@twinsearth/w2m-dsh-plugin 1.1.17 → 1.1.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.1.17",
+  "version": "1.1.19",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "main": "lib/index.js",
@@ -129,13 +129,13 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:admission": "node --test --test-force-exit test/admission.test.mjs",
     "test:admission-routes": "node --test --test-force-exit test/admission-routes.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs",
     "test:approval-gate": "node --test --test-force-exit test/approval-gate.test.mjs",
     "test:approval-index": "node --test --test-force-exit test/approval-index.test.mjs",
     "test:authority": "node --test --test-force-exit test/authority.test.mjs",
@@ -179,7 +179,9 @@
     "test:fleet-messages": "node --test --test-force-exit test/fleet-messages.test.mjs",
     "test:message-shards": "node --test --test-force-exit test/message-shards.test.mjs",
     "test:fleet-messages-http": "node --test --test-force-exit test/fleet-messages-http.test.mjs",
-    "test:message-notify": "node --test --test-force-exit test/message-notify.test.mjs"
+    "test:message-notify": "node --test --test-force-exit test/message-notify.test.mjs",
+    "test:update-channels": "node --test --test-force-exit test/update-channels.test.mjs",
+    "test:update-prerelease": "node --test --test-force-exit test/update-prerelease.test.mjs"
   },
   "keywords": [
     "dsh-bundle",

package/plugin.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.1.17",
-  "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
+  "version": "1.1.19",
+  "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [
     "agent-skills",

package/src/plugin/fleet-chat-route.mjs

@@ -0,0 +1,120 @@
+/**
+ * `/api/w2m/chat` — the browser-facing half of fleet chat (v1.1.17 shipped the tool only; this
+ * module is the missing host route the composer's chat panel calls).
+ *
+ * The route proxies the relay's device-gated `/v1/fleet/messages` endpoints with this machine's
+ * device token. The browser never sees the token: it calls this same-origin route, which is inside
+ * the host's authentication fence, exactly like `/api/w2m/target`.
+ *
+ * Wire:
+ *   GET  /api/w2m/chat?session_id=…&since_ms=…&limit=…   -> relay list shape passed through
+ *   POST /api/w2m/chat  { session_id, text }              -> relay send shape passed through
+ *
+ * Failure is a value here: `{ok:false, error, reason_code, detail}` with a non-2xx status, so the
+ * panel can print the host's own words. A relay that predates the fleet-messages routes answers
+ * 404, which is reported as such rather than as an empty conversation.
+ */
+export const CHAT_ROUTE_PATH = '/api/w2m/chat';
+export const MAX_SESSION_ID_LENGTH = 200;
+
+const NO_STORE = { 'cache-control': 'no-store' };
+
+/**
+ * Attach the route to one host's fetch registry, recording the outcome on `status`.
+ *
+ * @param {object} ctx the plugin context (a Cordis fiber)
+ * @param {{cfg: () => object, request: Function, resolveToken: () => Promise<string|null>}} deps
+ * @returns {{mounted: boolean, reason: string|null}}
+ */
+export function registerChatRoutes(ctx, deps) {
+  const status = { mounted: false, reason: 'the host has no Connection service' };
+  if (typeof ctx?.inject !== 'function') return status;
+  ctx.inject(['connection'], (webCtx) => {
+    const registry = webCtx?.connection?.fetch;
+    if (registry === undefined || registry === null || typeof registry.register !== 'function') {
+      status.reason = 'the connection service carries no fetch registry';
+      return;
+    }
+    try {
+      registry.register({
+        path: CHAT_ROUTE_PATH,
+        methods: ['GET', 'POST'],
+        requestBody: 'buffered',
+        fetch: async (request) => {
+          const refuse = (httpStatus, reasonCode, error, detail) =>
+            Response.json({ ok: false, error, reason_code: reasonCode, detail }, { status: httpStatus, headers: NO_STORE });
+
+          if (request.method !== 'GET' && request.method !== 'POST') {
+            return refuse(405, 'CHAT_METHOD_NOT_ALLOWED', `${request.method} is not answered here`, 'GET lists a session; POST sends a message');
+          }
+
+          const url = new URL(request.url);
+          const sessionIdOf = (value) => (typeof value === 'string' ? value.trim() : '');
+          let sessionId = '';
+          let text = null;
+          if (request.method === 'GET') {
+            sessionId = sessionIdOf(url.searchParams.get('session_id'));
+          } else {
+            let body;
+            try {
+              body = await request.json();
+            } catch {
+              return refuse(400, 'CHAT_BODY_NOT_JSON', 'body is not JSON', 'send {"session_id":"…","text":"…"}');
+            }
+            sessionId = sessionIdOf(body?.session_id);
+            text = typeof body?.text === 'string' ? body.text : null;
+          }
+          if (sessionId === '') return refuse(400, 'CHAT_SESSION_ID_REQUIRED', '`session_id` is required', 'chat is scoped to one conversation');
+          if (sessionId.length > MAX_SESSION_ID_LENGTH) {
+            return refuse(400, 'CHAT_SESSION_ID_TOO_LONG', `\`session_id\` must be at most ${MAX_SESSION_ID_LENGTH} characters`, 'send the id the host gave this session');
+          }
+
+          const cfg = deps.cfg();
+          const rabbitUrl = cfg?.rabbitUrl ?? null;
+          if (rabbitUrl === null) return refuse(503, 'CHAT_NO_RELAY', 'no relay is configured', 'set rabbitUrl in the profile patch');
+          let token;
+          try {
+            token = await deps.resolveToken();
+          } catch (error) {
+            return refuse(503, 'CHAT_UNPAIRED', `this machine has no device token: ${error instanceof Error ? error.message : String(error)}`, 'pair the machine first (autoStartAgent or a pairing code)');
+          }
+          if (typeof token !== 'string' || token === '') {
+            return refuse(503, 'CHAT_UNPAIRED', 'this machine has no device token', 'pair the machine first (autoStartAgent or a pairing code)');
+          }
+
+          try {
+            if (request.method === 'GET') {
+              const query = { session_id: sessionId };
+              const sinceMs = url.searchParams.get('since_ms');
+              const limit = url.searchParams.get('limit');
+              if (sinceMs !== null && /^\d+$/.test(sinceMs)) query.since_ms = sinceMs;
+              if (limit !== null && /^\d+$/.test(limit)) query.limit = limit;
+              const listed = await deps.request({ rabbitUrl, token, method: 'GET', pathname: '/v1/fleet/messages', query, signal: request.signal });
+              if (listed?.ok !== true) {
+                const code = listed?.json?.error?.code ?? listed?.error?.code ?? 'CHAT_LIST_REFUSED';
+                const message = listed?.json?.error?.message ?? listed?.error?.message ?? `the relay answered HTTP ${listed?.status ?? 0}`;
+                return refuse(listed?.status === 404 ? 502 : 502, code, message, 'the relay must run a version with /v1/fleet/messages (>= 1.1.17) and be restarted');
+              }
+              return Response.json({ ...listed.json, ok: true }, { headers: NO_STORE });
+            }
+            const posted = await deps.request({ rabbitUrl, token, method: 'POST', pathname: '/v1/fleet/messages', body: { session_id: sessionId, text: text ?? '' }, signal: request.signal });
+            if (posted?.ok !== true) {
+              const code = posted?.json?.error?.code ?? posted?.error?.code ?? 'CHAT_SEND_REFUSED';
+              const message = posted?.json?.error?.message ?? posted?.error?.message ?? `the relay answered HTTP ${posted?.status ?? 0}`;
+              return refuse(posted?.status === 404 ? 502 : 400, code, message, 'quota, size and non-text are each refused by name; 404 means the relay predates fleet chat');
+            }
+            return Response.json({ ...posted.json, ok: true }, { headers: NO_STORE });
+          } catch (error) {
+            return refuse(502, 'CHAT_RELAY_ERROR', `the relay call failed: ${error instanceof Error ? error.message : String(error)}`, 'check the relay and this machine token');
+          }
+        },
+      });
+      status.mounted = true;
+      status.reason = null;
+    } catch (error) {
+      status.reason = error instanceof Error ? error.message : String(error);
+      ctx?.logger?.warn?.(`w2m: the fleet chat route is inactive — ${status.reason}`);
+    }
+  });
+  return status;
+}

package/src/plugin/tools.mjs

@@ -89,7 +89,10 @@
  */
 
 import { execFile } from 'node:child_process';
-import { createHash, randomUUID } from 'node:crypto';
+
+import { resolveChannels } from './update-channels.mjs';
+import { fetchLatestRelease, fetchPrereleaseRelease, requireChecksum, downloadVerified, DEFAULT_REPO } from './update-source.mjs';
+import { installUpdate } from './update-install.mjs';import { createHash, randomUUID } from 'node:crypto';
 import { promises as fs } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -177,6 +180,9 @@ import {
   sessionKeyFor,
   TARGET_ROUTE_PATH,
 } from './fleet-target.mjs';
+// v1.1.17 chat: the host route behind the composer's fleet-chat panel. The relay side and the
+// `w2m_chat` tool shipped first; this is the browser-facing half that was still missing.
+import { registerChatRoutes } from './fleet-chat-route.mjs';
 // v0.7.0: the LAN hint layer. Imported here and used in exactly one place (`w2m_devices`); see the
 // module header for why a discovered device is a candidate to *ask* and never an authorisation.
 import { createDiscoverySource } from './mdns-discover.mjs';
@@ -214,7 +220,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.1.17';
+const PLUGIN_VERSION = '1.1.19';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -3398,6 +3404,20 @@ export async function apply(ctx, config = {}) {
     resolveToken,
   });
 
+  // The composer's fleet-chat panel: `GET/POST /api/w2m/chat`, proxied to the relay's device-gated
+  // `/v1/fleet/messages`. Optional like the target routes — a host without Connection keeps every
+  // tool and the panel is simply not mounted.
+  const chatRoutes = registerChatRoutes(ctx, {
+    cfg: () => cfg,
+    request,
+    resolveToken: () => resolveToken(cfg),
+  });
+  if (chatRoutes.mounted !== true) {
+    // Named rather than silent: a composition without the fetch registry loses the chat panel while every tool still
+    // works, and "the panel is missing" with no line anywhere is the shape this project keeps paying for.
+    ctx.logger?.warn?.('w2m: the fleet-chat composer route is not mounted (' + (chatRoutes.reason ?? 'unknown reason') + ')');
+  }
+
   // The LAN discovery source (v0.7.0). Constructing it binds nothing: a socket is opened only when a
   // scan is asked for, and only `w2m_devices` asks. A network where multicast is unavailable produces
   // one log line and an `available: false` block in the answer - never a failure of the tool.
@@ -4858,7 +4878,50 @@ export async function apply(ctx, config = {}) {
       // `jsonOutput` is a renderer, not a serialiser; the tool still owns turning its value into
       // text.
       if (action === 'status') {
-        return JSON.stringify({ ok: true, action, update: updater.describe() }, null, 2);
+        const described = { ok: true, action, update: updater.describe() };
+        // Opt-in on purpose: the plain status call is local and offline, and making it reach GitHub would slow every
+        // w2m_status and fail behind a proxy. The three channels need two API calls, so they are asked for explicitly.
+        if (args?.channels !== true) return JSON.stringify(described, null, 2);
+        const repo = (typeof process.env.W2M_UPDATE_REPO === 'string' && process.env.W2M_UPDATE_REPO.trim() !== '')
+          ? process.env.W2M_UPDATE_REPO.trim() : DEFAULT_REPO;
+        const [stableRelease, betaRelease] = await Promise.all([fetchLatestRelease({ repo }), fetchPrereleaseRelease({ repo })]);
+        const currentVersion = resolveCurrentVersion(null, process.env);
+        return JSON.stringify({ ...described, ...resolveChannels({ stable: stableRelease?.ok === true ? stableRelease : null, beta: betaRelease?.ok === true ? betaRelease : null, currentVersion }), sources: { stable: stableRelease, beta: betaRelease } }, null, 2);
+      }
+
+      /**
+       * v1.1.18: install a specific channel. The beta channel exists only as a GitHub prerelease, so it is verified here
+       * rather than trusted: the tarball sha256 must match the SHA256SUMS shipped with the same release, and
+       * downloadVerified removes its temp file on a mismatch, leaving the installed profile untouched.
+       */
+      if (action === 'apply') {
+        const channel = typeof args?.channel === 'string' ? args.channel : 'stable';
+        if (channel !== 'stable' && channel !== 'beta' && channel !== 'latest') {
+          throw new W2MError('W2M_CHANNEL', 'W2M_CHANNEL: channel must be stable, beta or latest', { hint: 'call status with channels=true to see what each channel offers' });
+        }
+        const repo = (typeof process.env.W2M_UPDATE_REPO === 'string' && process.env.W2M_UPDATE_REPO.trim() !== '')
+          ? process.env.W2M_UPDATE_REPO.trim() : DEFAULT_REPO;
+        const [stableRelease, betaRelease] = await Promise.all([fetchLatestRelease({ repo }), fetchPrereleaseRelease({ repo })]);
+        const currentVersion = resolveCurrentVersion(null, process.env);
+        const resolved = resolveChannels({ stable: stableRelease?.ok === true ? stableRelease : null, beta: betaRelease?.ok === true ? betaRelease : null, currentVersion });
+        const wanted = channel === 'latest' ? resolved.latest.channel : channel;
+        const release = wanted === 'beta' ? betaRelease : stableRelease;
+        if (release?.ok !== true) {
+          throw new W2MError('W2M_NO_CHANNEL', 'W2M_NO_CHANNEL: nothing is available on the ' + channel + ' channel', { hint: release?.code ? release.code + ': ' + release.error : undefined });
+        }
+        const sumsAsset = release.assets?.sums;
+        const tarballAsset = release.assets?.tarball;
+        if (!sumsAsset || !tarballAsset) throw new W2MError('W2M_NO_ASSETS', 'W2M_NO_ASSETS: the release carries no tarball and SHA256SUMS');
+        const sumsResponse = await fetch(sumsAsset.url, { headers: sumsAsset.headers ?? {} });
+        if (sumsResponse?.ok !== true) throw new W2MError('W2M_SUMS', 'W2M_SUMS: could not download SHA256SUMS (HTTP ' + sumsResponse?.status + ')');
+        const sha256 = requireChecksum(await sumsResponse.text(), tarballAsset.name);
+        const profileDir = args?.profile_dir ?? findProfileDir({});
+        const staged = await downloadVerified({ url: tarballAsset.url, sha256, destPath: (args?.staging_dir ?? profileDir) + '/.w2m-update/' + tarballAsset.name });
+        if (staged?.ok !== true) {
+          throw new W2MError('W2M_CHECKSUM', 'W2M_CHECKSUM: refusing to install; ' + (staged?.code ?? 'download-failed') + ' ' + (staged?.error ?? ''), { hint: 'a checksum mismatch is not retried: the asset and its SHA256SUMS disagree' });
+        }
+        const installed = await installUpdate({ tarballPath: staged.path, profileDir, expectedSha256: sha256, dryRun: args?.dry_run === true });
+        return JSON.stringify({ ok: installed?.ok === true, action, channel, version: resolved.channels[wanted]?.available ?? null, sha256, install: installed }, null, 2);
       }
       const result = await updater.check('manual');
       // `ok:false` inside `result` means "the check could not complete", never "the tool failed".
@@ -6274,10 +6337,14 @@ export async function apply(ctx, config = {}) {
       const action = typeof args?.action === 'string' ? args.action : 'list';
       const sessionId = typeof args?.session_id === 'string' ? args.session_id.trim() : '';
       if (sessionId === '') throw new W2MError('W2M_CHAT_SESSION', 'W2M_CHAT_SESSION: session_id is required', { hint: 'chat is scoped to a conversation' });
-      const device = await readDevice(cfg);
       const rabbitUrl = cfg.rabbitUrl ?? null;
       if (rabbitUrl === null) throw new W2MError('W2M_NO_RELAY', 'W2M_NO_RELAY: no relay is configured, so chat cannot be reached', { hint: 'set rabbitUrl in the profile patch' });
-      const token = requireToken(device);
+      // resolveToken, not readDevice: readDevice returns an empty identity whenever `stateDir` is
+      // unset, even though this machine's device.json exists at the default DSH_HOME path — every
+      // other device-authenticated tool goes through resolveToken for exactly that reason, and this
+      // one reported W2M_NO_TOKEN on a machine that was paired and answering every other call.
+      const token = await resolveToken(cfg);
+      if (token === null) throw new W2MError('W2M_NO_TOKEN', 'W2M_NO_TOKEN: this machine has no device token, so chat cannot be authenticated', { hint: 'pair this machine first (autoStartAgent or a pairing code), then retry' });
       if (action === 'send') {
         const posted = await request({ rabbitUrl, token, signal: exec?.signal, method: 'POST', pathname: '/v1/fleet/messages', body: { session_id: sessionId, text: typeof args?.text === 'string' ? args.text : '' } });
         if (posted?.ok !== true) {

package/src/plugin/update-channels.mjs

@@ -0,0 +1,71 @@
+/**
+ * The three channels an operator chooses between, resolved from the two releases that exist.
+ *
+ * ## Why this file is thin
+ *
+ * The hard rule -- never install downwards, never install a prerelease unless asked -- is already implemented, and
+ * re-implementing it here would be the second copy that eventually disagrees. So every decision in this file comes from
+ * \`decideUpdate\`, and this module's only job is to pick WHICH TWO RELEASES the rule is asked about.
+ *
+ * ## The channels, as the operator defined them
+ *
+ *   stable  npm \`latest\`; a version the developer declared stable. Prereleases are refused.
+ *   beta    a GitHub **prerelease**. Reaching it requires \`beta-access\` approval and a signed risk acknowledgment;
+ *           npm never carries it.
+ *   latest  whichever of the two is newer by SemVer. Equal versions mean the stable one, because the answer should not
+ *           depend on which list was read first.
+ *
+ * A missing channel is reported as \`available: null\` rather than substituted: "there is no beta right now" is a fact a
+ * UI must be able to show as a disabled button, and inventing a fallback would hide it.
+ */
+import { decideUpdate } from './auto-update.mjs';
+
+/** The version a release names, as a comparable string. */
+function versionOf(release) {
+  if (release === null || typeof release !== 'object') return null;
+  const raw = release.version;
+  if (typeof raw === 'string') return raw;
+  if (raw !== null && typeof raw === 'object' && Number.isInteger(raw.major)) {
+    return [raw.major, raw.minor ?? 0, raw.patch ?? 0].join('.');
+  }
+  const tag = typeof release.tag === 'string' ? release.tag : null;
+  return tag !== null && tag.startsWith('v') ? tag.slice(1) : null;
+}
+
+/**
+ * @param {{stable?: object|null, beta?: object|null, currentVersion: string|null}} input
+ * @returns {{current_version: string|null, channels: object, latest: object}}
+ */
+export function resolveChannels({ stable = null, beta = null, currentVersion = null } = {}) {
+  const stableDecision = stable === null ? null : decideUpdate({ release: stable, currentVersion, allowPrerelease: false });
+  const betaDecision = beta === null ? null : decideUpdate({ release: beta, currentVersion, allowPrerelease: true });
+
+  const stableVersion = versionOf(stable);
+  const betaVersion = versionOf(beta);
+
+  let latest = { version: null, channel: null };
+  if (stableVersion !== null && betaVersion !== null) {
+    // Ask the same rule whether beta outranks stable. "skip" means it does not, which also covers equal versions.
+    const betaOutranksStable = decideUpdate({
+      release: beta,
+      currentVersion: stableVersion,
+      allowPrerelease: true,
+    }).action === 'install';
+    latest = betaOutranksStable
+      ? { version: betaVersion, channel: 'beta' }
+      : { version: stableVersion, channel: 'stable' };
+  } else if (betaVersion !== null) {
+    latest = { version: betaVersion, channel: 'beta' };
+  } else if (stableVersion !== null) {
+    latest = { version: stableVersion, channel: 'stable' };
+  }
+
+  return {
+    current_version: currentVersion,
+    channels: {
+      stable: { available: stableVersion, decision: stableDecision },
+      beta: { available: betaVersion, decision: betaDecision },
+    },
+    latest,
+  };
+}

package/src/plugin/update-source.mjs

@@ -684,3 +684,74 @@ export async function downloadVerified({
 }
 
 export default { fetchLatestRelease, downloadVerified, parseVersion, compareVersions, isNewer, parseSha256Sums, findChecksum };
+
+/**
+ * The beta channel's source: the newest PRERELEASE.
+ *
+ * ## Why this cannot reuse `fetchLatestRelease`
+ *
+ * That function asks GitHub for `/releases/latest`, and GitHub's own definition of "latest" **excludes prereleases**
+ * -- which is exactly right for the stable channel and exactly wrong for the beta one. The beta channel needs the
+ * opposite query: list releases, keep the prereleases, take the highest by SemVer.
+ *
+ * ## What it deliberately does not do
+ *
+ * It does not fall back to a stable release when no prerelease exists. "There is no beta right now" is a fact the update
+ * UI has to be able to show (a disabled button); substituting the stable version would make the beta button a stable
+ * button with a misleading label.
+ *
+ * @param {{repo?: string, fetchImpl?: Function, timeoutMs?: number, token?: string|null,
+ *          apiBase?: string, userAgent?: string, perPage?: number, signal?: AbortSignal|null}} [options]
+ * @returns {Promise<{ok:true, tag:string, version:object|null, prerelease:true, htmlUrl:string|null}
+ *   | {ok:false, code:string, error:string, status?:number, rateLimited?:boolean}>}
+ */
+export async function fetchPrereleaseRelease({
+  repo = DEFAULT_REPO,
+  fetchImpl = globalThis.fetch,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  token = null,
+  apiBase = DEFAULT_API_BASE,
+  userAgent = DEFAULT_USER_AGENT,
+  perPage = 30,
+  signal = null,
+} = {}) {
+  try {
+    if (typeof fetchImpl !== 'function') {
+      throw new UpdateSourceError('NO_FETCH', 'no fetch implementation available (Node.js 18+ required)');
+    }
+    if (typeof repo !== 'string' || !/^[\w.-]+\/[\w.-]+$/.test(repo)) {
+      throw new UpdateSourceError('BAD_REPO', 'repo must look like "owner/name"');
+    }
+    const base = String(apiBase).replace(/\/+$/, '');
+    const url = base + '/repos/' + repo + '/releases?per_page=' + perPage;
+    const headers = { accept: 'application/vnd.github+json', 'user-agent': userAgent };
+    if (typeof token === 'string' && token !== '') headers.authorization = 'Bearer ' + token;
+    const response = await fetchImpl(url, { headers, signal: signal ?? AbortSignal.timeout(timeoutMs) });
+    const status = response?.status ?? 0;
+    if (response?.ok !== true) {
+      const rateLimited = status === 403 || status === 429;
+      return { ok: false, status, rateLimited, code: rateLimited ? 'RATE_LIMITED' : 'HTTP_' + status, error: 'GitHub answered HTTP ' + status };
+    }
+    const list = await response.json();
+    if (!Array.isArray(list)) return { ok: false, code: 'BAD_SHAPE', error: 'the releases response was not an array' };
+    const candidates = list.filter((r) => r && r.draft !== true && r.prerelease === true && typeof r.tag_name === 'string');
+    if (candidates.length === 0) {
+      // Not an error: the beta channel is empty, and the caller must be able to say so.
+      return { ok: false, code: 'NO_PRERELEASE', error: 'there is no prerelease at the moment' };
+    }
+    let best = candidates[0];
+    for (const candidate of candidates.slice(1)) {
+      // Highest SemVer wins; `compareVersions` is the same comparison the install decision uses.
+      if (compareVersions(candidate.tag_name, best.tag_name) > 0) best = candidate;
+    }
+    return {
+      ok: true,
+      tag: best.tag_name,
+      version: parseVersion(best.tag_name),
+      prerelease: true,
+      htmlUrl: typeof best.html_url === 'string' ? best.html_url : null,
+    };
+  } catch (error) {
+    return { ok: false, code: 'FETCH_FAILED', error: String(error && error.message ? error.message : error) };
+  }
+}