@twinsearth/w2m-dsh-plugin 1.2.3 → 1.2.6

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
               },
     "metadata":  {
                      "description":  "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-                     "version":  "1.2.3"
+                     "version":  "1.2.6"
                  },
     "plugins":  [
                     {
                         "name":  "w2m-fleet",
                         "source":  "./",
                         "description":  "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-                        "version":  "1.2.3",
+                        "version":  "1.2.6",
                         "author":  {
                                        "name":  "TwinsEarth"
                                    },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
     "name":  "w2m-fleet",
     "description":  "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-    "version":  "1.2.3",
+    "version":  "1.2.6",
     "author":  {
                    "name":  "TwinsEarth"
                },

package/CHANGELOG.md

@@ -7,6 +7,190 @@
 
 All notable changes to this project are documented here.
 
+## [1.2.6] — 2026-10-20
+
+**Security surface: signatures, a permission matrix, and output that no longer carries secrets — plus the reliability the chat
+needed before it could be trusted with real messages.**
+
+### Command signatures
+
+The agent signs `{task_id, argv_hash, machine_id, ts}` with an Ed25519 key derived from its device key (`DeviceKey` is X25519 and
+cannot sign; deriving keeps one secret per machine). The envelope carries `signature {alg, value, public_key, ts}`, and
+`w2m_wait` reports every machine as `signed`, `unsigned` or `bad_signature`, with a task-level `signature_warning`. A tampered
+`argv_hash` verifies as `bad_signature` -- tested at the unit level and end to end through a real agent run.
+
+Honest limit: the public half travels inside the signature. That proves the result matches the key it carries, not that the key
+belongs to the machine. Binding it to the relay's device record is the remaining step for non-repudiation across machines, and it
+is named here rather than implied.
+
+### Permission matrix
+
+`src/util/policy-matrix.mjs` is the single table: `observer < worker < owner` against `read_private | vote | join | dispatch |
+approve | manage_members`. A refusal is `FORBIDDEN_ACTION` naming the action, the level required and the level held. The relay
+enforces it where a role actually acts: an observer may read the fleet flow and may not post into it. Unknown means worker, never
+owner.
+
+### Output redaction
+
+`stdout_head`/`tail` and `stderr_head`/`tail` are filtered for API keys, `npm_`/`github_pat_` tokens and private-key blocks,
+replaced in place with `[redacted:class]` so line numbers survive. Hashes and blobs are never touched: they are evidence of the raw
+bytes. `redactOutput: false` is allowed and marks the envelope `unredacted: true`.
+
+### End-to-end encrypted chat
+
+Sending encrypts with AES-256-GCM under a group key derived as `HKDF(fleetKey, 'fleet-chat-v1')`; the relay stores ciphertext and
+cannot open it. Reading decrypts what the key covers and marks the rest `encrypted: true` with a `decrypt_error`. Plaintext
+messages keep working, so older clients neither break nor are lied to. The relay validates the encryption envelope's shape and
+refuses a malformed one (`BAD_ENCRYPTION`), and cannot search content -- which is the point, and is written down as the cost.
+
+### Reliability
+
+- **Role persistence**: `member.role` ledger entries replay on restart, so a relay restart no longer silently demotes every owner.
+  Verified live: the role that was lost before the deploy came back after it.
+- **Chat cursor**: `list` continues where the last page ended (`since_ms` from a persisted per-session cursor) and advances only
+  over what was actually read.
+- **Offline spool**: a send that cannot reach the relay is written to disk with an idempotency key and replayed on the next call;
+  a replay that the relay already received returns the first message instead of posting twice.
+
+### Verified
+
+Gate GREEN twice, 15 of 15: 2666 tests / 2652 pass / 0 fail / 14 skip in 130 files. New suites: chat-crypto (8),
+envelope-signature (6), policy-matrix (9); agent 152, relay 173, tools 132, fleet-messages 14.
+
+Relay redeployed twice from hash-verified tarballs, with state backups, and the new surfaces exercised against the live relay:
+encrypted message stored as ciphertext and read back, malformed encryption refused with 400, roles restored after restart.
+
+### Known gaps
+
+- The GitHub Packages mirror still holds an orphan `1.2.4` published by a diagnostic dispatch; removal needs a token with package
+  administration (this one sees 404 on the package API).
+- The signing public key is not yet bound to the relay's device record (see above).
+- Two-machine end-to-end runs of the new chat surface are still not done; the HTTP and tool surfaces are tested against fakes and
+  exercised once against jp-shared.
+## [1.2.5] — 2026-10-20
+
+**Who is in the fleet, what they have read, who was named, and a retry that cannot double-post.**
+
+### Members and roles
+
+`GET /v1/fleet/members` lists every machine with its name, role, join time, presence and last-seen time. `PUT
+/v1/fleet/members/{id}` changes a role and requires the **operator** token, so the route sits with dispatch rather than behind the
+device gate. Roles are `owner | worker | observer` and live in their own table: a device record is written by pairing and by
+reconnect, and a role is an operator decision that must survive both. An unknown machine is a `worker`, never an `owner` -- a
+re-pair cannot gain authority. The last owner cannot be demoted, because then nobody could readmit a machine.
+
+### Read watermarks
+
+`PUT /v1/fleet/read/{session}` records how far this machine has read a conversation (its own token decides which machine);
+`GET /v1/fleet/read/{session}` answers the watermark and an unread count of messages from others newer than it. Only forward: a
+stale marker arriving late must not move the watermark backwards, or the count would grow for messages already seen.
+
+### Mentions
+
+A message may carry `mentions: [machine_id]` (at most 10, validated). The row is still **one** row -- a mention is a
+notification hint, not a delivery mechanism -- and the SSE notification says only whether **this** listener was named. It never
+carries the text, and it does not carry the mention list.
+
+### Idempotent posts
+
+`POST /v1/fleet/messages` accepts `idempotency_key` (per session). A retry after a lost response returns the **first** message
+with `deduped: true` instead of storing the sentence twice. The key is bounded, like the message log.
+
+### Two defects the 1.2.4 tag carried, fixed here
+
+The 1.2.4 commit (tag `v1.2.4`) had a red CI and a red Compat, both found before approval:
+
+- **Compat**: `w2m_wait`'s `reducer_machine_id` declaration had been pasted **inside** `poll_ms`. Every local check was green;
+  the real host refused the whole entry ("parameters.poll_ms.reducer_machine_id is not supported by the value schema DSL"). The
+  parameter now sits where it belongs, and `schema-spec.mjs` gained `strayParameterProblems()` — a parameter declaration
+  nested inside another parameter is now refused where the tool is written, with two tests.
+- **CI**: the cancellation HTTP test had been inserted inside an enclosing `it`. Node 24 ran it; Node 20/22 reported
+  `cancelledByParent`. The test now lives in its own top-level `describe`.
+
+### Verified
+
+Gate GREEN twice, 15 of 15: 2628 tests / 2614 pass / 0 fail / 14 skip. New suites: fleet-members (6); fleet-messages grew to 11;
+relay grew to 171 including two HTTP cases for members and watermarks.
+
+The relay was deployed a fourth time from a hash-verified tarball with a state backup, and the new routes were exercised against
+the live relay (members returned 8 machines; a role change returned 200; a watermark round-tripped; unread answered 0).
+
+### Not in this release
+
+- **Offline replay of outbound chat** is not implemented. The agent's spool already holds undeliverable *results*; chat text is
+  not yet spooled and replayed.
+- A two-machine end-to-end run of mentions/watermarks. The HTTP surface is tested against the fake relay and exercised once
+  against jp-shared, but not by two physical machines.
+## [1.2.4] — 2026-10-20
+
+**Fleet collaboration, part two: cancellation, dependencies, a task board, questions on disk, and output that travels.**
+
+### Cancelling a task over HTTP
+
+`state.cancelTask` has existed since the task ledger gained a cancel flag, but **no route reached it**. `POST /v1/tasks/{id}/cancel`
+now does, with the same operator authorization dispatch requires, and `w2m_cancel` is the tool over it. Cancelling twice is not
+an error: the ledger is the answer.
+
+### Prerequisites and a task board
+
+- `POST /v1/task` accepts `depends_on[]`. Validated at **enqueue** time: unknown prerequisite, self-edge, duplicate edge and
+  cycles are refused by name (`src/relay/task-deps.mjs`), because a graph checked only when a worker picks the task up puts the
+  refusal on a machine that did not create the problem.
+- `depends_on` / `assignee` travel on the task record.
+- `w2m_tasks` (the fifteenth tool) is the board: it classifies every visible task as ready / active / waiting / blocked / done
+  (`src/plugin/task-graph.mjs`). A prerequisite outside the page is treated as **waiting**, never as absent.
+
+### Questions that survive a restart
+
+`src/plugin/ask-store.mjs` keeps open questions in a JSONL file next to the profile (`ask-store.jsonl`, atomic rewrite, cap on
+records). A reply that arrives after the deadline is recorded as `answered_after_timeout` rather than overwriting the timeout or
+being dropped, and a settled question is never reopened. `w2m_chat` gained `action: "asks"`, and `await` settles the stored ask.
+
+### Output that travels
+
+`src/util/dataflow.mjs` (moved from `src/plugin/` — the layer check refused an `agent -> plugin` edge) is now wired:
+
+- a pipeline stage whose stdout exceeds 64 KiB **uploads it as a blob** (`PUT /v1/fleet/blobs/{sha256}`) and the envelope names
+  it (`blob_sha256`, `output_mode: "blob"`) instead of inlining head/tail;
+- a failed upload **fails the stage** by name (`BLOB_UPLOAD_FAILED`) rather than leaving a reference to nothing;
+- `w2m_wait` builds the reduce plan with `buildReducePlan` from the **raw** envelopes and marks the verdict `degraded` when a
+  shard is missing — but only when the caller declared `reducer_machine_id`, so a large pipeline result is not mistaken for a
+  partial reduce.
+
+The end-to-end fixture this release adds (`test/agent.test.mjs`) runs a real agent against a fake relay: it asserts the blob name
+is the hash of the bytes sent and that a refused upload fails the stage. Two real defects surfaced while writing it and are fixed
+here: the stage stdout arrives as a `Buffer` (it was handed to the signature helper as a string), and a 70 KiB test argv exceeds
+Windows' `CreateProcess` limit.
+
+### Retry and hand-off
+
+- `POST /v1/task` accepts `max_attempts` (1..5, default 1) and `retry_on` (`expired|failed|partial|timeout`). Defaults keep
+  at-most-once for every existing caller; a malformed policy is `BAD_REQUEST`, not silently ignored.
+- On lease expiry, `retry_on` containing `expired` performs the hand-off `halt=now` always had: attempt+1 and a re-offer to idle
+  machines (`_takeover`, which already refuses writing tasks to avoid double application).
+
+### mapreduce
+
+`mode: "mapreduce"` is accepted with `reduce_argv` and an optional `reducer_machine_id`. The map half is ordinary dispatch; the
+reduce half is **described, never launched** — the caller runs it as an explicit second task after `w2m_wait` says every shard is
+present, so one task id never describes two executions.
+
+### Relay
+
+The relay was deployed three times during this release (cancel route, retry policy, mapreduce) from hash-verified tarballs, each
+with a state backup, a health check, and a 401 check on the pre-existing routes. **The relay name is separate from the package
+version**: the tarball deployed was the 1.2.3-labelled build carrying this code, and is re-deployed from the released 1.2.4 tarball
+below.
+
+### Verified
+
+Gate GREEN twice, 15 of 15: 2610 tests / 2596 pass / 0 fail / 14 skip. Notable suites: agent 149 (147 pass, 2 skipped),
+relay 169, tools 127, task-deps 13, task-graph 11, ask-store 8, turn 5, dataflow 7, dataflow-wiring 7.
+
+### Not verified
+
+A two-machine run of cancel / retry / mapreduce end to end. The code paths are tested against a fake relay and against the real
+relay's HTTP surface, but no test here runs two physical machines exchanging an expired lease.
 ## [1.2.3] — 2026-10-20
 
 **The packed artifact did not mount. This fixes that, and the reason it was not caught here.**