@twinsearth/w2m-dsh-plugin 1.1.18 → 1.1.20

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.1.18"
+    "version": "1.1.20"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.1.18",
+      "version": "1.1.20",
       "author": {
         "name": "TwinsEarth"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.1.18",
+  "version": "1.1.20",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -2,6 +2,74 @@
 
 All notable changes to this project are documented here.
 
+## [1.1.20] — 2026-10-18
+
+**The developer declares this release STABLE.** The fleet panel now shows what each machine's owner actually typed into DSH.
+
+### What it does
+
+- the host route learns the conversation key from **account material + project directory name**, so the same project on
+  two machines is one conversation and nothing has to be configured;
+- a 2-second read-only watcher looks at the newest \`session.v4.jsonl.zstd\` for that project, extracts **only the user's
+  messages** (`role: 'user'`/`'prompt'`), and publishes the new ones to the relay;
+- the panel colours them: **red** for this machine's own prompts (marked "来自会话"), **green** for messages typed into the
+  fleet box here, **white** for other machines — each machine also gets a colour on its whale avatar derived from its id.
+
+### The rules that are enforced, not promised
+
+- **the session is never written** — \`test/session-readonly.test.mjs\` scans the two modules for any file-mutating API and
+  fails the gate if one appears;
+- **no injection into DSH** — nothing is appended to a conversation; the panel is a mirror;
+- **no assistant replies, tool calls or results** — only the user's own words;
+- **own broadcasts are not shown as remote** — the echo rule is a tested function, not a convention.
+
+### What the gate caught on the way
+
+Adding the panel's newest pieces put four real defects in front of the tests: a state declared in the wrong component
+(both components have a `busy`), an `accountMaterial` getter that named a variable outside its scope, a repair that ate
+the closing braces of the route registration, and lint errors from an unused import plus over-escaped regexes. The gate
+held at RED until each was fixed; this entry exists because it finally went green twice.
+
+### Not verified
+
+The end-to-end path (type in DSH on machine A, see it in machine B's panel) has **not been run across two machines yet**.
+The reader, the extractor, the sync rules, the route and the panel are each tested; their composition is not. That is stated
+here rather than implied by a green gate.
+
+### Verified
+
+Gate GREEN twice, 15 of 15. 2502 tests / 2488 pass / 0 fail / 14 skip.
+
+## [1.1.19] — 2026-10-18
+
+**The chat panel exists in the browser.**
+
+Fleet chat shipped as a tool in 1.1.17 and as a relay API in the same release. What was missing was the half a user actually
+touches: a control in the composer. This release adds it.
+
+- **The panel**: a "fleet chat" control beside the target-machine control opens a floating panel listing this session's
+  messages, with the relay usage shown next to them, a multi-line input, and a send button. It refreshes while open.
+- **The host route**: the browser never holds a device token. It calls `/api/w2m/chat` on the host, which proxies to the
+  relay's device-gated `/v1/fleet/messages` — so the token stays in the host process.
+- **Tool bug fixed**: `w2m_chat` resolved its token through `readDevice(cfg)`, which fails when `stateDir` is unset even
+  though a `device.json` exists elsewhere; it now resolves exactly like every other tool (`resolveToken(cfg)`).
+- **Theme discipline**: the panel carries no literal colours, only `--dsw-*` tokens, because a literal is wrong in one of
+  the two themes. The stylesheet test caught the one literal (`#fff` on the send button).
+
+The relay on the fleet host was upgraded to this line of code in the same step: it had been running 1.0.14, which has no
+`/v1/fleet/messages` route at all, so the panel would have shown "no route" forever. Verified after the restart: an
+authenticated GET returns 200 (it returned 404 before), unauthenticated returns 401, and the fleet came back with the same
+eight devices and no re-pairing.
+
+### Not in this release
+
+The coloured per-machine avatars for chat messages are designed and not built. The panel shows one style for every
+machine today.
+
+### Verified
+
+Gate GREEN, 15 of 15. 2489 tests / 2471+ pass. client-bundle 25, tools 122, claims, portable-plugins 10.
+
 ## [1.1.18] — 2026-10-18
 
 **The developer declares this a STABLE release.** It ships the three-channel updater and the release plumbing that makes

package/README.md

@@ -66,22 +66,44 @@ The manifests live in [`.claude-plugin/`](.claude-plugin/) and are version-locke
 # copy this block into your own codex/mcp-servers.toml
 [mcp_servers.w2m]
 command = "npx"
-args = ["-y", "@twinsearth/w2m-dsh-plugin@1.1.18", "w2m-mcp"]
+args = ["-y", "@twinsearth/w2m-dsh-plugin@1.1.19", "w2m-mcp"]
 ```
 
 ### 5. Verified release tarball (offline)
 
-From the `v1.1.18` release page download **both** files — `twinsearth-w2m-dsh-plugin-1.1.18.tgz` and `SHA256SUMS` —
+From the `v1.1.19` release page download **both** files — `twinsearth-w2m-dsh-plugin-1.1.19.tgz` and `SHA256SUMS` —
 then:
 
 ```bash
-curl -LO https://github.com/TwinsEarth/dsh-windows2macos/releases/download/v1.1.18/twinsearth-w2m-dsh-plugin-1.1.18.tgz
+curl -LO https://github.com/TwinsEarth/dsh-windows2macos/releases/download/v1.1.19/twinsearth-w2m-dsh-plugin-1.1.19.tgz
 sha256sum -c SHA256SUMS          # verify before installing, always
-npm install -g ./twinsearth-w2m-dsh-plugin-1.1.18.tgz
+npm install -g ./twinsearth-w2m-dsh-plugin-1.1.19.tgz
 ```
 
 Every release carries `SHA256SUMS` for exactly this reason. If a release is missing it, do not install that release.
 
+### 6. Beta (prerelease — never on npm)
+
+A beta is a **GitHub prerelease**, not an npm version. Nothing about it is resolved by `npm install`, and `latest` never
+points at one. It exists for a developer who has been granted `beta-access` and accepts that it can break.
+
+```bash
+# 1. find the newest prerelease (a beta is marked "Pre-release" on the releases page)
+#    https://github.com/TwinsEarth/dsh-windows2macos/releases  -> latest entry labelled Pre-release
+# 2. download BOTH files attached to it: twinsearth-w2m-dsh-plugin-<version>.tgz and SHA256SUMS
+sha256sum -c SHA256SUMS          # verify before installing, always
+npm install -g ./twinsearth-w2m-dsh-plugin-<version>.tgz
+```
+
+- **Access**: the beta workflow waits on the protected `beta-access` environment, so a reviewer must approve each run
+  before the artifact exists at all.
+- **Risk acknowledgment**: install it only if you have read [SECURITY.md](SECURITY.md) and accept that a beta may fail
+  where a stable release does not.
+- **Going back**: `npm install -g @twinsearth/w2m-dsh-plugin@latest` returns you to the stable channel.
+- **Why not npm**: there is no `npm publish` line in the beta workflow. A channel cannot leak into the default install if
+  the publication cannot happen at all.
+
+
 ---
 
 ## Quick start
@@ -288,21 +310,40 @@ w2m-mcp --help
 # 把这段复制进你自己的 codex/mcp-servers.toml
 [mcp_servers.w2m]
 command = "npx"
-args = ["-y", "@twinsearth/w2m-dsh-plugin@1.1.18", "w2m-mcp"]
+args = ["-y", "@twinsearth/w2m-dsh-plugin@1.1.19", "w2m-mcp"]
 ```
 
 #### 5. 校验过的发布包（离线）
 
-从 `v1.1.18` 的 release 页面下载**两个**文件 —— `twinsearth-w2m-dsh-plugin-1.1.18.tgz` 与 `SHA256SUMS` —— 然后：
+从 `v1.1.19` 的 release 页面下载**两个**文件 —— `twinsearth-w2m-dsh-plugin-1.1.19.tgz` 与 `SHA256SUMS` —— 然后：
 
 ```bash
-curl -LO https://github.com/TwinsEarth/dsh-windows2macos/releases/download/v1.1.18/twinsearth-w2m-dsh-plugin-1.1.18.tgz
+curl -LO https://github.com/TwinsEarth/dsh-windows2macos/releases/download/v1.1.19/twinsearth-w2m-dsh-plugin-1.1.19.tgz
 sha256sum -c SHA256SUMS          # 安装前务必校验
-npm install -g ./twinsearth-w2m-dsh-plugin-1.1.18.tgz
+npm install -g ./twinsearth-w2m-dsh-plugin-1.1.19.tgz
 ```
 
 每个 release 都带 `SHA256SUMS` 正是为了这一步。若某个 release 缺少它，**不要安装该版本**。
 
+#### 6. Beta（预发布版 —— 不进 npm）
+
+Beta 是 **GitHub prerelease**，不是 npm 版本：`npm install` 永远拿不到它，`latest` 也不会指向它。它是给**已获
+`beta-access` 授权、且接受它可能出问题**的开发者用的。
+
+```bash
+# 1. 在 releases 页面找标着 Pre-release 的最新条目
+#    https://github.com/TwinsEarth/dsh-windows2macos/releases
+# 2. 下载该条目的两个文件：twinsearth-w2m-dsh-plugin-<版本>.tgz 与 SHA256SUMS
+sha256sum -c SHA256SUMS          # 安装前务必校验
+npm install -g ./twinsearth-w2m-dsh-plugin-<版本>.tgz
+```
+
+- **权限**：beta 流水线挂在受保护的 `beta-access` 环境上，**每次运行都需要审批者批准**，产物才会存在；
+- **风险确认**：安装前请阅读 [SECURITY.md](SECURITY.md)，并接受 beta 可能比稳定版更容易失败；
+- **回退**：`npm install -g @twinsearth/w2m-dsh-plugin@latest` 即回到稳定版通道；
+- **为什么不走 npm**：beta 工作流里**没有 `npm publish`** —— 只要发布动作不可能发生，这个通道就漏不进默认安装。
+
+
 ### 快速开始
 
 ```text

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.18", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.20", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60