@twinsearth/w2m-dsh-plugin 1.1.18 → 1.1.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.1.18",
+  "version": "1.1.20",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "main": "lib/index.js",
@@ -120,22 +120,22 @@
     }
   },
   "scripts": {
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
     "layer-check": "node scripts/layer-check.mjs",
+    "format:check": "prettier --check .",
+    "format": "prettier --write .",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "orphans": "node --test --test-force-exit test/accepted-orphans.test.mjs",
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:admission": "node --test --test-force-exit test/admission.test.mjs",
     "test:admission-routes": "node --test --test-force-exit test/admission-routes.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs",
     "test:approval-gate": "node --test --test-force-exit test/approval-gate.test.mjs",
     "test:approval-index": "node --test --test-force-exit test/approval-index.test.mjs",
     "test:authority": "node --test --test-force-exit test/authority.test.mjs",
@@ -181,7 +181,10 @@
     "test:fleet-messages-http": "node --test --test-force-exit test/fleet-messages-http.test.mjs",
     "test:message-notify": "node --test --test-force-exit test/message-notify.test.mjs",
     "test:update-channels": "node --test --test-force-exit test/update-channels.test.mjs",
-    "test:update-prerelease": "node --test --test-force-exit test/update-prerelease.test.mjs"
+    "test:update-prerelease": "node --test --test-force-exit test/update-prerelease.test.mjs",
+    "test:session-watch": "node --test --test-force-exit test/session-watch.test.mjs",
+    "test:session-readonly": "node --test --test-force-exit test/session-readonly.test.mjs",
+    "test:session-sync": "node --test --test-force-exit test/session-sync.test.mjs"
   },
   "keywords": [
     "dsh-bundle",

package/plugin.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.1.18",
-  "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
+  "version": "1.1.20",
+  "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [
     "agent-skills",

package/src/plugin/fleet-chat-route.mjs

@@ -0,0 +1,221 @@
+/**
+ * `/api/w2m/chat` — the browser-facing half of fleet chat (v1.1.17 shipped the tool only; this
+ * module is the missing host route the composer's chat panel calls).
+ *
+ * The route proxies the relay's device-gated `/v1/fleet/messages` endpoints with this machine's
+ * device token. The browser never sees the token: it calls this same-origin route, which is inside
+ * the host's authentication fence, exactly like `/api/w2m/target`.
+ *
+ * Wire:
+ *   GET  /api/w2m/chat?session_id=…&since_ms=…&limit=…   -> relay list shape passed through
+ *   POST /api/w2m/chat  { session_id, text }              -> relay send shape passed through
+ *
+ * Failure is a value here: `{ok:false, error, reason_code, detail}` with a non-2xx status, so the
+ * panel can print the host's own words. A relay that predates the fleet-messages routes answers
+ * 404, which is reported as such rather than as an empty conversation.
+ */
+import { createHash } from 'node:crypto';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import {
+  conversationKey as deriveConversationKey, decodeTranscript, extractUserMessages, sessionDirName,
+} from './session-watch.mjs';
+import { createSessionSync } from './session-sync.mjs';
+
+/**
+ * The newest transcript for a cwd, or null. Reads directory listings and stat only -- this module never opens a
+ * session file for writing, and \	est/session-readonly.test.mjs\ enforces that.
+ */
+function newestTranscript(cwd) {
+  const dir = join(homedir(), '.dsh', 'sessions', sessionDirName(cwd));
+  let entries;
+  try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return null; }
+  let best = null;
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !entry.name.startsWith('session-')) continue;
+    const file = join(dir, entry.name, 'session.v4.jsonl.zstd');
+    let stat;
+    try { stat = statSync(file); } catch { continue; }
+    if (best === null || stat.mtimeMs > best.mtimeMs) best = { file, mtimeMs: stat.mtimeMs };
+  }
+  return best === null ? null : best.file;
+}
+
+export const CHAT_ROUTE_PATH = '/api/w2m/chat';
+export const MAX_SESSION_ID_LENGTH = 200;
+
+const NO_STORE = { 'cache-control': 'no-store' };
+
+/**
+ * Attach the route to one host's fetch registry, recording the outcome on `status`.
+ *
+ * @param {object} ctx the plugin context (a Cordis fiber)
+ * @param {{cfg: () => object, request: Function, resolveToken: () => Promise<string|null>}} deps
+ * @returns {{mounted: boolean, reason: string|null}}
+ */
+export function registerChatRoutes(ctx, deps) {
+  const status = { mounted: false, reason: 'the host has no Connection service' };
+  const cwd = process.cwd();
+  const sync = createSessionSync({ conversationKey: 'pending', machineId: 'pending', machineName: null });
+
+  /**
+   * Which machine this is and which conversation the project belongs to.
+   *
+   * Resolved once. The account material is hashed with a domain label first: it is the fleet key, which is secret, but
+   * hashing keeps the conversation key from ever being usable as a joining secret.
+   */
+  let identityPromise = null;
+  const identityOf = () => (identityPromise ??= (async () => {
+    const local = typeof deps.localIdentity === 'function' ? await deps.localIdentity() : null;
+    const material = typeof deps.accountMaterial === 'function' ? deps.accountMaterial() : null;
+    const machineId = typeof local?.machine_id === 'string' && local.machine_id !== '' ? local.machine_id : null;
+    if (machineId === null || typeof material !== 'string' || material === '') {
+      return { error: 'CHAT_NO_IDENTITY', machineId: null, machineName: null, conversationKey: null };
+    }
+    const fingerprint = createHash('sha256').update('w2m-account-material-v1').update('\\u0000').update(material).digest('hex');
+    return {
+      error: null,
+      machineId,
+      machineName: typeof local?.machine_name === 'string' ? local.machine_name : null,
+      conversationKey: deriveConversationKey(fingerprint, cwd),
+    };
+  })());
+
+  /** Post one batch into the relay using the machine's device token, exactly as the browser route does. */
+  const postToRelay = async (identity, payload) => {
+    const cfg = deps.cfg();
+    const rabbitUrl = cfg?.rabbitUrl ?? null;
+    if (rabbitUrl === null) return { ok: false };
+    let token;
+    try { token = await deps.resolveToken(); } catch { return { ok: false }; }
+    if (typeof token !== 'string' || token === '') return { ok: false };
+    return deps.request({
+      rabbitUrl, token, method: 'POST', pathname: '/v1/fleet/messages',
+      body: { session_id: identity.conversationKey, ...payload },
+    });
+  };
+
+  /**
+   * v1.1.20: mirror this machine's own prompts into the fleet conversation -- READ ONLY.
+   *
+   * The session files are never written and nothing is injected into DSH: the transcript is read, the user's messages
+   * are extracted, and only the new ones are published. A failure here must not disturb the panel or the route.
+   */
+  const mirrorOnce = async () => {
+    const identity = await identityOf();
+    if (identity.conversationKey === null) return;
+    const file = newestTranscript(cwd);
+    if (file === null) return;
+    let messages;
+    try { messages = extractUserMessages(decodeTranscript(readFileSync(file))); } catch { return; }
+    for (const payload of sync.pending(messages)) {
+      await postToRelay(identity, {
+        text: payload.text,
+        machine_id: identity.machineId,
+        machine_name: identity.machineName,
+        origin: 'session',
+      });
+    }
+  };
+  if (typeof ctx?.inject !== 'function') return status;
+  ctx.inject(['connection'], (webCtx) => {
+    const registry = webCtx?.connection?.fetch;
+    if (registry === undefined || registry === null || typeof registry.register !== 'function') {
+      status.reason = 'the connection service carries no fetch registry';
+      return;
+    }
+    try {
+      registry.register({
+        path: CHAT_ROUTE_PATH,
+        methods: ['GET', 'POST'],
+        requestBody: 'buffered',
+        fetch: async (request) => {
+          const refuse = (httpStatus, reasonCode, error, detail) =>
+            Response.json({ ok: false, error, reason_code: reasonCode, detail }, { status: httpStatus, headers: NO_STORE });
+
+          if (request.method !== 'GET' && request.method !== 'POST') {
+            return refuse(405, 'CHAT_METHOD_NOT_ALLOWED', `${request.method} is not answered here`, 'GET lists a session; POST sends a message');
+          }
+
+          const url = new URL(request.url);
+          const sessionIdOf = (value) => (typeof value === 'string' ? value.trim() : '');
+          let sessionId = '';
+          let text = null;
+          if (request.method === 'GET') {
+            sessionId = sessionIdOf(url.searchParams.get('session_id'));
+          } else {
+            let body;
+            try {
+              body = await request.json();
+            } catch {
+              return refuse(400, 'CHAT_BODY_NOT_JSON', 'body is not JSON', 'send {"session_id":"…","text":"…"}');
+            }
+            sessionId = sessionIdOf(body?.session_id);
+            text = typeof body?.text === 'string' ? body.text : null;
+          }
+           const identity = await identityOf();
+           if (identity.error !== null) {
+             return refuse(503, identity.error, 'this machine has no fleet-chat identity yet', 'pair the machine and let it derive the fleet key');
+           }
+           // v1.1.20: the browser's session id is per-machine and no other machine can compute it, so the wire key is the
+           // conversation key (account + project directory). The browser's value is accepted and then replaced.
+           sessionId = identity.conversationKey;
+          if (sessionId === '') return refuse(400, 'CHAT_SESSION_ID_REQUIRED', '`session_id` is required', 'chat is scoped to one conversation');
+          if (sessionId.length > MAX_SESSION_ID_LENGTH) {
+            return refuse(400, 'CHAT_SESSION_ID_TOO_LONG', `\`session_id\` must be at most ${MAX_SESSION_ID_LENGTH} characters`, 'send the id the host gave this session');
+          }
+
+          const cfg = deps.cfg();
+          const rabbitUrl = cfg?.rabbitUrl ?? null;
+          if (rabbitUrl === null) return refuse(503, 'CHAT_NO_RELAY', 'no relay is configured', 'set rabbitUrl in the profile patch');
+          let token;
+          try {
+            token = await deps.resolveToken();
+          } catch (error) {
+            return refuse(503, 'CHAT_UNPAIRED', `this machine has no device token: ${error instanceof Error ? error.message : String(error)}`, 'pair the machine first (autoStartAgent or a pairing code)');
+          }
+          if (typeof token !== 'string' || token === '') {
+            return refuse(503, 'CHAT_UNPAIRED', 'this machine has no device token', 'pair the machine first (autoStartAgent or a pairing code)');
+          }
+
+          try {
+            if (request.method === 'GET') {
+              const query = { session_id: sessionId };
+              const sinceMs = url.searchParams.get('since_ms');
+              const limit = url.searchParams.get('limit');
+              if (sinceMs !== null && /^\d+$/.test(sinceMs)) query.since_ms = sinceMs;
+              if (limit !== null && /^\d+$/.test(limit)) query.limit = limit;
+              const listed = await deps.request({ rabbitUrl, token, method: 'GET', pathname: '/v1/fleet/messages', query, signal: request.signal });
+              if (listed?.ok !== true) {
+                const code = listed?.json?.error?.code ?? listed?.error?.code ?? 'CHAT_LIST_REFUSED';
+                const message = listed?.json?.error?.message ?? listed?.error?.message ?? `the relay answered HTTP ${listed?.status ?? 0}`;
+                return refuse(listed?.status === 404 ? 502 : 502, code, message, 'the relay must run a version with /v1/fleet/messages (>= 1.1.17) and be restarted');
+              }
+              return Response.json({ ...listed.json, ok: true, local_machine_id: identity.machineId, local_machine_name: identity.machineName, conversation_key: sessionId }, { headers: NO_STORE });
+            }
+            const posted = await deps.request({ rabbitUrl, token, method: 'POST', pathname: '/v1/fleet/messages', body: { session_id: sessionId, text: text ?? '', machine_id: identity.machineId, machine_name: identity.machineName, origin: 'chat' }, signal: request.signal });
+            if (posted?.ok !== true) {
+              const code = posted?.json?.error?.code ?? posted?.error?.code ?? 'CHAT_SEND_REFUSED';
+              const message = posted?.json?.error?.message ?? posted?.error?.message ?? `the relay answered HTTP ${posted?.status ?? 0}`;
+              return refuse(posted?.status === 404 ? 502 : 400, code, message, 'quota, size and non-text are each refused by name; 404 means the relay predates fleet chat');
+            }
+            return Response.json({ ...posted.json, ok: true }, { headers: NO_STORE });
+          } catch (error) {
+            return refuse(502, 'CHAT_RELAY_ERROR', `the relay call failed: ${error instanceof Error ? error.message : String(error)}`, 'check the relay and this machine token');
+          }
+        },
+      });
+      status.mounted = true;
+      status.reason = null;
+      const timer = setInterval(() => { mirrorOnce().catch(() => { /* one bad tick must not stop the next */ }); }, 2000);
+      if (typeof timer.unref === 'function') timer.unref();
+      if (typeof ctx?.effect === 'function') ctx.effect(() => () => clearInterval(timer), 'w2m: fleet chat session mirror');
+      else globalThis.__w2mChatMirrorTimer = timer;
+    } catch (error) {
+      status.reason = error instanceof Error ? error.message : String(error);
+      ctx?.logger?.warn?.(`w2m: the fleet chat route is inactive — ${status.reason}`);
+    }
+  });
+  return status;
+}