@twinsearth/w2m-dsh-plugin 1.4.2 → 1.4.4

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.4.2"
+    "version": "1.4.4"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.4.2",
+      "version": "1.4.4",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.4.2"
+  "version": "1.4.4"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,38 @@
 
 All notable changes to this project are documented here.
 
+## [1.4.4] — 2026-10-23
+
+**relay 重启不再丢失编队归属（devices.json 持久化 fleet_id）。**
+
+- 持久化修复：`devices.json` 快照新增 `fleet_id` / `fleet_source`，`restore()` 同步恢复。
+  在此之前，relay 重启后设备全在、token 仍有效，但每台设备的 fleet 归属全变成 null——
+  编队"静默消失"且没有任何错误可看（本次在共享 relay 上实测复现）。
+- 桥接 getupdates 看门狗：空闲时每 10 分钟输出 `polling ... connection live`；
+  40s 长轮询超时明确记录 `poll timeout after 40s -- reconnecting`；
+  连续 5 分钟没有一次成功轮询则退出（exit 3），由 launchd KeepAlive / systemd Restart= 拉起新连接，
+  避免"进程活着但没人知道它是否还在轮询"的静默状态。
+- 测试：relay 新增 fleet 重启往返用例（pair by fleet_key → 重启 → fleet_id/fleet_source 保留）；
+  bridge 套件 36/36；门禁 GREEN ×2。
+- 证据：docs/acceptance/1.4.4/FLEET-PERSISTENCE.json（真实 fleet task `01M5FLEETPERSIST0000000002`）。
+
+## [1.4.3] — 2026-10-22
+
+**微信编队桥接：回复可靠性修复（不回复/静默问题）。**
+
+- 每条消息独立 try/catch：任何处理异常不再让进程退出，改为回复
+  `处理失败（阶段，错误码）：原因 + /help 提示`（新增 `renderBridgeError`）。
+- 桥接启动调用 `ilink/bot/msg/notifystart`：修复"token 有效、进程在跑、但 iLink 不推送消息"的静默状态；
+  日志记录 `notifystart : ok`，失败也记录原因。
+- 非文本、空消息、未以 `/run` 开头、权限不足、派发失败/超时等路径均保证有回复与下一步提示。
+- 运行方式支持 launchd 常驻（KeepAlive 自动拉起；macOS plist 由运维部署，不进入安装包）。
+
+- **授权优先级修复**：exec-capability 只在任务未携带 grant 时兜底；grant 被拒（replay / 过期 / 机器不符）
+  原样上报，不再被能力分支覆盖成路径匹配错误，`GRANT_REPLAY` 语义恢复。
+
+真机验收（macmini）：`notifystart ok`、错误回复代码在位、launchd state=running、bridge 进程存活；
+证据 `docs/acceptance/1.4.3/BRIDGE-LIVE.json`。测试：chatops-ilink-fleet-bridge 36/36。
+
 ## [1.4.2] — 2026-10-22
 
 **Node 代码执行权限成为 UI 可激活的子插件能力（命中真机验收）。**

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.4.2", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.4.4", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/acceptance/1.4.3/BRIDGE-LIVE.json

@@ -0,0 +1,22 @@
+{
+  "version": "1.4.3",
+  "case": "BRIDGE-LIVE",
+  "kind": "positive",
+  "machines": [
+    "71f0dd07-e957-4889-bf82-319a0d6b434a"
+  ],
+  "executed_at": "2026-10-22T07:08:13.838Z",
+  "executor": "lead",
+  "requirement": "the deployed WeChat bridge enables iLink message push (notifystart ok), answers failures through the renderBridgeError path, and runs under launchd KeepAlive",
+  "task_id": "01M5BRIDGEACCMVJ78GU0",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "notifystart": true,
+      "error_reply_code": true,
+      "launchd_state": "state = running",
+      "bridge_processes": 3
+    }
+  },
+  "note": "hotfixed bridge files were verified live on macmini before packaging; the same files are what v1.4.3 ships"
+}

package/docs/acceptance/1.4.4/FLEET-PERSISTENCE.json

@@ -0,0 +1,20 @@
+{
+  "version": "1.4.4",
+  "case": "FLEET-PERSISTENCE",
+  "kind": "positive",
+  "machines": [
+    "d89d5817-953d-4571-883d-23800e67d20c"
+  ],
+  "executed_at": "2026-10-22T16:32:38.180Z",
+  "executor": "lead",
+  "requirement": "a relay restart keeps every device in the fleet it was paired into: devices.json persists fleet_id/fleet_source and restore rebuilds them",
+  "task_id": "01M5FLEETPERSIST0000000002",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "fleet_roundtrip_test": "pass",
+      "node_test_exit": 0
+    }
+  },
+  "note": "executed as a real fleet task (node --test, fleet round-trip case) on the local machine before packaging"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/agent/agent.mjs

@@ -2988,8 +2988,10 @@ export function createAgent(options) {
       let allowed = matchAllowedCommand(commandArgv, allowedCommands);
       let grantAuthorized = false;
       let capabilityAuthorized = false;
+      let grantAttempted = false;
       const capabilityStatus = readExecCapability(execCapabilityFile);
       if (allowed.allowed !== true && offer && typeof offer.grant === 'object' && offer.grant !== null) {
+        grantAttempted = true;
         const gatePaths = maintenancePaths();
         const gate = await authorizeWithGrant({
           offer,
@@ -3000,7 +3002,10 @@ export function createAgent(options) {
         if (gate.ok === true) { allowed = { allowed: true, ok: true, grant_id: gate.grantId }; grantAuthorized = true; }
         else allowed = { ok: false, reason_code: gate.code ?? 'GRANT_REJECTED', detail: gate.message };
       }
-      if (allowed.allowed !== true && capabilityStatus.effective === true) {
+      // A capability is a machine-local standing authorization, so it may rescue an allow-list miss -- but never an
+      // explicit grant refusal (replay, expiry, wrong machine). Masking GRANT_REPLAY with a capability would execute a
+      // token the operator already spent, and the envelope would report a reason that names neither decision.
+      if (allowed.allowed !== true && grantAttempted !== true && capabilityStatus.effective === true) {
         allowed = matchAllowedCommand(commandArgv, effectiveExecCapabilityPrefixes(execCapabilityFile));
         if (allowed.allowed === true) { capabilityAuthorized = true; warnings.push('EXEC_CAPABILITY: ' + EXEC_CAPABILITY_WARNING); }
       }

package/src/chatops/ilink-fleet-bridge.mjs

@@ -372,6 +372,25 @@ export function renderTaskOutcome({ taskId, body }) {
   return `${renderVerdict({ taskId, verdict, machines: rows }).text}`;
 }
 
+/**
+ * Render a per-message handling failure as something the operator can act on.
+ *
+ * The rule this exists for: **every message gets an answer, including the ones that broke something.**
+ * Before this, an exception anywhere in the per-message path escaped the loop, killed the process, and the
+ * chat window went silent with no indication why. A failure is now a reply with the phase, a stable code and
+ * the next step, and the loop continues.
+ *
+ * @param {unknown} error
+ * @param {string} [phase] where it failed: message | parse | reply | dispatch
+ * @returns {string}
+ */
+export function renderBridgeError(error, phase = 'message') {
+  const code = error?.code ?? error?.name ?? 'ERR_UNKNOWN';
+  const message = error?.message ?? String(error ?? '未知错误');
+  return `处理失败（${phase}，${code}）：${String(message).slice(0, 300)}\n`
+    + '可以发送 /help 查看用法，或稍后重试这条指令。';
+}
+
 /** Render a dispatch that never became a task. */
 export function renderFailure(error) {
   return renderDispatchFailure({

package/src/plugin/tools.mjs

@@ -276,7 +276,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.4.2';
+const PLUGIN_VERSION = '1.4.4';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;

package/src/relay/persistence.mjs

@@ -213,6 +213,18 @@ export class Persistence {
         device_token: d.device_token ?? null,
         paired_at: rfc3339(d.paired_at_ms ?? this._now()),
         re_paired: d.re_paired === true,
+        /**
+         * v1.4.4: **the fleet binding is part of the device, so it must survive a restart.**
+         *
+         * Measured on the shared relay (2026-10-23): a relay restart came back with every device
+         * present and every fleet assignment gone, because this snapshot did not carry the two
+         * fields the pairing decision had produced. The devices were still authorised, so nothing
+         * looked broken -- they simply stopped being in a fleet, which is the one thing the fleet
+         * key had been bought to guarantee. `fleet_id` is a derived hash (not a secret) and
+         * `fleet_source` is the provenance that makes a wrong binding visible.
+         */
+        fleet_id: d.fleet_id ?? null,
+        fleet_source: d.fleet_source ?? null,
       };
     }
     const body = JSON.stringify(out, null, 2);

package/src/relay/state.mjs

@@ -750,6 +750,11 @@ export class RabbitState {
           device_token: typeof d.device_token === 'string' ? d.device_token : null,
           paired_at_ms: Number.isFinite(pairedAt) ? pairedAt : this.nowMs(),
           re_paired: d.re_paired === true,
+          // v1.4.4: restore the fleet binding with the device. Without this the snapshot brought the
+          // device back but dropped the fleet it was paired into, so a restart silently un-joined
+          // every machine while leaving it fully authorised (measured 2026-10-23 on the shared relay).
+          fleet_id: typeof d.fleet_id === 'string' && d.fleet_id !== '' ? d.fleet_id : null,
+          fleet_source: typeof d.fleet_source === 'string' && d.fleet_source !== '' ? d.fleet_source : null,
           last_seen_at_ms: this.nowMs(),
           // a snapshot proves the device exists, not that it is connected
           online: false,