@twinsearth/w2m-dsh-plugin 1.4.2 → 1.4.3

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.4.2"
+    "version": "1.4.3"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.4.2",
+      "version": "1.4.3",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.4.2"
+  "version": "1.4.3"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,23 @@
 
 All notable changes to this project are documented here.
 
+## [1.4.3] — 2026-10-22
+
+**微信编队桥接：回复可靠性修复（不回复/静默问题）。**
+
+- 每条消息独立 try/catch：任何处理异常不再让进程退出，改为回复
+  `处理失败（阶段，错误码）：原因 + /help 提示`（新增 `renderBridgeError`）。
+- 桥接启动调用 `ilink/bot/msg/notifystart`：修复"token 有效、进程在跑、但 iLink 不推送消息"的静默状态；
+  日志记录 `notifystart : ok`，失败也记录原因。
+- 非文本、空消息、未以 `/run` 开头、权限不足、派发失败/超时等路径均保证有回复与下一步提示。
+- 运行方式支持 launchd 常驻（KeepAlive 自动拉起；macOS plist 由运维部署，不进入安装包）。
+
+- **授权优先级修复**：exec-capability 只在任务未携带 grant 时兜底；grant 被拒（replay / 过期 / 机器不符）
+  原样上报，不再被能力分支覆盖成路径匹配错误，`GRANT_REPLAY` 语义恢复。
+
+真机验收（macmini）：`notifystart ok`、错误回复代码在位、launchd state=running、bridge 进程存活；
+证据 `docs/acceptance/1.4.3/BRIDGE-LIVE.json`。测试：chatops-ilink-fleet-bridge 36/36。
+
 ## [1.4.2] — 2026-10-22
 
 **Node 代码执行权限成为 UI 可激活的子插件能力（命中真机验收）。**

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.4.2", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.4.3", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/acceptance/1.4.3/BRIDGE-LIVE.json

@@ -0,0 +1,22 @@
+{
+  "version": "1.4.3",
+  "case": "BRIDGE-LIVE",
+  "kind": "positive",
+  "machines": [
+    "71f0dd07-e957-4889-bf82-319a0d6b434a"
+  ],
+  "executed_at": "2026-10-22T07:08:13.838Z",
+  "executor": "lead",
+  "requirement": "the deployed WeChat bridge enables iLink message push (notifystart ok), answers failures through the renderBridgeError path, and runs under launchd KeepAlive",
+  "task_id": "01M5BRIDGEACCMVJ78GU0",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "notifystart": true,
+      "error_reply_code": true,
+      "launchd_state": "state = running",
+      "bridge_processes": 3
+    }
+  },
+  "note": "hotfixed bridge files were verified live on macmini before packaging; the same files are what v1.4.3 ships"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/agent/agent.mjs

@@ -2988,8 +2988,10 @@ export function createAgent(options) {
       let allowed = matchAllowedCommand(commandArgv, allowedCommands);
       let grantAuthorized = false;
       let capabilityAuthorized = false;
+      let grantAttempted = false;
       const capabilityStatus = readExecCapability(execCapabilityFile);
       if (allowed.allowed !== true && offer && typeof offer.grant === 'object' && offer.grant !== null) {
+        grantAttempted = true;
         const gatePaths = maintenancePaths();
         const gate = await authorizeWithGrant({
           offer,
@@ -3000,7 +3002,10 @@ export function createAgent(options) {
         if (gate.ok === true) { allowed = { allowed: true, ok: true, grant_id: gate.grantId }; grantAuthorized = true; }
         else allowed = { ok: false, reason_code: gate.code ?? 'GRANT_REJECTED', detail: gate.message };
       }
-      if (allowed.allowed !== true && capabilityStatus.effective === true) {
+      // A capability is a machine-local standing authorization, so it may rescue an allow-list miss -- but never an
+      // explicit grant refusal (replay, expiry, wrong machine). Masking GRANT_REPLAY with a capability would execute a
+      // token the operator already spent, and the envelope would report a reason that names neither decision.
+      if (allowed.allowed !== true && grantAttempted !== true && capabilityStatus.effective === true) {
         allowed = matchAllowedCommand(commandArgv, effectiveExecCapabilityPrefixes(execCapabilityFile));
         if (allowed.allowed === true) { capabilityAuthorized = true; warnings.push('EXEC_CAPABILITY: ' + EXEC_CAPABILITY_WARNING); }
       }

package/src/chatops/ilink-fleet-bridge.mjs

@@ -372,6 +372,25 @@ export function renderTaskOutcome({ taskId, body }) {
   return `${renderVerdict({ taskId, verdict, machines: rows }).text}`;
 }
 
+/**
+ * Render a per-message handling failure as something the operator can act on.
+ *
+ * The rule this exists for: **every message gets an answer, including the ones that broke something.**
+ * Before this, an exception anywhere in the per-message path escaped the loop, killed the process, and the
+ * chat window went silent with no indication why. A failure is now a reply with the phase, a stable code and
+ * the next step, and the loop continues.
+ *
+ * @param {unknown} error
+ * @param {string} [phase] where it failed: message | parse | reply | dispatch
+ * @returns {string}
+ */
+export function renderBridgeError(error, phase = 'message') {
+  const code = error?.code ?? error?.name ?? 'ERR_UNKNOWN';
+  const message = error?.message ?? String(error ?? '未知错误');
+  return `处理失败（${phase}，${code}）：${String(message).slice(0, 300)}\n`
+    + '可以发送 /help 查看用法，或稍后重试这条指令。';
+}
+
 /** Render a dispatch that never became a task. */
 export function renderFailure(error) {
   return renderDispatchFailure({

package/src/plugin/tools.mjs

@@ -276,7 +276,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.4.2';
+const PLUGIN_VERSION = '1.4.3';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;