@twinsearth/w2m-dsh-plugin 1.2.2 → 1.2.5

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
               },
     "metadata":  {
                      "description":  "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-                     "version":  "1.2.2"
+                     "version":  "1.2.5"
                  },
     "plugins":  [
                     {
                         "name":  "w2m-fleet",
                         "source":  "./",
                         "description":  "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-                        "version":  "1.2.2",
+                        "version":  "1.2.5",
                         "author":  {
                                        "name":  "TwinsEarth"
                                    },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
     "name":  "w2m-fleet",
     "description":  "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-    "version":  "1.2.2",
+    "version":  "1.2.5",
     "author":  {
                    "name":  "TwinsEarth"
                },

package/CHANGELOG.md

@@ -7,6 +7,176 @@
 
 All notable changes to this project are documented here.
 
+## [1.2.5] — 2026-10-20
+
+**Who is in the fleet, what they have read, who was named, and a retry that cannot double-post.**
+
+### Members and roles
+
+`GET /v1/fleet/members` lists every machine with its name, role, join time, presence and last-seen time. `PUT
+/v1/fleet/members/{id}` changes a role and requires the **operator** token, so the route sits with dispatch rather than behind the
+device gate. Roles are `owner | worker | observer` and live in their own table: a device record is written by pairing and by
+reconnect, and a role is an operator decision that must survive both. An unknown machine is a `worker`, never an `owner` -- a
+re-pair cannot gain authority. The last owner cannot be demoted, because then nobody could readmit a machine.
+
+### Read watermarks
+
+`PUT /v1/fleet/read/{session}` records how far this machine has read a conversation (its own token decides which machine);
+`GET /v1/fleet/read/{session}` answers the watermark and an unread count of messages from others newer than it. Only forward: a
+stale marker arriving late must not move the watermark backwards, or the count would grow for messages already seen.
+
+### Mentions
+
+A message may carry `mentions: [machine_id]` (at most 10, validated). The row is still **one** row -- a mention is a
+notification hint, not a delivery mechanism -- and the SSE notification says only whether **this** listener was named. It never
+carries the text, and it does not carry the mention list.
+
+### Idempotent posts
+
+`POST /v1/fleet/messages` accepts `idempotency_key` (per session). A retry after a lost response returns the **first** message
+with `deduped: true` instead of storing the sentence twice. The key is bounded, like the message log.
+
+### Two defects the 1.2.4 tag carried, fixed here
+
+The 1.2.4 commit (tag `v1.2.4`) had a red CI and a red Compat, both found before approval:
+
+- **Compat**: `w2m_wait`'s `reducer_machine_id` declaration had been pasted **inside** `poll_ms`. Every local check was green;
+  the real host refused the whole entry ("parameters.poll_ms.reducer_machine_id is not supported by the value schema DSL"). The
+  parameter now sits where it belongs, and `schema-spec.mjs` gained `strayParameterProblems()` — a parameter declaration
+  nested inside another parameter is now refused where the tool is written, with two tests.
+- **CI**: the cancellation HTTP test had been inserted inside an enclosing `it`. Node 24 ran it; Node 20/22 reported
+  `cancelledByParent`. The test now lives in its own top-level `describe`.
+
+### Verified
+
+Gate GREEN twice, 15 of 15: 2628 tests / 2614 pass / 0 fail / 14 skip. New suites: fleet-members (6); fleet-messages grew to 11;
+relay grew to 171 including two HTTP cases for members and watermarks.
+
+The relay was deployed a fourth time from a hash-verified tarball with a state backup, and the new routes were exercised against
+the live relay (members returned 8 machines; a role change returned 200; a watermark round-tripped; unread answered 0).
+
+### Not in this release
+
+- **Offline replay of outbound chat** is not implemented. The agent's spool already holds undeliverable *results*; chat text is
+  not yet spooled and replayed.
+- A two-machine end-to-end run of mentions/watermarks. The HTTP surface is tested against the fake relay and exercised once
+  against jp-shared, but not by two physical machines.
+## [1.2.4] — 2026-10-20
+
+**Fleet collaboration, part two: cancellation, dependencies, a task board, questions on disk, and output that travels.**
+
+### Cancelling a task over HTTP
+
+`state.cancelTask` has existed since the task ledger gained a cancel flag, but **no route reached it**. `POST /v1/tasks/{id}/cancel`
+now does, with the same operator authorization dispatch requires, and `w2m_cancel` is the tool over it. Cancelling twice is not
+an error: the ledger is the answer.
+
+### Prerequisites and a task board
+
+- `POST /v1/task` accepts `depends_on[]`. Validated at **enqueue** time: unknown prerequisite, self-edge, duplicate edge and
+  cycles are refused by name (`src/relay/task-deps.mjs`), because a graph checked only when a worker picks the task up puts the
+  refusal on a machine that did not create the problem.
+- `depends_on` / `assignee` travel on the task record.
+- `w2m_tasks` (the fifteenth tool) is the board: it classifies every visible task as ready / active / waiting / blocked / done
+  (`src/plugin/task-graph.mjs`). A prerequisite outside the page is treated as **waiting**, never as absent.
+
+### Questions that survive a restart
+
+`src/plugin/ask-store.mjs` keeps open questions in a JSONL file next to the profile (`ask-store.jsonl`, atomic rewrite, cap on
+records). A reply that arrives after the deadline is recorded as `answered_after_timeout` rather than overwriting the timeout or
+being dropped, and a settled question is never reopened. `w2m_chat` gained `action: "asks"`, and `await` settles the stored ask.
+
+### Output that travels
+
+`src/util/dataflow.mjs` (moved from `src/plugin/` — the layer check refused an `agent -> plugin` edge) is now wired:
+
+- a pipeline stage whose stdout exceeds 64 KiB **uploads it as a blob** (`PUT /v1/fleet/blobs/{sha256}`) and the envelope names
+  it (`blob_sha256`, `output_mode: "blob"`) instead of inlining head/tail;
+- a failed upload **fails the stage** by name (`BLOB_UPLOAD_FAILED`) rather than leaving a reference to nothing;
+- `w2m_wait` builds the reduce plan with `buildReducePlan` from the **raw** envelopes and marks the verdict `degraded` when a
+  shard is missing — but only when the caller declared `reducer_machine_id`, so a large pipeline result is not mistaken for a
+  partial reduce.
+
+The end-to-end fixture this release adds (`test/agent.test.mjs`) runs a real agent against a fake relay: it asserts the blob name
+is the hash of the bytes sent and that a refused upload fails the stage. Two real defects surfaced while writing it and are fixed
+here: the stage stdout arrives as a `Buffer` (it was handed to the signature helper as a string), and a 70 KiB test argv exceeds
+Windows' `CreateProcess` limit.
+
+### Retry and hand-off
+
+- `POST /v1/task` accepts `max_attempts` (1..5, default 1) and `retry_on` (`expired|failed|partial|timeout`). Defaults keep
+  at-most-once for every existing caller; a malformed policy is `BAD_REQUEST`, not silently ignored.
+- On lease expiry, `retry_on` containing `expired` performs the hand-off `halt=now` always had: attempt+1 and a re-offer to idle
+  machines (`_takeover`, which already refuses writing tasks to avoid double application).
+
+### mapreduce
+
+`mode: "mapreduce"` is accepted with `reduce_argv` and an optional `reducer_machine_id`. The map half is ordinary dispatch; the
+reduce half is **described, never launched** — the caller runs it as an explicit second task after `w2m_wait` says every shard is
+present, so one task id never describes two executions.
+
+### Relay
+
+The relay was deployed three times during this release (cancel route, retry policy, mapreduce) from hash-verified tarballs, each
+with a state backup, a health check, and a 401 check on the pre-existing routes. **The relay name is separate from the package
+version**: the tarball deployed was the 1.2.3-labelled build carrying this code, and is re-deployed from the released 1.2.4 tarball
+below.
+
+### Verified
+
+Gate GREEN twice, 15 of 15: 2610 tests / 2596 pass / 0 fail / 14 skip. Notable suites: agent 149 (147 pass, 2 skipped),
+relay 169, tools 127, task-deps 13, task-graph 11, ask-store 8, turn 5, dataflow 7, dataflow-wiring 7.
+
+### Not verified
+
+A two-machine run of cancel / retry / mapreduce end to end. The code paths are tested against a fake relay and against the real
+relay's HTTP surface, but no test here runs two physical machines exchanging an expired lease.
+## [1.2.3] — 2026-10-20
+
+**The packed artifact did not mount. This fixes that, and the reason it was not caught here.**
+
+`v1.2.2` was released, published to npm, and **failed Compat**: the packed artifact would not mount in a real profile.
+
+```
+JsonSchemaError: unsupported JSON schema: parameters.params.additionalProperties must be explicitly true or false
+```
+
+`w2m_intent` declared `params: { type: "object", ... }` without stating `additionalProperties`. DSH refuses such a
+schema **at mount time** -- in the profile of whoever installs the build -- and this repository had no check that would
+have said so before shipping: the local loader gate mounted the artifact on a host whose compiler path differs, so it
+stayed green while the real profile refused the entry.
+
+### What changed
+
+- `w2m_intent`'s `params` now states `additionalProperties: true`, and every tool schema is checked when it is defined.
+- New `src/plugin/schema-spec.mjs`: a pure walker over schema-shaped values, and `schemaProblems()` which returns every
+  object node that does not state `additionalProperties` as a boolean -- all of them at once, not the first one.
+- `defineTool` now runs that check, so a tool with an under-specified object parameter fails where it is written rather
+  than in someone else's profile.
+- `test/schema-spec.test.mjs`: 5 tests on the walker and the checker (nested properties, array items, unions, multiple
+  offenders, `true` accepted as well as `false`).
+
+### Panel polish
+
+- **Thread grouping**: consecutive messages that share a thread are shown under one thread head. Only consecutive runs are
+  grouped, because re-sorting by thread would put an answer above the question it answers.
+- **Unread count**: the trigger shows how many messages arrived since this conversation was last opened. The watermark is
+  local storage per conversation -- the relay stays stateless and no "who read what" is invented.
+
+- **Task board**: the panel shows the relay's own task list (up to six rows: id prefix, mode, status) through a host
+  proxy (`/api/w2m/tasks`), so the browser never holds a device token.
+
+Still missing from the panel: a timeout mark on an unanswered question, which needs the ask store from the turn state
+machine.
+### Verified
+
+Gate GREEN twice, 15 of 15: 2555 tests / 2541 pass / 0 fail / 14 skip.
+
+### Not verified
+
+Compat itself: that workflow runs in its own environment, so this release is verified by the same local gate that missed
+the defect. **Watch the Compat run for this tag.** If it fails again, the mount is failing for a different reason than the
+schema and the log will say which entry and which fiber.
 ## [1.2.2] — 2026-10-20
 
 **Fleet collaboration, part one: shared-memory writes, a council of machines, and the panel that reaches them.**
@@ -22,33 +192,33 @@ Creating the tag through the API had already triggered one run, which created th
 collided with it. A release step that cannot be retried fails for the wrong reason, so `beta.yml` now refreshes an existing
 release (notes + assets with `--clobber`) instead of refusing, and says so in the log.
 
-### What is in it
-
-- **Shared-memory writes**: `w2m_memory` gained `action: "append"` with `if_revision`. A stale revision comes back as a 409
-  the caller reads (revision, how far behind, which records it has not seen) and is deliberately **not** retried in the
-  transport -- retrying there turns a visible conflict into a silent overwrite.
-- **A council of machines**: `src/plugin/council-fleet.mjs` keeps the single-machine decision rule and changes the
-  transport to chat messages on `council-<id>`, so every machine reads the same ballots and recounts the same outcome.
-  Weights are a pure function of the ballot; a tie is refused; one ballot per machine; a late ballot is refused by name.
-  `w2m_council` exposes `fleet-open` / `fleet-vote` / `fleet-decide` / `fleet-state` / `fleet-list`.
-- **The panel**: a recipient picker (default "all"), a thread chip on messages that belong to a thread, click-to-reply with
-  a quoted line above the input, and the reply thread travelling with it. The host route refuses a single recipient that
-  is not in this fleet (`CHAT_UNKNOWN_RECIPIENT`) and says `CHAT_ROSTER_UNAVAILABLE` when the roster could not be read at
-  all -- a relay outage is not a typo in the recipient.
-- **A readable view over memory**: `w2m_memory` read now returns `view` (counts by machine and by status, one line per
-  record). A row shape it does not recognise is shown as itself rather than dropped.
-- **The beta pipeline is repeatable**: creating the tag had triggered a run that created the release, so the explicit
-  dispatch collided with it. The step now refreshes an existing release instead of refusing.
-
-### Verified
-
-Gate GREEN twice, 15 of 15: 2550 tests / 2536 pass / 0 fail / 14 skip. tools 125 (three append cases), council-fleet 12,
-memory-view 6, client-bundle 25.
-
-### Not verified
-
-The fleet council and a directed message across two live machines, and the panel against a second machine. Those need two
-machines on this build.
+### What is in it
+
+- **Shared-memory writes**: `w2m_memory` gained `action: "append"` with `if_revision`. A stale revision comes back as a 409
+  the caller reads (revision, how far behind, which records it has not seen) and is deliberately **not** retried in the
+  transport -- retrying there turns a visible conflict into a silent overwrite.
+- **A council of machines**: `src/plugin/council-fleet.mjs` keeps the single-machine decision rule and changes the
+  transport to chat messages on `council-<id>`, so every machine reads the same ballots and recounts the same outcome.
+  Weights are a pure function of the ballot; a tie is refused; one ballot per machine; a late ballot is refused by name.
+  `w2m_council` exposes `fleet-open` / `fleet-vote` / `fleet-decide` / `fleet-state` / `fleet-list`.
+- **The panel**: a recipient picker (default "all"), a thread chip on messages that belong to a thread, click-to-reply with
+  a quoted line above the input, and the reply thread travelling with it. The host route refuses a single recipient that
+  is not in this fleet (`CHAT_UNKNOWN_RECIPIENT`) and says `CHAT_ROSTER_UNAVAILABLE` when the roster could not be read at
+  all -- a relay outage is not a typo in the recipient.
+- **A readable view over memory**: `w2m_memory` read now returns `view` (counts by machine and by status, one line per
+  record). A row shape it does not recognise is shown as itself rather than dropped.
+- **The beta pipeline is repeatable**: creating the tag had triggered a run that created the release, so the explicit
+  dispatch collided with it. The step now refreshes an existing release instead of refusing.
+
+### Verified
+
+Gate GREEN twice, 15 of 15: 2550 tests / 2536 pass / 0 fail / 14 skip. tools 125 (three append cases), council-fleet 12,
+memory-view 6, client-bundle 25.
+
+### Not verified
+
+The fleet council and a directed message across two live machines, and the panel against a second machine. Those need two
+machines on this build.
 
 ## [1.2.1] — 2026-10-18