@twinsearth/w2m-dsh-plugin 1.1.19 → 1.1.20

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.1.19"
+    "version": "1.1.20"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.1.19",
+      "version": "1.1.20",
       "author": {
         "name": "TwinsEarth"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.1.19",
+  "version": "1.1.20",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -2,6 +2,44 @@
 
 All notable changes to this project are documented here.
 
+## [1.1.20] — 2026-10-18
+
+**The developer declares this release STABLE.** The fleet panel now shows what each machine's owner actually typed into DSH.
+
+### What it does
+
+- the host route learns the conversation key from **account material + project directory name**, so the same project on
+  two machines is one conversation and nothing has to be configured;
+- a 2-second read-only watcher looks at the newest \`session.v4.jsonl.zstd\` for that project, extracts **only the user's
+  messages** (`role: 'user'`/`'prompt'`), and publishes the new ones to the relay;
+- the panel colours them: **red** for this machine's own prompts (marked "来自会话"), **green** for messages typed into the
+  fleet box here, **white** for other machines — each machine also gets a colour on its whale avatar derived from its id.
+
+### The rules that are enforced, not promised
+
+- **the session is never written** — \`test/session-readonly.test.mjs\` scans the two modules for any file-mutating API and
+  fails the gate if one appears;
+- **no injection into DSH** — nothing is appended to a conversation; the panel is a mirror;
+- **no assistant replies, tool calls or results** — only the user's own words;
+- **own broadcasts are not shown as remote** — the echo rule is a tested function, not a convention.
+
+### What the gate caught on the way
+
+Adding the panel's newest pieces put four real defects in front of the tests: a state declared in the wrong component
+(both components have a `busy`), an `accountMaterial` getter that named a variable outside its scope, a repair that ate
+the closing braces of the route registration, and lint errors from an unused import plus over-escaped regexes. The gate
+held at RED until each was fixed; this entry exists because it finally went green twice.
+
+### Not verified
+
+The end-to-end path (type in DSH on machine A, see it in machine B's panel) has **not been run across two machines yet**.
+The reader, the extractor, the sync rules, the route and the panel are each tested; their composition is not. That is stated
+here rather than implied by a green gate.
+
+### Verified
+
+Gate GREEN twice, 15 of 15. 2502 tests / 2488 pass / 0 fail / 14 skip.
+
 ## [1.1.19] — 2026-10-18
 
 **The chat panel exists in the browser.**

package/README.md

@@ -82,6 +82,28 @@ npm install -g ./twinsearth-w2m-dsh-plugin-1.1.19.tgz
 
 Every release carries `SHA256SUMS` for exactly this reason. If a release is missing it, do not install that release.
 
+### 6. Beta (prerelease — never on npm)
+
+A beta is a **GitHub prerelease**, not an npm version. Nothing about it is resolved by `npm install`, and `latest` never
+points at one. It exists for a developer who has been granted `beta-access` and accepts that it can break.
+
+```bash
+# 1. find the newest prerelease (a beta is marked "Pre-release" on the releases page)
+#    https://github.com/TwinsEarth/dsh-windows2macos/releases  -> latest entry labelled Pre-release
+# 2. download BOTH files attached to it: twinsearth-w2m-dsh-plugin-<version>.tgz and SHA256SUMS
+sha256sum -c SHA256SUMS          # verify before installing, always
+npm install -g ./twinsearth-w2m-dsh-plugin-<version>.tgz
+```
+
+- **Access**: the beta workflow waits on the protected `beta-access` environment, so a reviewer must approve each run
+  before the artifact exists at all.
+- **Risk acknowledgment**: install it only if you have read [SECURITY.md](SECURITY.md) and accept that a beta may fail
+  where a stable release does not.
+- **Going back**: `npm install -g @twinsearth/w2m-dsh-plugin@latest` returns you to the stable channel.
+- **Why not npm**: there is no `npm publish` line in the beta workflow. A channel cannot leak into the default install if
+  the publication cannot happen at all.
+
+
 ---
 
 ## Quick start
@@ -303,6 +325,25 @@ npm install -g ./twinsearth-w2m-dsh-plugin-1.1.19.tgz
 
 每个 release 都带 `SHA256SUMS` 正是为了这一步。若某个 release 缺少它，**不要安装该版本**。
 
+#### 6. Beta（预发布版 —— 不进 npm）
+
+Beta 是 **GitHub prerelease**，不是 npm 版本：`npm install` 永远拿不到它，`latest` 也不会指向它。它是给**已获
+`beta-access` 授权、且接受它可能出问题**的开发者用的。
+
+```bash
+# 1. 在 releases 页面找标着 Pre-release 的最新条目
+#    https://github.com/TwinsEarth/dsh-windows2macos/releases
+# 2. 下载该条目的两个文件：twinsearth-w2m-dsh-plugin-<版本>.tgz 与 SHA256SUMS
+sha256sum -c SHA256SUMS          # 安装前务必校验
+npm install -g ./twinsearth-w2m-dsh-plugin-<版本>.tgz
+```
+
+- **权限**：beta 流水线挂在受保护的 `beta-access` 环境上，**每次运行都需要审批者批准**，产物才会存在；
+- **风险确认**：安装前请阅读 [SECURITY.md](SECURITY.md)，并接受 beta 可能比稳定版更容易失败；
+- **回退**：`npm install -g @twinsearth/w2m-dsh-plugin@latest` 即回到稳定版通道；
+- **为什么不走 npm**：beta 工作流里**没有 `npm publish`** —— 只要发布动作不可能发生，这个通道就漏不进默认安装。
+
+
 ### 快速开始
 
 ```text

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.19", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.20", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60