@twinsearth/w2m-dsh-plugin 1.1.17 → 1.1.18

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.1.17"
+    "version": "1.1.18"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.1.17",
+      "version": "1.1.18",
       "author": {
         "name": "TwinsEarth"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.1.17",
+  "version": "1.1.18",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -2,6 +2,51 @@
 
 All notable changes to this project are documented here.
 
+## [1.1.18] — 2026-10-18
+
+**The developer declares this a STABLE release.** It ships the three-channel updater and the release plumbing that makes
+the beta channel real.
+
+### Three channels, resolved from the two releases that exist
+
+`w2m_update action:"status" channels:true` reports:
+
+| Channel | Source | Rule |
+|---|---|---|
+| `stable` | GitHub's `/releases/latest` | never a prerelease |
+| `beta` | the newest **prerelease**, fetched from `/releases` and filtered | exists only when one is published |
+| `latest` | whichever of the two is newer by SemVer | equal versions resolve to stable |
+
+Every decision comes from the existing `decideUpdate`, so the channel logic cannot drift from the install rule; this
+module only chooses which two releases to ask about. A missing beta is reported as `available: null` rather than
+substituted with stable — "there is no beta right now" is a fact the UI has to be able to show as a disabled button.
+
+**The channel report is opt-in.** A plain `status` remains local and offline; making every status call reach GitHub would
+slow the tool and break it behind a proxy. Asserted by a test that fails if any fetch happens.
+
+### Installing a channel, with the checksum enforced twice
+
+`w2m_update action:"apply" channel:"stable"|"beta"|"latest"`: the release's `SHA256SUMS` is downloaded, the hash for the
+tarball is required (no hash, no install), `downloadVerified` removes its temp file on any mismatch, and `installUpdate`
+receives `expectedSha256` as well and keeps its rollback path. A mismatch is not retried: it means the asset and its
+checksums disagree, which is never a transient condition.
+
+### The beta channel is a GitHub prerelease, and never npm
+
+`.github/workflows/beta.yml`: a bump is a beta by default; a beta becomes a **prerelease** (so neither GitHub nor npm
+resolves it as latest) gated by the `beta-access` environment, which requires a reviewer. There is **no `npm publish`
+line in that file** — a channel cannot leak into the default install if the publication cannot happen at all. npm
+receives a version only when the developer declares it stable, as this release does.
+
+`.github/workflows/packages.yml` mirrors a released stable version to GitHub Packages with the registry overridden **on
+the command line**, because `publishConfig.registry` would silently redirect the operator-channel publish too.
+
+### Verified
+
+Gate GREEN twice, 15/15. 2504 tests / 2490 pass / 0 fail / 14 skip. tools 122, update-channels 4, update-prerelease 2.
+The first GitHub Packages publication succeeded; the package page itself is confirmed by the operator, since the PAT has
+no `read:packages` scope to read it back.
+
 ## [1.1.17] — 2026-10-18
 
 **Fleet chat: messages live in a session, are refused by a byte budget rather than silently dropped, are stored

package/README.md

@@ -66,18 +66,18 @@ The manifests live in [`.claude-plugin/`](.claude-plugin/) and are version-locke
 # copy this block into your own codex/mcp-servers.toml
 [mcp_servers.w2m]
 command = "npx"
-args = ["-y", "@twinsearth/w2m-dsh-plugin@1.1.17", "w2m-mcp"]
+args = ["-y", "@twinsearth/w2m-dsh-plugin@1.1.18", "w2m-mcp"]
 ```
 
 ### 5. Verified release tarball (offline)
 
-From the `v1.1.17` release page download **both** files — `twinsearth-w2m-dsh-plugin-1.1.17.tgz` and `SHA256SUMS` —
+From the `v1.1.18` release page download **both** files — `twinsearth-w2m-dsh-plugin-1.1.18.tgz` and `SHA256SUMS` —
 then:
 
 ```bash
-curl -LO https://github.com/TwinsEarth/dsh-windows2macos/releases/download/v1.1.17/twinsearth-w2m-dsh-plugin-1.1.17.tgz
+curl -LO https://github.com/TwinsEarth/dsh-windows2macos/releases/download/v1.1.18/twinsearth-w2m-dsh-plugin-1.1.18.tgz
 sha256sum -c SHA256SUMS          # verify before installing, always
-npm install -g ./twinsearth-w2m-dsh-plugin-1.1.17.tgz
+npm install -g ./twinsearth-w2m-dsh-plugin-1.1.18.tgz
 ```
 
 Every release carries `SHA256SUMS` for exactly this reason. If a release is missing it, do not install that release.
@@ -198,6 +198,27 @@ Linux, npm + GitHub release + checksums consistent, end-to-end fleet runs on a r
 
 ---
 
+## Release channels
+
+Three channels, and only one of them is what \
+pm install\ gives you.
+
+| Channel | Where it comes from | Who should use it |
+|---|---|---|
+| **stable** | npm \latest\ — a version the developer declared stable | everyone; this is the default install |
+| **beta** | a GitHub **prerelease** (tarball + \SHA256SUMS\), **never on npm** | developers granted \eta-access\ who accept that it can fail |
+| **latest build** | the newest of the two, whatever its channel | a developer who wants the newest code and knows the above |
+
+A bump is a **beta by default**. npm receives a version only when the developer says, in so many words, that this one is a
+stable release: a beta is published as a prerelease (so neither GitHub nor npm ever resolves it as \latest\), it is
+downloadable only after the \eta-access\ environment approves the run, and installing it requires reading
+[SECURITY.md](SECURITY.md) and accepting the risk.
+
+There is no \
+pm publish\ line in the beta workflow. That is deliberate — a channel cannot leak to the default install if
+the publication cannot happen at all.
+---
+
 ## Links
 
 - [CHANGELOG](CHANGELOG.md) — every version, including what it deliberately did **not** ship
@@ -267,17 +288,17 @@ w2m-mcp --help
 # 把这段复制进你自己的 codex/mcp-servers.toml
 [mcp_servers.w2m]
 command = "npx"
-args = ["-y", "@twinsearth/w2m-dsh-plugin@1.1.17", "w2m-mcp"]
+args = ["-y", "@twinsearth/w2m-dsh-plugin@1.1.18", "w2m-mcp"]
 ```
 
 #### 5. 校验过的发布包（离线）
 
-从 `v1.1.17` 的 release 页面下载**两个**文件 —— `twinsearth-w2m-dsh-plugin-1.1.17.tgz` 与 `SHA256SUMS` —— 然后：
+从 `v1.1.18` 的 release 页面下载**两个**文件 —— `twinsearth-w2m-dsh-plugin-1.1.18.tgz` 与 `SHA256SUMS` —— 然后：
 
 ```bash
-curl -LO https://github.com/TwinsEarth/dsh-windows2macos/releases/download/v1.1.17/twinsearth-w2m-dsh-plugin-1.1.17.tgz
+curl -LO https://github.com/TwinsEarth/dsh-windows2macos/releases/download/v1.1.18/twinsearth-w2m-dsh-plugin-1.1.18.tgz
 sha256sum -c SHA256SUMS          # 安装前务必校验
-npm install -g ./twinsearth-w2m-dsh-plugin-1.1.17.tgz
+npm install -g ./twinsearth-w2m-dsh-plugin-1.1.18.tgz
 ```
 
 每个 release 都带 `SHA256SUMS` 正是为了这一步。若某个 release 缺少它，**不要安装该版本**。
@@ -372,6 +393,23 @@ CI 全绿、npm 与 GitHub 发布及校验和一致、在真实的 Linux/Mac/Win
 | 裁决总是 `partial` | 来自已下线机器的陈旧租约 | 1.1.2 已修：派发只对在线且未沉默的机器建租约 |
 | `P2P_PUNCH_FAILED` | NAT，或宿主密码学能力缺口 | 会自动降级到 relay 路径，结果不受影响 |
 
+### 发布通道（中文）
+
+三个通道，其中只有一个是你 \
+pm install\ 默认拿到的。
+
+| 通道 | 来源 | 适合谁 |
+|---|---|---|
+| **stable** | npm \latest\，开发者明确声明为稳定版 | 所有人；默认安装就是它 |
+| **beta** | GitHub **prerelease**（tarball + \SHA256SUMS\），**绝不进 npm** | 被授予 \eta-access\、且接受它可能失败的开发者 |
+| **最新构建** | 两者中版本较新的那个，不论通道 | 想要最新代码、并理解上述含义的开发者 |
+
+**默认的 bump 是 beta**。只有开发者明确说明"这次是稳定版"，npm 才会收到该版本：beta 以 prerelease 形式发布（因此
+GitHub 与 npm 都不会把它解析成 \latest\），只有在 \eta-access\ 环境审批通过后才能下载，安装前需阅读
+[SECURITY.md](SECURITY.md) 并自担风险。
+
+beta 工作流里**没有 \
+pm publish\ 这一行**，这是刻意的 —— 只要发布动作不可能发生，这个通道就不可能泄漏到默认安装。
 ### 链接
 
 - [CHANGELOG](CHANGELOG.md) —— 每个版本，包括它**故意没有**交付的内容

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.17", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.18", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.1.17",
+  "version": "1.1.18",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "main": "lib/index.js",
@@ -129,13 +129,13 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:admission": "node --test --test-force-exit test/admission.test.mjs",
     "test:admission-routes": "node --test --test-force-exit test/admission-routes.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs",
     "test:approval-gate": "node --test --test-force-exit test/approval-gate.test.mjs",
     "test:approval-index": "node --test --test-force-exit test/approval-index.test.mjs",
     "test:authority": "node --test --test-force-exit test/authority.test.mjs",
@@ -179,7 +179,9 @@
     "test:fleet-messages": "node --test --test-force-exit test/fleet-messages.test.mjs",
     "test:message-shards": "node --test --test-force-exit test/message-shards.test.mjs",
     "test:fleet-messages-http": "node --test --test-force-exit test/fleet-messages-http.test.mjs",
-    "test:message-notify": "node --test --test-force-exit test/message-notify.test.mjs"
+    "test:message-notify": "node --test --test-force-exit test/message-notify.test.mjs",
+    "test:update-channels": "node --test --test-force-exit test/update-channels.test.mjs",
+    "test:update-prerelease": "node --test --test-force-exit test/update-prerelease.test.mjs"
   },
   "keywords": [
     "dsh-bundle",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.1.17",
+  "version": "1.1.18",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/tools.mjs

@@ -89,7 +89,10 @@
  */
 
 import { execFile } from 'node:child_process';
-import { createHash, randomUUID } from 'node:crypto';
+
+import { resolveChannels } from './update-channels.mjs';
+import { fetchLatestRelease, fetchPrereleaseRelease, requireChecksum, downloadVerified, DEFAULT_REPO } from './update-source.mjs';
+import { installUpdate } from './update-install.mjs';import { createHash, randomUUID } from 'node:crypto';
 import { promises as fs } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -214,7 +217,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.1.17';
+const PLUGIN_VERSION = '1.1.18';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -4858,7 +4861,50 @@ export async function apply(ctx, config = {}) {
       // `jsonOutput` is a renderer, not a serialiser; the tool still owns turning its value into
       // text.
       if (action === 'status') {
-        return JSON.stringify({ ok: true, action, update: updater.describe() }, null, 2);
+        const described = { ok: true, action, update: updater.describe() };
+        // Opt-in on purpose: the plain status call is local and offline, and making it reach GitHub would slow every
+        // w2m_status and fail behind a proxy. The three channels need two API calls, so they are asked for explicitly.
+        if (args?.channels !== true) return JSON.stringify(described, null, 2);
+        const repo = (typeof process.env.W2M_UPDATE_REPO === 'string' && process.env.W2M_UPDATE_REPO.trim() !== '')
+          ? process.env.W2M_UPDATE_REPO.trim() : DEFAULT_REPO;
+        const [stableRelease, betaRelease] = await Promise.all([fetchLatestRelease({ repo }), fetchPrereleaseRelease({ repo })]);
+        const currentVersion = resolveCurrentVersion(null, process.env);
+        return JSON.stringify({ ...described, ...resolveChannels({ stable: stableRelease?.ok === true ? stableRelease : null, beta: betaRelease?.ok === true ? betaRelease : null, currentVersion }), sources: { stable: stableRelease, beta: betaRelease } }, null, 2);
+      }
+
+      /**
+       * v1.1.18: install a specific channel. The beta channel exists only as a GitHub prerelease, so it is verified here
+       * rather than trusted: the tarball sha256 must match the SHA256SUMS shipped with the same release, and
+       * downloadVerified removes its temp file on a mismatch, leaving the installed profile untouched.
+       */
+      if (action === 'apply') {
+        const channel = typeof args?.channel === 'string' ? args.channel : 'stable';
+        if (channel !== 'stable' && channel !== 'beta' && channel !== 'latest') {
+          throw new W2MError('W2M_CHANNEL', 'W2M_CHANNEL: channel must be stable, beta or latest', { hint: 'call status with channels=true to see what each channel offers' });
+        }
+        const repo = (typeof process.env.W2M_UPDATE_REPO === 'string' && process.env.W2M_UPDATE_REPO.trim() !== '')
+          ? process.env.W2M_UPDATE_REPO.trim() : DEFAULT_REPO;
+        const [stableRelease, betaRelease] = await Promise.all([fetchLatestRelease({ repo }), fetchPrereleaseRelease({ repo })]);
+        const currentVersion = resolveCurrentVersion(null, process.env);
+        const resolved = resolveChannels({ stable: stableRelease?.ok === true ? stableRelease : null, beta: betaRelease?.ok === true ? betaRelease : null, currentVersion });
+        const wanted = channel === 'latest' ? resolved.latest.channel : channel;
+        const release = wanted === 'beta' ? betaRelease : stableRelease;
+        if (release?.ok !== true) {
+          throw new W2MError('W2M_NO_CHANNEL', 'W2M_NO_CHANNEL: nothing is available on the ' + channel + ' channel', { hint: release?.code ? release.code + ': ' + release.error : undefined });
+        }
+        const sumsAsset = release.assets?.sums;
+        const tarballAsset = release.assets?.tarball;
+        if (!sumsAsset || !tarballAsset) throw new W2MError('W2M_NO_ASSETS', 'W2M_NO_ASSETS: the release carries no tarball and SHA256SUMS');
+        const sumsResponse = await fetch(sumsAsset.url, { headers: sumsAsset.headers ?? {} });
+        if (sumsResponse?.ok !== true) throw new W2MError('W2M_SUMS', 'W2M_SUMS: could not download SHA256SUMS (HTTP ' + sumsResponse?.status + ')');
+        const sha256 = requireChecksum(await sumsResponse.text(), tarballAsset.name);
+        const profileDir = args?.profile_dir ?? findProfileDir({});
+        const staged = await downloadVerified({ url: tarballAsset.url, sha256, destPath: (args?.staging_dir ?? profileDir) + '/.w2m-update/' + tarballAsset.name });
+        if (staged?.ok !== true) {
+          throw new W2MError('W2M_CHECKSUM', 'W2M_CHECKSUM: refusing to install; ' + (staged?.code ?? 'download-failed') + ' ' + (staged?.error ?? ''), { hint: 'a checksum mismatch is not retried: the asset and its SHA256SUMS disagree' });
+        }
+        const installed = await installUpdate({ tarballPath: staged.path, profileDir, expectedSha256: sha256, dryRun: args?.dry_run === true });
+        return JSON.stringify({ ok: installed?.ok === true, action, channel, version: resolved.channels[wanted]?.available ?? null, sha256, install: installed }, null, 2);
       }
       const result = await updater.check('manual');
       // `ok:false` inside `result` means "the check could not complete", never "the tool failed".

package/src/plugin/update-channels.mjs

@@ -0,0 +1,71 @@
+/**
+ * The three channels an operator chooses between, resolved from the two releases that exist.
+ *
+ * ## Why this file is thin
+ *
+ * The hard rule -- never install downwards, never install a prerelease unless asked -- is already implemented, and
+ * re-implementing it here would be the second copy that eventually disagrees. So every decision in this file comes from
+ * \`decideUpdate\`, and this module's only job is to pick WHICH TWO RELEASES the rule is asked about.
+ *
+ * ## The channels, as the operator defined them
+ *
+ *   stable  npm \`latest\`; a version the developer declared stable. Prereleases are refused.
+ *   beta    a GitHub **prerelease**. Reaching it requires \`beta-access\` approval and a signed risk acknowledgment;
+ *           npm never carries it.
+ *   latest  whichever of the two is newer by SemVer. Equal versions mean the stable one, because the answer should not
+ *           depend on which list was read first.
+ *
+ * A missing channel is reported as \`available: null\` rather than substituted: "there is no beta right now" is a fact a
+ * UI must be able to show as a disabled button, and inventing a fallback would hide it.
+ */
+import { decideUpdate } from './auto-update.mjs';
+
+/** The version a release names, as a comparable string. */
+function versionOf(release) {
+  if (release === null || typeof release !== 'object') return null;
+  const raw = release.version;
+  if (typeof raw === 'string') return raw;
+  if (raw !== null && typeof raw === 'object' && Number.isInteger(raw.major)) {
+    return [raw.major, raw.minor ?? 0, raw.patch ?? 0].join('.');
+  }
+  const tag = typeof release.tag === 'string' ? release.tag : null;
+  return tag !== null && tag.startsWith('v') ? tag.slice(1) : null;
+}
+
+/**
+ * @param {{stable?: object|null, beta?: object|null, currentVersion: string|null}} input
+ * @returns {{current_version: string|null, channels: object, latest: object}}
+ */
+export function resolveChannels({ stable = null, beta = null, currentVersion = null } = {}) {
+  const stableDecision = stable === null ? null : decideUpdate({ release: stable, currentVersion, allowPrerelease: false });
+  const betaDecision = beta === null ? null : decideUpdate({ release: beta, currentVersion, allowPrerelease: true });
+
+  const stableVersion = versionOf(stable);
+  const betaVersion = versionOf(beta);
+
+  let latest = { version: null, channel: null };
+  if (stableVersion !== null && betaVersion !== null) {
+    // Ask the same rule whether beta outranks stable. "skip" means it does not, which also covers equal versions.
+    const betaOutranksStable = decideUpdate({
+      release: beta,
+      currentVersion: stableVersion,
+      allowPrerelease: true,
+    }).action === 'install';
+    latest = betaOutranksStable
+      ? { version: betaVersion, channel: 'beta' }
+      : { version: stableVersion, channel: 'stable' };
+  } else if (betaVersion !== null) {
+    latest = { version: betaVersion, channel: 'beta' };
+  } else if (stableVersion !== null) {
+    latest = { version: stableVersion, channel: 'stable' };
+  }
+
+  return {
+    current_version: currentVersion,
+    channels: {
+      stable: { available: stableVersion, decision: stableDecision },
+      beta: { available: betaVersion, decision: betaDecision },
+    },
+    latest,
+  };
+}

package/src/plugin/update-source.mjs

@@ -684,3 +684,74 @@ export async function downloadVerified({
 }
 
 export default { fetchLatestRelease, downloadVerified, parseVersion, compareVersions, isNewer, parseSha256Sums, findChecksum };
+
+/**
+ * The beta channel's source: the newest PRERELEASE.
+ *
+ * ## Why this cannot reuse `fetchLatestRelease`
+ *
+ * That function asks GitHub for `/releases/latest`, and GitHub's own definition of "latest" **excludes prereleases**
+ * -- which is exactly right for the stable channel and exactly wrong for the beta one. The beta channel needs the
+ * opposite query: list releases, keep the prereleases, take the highest by SemVer.
+ *
+ * ## What it deliberately does not do
+ *
+ * It does not fall back to a stable release when no prerelease exists. "There is no beta right now" is a fact the update
+ * UI has to be able to show (a disabled button); substituting the stable version would make the beta button a stable
+ * button with a misleading label.
+ *
+ * @param {{repo?: string, fetchImpl?: Function, timeoutMs?: number, token?: string|null,
+ *          apiBase?: string, userAgent?: string, perPage?: number, signal?: AbortSignal|null}} [options]
+ * @returns {Promise<{ok:true, tag:string, version:object|null, prerelease:true, htmlUrl:string|null}
+ *   | {ok:false, code:string, error:string, status?:number, rateLimited?:boolean}>}
+ */
+export async function fetchPrereleaseRelease({
+  repo = DEFAULT_REPO,
+  fetchImpl = globalThis.fetch,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  token = null,
+  apiBase = DEFAULT_API_BASE,
+  userAgent = DEFAULT_USER_AGENT,
+  perPage = 30,
+  signal = null,
+} = {}) {
+  try {
+    if (typeof fetchImpl !== 'function') {
+      throw new UpdateSourceError('NO_FETCH', 'no fetch implementation available (Node.js 18+ required)');
+    }
+    if (typeof repo !== 'string' || !/^[\w.-]+\/[\w.-]+$/.test(repo)) {
+      throw new UpdateSourceError('BAD_REPO', 'repo must look like "owner/name"');
+    }
+    const base = String(apiBase).replace(/\/+$/, '');
+    const url = base + '/repos/' + repo + '/releases?per_page=' + perPage;
+    const headers = { accept: 'application/vnd.github+json', 'user-agent': userAgent };
+    if (typeof token === 'string' && token !== '') headers.authorization = 'Bearer ' + token;
+    const response = await fetchImpl(url, { headers, signal: signal ?? AbortSignal.timeout(timeoutMs) });
+    const status = response?.status ?? 0;
+    if (response?.ok !== true) {
+      const rateLimited = status === 403 || status === 429;
+      return { ok: false, status, rateLimited, code: rateLimited ? 'RATE_LIMITED' : 'HTTP_' + status, error: 'GitHub answered HTTP ' + status };
+    }
+    const list = await response.json();
+    if (!Array.isArray(list)) return { ok: false, code: 'BAD_SHAPE', error: 'the releases response was not an array' };
+    const candidates = list.filter((r) => r && r.draft !== true && r.prerelease === true && typeof r.tag_name === 'string');
+    if (candidates.length === 0) {
+      // Not an error: the beta channel is empty, and the caller must be able to say so.
+      return { ok: false, code: 'NO_PRERELEASE', error: 'there is no prerelease at the moment' };
+    }
+    let best = candidates[0];
+    for (const candidate of candidates.slice(1)) {
+      // Highest SemVer wins; `compareVersions` is the same comparison the install decision uses.
+      if (compareVersions(candidate.tag_name, best.tag_name) > 0) best = candidate;
+    }
+    return {
+      ok: true,
+      tag: best.tag_name,
+      version: parseVersion(best.tag_name),
+      prerelease: true,
+      htmlUrl: typeof best.html_url === 'string' ? best.html_url : null,
+    };
+  } catch (error) {
+    return { ok: false, code: 'FETCH_FAILED', error: String(error && error.message ? error.message : error) };
+  }
+}