@twinsearth/w2m-dsh-plugin 1.1.18 → 1.1.19

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.1.18"
+    "version": "1.1.19"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.1.18",
+      "version": "1.1.19",
       "author": {
         "name": "TwinsEarth"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.1.18",
+  "version": "1.1.19",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to this project are documented here.
 
+## [1.1.19] — 2026-10-18
+
+**The chat panel exists in the browser.**
+
+Fleet chat shipped as a tool in 1.1.17 and as a relay API in the same release. What was missing was the half a user actually
+touches: a control in the composer. This release adds it.
+
+- **The panel**: a "fleet chat" control beside the target-machine control opens a floating panel listing this session's
+  messages, with the relay usage shown next to them, a multi-line input, and a send button. It refreshes while open.
+- **The host route**: the browser never holds a device token. It calls `/api/w2m/chat` on the host, which proxies to the
+  relay's device-gated `/v1/fleet/messages` — so the token stays in the host process.
+- **Tool bug fixed**: `w2m_chat` resolved its token through `readDevice(cfg)`, which fails when `stateDir` is unset even
+  though a `device.json` exists elsewhere; it now resolves exactly like every other tool (`resolveToken(cfg)`).
+- **Theme discipline**: the panel carries no literal colours, only `--dsw-*` tokens, because a literal is wrong in one of
+  the two themes. The stylesheet test caught the one literal (`#fff` on the send button).
+
+The relay on the fleet host was upgraded to this line of code in the same step: it had been running 1.0.14, which has no
+`/v1/fleet/messages` route at all, so the panel would have shown "no route" forever. Verified after the restart: an
+authenticated GET returns 200 (it returned 404 before), unauthenticated returns 401, and the fleet came back with the same
+eight devices and no re-pairing.
+
+### Not in this release
+
+The coloured per-machine avatars for chat messages are designed and not built. The panel shows one style for every
+machine today.
+
+### Verified
+
+Gate GREEN, 15 of 15. 2489 tests / 2471+ pass. client-bundle 25, tools 122, claims, portable-plugins 10.
+
 ## [1.1.18] — 2026-10-18
 
 **The developer declares this a STABLE release.** It ships the three-channel updater and the release plumbing that makes

package/README.md

@@ -66,18 +66,18 @@ The manifests live in [`.claude-plugin/`](.claude-plugin/) and are version-locke
 # copy this block into your own codex/mcp-servers.toml
 [mcp_servers.w2m]
 command = "npx"
-args = ["-y", "@twinsearth/w2m-dsh-plugin@1.1.18", "w2m-mcp"]
+args = ["-y", "@twinsearth/w2m-dsh-plugin@1.1.19", "w2m-mcp"]
 ```
 
 ### 5. Verified release tarball (offline)
 
-From the `v1.1.18` release page download **both** files — `twinsearth-w2m-dsh-plugin-1.1.18.tgz` and `SHA256SUMS` —
+From the `v1.1.19` release page download **both** files — `twinsearth-w2m-dsh-plugin-1.1.19.tgz` and `SHA256SUMS` —
 then:
 
 ```bash
-curl -LO https://github.com/TwinsEarth/dsh-windows2macos/releases/download/v1.1.18/twinsearth-w2m-dsh-plugin-1.1.18.tgz
+curl -LO https://github.com/TwinsEarth/dsh-windows2macos/releases/download/v1.1.19/twinsearth-w2m-dsh-plugin-1.1.19.tgz
 sha256sum -c SHA256SUMS          # verify before installing, always
-npm install -g ./twinsearth-w2m-dsh-plugin-1.1.18.tgz
+npm install -g ./twinsearth-w2m-dsh-plugin-1.1.19.tgz
 ```
 
 Every release carries `SHA256SUMS` for exactly this reason. If a release is missing it, do not install that release.
@@ -288,17 +288,17 @@ w2m-mcp --help
 # 把这段复制进你自己的 codex/mcp-servers.toml
 [mcp_servers.w2m]
 command = "npx"
-args = ["-y", "@twinsearth/w2m-dsh-plugin@1.1.18", "w2m-mcp"]
+args = ["-y", "@twinsearth/w2m-dsh-plugin@1.1.19", "w2m-mcp"]
 ```
 
 #### 5. 校验过的发布包（离线）
 
-从 `v1.1.18` 的 release 页面下载**两个**文件 —— `twinsearth-w2m-dsh-plugin-1.1.18.tgz` 与 `SHA256SUMS` —— 然后：
+从 `v1.1.19` 的 release 页面下载**两个**文件 —— `twinsearth-w2m-dsh-plugin-1.1.19.tgz` 与 `SHA256SUMS` —— 然后：
 
 ```bash
-curl -LO https://github.com/TwinsEarth/dsh-windows2macos/releases/download/v1.1.18/twinsearth-w2m-dsh-plugin-1.1.18.tgz
+curl -LO https://github.com/TwinsEarth/dsh-windows2macos/releases/download/v1.1.19/twinsearth-w2m-dsh-plugin-1.1.19.tgz
 sha256sum -c SHA256SUMS          # 安装前务必校验
-npm install -g ./twinsearth-w2m-dsh-plugin-1.1.18.tgz
+npm install -g ./twinsearth-w2m-dsh-plugin-1.1.19.tgz
 ```
 
 每个 release 都带 `SHA256SUMS` 正是为了这一步。若某个 release 缺少它，**不要安装该版本**。

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.18", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.19", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/lib/client.js

@@ -283,6 +283,24 @@ window.__ModuleLoader__.load({
       '.w2mTarget_name{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}',
       '.w2mTarget_detail{margin-left:auto;flex:none;color:var(--dsw-alias-label-tertiary);font-size:11px;font-weight:400}',
       '.w2mTarget_option:disabled .w2mTarget_detail{color:var(--dsw-alias-label-caption)}',
+      '.w2mChat{position:relative;display:inline-flex;align-items:center}',
+      '.w2mChat_trigger{display:inline-flex;align-items:center;gap:4px;height:28px;padding:0 8px;border:none;border-radius:var(--dsw-radius-sm);background:transparent;color:var(--dsw-alias-label-secondary);font-size:13px;font-weight:500;line-height:20px;cursor:pointer;outline:none}',
+      '.w2mChat_trigger:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}',
+      '.w2mChat_trigger:disabled{color:var(--dsw-alias-label-dimmed);cursor:default}',
+      '.w2mChat_panel{position:fixed;right:16px;bottom:88px;z-index:60;display:flex;flex-direction:column;width:340px;max-height:420px;border-radius:var(--dsw-radius-lg);border:.5px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-1);box-shadow:var(--dsw-elevation-soft);font-size:13px;line-height:20px;color:var(--dsw-alias-label-primary);overflow:hidden}',
+      '.w2mChat_head{display:flex;align-items:center;gap:8px;padding:8px 10px;border-bottom:.5px solid var(--dsw-alias-border-l2);font-weight:600}',
+      '.w2mChat_usage{margin-left:auto;font-weight:400;color:var(--dsw-alias-label-tertiary);font-size:11px}',
+      '.w2mChat_close{border:none;background:transparent;color:var(--dsw-alias-label-secondary);cursor:pointer;font-size:16px;line-height:16px;padding:0 2px}',
+      '.w2mChat_list{flex:1;overflow-y:auto;padding:8px 10px;display:flex;flex-direction:column;gap:8px;min-height:120px}',
+      '.w2mChat_empty{color:var(--dsw-alias-label-tertiary)}',
+      '.w2mChat_msg{display:flex;flex-direction:column;gap:2px}',
+      '.w2mChat_meta{color:var(--dsw-alias-label-tertiary);font-size:11px}',
+      '.w2mChat_text{white-space:pre-wrap;word-break:break-word}',
+      '.w2mChat_compose{display:flex;gap:8px;padding:8px 10px;border-top:.5px solid var(--dsw-alias-border-l2);align-items:flex-end}',
+      '.w2mChat_input{flex:1;resize:none;box-sizing:border-box;font:inherit;color:inherit;background:var(--dsw-alias-bg-layer-2);border:.5px solid var(--dsw-alias-border-l2);border-radius:var(--dsw-radius-sm);padding:6px 8px;outline:none;min-height:38px;max-height:96px}',
+      '.w2mChat_send{flex:none;height:28px;padding:0 10px;border:none;border-radius:var(--dsw-radius-sm);background:var(--dsw-alias-state-business-primary);color:var(--dsw-alias-text-on-business);font:inherit;font-weight:500;cursor:pointer}',
+      '.w2mChat_send:disabled{opacity:.5;cursor:default}',
+      '.w2mChat_error{padding:0 10px 8px;color:var(--dsw-alias-state-error-primary);font-size:11px}',
     ].join('');
 
     /**
@@ -530,6 +548,148 @@ window.__ModuleLoader__.load({
       ]);
     }
 
+    // -------------------------------------------------------------------------------------------
+    // Fleet chat panel (v1.1.18 addition: the missing browser half of `w2m_chat`)
+    // -------------------------------------------------------------------------------------------
+    //
+    // v1.1.17 shipped fleet chat as a tool only — its own CHANGELOG records "no client UI panel
+    // beyond the generic tool card". This is that panel: a session-scoped broadcast board the
+    // operator and the agent share. Every read and write goes through the host route
+    // `/api/w2m/chat` (host-side `fleet-chat-route.mjs`), so the device token stays in the host
+    // process and this file never holds a credential.
+    const CHAT_ROUTE = '/api/w2m/chat';
+
+    /** One JSON call to the host chat route; a refusal is a value, not an exception. */
+    async function chatCall(options) {
+      let response;
+      try {
+        response = await fetch(options.url, options.init);
+      } catch (error) {
+        return { ok: false, error: `the plugin could not be reached: ${error instanceof Error ? error.message : String(error)}` };
+      }
+      let body = null;
+      try {
+        body = await response.json();
+      } catch {
+        return { ok: false, error: `the plugin answered HTTP ${response.status} with a body that is not JSON` };
+      }
+      if (response.status === 404) return { ok: false, error: 'this host does not serve the W2M chat route' };
+      if (response.ok !== true || body?.ok === false) {
+        return { ok: false, error: typeof body?.error === 'string' ? body.error : `HTTP ${response.status}` };
+      }
+      return { ok: true, state: body };
+    }
+
+    /**
+     * The fleet-chat control: opens a panel with the session's messages, a compose box and the
+     * relay's current usage. The text stays on the relay; this component keeps only the last view.
+     */
+    function FleetChat({ sessionId }) {
+      const [open, setOpen] = React.useState(false);
+      const [messages, setMessages] = React.useState([]);
+      const [usage, setUsage] = React.useState(null);
+      const [text, setText] = React.useState('');
+      const [error, setError] = React.useState(null);
+      const [busy, setBusy] = React.useState(false);
+
+      const load = React.useCallback(async (signal) => {
+        if (typeof sessionId !== 'string' || sessionId === '') return;
+        const result = await chatCall({
+          url: `${CHAT_ROUTE}?session_id=${encodeURIComponent(sessionId)}&limit=50`,
+          init: { method: 'GET', credentials: 'same-origin', headers: { accept: 'application/json' }, signal },
+        });
+        if (result.ok) {
+          setMessages(Array.isArray(result.state.messages) ? result.state.messages : []);
+          setUsage(result.state.usage ?? null);
+          setError(null);
+        } else {
+          setError(result.error);
+        }
+      }, [sessionId]);
+
+      React.useEffect(() => {
+        if (!open) return undefined;
+        const controller = new AbortController();
+        load(controller.signal);
+        const timer = setInterval(() => load(controller.signal), 3000);
+        return () => {
+          controller.abort();
+          clearInterval(timer);
+        };
+      }, [open, load]);
+
+      const send = React.useCallback(async () => {
+        const value = text.trim();
+        if (value === '' || busy) return undefined;
+        setBusy(true);
+        const result = await chatCall({
+          url: CHAT_ROUTE,
+          init: {
+            method: 'POST',
+            credentials: 'same-origin',
+            headers: { 'content-type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify({ session_id: sessionId, text: value }),
+          },
+        });
+        setBusy(false);
+        if (result.ok) {
+          setText('');
+          await load();
+        } else {
+          setError(result.error);
+        }
+        return undefined;
+      }, [busy, load, sessionId, text]);
+
+      const disabled = typeof sessionId !== 'string' || sessionId === '';
+      const usageText = usage === null ? null : `${Math.round((usage.used_24h_bytes ?? 0) / 1024)} KiB/24h · ${usage.messages ?? 0} 条`;
+      const machineLabel = (message) => {
+        const id = typeof message?.machine_id === 'string' ? message.machine_id : '?';
+        return id.length > 12 ? `${id.slice(0, 8)}…` : id;
+      };
+      const timeLabel = (message) => (Number.isFinite(message?.at_ms) ? new Date(message.at_ms).toLocaleTimeString() : '');
+
+      return h('span', { className: 'w2mChat' },
+        h('button', {
+          type: 'button',
+          className: 'w2mChat_trigger',
+          title: '编队聊天（本会话广播）',
+          'aria-expanded': open,
+          disabled,
+          onClick: () => setOpen((value) => !value),
+        }, '💬', h('span', { className: 'w2mChat_label' }, '编队聊天')),
+        open
+          ? h('div', { className: 'w2mChat_panel', role: 'dialog', 'aria-label': '编队聊天' },
+              h('div', { className: 'w2mChat_head' },
+                h('span', null, '编队聊天'),
+                usageText === null ? null : h('span', { className: 'w2mChat_usage' }, usageText),
+                h('button', { type: 'button', className: 'w2mChat_close', title: '关闭', onClick: () => setOpen(false) }, '×')),
+              h('div', { className: 'w2mChat_list' },
+                error !== null ? h('div', { className: 'w2mChat_error' }, error) : null,
+                messages.length === 0
+                  ? (error === null ? h('div', { className: 'w2mChat_empty' }, '本会话还没有消息') : null)
+                  : messages.map((message) => h('div', { key: message?.message_id ?? `${message?.machine_id}:${message?.at_ms}`, className: 'w2mChat_msg' },
+                      h('div', { className: 'w2mChat_meta' }, `${machineLabel(message)} · ${timeLabel(message)}`),
+                      h('div', { className: 'w2mChat_text' }, message?.text ?? '')))),
+              h('div', { className: 'w2mChat_compose' },
+                h('textarea', {
+                  className: 'w2mChat_input',
+                  value: text,
+                  rows: 2,
+                  placeholder: '说点什么，发给本会话的机器…',
+                  disabled: busy,
+                  onChange: (event) => setText(event.target.value),
+                  onKeyDown: (event) => {
+                    if (event.key === 'Enter' && event.shiftKey !== true) {
+                      event.preventDefault();
+                      send();
+                    }
+                  },
+                }),
+                h('button', { type: 'button', className: 'w2mChat_send', disabled: busy || text.trim() === '', onClick: send }, busy ? '发送中…' : '发送')))
+          : null);
+    }
+
     /**
      * Client plugin body: install the stylesheet, register the dictionaries, take the seat.
      *
@@ -607,6 +767,24 @@ window.__ModuleLoader__.load({
           t,
         }),
       }, TargetSelect));
+
+      // The fleet-chat panel: the same session-scoped seat, one slot after the target control.
+      // Wrapped in its own try/catch on purpose — the target control is the primary half of this
+      // bundle, and a chat panel that cannot mount must not take the page (or the app) down with it.
+      try {
+        slots.inject('conversation.input.left', () => slots.register({
+          name: 'conversation.input.left',
+          id: 'w2m-chat',
+          order: 41,
+          label: 'fleet chat',
+          inject: (sessionId) => ({ sessionId }),
+        }, FleetChat));
+      } catch (error) {
+        console.error(
+          '@twinsearth/w2m-dsh-plugin: the fleet chat panel was not mounted; the rest of the page is unaffected',
+          error,
+        );
+      }
     }
 
     /**
@@ -633,6 +811,7 @@ window.__ModuleLoader__.load({
     exports.apply = apply;
     exports.inject = inject;
     exports.TargetSelect = TargetSelect;
+    exports.FleetChat = FleetChat;
     exports.injectStyle = injectStyle;
     exports.makeTranslator = makeTranslator;
     return module.exports;