast carrying text would send every message to every
+listener and make the membership check decorative.
+
+### The twelfth tool: `w2m_chat`
+
+`w2m_chat` (`send` / `list`) exposes the above to the agent. It is an ordinary MCP tool available on every transport;
+`w2m_run` remains the only host-only one.
+
+### The cost of adding a tool: seven count pins
+
+Adding a twelfth tool is not one edit. The count is pinned in **eight** places -- `README` (both languages), four test
+suites (`tools`, `p2p-plugin`, `loader-entry`, `tool-cards`), `scripts/verify-installed.mjs`'s expected list, and
+`test/claims.test.mjs`'s assertion. The first attempt fixed the ones that came to mind and left three red; the gate caught
+each. `docs/PLATFORMS.md` gained a section stating that `w2m_chat` is available over MCP.
+
+### Not verified
+
+- no client UI panel beyond the generic tool card;
+- the SSE route has module-level notification tests, not a live end-to-end stream assertion;
+- shards are produced and reassembled but **not yet transported** to machines -- that is the relay's next step, and the
+  tests say so rather than implying distribution works.
+
+### Verified
+
+Gate GREEN twice, 15 of 15. tools 120, claims 48, p2p 32, loader 10, fleet-messages 7, message-shards 9, chat-http 3,
+message-notify 3.
+
+## [1.1.16] — 2026-10-18
+
+**A machine waiting to be admitted now appears where you already answer questions -- and the README leads with how to
+install it.**
+
+### Admission in `w2m_approvals`
+
+`w2m_approvals` merges `GET /v1/fleet/admission/pending` into its list as `kind:'fleet_admission'` rows, so a machine
+asking to join shows up beside the permission requests already there. Settling an `adm-` id goes to the **relay's**
+decide endpoint, not the local permission index: admission is not an authority escalation, and pushing it through
+`approvalRequestFor` -- whose shape requires a needs-approval verdict and a capability -- would record a lie in the
+audit trail. The list is shared; the stores are not.
+
+The countdown is derived from the **relay's clock** (`rabbit_time`), never this machine's: three machines in this fleet
+disagree by tens of seconds, and a local countdown would fire the automatic approval early on a fast machine. The relay
+still owns the decision and still refuses to auto-approve with no member online.
+
+### Two defects the tests caught
+
+- the merged request omitted `rabbitUrl` and the device token, so it threw into the surrounding catch and the rows were
+  **silently missing** -- a probe showed the fetch was never called at all (`calls: []`);
+- the refusal code was read from `json.code`, but protocol errors arrive at `json.error.code`, so `reason_code` was always
+  null and a late `ALREADY_DECIDED` decision looked like a success path.
+
+Five assertions now cover that seam: rows and their fields, relay-clock countdown, an unreachable relay still showing the
+local queue, `adm-` routing reaching the relay, and a late decision reported rather than thrown.
+
+### README rewritten around installation
+
+Five routes, easiest first: DSH plugin (zero configuration), npm/MCP for any client, Claude Code marketplace, Codex, and
+the verified release tarball. Then quick start, the 11 tools registered, the `W2M_*` environment a dispatched command
+receives, the fleet model, the security posture, and an explicit **verified / not verified** table that names the approval
+popup, the four-machine `W2M_INDEX` run, the unimplemented chat channel and the macOS P2P downgrade instead of implying
+they work.
+
+Two claim checks rejected the first draft and were right: a `SHA256SUMS` release-download URL does not name a
+`<name>-<version>.tgz` asset, and "eleven tools" had to be the measured number.
+
+### Not in this release
+
+The approval **popup** (a dedicated 10-second countdown control) is not implemented -- the rules are enforced by the
+relay and this tool lists and settles the requests. The fleet chat channel remains designed (FLEET-CHAT-DESIGN.md) and
+not built. No four-machine `W2M_INDEX` run yet.
+
+### Verified
+
+Gate GREEN (final pass, 15 of 15). 2458 tests in 102 files, 2444 pass, 0 fail, 14 skip. tools 120, tool-cards 8,
+claims 47.
+
 ## [1.1.15] — 2026-10-17
 
 **A machine that cannot join the old way now proves its account, asks to join, and waits for an answer -- and the