@twinsearth/w2m-dsh-plugin 1.2.5 → 1.2.7

package/src/plugin/tools.mjs

@@ -1,4 +1,4 @@
-/**
+/**
  * DSH: Windows2MacO - the DSH Cordis plugin.
  *
  * # What this exposes
@@ -94,6 +94,7 @@ import { resolveChannels } from './update-channels.mjs';
 import { fetchLatestRelease, fetchPrereleaseRelease, requireChecksum, downloadVerified, DEFAULT_REPO } from './update-source.mjs';
 import { installUpdate } from './update-install.mjs';import { createHash, randomUUID } from 'node:crypto';
 import { promises as fs } from 'node:fs';
+import { join } from 'node:path';
 import os from 'node:os';
 import path from 'node:path';
 // The individual memory layer (v0.9.6). Read through the agent's own module rather than re-parsing the
@@ -186,8 +187,51 @@ import { registerChatRoutes } from './fleet-chat-route.mjs';
 import { createFleetCouncil, fleetCouncilThread } from './council-fleet.mjs';
 import { renderMemoryView } from './memory-view.mjs';
 import { buildBoard } from './task-graph.mjs';
+import { verifyEnvelopeSignature } from '../util/envelope-signature.mjs';
 import { createAskStore } from './ask-store.mjs';
 import { deriveTurns } from './turn.mjs';
+import { decryptChatMessage, deriveChatKey, encryptChatText, isEncrypted } from '../util/chat-crypto.mjs';
+
+/**
+ * v1.2.6 reliability: two small files beside the plugin's state.
+ *
+ * `chat-cursor.json` remembers how far each conversation has been read, so "list" continues where the last page ended instead of
+ * starting over. `chat-spool.jsonl` holds messages that could not be sent because the Rabbit was unreachable; each carries the
+ * idempotency key it will be posted with, so a replay that the relay already received does not post the sentence twice.
+ */
+const CHAT_CURSOR_FILE = 'chat-cursor.json';
+const CHAT_SPOOL_FILE = 'chat-spool.jsonl';
+
+async function readChatCursors(stateDir) {
+  if (typeof stateDir !== 'string' || stateDir === '') return {};
+  try {
+    const parsed = JSON.parse(await fs.readFile(join(stateDir, CHAT_CURSOR_FILE), 'utf8'));
+    return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+  } catch { return {}; }
+}
+
+async function writeChatCursors(stateDir, cursors) {
+  if (typeof stateDir !== 'string' || stateDir === '') return false;
+  try { await fs.writeFile(join(stateDir, CHAT_CURSOR_FILE), JSON.stringify(cursors, null, 2), 'utf8'); return true; }
+  catch { return false; }
+}
+
+async function readChatSpool(stateDir) {
+  if (typeof stateDir !== 'string' || stateDir === '') return [];
+  try {
+    const text = await fs.readFile(join(stateDir, CHAT_SPOOL_FILE), 'utf8');
+    return text.split('\n').map((line) => { try { return JSON.parse(line); } catch { return null; } }).filter((entry) => entry !== null && typeof entry === 'object');
+  } catch { return []; }
+}
+
+async function writeChatSpool(stateDir, entries) {
+  if (typeof stateDir !== 'string' || stateDir === '') return false;
+  try {
+    await fs.writeFile(join(stateDir, CHAT_SPOOL_FILE), entries.map((entry) => JSON.stringify(entry)).join('\n') + (entries.length === 0 ? '' : '\n'), 'utf8');
+    return true;
+  } catch { return false; }
+}
+
 import { buildReducePlan } from '../util/dataflow.mjs';
 import { schemaProblems, strayParameterProblems } from './schema-spec.mjs';
 import { listIntents, resolveIntent } from './intents.mjs';
@@ -228,7 +272,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.2.5';
+const PLUGIN_VERSION = '1.2.7';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -3727,6 +3771,15 @@ export async function apply(ctx, config = {}) {
         items: { type: 'string' },
         description: 'Which terminal conditions justify another attempt: expired, failed, partial, timeout. Omit to never retry.',
       },
+      depends_on: {
+        type: 'array',
+        items: { type: 'string' },
+        description: 'Task ids this task waits for. The relay will not dispatch it until every dependency has settled; then it is offered automatically.',
+      },
+      assignee: {
+        type: 'string',
+        description: 'Machine id that must execute this task. An assignee is a restriction: no other machine is offered the work, and an unknown id is refused by name.',
+      },
     },
     output: jsonOutput,
     async execute(args, exec) {
@@ -4137,6 +4190,11 @@ export async function apply(ctx, config = {}) {
         // v1.2.4: the retry policy travels only when the caller asked for one, so a default dispatch stays byte-identical.
         ...(Number.isInteger(args?.max_attempts) && args.max_attempts > 1 ? { max_attempts: args.max_attempts } : {}),
         ...(Array.isArray(args?.retry_on) && args.retry_on.length > 0 ? { retry_on: args.retry_on } : {}),
+        // v1.2.7: graph edges and assignment travel only when declared, so a default dispatch stays byte-identical.
+        ...(Array.isArray(args?.depends_on) && args.depends_on.filter((id) => typeof id === 'string' && id !== '').length > 0
+          ? { depends_on: args.depends_on.filter((id) => typeof id === 'string' && id !== '') }
+          : {}),
+        ...(typeof args?.assignee === 'string' && args.assignee.trim() !== '' ? { assignee: args.assignee.trim() } : {}),
         created_by: cfg.machineName,
         // Only sent for broadcast; the relay ignores it otherwise, and the validation above already
         // refused the combination, so this cannot silently mean nothing.
@@ -4423,6 +4481,14 @@ export async function apply(ctx, config = {}) {
       const machines = Array.isArray(aggregate.detail?.machines)
         ? aggregate.detail.machines.map((machine) => {
             const envelope = machine?.envelope ?? machine?.result ?? null;
+            // v1.2.6: the signature covers the command tuple; a reader is told which of the three states it is in.
+            const relayVerdict = typeof machine?.signature_status === 'string' && machine.signature_status !== '' ? machine.signature_status : null;
+          const signatureStatus = relayVerdict ?? verifyEnvelopeSignature({
+              signature: envelope?.signature ?? null,
+              task_id: envelope?.task_id ?? taskId,
+              argv_hash: envelope?.command_hash,
+              machine_id: envelope?.machine_id ?? machine?.machine_id,
+            });
             return {
               machine_id: machine?.machine_id ?? null,
               machine_name: machine?.machine_name ?? null,
@@ -4440,6 +4506,7 @@ export async function apply(ctx, config = {}) {
                * v0.3.9 agent sends, so a missing value must not be dressed up as `'relay'`.
                */
               transport: envelope?.transport ?? machine?.transport ?? null,
+              signature_status: signatureStatus,
               p2p: envelope?.p2p ?? machine?.p2p ?? null,
               reasons: machine?.reasons ?? [],
               envelope: compactEnvelope(envelope, COMPARABLE_FIELDS),
@@ -4447,19 +4514,39 @@ export async function apply(ctx, config = {}) {
           })
         : [];
 
+      // v1.2.6: a signature state is never silently flattened into success.
+      const signatureCounts = machines.reduce((counts, machine) => {
+        const key = machine.signature_status ?? 'unsigned';
+        counts[key] = (counts[key] ?? 0) + 1;
+        return counts;
+      }, {});
+      const unsigned = signatureCounts.unsigned ?? 0;
+      const badSignature = signatureCounts.bad_signature ?? 0;
+
       // v1.2.4: a task whose machines produced blobs is only complete when EVERY map result names one and a reducer was
       // declared. The plan is built from the RAW envelopes: the comparable copy intentionally drops the fields this needs,
       // and a reduce over a partial fleet that reports itself complete is the failure this guards.
       const reducerMachineId = typeof args?.reducer_machine_id === 'string' && args.reducer_machine_id.trim() !== ''
         ? args.reducer_machine_id.trim()
         : null;
-      const rawMachines = Array.isArray(aggregate.detail?.machines) ? aggregate.detail.machines : [];
-      const mapResults = rawMachines.map((machine) => {
+      // v1.2.7: the relay publishes machine facts directly on the aggregate; `detail.machines` is a test/report shape that the
+      // real /v1/tasks response does not carry. Reading only the latter made the reduce plan silently unreachable in production.
+      const rawMachines = Array.isArray(aggregate.detail?.machines)
+        ? aggregate.detail.machines
+        : (Array.isArray(aggregate.machines) ? aggregate.machines : []);
+      // v1.2.7: only a machine that actually reported can claim a shard. An expired lease still carries an index, and counting
+      // it as "produced" would make a partial run look complete -- the exact failure the expected-index check exists to prevent.
+      const reportedMachines = rawMachines.filter((machine) => (machine?.envelope ?? machine?.result ?? null) !== null || typeof machine?.blob_sha256 === 'string' || typeof machine?.stdout_head === 'string' || Number.isFinite(machine?.stdout_bytes) || (typeof machine?.status === 'string' && machine.status !== '' && Number.isFinite(machine?.exit_code)));
+      const mapResults = reportedMachines.map((machine) => {
         const envelope = machine?.envelope ?? machine?.result ?? null;
-        const blobSha = typeof envelope?.blob_sha256 === 'string' ? envelope.blob_sha256 : null;
-        const inline = typeof envelope?.stdout_head === 'string' && envelope.stdout_head !== '' ? envelope.stdout_head : null;
+        const blobSha = typeof envelope?.blob_sha256 === 'string' ? envelope.blob_sha256
+          : (typeof machine?.blob_sha256 === 'string' ? machine.blob_sha256 : null);
+        const inline = typeof envelope?.stdout_head === 'string' && envelope.stdout_head !== '' ? envelope.stdout_head
+          : (typeof machine?.stdout_head === 'string' && machine.stdout_head !== '' ? machine.stdout_head : null);
         return {
           machine_id: machine?.machine_id ?? null,
+          // v1.2.7: the shard this result belongs to, so the reduce plan can tell "complete" from "the rest never reported".
+          index: Number.isInteger(machine?.index) ? machine.index : (Number.isInteger(envelope?.index) ? envelope.index : null),
           mode: blobSha === null ? 'inline' : 'blob',
           ...(inline === null ? {} : { stdout: inline }),
           ...(blobSha === null ? {} : { blob_sha256: blobSha }),
@@ -4467,7 +4554,12 @@ export async function apply(ctx, config = {}) {
       });
       const anyBlob = mapResults.some((entry) => entry.mode === 'blob');
       const reduce = anyBlob && reducerMachineId !== null
-        ? buildReducePlan({ results: mapResults, reducerMachineId })
+        ? buildReducePlan({
+            results: mapResults,
+            reducerMachineId,
+            // v1.2.7: the task's own shard count is the completeness contract; absent it, the old "just what arrived" plan stands.
+            expectedIndexTotal: Number.isInteger(body?.task?.index_total) ? body.task.index_total : null,
+          })
         : null;
       const dataflowDegraded = reduce !== null && reduce.ok !== true;
 
@@ -4480,6 +4572,9 @@ export async function apply(ctx, config = {}) {
           state_known: aggregate.known,
           states: aggregate.states,
           machines,
+          signatures: signatureCounts,
+          ...(badSignature > 0 ? { signature_warning: 'bad_signature' } : {}),
+          ...(badSignature === 0 && unsigned > 0 ? { signature_warning: 'unsigned' } : {}),
           ...(reduce === null ? {} : { reduce }),
           ...(dataflowDegraded ? { dataflow_degraded: true } : {}),
           counts: aggregate.detail?.counts ?? null,
@@ -6536,6 +6631,10 @@ export async function apply(ctx, config = {}) {
         type: 'string',
         description: 'For send/ask: replay protection. A retry with the same key returns the first message instead of posting the same sentence twice.',
       },
+      reply_state: {
+        type: 'string',
+        description: 'For send/ask: answer the turn as "answered" or "refused". A refusal is a state the awaiter reads, not a wording it has to guess from.',
+      },
       timeout_ms: { type: 'number', description: 'For await: how long to wait before reporting a timeout (default 60000, capped at 300000). A timeout is a value, not an error.' },
     },
     output: jsonOutput,
@@ -6545,10 +6644,16 @@ export async function apply(ctx, config = {}) {
       const action = typeof args?.action === 'string' ? args.action : 'list';
       const sessionId = typeof args?.session_id === 'string' ? args.session_id.trim() : '';
       if (sessionId === '') throw new W2MError('W2M_CHAT_SESSION', 'W2M_CHAT_SESSION: session_id is required', { hint: 'chat is scoped to a conversation' });
+      // v1.2.7: expire stale turns on every entry, so `asks` reports the truth after downtime.
+      askStore.expireDue();
       if (action === 'asks') {
         // The persisted questions for this conversation, in the states they are in. A read, so it needs no relay.
         return JSON.stringify({ ok: true, action, session_id: sessionId, ...askStore.list({ sessionId }) });
       }
+      if (action === 'cursor') {
+        const cursors = await readChatCursors(cfg.stateDir);
+        return JSON.stringify({ ok: true, action, session_id: sessionId, cursor: Object.prototype.hasOwnProperty.call(cursors, sessionId) ? cursors[sessionId] : null, spool_count: (await readChatSpool(cfg.stateDir)).length });
+      }
       const rabbitUrl = cfg.rabbitUrl ?? null;
       if (rabbitUrl === null) throw new W2MError('W2M_NO_RELAY', 'W2M_NO_RELAY: no relay is configured, so chat cannot be reached', { hint: 'set rabbitUrl in the profile patch' });
       // resolveToken, not readDevice: readDevice returns an empty identity whenever `stateDir` is
@@ -6557,6 +6662,22 @@ export async function apply(ctx, config = {}) {
       // one reported W2M_NO_TOKEN on a machine that was paired and answering every other call.
       const token = await resolveToken(cfg);
       if (token === null) throw new W2MError('W2M_NO_TOKEN', 'W2M_NO_TOKEN: this machine has no device token, so chat cannot be authenticated', { hint: 'pair this machine first (autoStartAgent or a pairing code), then retry' });
+      const stateDir = typeof cfg.stateDir === 'string' ? cfg.stateDir : '';
+      // v1.2.6 reliability: try to deliver what the last unreachable attempt had to leave behind, before doing anything else.
+      let spool = await readChatSpool(stateDir);
+      let spoolDelivered = 0;
+      if (spool.length > 0) {
+        const remaining = [];
+        for (const entry of spool) {
+          try {
+            const replayed = await request({ rabbitUrl, token, signal: exec?.signal, method: 'POST', pathname: '/v1/fleet/messages', body: entry.body });
+            if (replayed?.ok === true) { spoolDelivered += 1; continue; }
+          } catch { /* still unreachable: keep it for next time */ }
+          remaining.push(entry);
+        }
+        spool = remaining;
+        await writeChatSpool(stateDir, spool);
+      }
       // Addressing + correlation travel only when the caller supplied them, so a plain broadcast stays byte-identical.
       const addressing = {};
       if (typeof args?.to === 'string' && args.to.trim() !== '') {
@@ -6570,64 +6691,180 @@ export async function apply(ctx, config = {}) {
       if (typeof args?.reply_to === 'string' && args.reply_to.trim() !== '') addressing.reply_to = args.reply_to.trim();
 
       if (action === 'await') {
-        // Waiting for an ANSWER is a state machine, and a timeout is a value the caller reads rather than an exception
-        // that loses the question. The question stays in the flow, so it can still be answered later.
+        // v1.2.7: waiting is a persisted turn, not a poll loop.
+        //
+        // The question is written to the ask store when it is ASKED; await attaches to that record, so a restart in between
+        // does not lose the question or turn a late answer into silence. The event stream is tried first (the reply arrives
+        // when it is posted, not up to a poll interval later), and polling remains the fallback for a relay or proxy that
+        // cannot stream -- an old relay must not break awaiting.
         const target = typeof args?.reply_to === 'string' ? args.reply_to.trim() : '';
-        if (target === '') throw new W2MError('W2M_CHAT_AWAIT', 'W2M_CHAT_AWAIT: reply_to is required for await', { hint: 'pass the message_id returned by ask' });
+        if (target === '') throw new W2MError('W2M_CHAT_AWAIT', 'W2M_CHAT_AWAIT: reply_to is required for await', { hint: 'pass reply_to: <message_id of the question>' });
         const timeoutMs = Number.isFinite(args?.timeout_ms) ? Math.max(1000, Math.min(args.timeout_ms, 300000)) : 60000;
         const startedAt = Date.now();
+        askStore.expireDue();
+        let turn = askStore.list({ sessionId }).asks.find((ask) => (ask.state === 'open' || ask.state === 'timeout') && ask.message_id === target) ?? null;
+        if (turn === null) {
+          const opened = askStore.openAsk({ sessionId, messageId: target, timeoutMs });
+          turn = opened.ok === true ? opened.ask : null;
+        }
+        const ownMachineId = cfg.machineId ?? null;
+        const findReply = async () => {
+          const listed = await request({ rabbitUrl, token, signal: exec?.signal, method: 'GET', pathname: '/v1/fleet/messages', query: { session_id: sessionId, limit: 200 } });
+          const rows = Array.isArray(listed?.json?.messages) ? listed.json.messages : [];
+          return rows.find((message) => message.reply_to === target && message.machine_id !== ownMachineId) ?? null;
+        };
+        const finish = (replyMessage, via) => {
+          const verdict = replyMessage?.reply_state === 'refused' ? 'refused' : 'answered';
+          if (turn !== null) askStore.settle(turn.ask_id, verdict, { messageId: replyMessage?.message_id ?? null });
+          const recorded = turn === null ? null : (askStore.list({ sessionId }).asks.find((ask) => ask.ask_id === turn.ask_id) ?? null);
+          return JSON.stringify({ ok: true, action, state: verdict, via, reply_to: target, reply: replyMessage, replies: replyMessage === null ? [] : [replyMessage], ask: recorded });
+        };
+        // 1) stream first -- and RE-subscribe while the budget remains: a dropped stream is not the end of the wait.
+        let emptyStreams = 0;
+        while (Date.now() - startedAt < timeoutMs) {
+          const remaining = timeoutMs - (Date.now() - startedAt);
+          const controller = new AbortController();
+          const timer = setTimeout(() => controller.abort(), Math.min(remaining, 30000));
+          let reachable = false;
+          let gotEvent = false;
+          try {
+            const streamUrl = joinUrl(rabbitUrl, '/v1/fleet/messages/stream') + '?session_id=' + encodeURIComponent(sessionId);
+            const response = await fetch(streamUrl, { headers: { authorization: 'Bearer ' + token }, signal: controller.signal });
+            if (response.ok === true && response.body !== null) {
+              reachable = true;
+              const reader = response.body.getReader();
+              const decoder = new TextDecoder();
+              let buffer = '';
+              for (;;) {
+                const { value, done } = await reader.read();
+                if (done === true) break;
+                buffer += decoder.decode(value, { stream: true });
+                const parts = buffer.split('\n\n');
+                buffer = parts.pop() ?? '';
+                for (const part of parts) {
+                  const line = part.split('\n').find((entry) => entry.startsWith('data: '));
+                  if (line === undefined) continue;
+                  gotEvent = true;
+                  const reply = await findReply();
+                  if (reply !== null) return finish(reply, 'stream');
+                }
+              }
+            }
+          } catch (error) {
+            if (error?.name === 'AbortError' && Date.now() - startedAt >= timeoutMs) break;
+          } finally { clearTimeout(timer); }
+          if (reachable !== true) break; // a relay that will not stream at all: polling is the contract
+          emptyStreams = gotEvent === true ? 0 : emptyStreams + 1;
+          if (emptyStreams >= 2) break; // two streams that end immediately will not deliver this reply
+          await new Promise((resolve) => { setTimeout(resolve, 100); });
+        }
+        // 2) polling fallback
         for (;;) {
           throwIfAborted(exec?.signal);
-          const reply = await request({ rabbitUrl, token, signal: exec?.signal, method: 'GET', pathname: '/v1/fleet/messages', query: { session_id: sessionId, reply_to: target, limit: '10' } });
-          const found = Array.isArray(reply?.json?.messages) ? reply.json.messages : [];
-          if (found.length > 0) {
-            for (const open of askStore.list({ sessionId }).asks) {
-              if (open.state === 'open' && open.message_id === target) askStore.settle(open.ask_id, 'answered', { messageId: found[0]?.message_id ?? null });
-            }
-            return JSON.stringify({ ok: true, action, state: 'answered', reply_to: target, replies: found });
-          }
+          const reply = await findReply();
+          if (reply !== null) return finish(reply, 'poll');
           if (Date.now() - startedAt >= timeoutMs) {
-            return JSON.stringify({ ok: true, action, state: 'timeout', reply_to: target, waited_ms: Date.now() - startedAt, hint: 'the question is still in the flow and can be answered later' });
+            if (turn !== null) askStore.expire(turn.ask_id);
+            const recorded = turn === null ? null : (askStore.list({ sessionId }).asks.find((ask) => ask.ask_id === turn.ask_id) ?? null);
+            return JSON.stringify({ ok: true, action, state: 'timeout', reply_to: target, waited_ms: Date.now() - startedAt, ask: recorded, hint: 'the question stays in the flow and can still be answered later' });
           }
-          await new Promise((resolve) => { setTimeout(resolve, 1500); });
+          await new Promise((resolve) => { setTimeout(resolve, 1000); });
         }
       }
       if (action === 'send' || action === 'ask') {
         const mentions = Array.isArray(args?.mentions) ? args.mentions.filter((id) => typeof id === 'string' && id !== '') : [];
-        const posted = await request({
-          rabbitUrl,
-          token,
-          signal: exec?.signal,
-          method: 'POST',
-          pathname: '/v1/fleet/messages',
-          body: {
-            session_id: sessionId,
-            text: typeof args?.text === 'string' ? args.text : '',
-            ...addressing,
-            // v1.2.5: a mention is a notification hint; the idempotency key lets a retry after a lost response replay the
-            // first message instead of posting the same sentence twice.
-            ...(mentions.length === 0 ? {} : { mentions }),
-            ...(typeof args?.idempotency_key === 'string' && args.idempotency_key.trim() !== '' ? { idempotency_key: args.idempotency_key.trim() } : {}),
-          },
-        });
+        /**
+         * v1.2.6: the chat is end-to-end encrypted when a fleet key is available (configured, or derived from the account join).
+         * Without one the tool keeps sending plaintext rather than refusing: a fleet that has not joined yet is a normal state,
+         * and a silent refusal would read as a broken chat.
+         */
+        const chatKey = deriveChatKey(cfg.fleetKey ?? resolvedFleetKey.value ?? null);
+        const plainText = typeof args?.text === 'string' ? args.text : '';
+        const sealed = chatKey === null ? null : encryptChatText(chatKey, plainText);
+        /**
+         * v1.2.6 reliability: an unreachable Rabbit does not lose the message. The exact body that could not be sent is
+         * spooled to disk and replayed with the SAME idempotency key next time, so a message the relay actually received
+         * before the connection died is not posted twice.
+         */
+        const messageBody = {
+          session_id: sessionId,
+          text: sealed !== null && sealed.ok === true ? sealed.text : plainText,
+          ...(sealed !== null && sealed.ok === true ? { enc: sealed.enc } : {}),
+          ...addressing,
+          ...(mentions.length === 0 ? {} : { mentions }),
+          ...(typeof args?.idempotency_key === 'string' && args.idempotency_key.trim() !== '' ? { idempotency_key: args.idempotency_key.trim() } : { idempotency_key: 'spool-' + Date.now() + '-' + Math.random().toString(36).slice(2) }),
+            ...(typeof args?.reply_state === 'string' && (args.reply_state === 'answered' || args.reply_state === 'refused') ? { reply_state: args.reply_state } : {}),
+        };
+        let posted = null;
+        try {
+          posted = await request({ rabbitUrl, token, signal: exec?.signal, method: 'POST', pathname: '/v1/fleet/messages', body: messageBody });
+        } catch (error) {
+          if (error?.code === 'W2M_UNREACHABLE') {
+            spool.push({ body: messageBody, created_at: new Date().toISOString() });
+            await writeChatSpool(stateDir, spool);
+            return JSON.stringify({ ok: true, action, spooled: true, spool_count: spool.length, encrypted: sealed !== null && sealed.ok === true });
+          }
+          throw error;
+        }
         if (posted?.ok !== true) {
           const code = posted?.json?.error?.code ?? posted?.error?.code ?? 'W2M_CHAT_SEND';
           throw new W2MError('W2M_CHAT_SEND', code + ': the message was refused', { reason_code: code, hint: 'quota, size and non-text each need a different answer' });
         }
-        return JSON.stringify({ ok: true, action, message: posted.json?.message ?? null, message_id: posted.json?.message?.message_id ?? null, ...(posted.json?.deduped === true ? { deduped: true } : {}) });
+        let ask = null;
+        if (action === 'ask' && posted.json?.message?.message_id !== undefined) {
+          // v1.2.7: the question becomes a turn on disk the moment it is asked, so a later await (in this process or after a
+          // restart) settles the same record instead of opening a second one.
+          const opened = askStore.openAsk({
+            sessionId,
+            messageId: posted.json.message.message_id,
+            threadId: typeof args?.thread_id === 'string' ? args.thread_id : null,
+            to: typeof args?.to === 'string' ? args.to : null,
+            timeoutMs: Number.isFinite(args?.timeout_ms) ? args.timeout_ms : 60000,
+          });
+          if (opened.ok === true) ask = opened.ask;
+        }
+        return JSON.stringify({
+          ok: true, action, message: posted.json?.message ?? null, message_id: posted.json?.message?.message_id ?? null,
+          encrypted: sealed !== null && sealed.ok === true,
+          ...(ask === null ? {} : { ask }),
+          ...(posted.json?.deduped === true ? { deduped: true } : {}),
+        });
       }
+      const query = { session_id: sessionId };
+      // v1.2.6 reliability: continue where the last page ended, unless the caller asked for an explicit start.
+      const cursors = await readChatCursors(stateDir);
+      const storedCursor = Object.prototype.hasOwnProperty.call(cursors, sessionId) ? cursors[sessionId] : null;
+      if (!Number.isFinite(args?.since_ms) && storedCursor !== null && Number.isFinite(storedCursor.at_ms)) query.since_ms = String(storedCursor.at_ms);
       if (typeof args?.thread_id === 'string' && args.thread_id.trim() !== '') query.thread_id = args.thread_id.trim();
       if (typeof args?.to === 'string' && args.to.trim() !== '') query.to = args.to.trim();
-      const query = { session_id: sessionId };
       if (Number.isFinite(args?.since_ms)) query.since_ms = String(args.since_ms);
       if (Number.isInteger(args?.limit)) query.limit = String(args.limit);
       const listed = await request({ rabbitUrl, token, signal: exec?.signal, method: 'GET', pathname: '/v1/fleet/messages', query });
       if (listed?.ok !== true) throw new W2MError('W2M_CHAT_LIST', 'W2M_CHAT_LIST: the relay refused the read', { hint: 'check the relay and this machine token' });
-      const messages = listed.json?.messages ?? [];
+      const rawMessages = listed.json?.messages ?? [];
+      /**
+       * v1.2.6: a reader decrypts what its key covers and marks the rest. An undecryptable message keeps its ciphertext and its
+       * reason instead of failing the page -- the relay is allowed to hold a message this machine cannot open.
+       */
+      const listKey = deriveChatKey(cfg.fleetKey ?? resolvedFleetKey.value ?? null);
+      const messages = rawMessages.map((message) => {
+        if (!isEncrypted(message)) return message;
+        const opened = decryptChatMessage(listKey, message);
+        if (opened.ok === true) return { ...message, text: opened.text, decrypted: true };
+        return { ...message, text: '', decrypted: false, encrypted: true, decrypt_error: opened.code };
+      });
+      const encryptedCount = messages.filter((message) => message.encrypted === true || message.decrypted === true).length;
+      // The cursor advances only over what was actually read, so a page that failed mid-way does not skip messages.
+      const newestAt = messages.reduce((max, message) => (Number.isFinite(message?.at_ms) && message.at_ms > max ? message.at_ms : max), 0);
+      let cursor = storedCursor;
+      if (newestAt > 0 && (storedCursor === null || newestAt > storedCursor.at_ms)) {
+        cursor = { at_ms: newestAt, message_id: messages.filter((message) => message.at_ms === newestAt)[0]?.message_id ?? null };
+        await writeChatCursors(stateDir, { ...cursors, [sessionId]: cursor });
+      }
       // v1.2.4: the page is annotated with turns derived from the relay's own numbering, so a reader does not have to order
       // replies by arrival time.
       const turns = deriveTurns(messages);
-      return JSON.stringify({ ok: true, action, session_id: sessionId, messages, count: messages.length, turns: turns.threads, inferred_turns: turns.inferred_turns, count_was: listed.json?.count ?? 0, usage: listed.json?.usage ?? null });
+      return JSON.stringify({ ok: true, action, session_id: sessionId, messages, count: messages.length, encrypted_count: encryptedCount, cursor, spooled: spoolDelivered, turns: turns.threads ?? [], inferred_turns: turns.inferred_turns ?? [] });
     },
   }));
 
@@ -6941,6 +7178,11 @@ export async function apply(ctx, config = {}) {
           mode: row?.mode ?? null,
           status: row?.status ?? null,
           cancelled: row?.cancelled === true,
+          // v1.2.7: graph facts travel with each row so the board and the scheduler cannot disagree.
+          depends_on: Array.isArray(row?.depends_on) ? row.depends_on : [],
+          assignee: row?.assignee ?? null,
+          waiting_on: Array.isArray(row?.waiting_on) ? row.waiting_on : [],
+          lease_states: row?.lease_states ?? {},
           machines: Array.isArray(row?.leases)
             ? row.leases.map((lease) => lease?.machine_id ?? null).filter((id) => typeof id === "string")
             : [],
@@ -7182,6 +7424,8 @@ async function startLocalStack(ctx, cfg) {
       caps,
       platform,
       allowedCommands: cfg.allowedCommands,
+      // v1.2.6: on by default; a profile may turn it off for debugging, and the envelope then says `unredacted: true`.
+      redactOutput: cfg.redactOutput !== false,
     });
     /**
      * v0.8.9: derive the fleet key, RETRYING until the account actually answers.

package/src/relay/fleet-messages.mjs

@@ -105,6 +105,20 @@ export function createFleetMessages(options = {}) {
     if (to !== 'all' && (to.length > 64 || /\s/.test(to))) return { ok: false, code: 'BAD_ADDRESS' };
     // Correlation: a thread groups a conversation, reply_to points at the message being answered, turn orders the
     // exchange inside one thread. Plain fields, validated rather than trusted.
+    /**
+     * v1.2.6 end-to-end encryption: the relay carries the ciphertext and its metadata, and never a key. It validates the SHAPE
+     * because a malformed envelope would be stored and later fail on every reader; it cannot check the content, and that is the
+     * point -- which also means it cannot search messages or know their real length.
+     */
+    const rawEnc = input?.enc;
+    let enc = null;
+    if (rawEnc !== undefined && rawEnc !== null) {
+      const ivOk = typeof rawEnc.iv === 'string' && rawEnc.iv.length > 0 && rawEnc.iv.length <= 64;
+      const tagOk = typeof rawEnc.tag === 'string' && rawEnc.tag.length > 0 && rawEnc.tag.length <= 64;
+      if (rawEnc.v !== 1 || rawEnc.alg !== 'aes-256-gcm' || !ivOk || !tagOk) return { ok: false, code: 'BAD_ENCRYPTION' };
+      enc = { v: 1, alg: 'aes-256-gcm', iv: rawEnc.iv, tag: rawEnc.tag };
+    }
+
     // v1.2.5 idempotency: replay the first message instead of storing the text twice.
     const idempotencyKey = typeof input?.idempotency_key === 'string' && input.idempotency_key.trim() !== ''
       ? input.idempotency_key.trim().slice(0, 64)
@@ -129,6 +143,11 @@ export function createFleetMessages(options = {}) {
       mentions = [...new Set(rawMentions)];
     }
 
+    // v1.2.7: a reply can be an ANSWER or a REFUSAL, and the difference is a state, not a wording. Validated here so the
+    // turn state machine reads the sender's own word instead of guessing from text.
+    const replyState = input?.reply_state === undefined || input?.reply_state === null ? null : input.reply_state;
+    if (replyState !== null && replyState !== 'answered' && replyState !== 'refused') return { ok: false, code: 'BAD_REPLY_STATE' };
+
     const threadId = typeof input?.thread_id === 'string' && input.thread_id.trim() !== ''
       ? input.thread_id.trim().slice(0, 64)
       : null;
@@ -161,7 +180,11 @@ export function createFleetMessages(options = {}) {
       text,
       // Omitted when empty so a message without mentions keeps the pre-1.2.5 shape.
       ...(mentions.length === 0 ? {} : { mentions }),
+      // v1.2.6: ciphertext metadata travels beside the text so an old client can read it as opaque text and a new one can name
+      // the cipher it does not have a key for.
+      ...(enc === null ? {} : { enc }),
       ...(idempotencyKey === null ? {} : { idempotency_key: idempotencyKey }),
+      ...(replyState === null ? {} : { reply_state: replyState }),
       at_ms: now(),
       bytes,
     };

package/src/relay/report.mjs

@@ -148,6 +148,8 @@ export function aggregate(task, resultRecords = [], opts = {}) {
       observing: lease.state === 'observing',
       result: rec,
       envelope: rec?.envelope ?? null,
+      // v1.2.6: the relay's own signature verdict (bound to the key registered at pairing), not a client claim.
+      signature_status: rec?.validation?.signature_status ?? null,
       outcome: null,
       reasons: [],
     });
@@ -166,6 +168,7 @@ export function aggregate(task, resultRecords = [], opts = {}) {
       gate_refused: false,
       result: rec,
       envelope: rec.envelope,
+      signature_status: rec?.validation?.signature_status ?? null,
       outcome: null,
       reasons: [],
     });
@@ -487,6 +490,19 @@ export function aggregate(task, resultRecords = [], opts = {}) {
       transport: m.envelope?.transport ?? null,
       p2p: m.envelope?.p2p ?? null,
       reasons: m.reasons,
+      // v1.2.6: the relay's verdict, bound to the key registered at pairing.
+      signature_status: m.signature_status ?? null,
+      /**
+       * v1.2.7: the dataflow facts a reader needs to build a reduce plan.
+       *
+       * The aggregate used to publish only a summary per machine, so a client could not see that a result was a blob -- the
+       * reduce plan existed in tests and read raw envelopes that the production response never carried. These four fields are
+       * that omission, closed: the blob hash, the file/blob mode, the inline head, and the byte count.
+       */
+      blob_sha256: m.envelope?.blob_sha256 ?? null,
+      output_mode: m.envelope?.output_mode ?? null,
+      stdout_head: m.envelope?.stdout_head ?? null,
+      stdout_bytes: m.envelope?.stdout_bytes ?? null,
     })),
     steps,
     differences: step3.differences ?? [],

package/src/relay/server.mjs

@@ -22,7 +22,16 @@ import {
   RabbitState,
   rfc3339,
 } from './state.mjs';
+
+// v1.2.7: the content-addressed blob channel carries ARTIFACTS, so its frame limit cannot be the JSON frame limit.
+//
+// MAX_FRAME_BYTES (64 KiB) is exactly the inline threshold: any blob is larger than an inline result by construction, so with
+// one shared limit the blob channel could never accept a single byte -- a pipeline blob upload from a real relay failed with
+// FRAME_TOO_LARGE while the fake relay in the tests accepted it. The dataflow hard cap stays the agent-side bound; this is the
+// transport bound, and it is still bounded.
+export const BLOB_FRAME_BYTES = 1024 * 1024; // 1 MiB per blob frame
 import { createFleetMessages } from './fleet-messages.mjs';
+import { can as mayAct } from '../util/policy-matrix.mjs';
 import { createFleetMemory } from './fleet-memory.mjs';
 import { createJoinChallenges } from './join-challenge.mjs';
 import { createAdmission } from './admission.mjs';
@@ -686,7 +695,9 @@ export class RelayServer {
 
     // v0.3.0 §9: read the body ONCE, before routing. An HMAC covers the exact
     // received bytes, so no route may consume the stream first and re-serialise.
-    const rawBody = methodHasBody(method) ? await readRawBody(req, this.frameLimitBytes) : null;
+    /** v1.2.7: only the blob channel gets the larger frame cap; every JSON route keeps the 64 KiB frame limit. */
+    const blobFrameLimit = method === 'PUT' && path.startsWith('/v1/fleet/blobs/') ? BLOB_FRAME_BYTES : this.frameLimitBytes;
+    const rawBody = methodHasBody(method) ? await readRawBody(req, blobFrameLimit) : null;
     const takeJson = () => parseJsonBody(rawBody);
 
     /* ---- public endpoints ---- */
@@ -1114,6 +1125,25 @@ export class RelayServer {
     this.fleetMemory ??= createFleetMemory({ now: () => this.state.nowMs() });
 
     if (method === 'POST' && path === '/v1/fleet/messages') {
+      /**
+       * v1.2.6: posting to the group is a dispatch-class action. An observer may read the flow and may not speak into it, and
+       * the refusal names the action and both roles so it is actionable.
+       */
+      const permitted = mayAct({ role: this.state.roleOf(device.machine_id), action: 'dispatch' });
+      if (permitted.ok !== true) {
+        return sendJson(res, 403, {
+          protocol_version: PROTOCOL_VERSION,
+          ok: false,
+          error: { code: permitted.code, message: 'role may not post to the fleet group' },
+          detail: {
+            action: permitted.action,
+            required_level: permitted.required_level,
+            current_level: permitted.current_level,
+            required_role: permitted.required_role,
+            current_role: permitted.current_role,
+          },
+        });
+      }
       const body = takeJson();
       const posted = this.fleetMessages.post({
         session_id: body.session_id,
@@ -1124,6 +1154,8 @@ export class RelayServer {
         reply_to: body.reply_to,
         text: body.text,
         mentions: body.mentions,
+        enc: body.enc,
+        reply_state: body.reply_state,
         idempotency_key: body.idempotency_key,
       });
       if (posted.ok !== true) {