@twinsearth/w2m-dsh-plugin 1.5.0 → 1.5.1

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.5.0"
+    "version": "1.5.1"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.5.0",
+      "version": "1.5.1",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.5.0"
+  "version": "1.5.1"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,21 @@
 
 All notable changes to this project are documented here.
 
+## [1.5.1] — 2026-10-23
+
+**备用链路的身份隔离 + 控制面板的 relay 折叠。**
+
+- `bin/w2m-secondary-link.mjs`：默认给子进程独立身份目录（`<stateDir>/dsh-home`），并同时设置
+  `DSH_HOME` / `USERPROFILE` / `HOME`，可用 `--identity-home` 指定。修复的是 v1.5.0 现场实测的坑：
+  备用链路首次启动覆盖了主链路 `~/.dsh/xclient/device.json`，机器在下一次重启前看不出问题，
+  重启后却会以**备用身份**连到**错误的 relay**。这种"重启后才爆"的坑按默认隔离处理。
+- 控制面板 relay 折叠：`GET /api/w2m/target` 快照新增 `relays`（`relayUrls` 数组优先，兼容单
+  `rabbitUrl`），探测 `/healthz` 后按 RTT 排序、标注 primary/standby/offline；超过 3 个节点时只显示
+  3 个并给出 "+N 折叠" 提示，展开后显示全部（含离线节点，不隐藏故障）。
+- 探针失败保留在列表末尾（`ok:false`），网络异常不会让节点从视图中消失，也不会抛进快照路径。
+- 测试：secondary-link 7/7、fleet-target 49/49（新增 relay pool 四个用例）；门禁 GREEN ×2；
+  证据 `docs/acceptance/1.5.1/IDENTITY-ISOLATION-RELAY-FOLD.json`（真实 fleet task `01M5ANYMVKS3OQZ`）。
+
 ## [1.5.0] — 2026-10-23
 
 **多 relay 双通道（active-passive）+ relay 健康看门狗。**

package/bin/w2m-secondary-link.mjs

@@ -47,6 +47,7 @@ const HERE = dirname(fileURLToPath(import.meta.url));
 const DEFAULTS = Object.freeze({
   project: process.cwd(),
   stateDir: null,
+  identityHome: null,
   logFile: null,
   allowedCommands: '[]',
   restartDelayMs: 3000,
@@ -68,6 +69,7 @@ export function parseSecondaryArgs(argv) {
     fleetKey: null,
     name: null,
     stateDir: null,
+    identityHome: null,
     logFile: null,
     project: DEFAULTS.project,
     operatorToken: null,
@@ -86,6 +88,7 @@ export function parseSecondaryArgs(argv) {
       case '--fleet-key': out.fleetKey = value(); break;
       case '--name': out.name = value(); break;
       case '--state': out.stateDir = value(); break;
+      case '--identity-home': out.identityHome = value(); break;
       case '--log': out.logFile = value(); break;
       case '--project': out.project = value(); break;
       case '--operator-token': out.operatorToken = value(); break;
@@ -104,6 +107,18 @@ export function parseSecondaryArgs(argv) {
   }
   const suffix = out.name ?? 'standby';
   out.stateDir = out.stateDir ?? join(process.cwd(), '.w2m-secondary', suffix);
+  /**
+   * v1.5.1: **the standby gets its own identity home.**
+   *
+   * Measured in the field: the first v1.5.0 standby overwrote `~/.dsh/xclient/device.json` -- the
+   * primary link's identity -- because `w2m-localside` derives that path from `DSH_HOME`. The
+   * machine kept working (the running agent holds its token in memory) until its next restart, at
+   * which point it would have come up as the *standby* identity on the wrong relay. A link that is
+   * only correct until the next restart is a trap, so isolation is the default rather than an
+   * option: the child runs with `DSH_HOME` (and the platforms' home variables) pointed at this
+   * directory, and `--identity-home` exists for operators who need a specific path.
+   */
+  out.identityHome = out.identityHome ?? join(out.stateDir, 'dsh-home');
   out.logFile = out.logFile ?? join(out.stateDir, 'link.log');
   return out;
 }
@@ -158,10 +173,25 @@ export async function runSupervisor(options, deps) {
   const stopSignal = deps.stopSignal ?? { stopped: false };
   const args = buildLocalsideArgs(options);
   let delay = DEFAULTS.restartDelayMs;
-  log(`supervising secondary link relay=${options.relay} state=${options.stateDir}`);
+  // v1.5.1: the child must not see the primary link's identity. Both spellings are set because
+  // Windows resolves the home directory from USERPROFILE while POSIX uses HOME, and `DSH_HOME` is
+  // what `src/agent/identity.mjs` actually reads for `<DSH_HOME>/xclient/device.json`.
+  const childEnv = {
+    ...process.env,
+    DSH_HOME: options.identityHome,
+    USERPROFILE: options.identityHome,
+    HOME: options.identityHome,
+  };
+  try {
+    mkdirSync(options.identityHome, { recursive: true, mode: 0o700 });
+  } catch (error) {
+    log(`cannot create identity home ${options.identityHome}: ${error?.message ?? error}`);
+    throw error;
+  }
+  log(`supervising secondary link relay=${options.relay} state=${options.stateDir} identityHome=${options.identityHome}`);
   while (!stopSignal.stopped) {
     const startedAt = Date.now();
-    const child = spawnFn(process.execPath, args, { stdio: 'ignore', windowsHide: true });
+    const child = spawnFn(process.execPath, args, { stdio: 'ignore', windowsHide: true, env: childEnv });
     log(`child started pid=${child.pid ?? '?'}`);
     const exit = await new Promise((resolve) => {
       child.once('exit', (code, signal) => resolve({ code, signal }));

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.5.0", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.5.1", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/acceptance/1.5.1/IDENTITY-ISOLATION-RELAY-FOLD.json

@@ -0,0 +1,22 @@
+{
+  "version": "1.5.1",
+  "case": "IDENTITY-ISOLATION-RELAY-FOLD",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-23T09:40:01.304Z",
+  "executor": "lead",
+  "requirement": "the standby link isolates its identity home from the primary link (DSH_HOME/USERPROFILE/HOME) and the composer control folds a relay pool of more than three nodes",
+  "task_id": "01M5ANYMVKS3OQZ",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "secondary_link_suite": "7/7 pass",
+      "fleet_target_suite": "49/49 pass",
+      "identity_home_default": "isolated",
+      "relay_fold": "shown+hidden counted"
+    }
+  },
+  "note": "both suites were executed as one real fleet task on the Tencent relay before packaging"
+}

package/lib/client.js

@@ -105,6 +105,12 @@ window.__ModuleLoader__.load({
         unreachable: '无法连接插件',
         routeMissing: '这个 Harness 没有提供插件目标路由',
         fleetUnreadable: '机器列表读取失败',
+        relays: 'Relay 节点',
+        relayPrimary: '主 relay',
+        relayStandby: '备用',
+        relayOffline: '离线',
+        relayFold: '另有 {count} 个已折叠，点击展开',
+        relayUnfold: '收起折叠的 relay',
         capLabel: 'Node 执行：{state}',
         capDenied: '拒绝',
         capTemporary: '临时 24 小时',
@@ -129,6 +135,12 @@ window.__ModuleLoader__.load({
         unreachable: 'the plugin could not be reached',
         routeMissing: 'this host does not serve the W2M target route',
         fleetUnreadable: 'the fleet could not be read',
+        relays: 'Relay nodes',
+        relayPrimary: 'primary',
+        relayStandby: 'standby',
+        relayOffline: 'offline',
+        relayFold: '{count} more folded — expand',
+        relayUnfold: 'collapse the folded relays',
         capLabel: 'Node exec: {state}',
         capDenied: 'denied',
         capTemporary: 'temporary 24 h',
@@ -311,6 +323,13 @@ window.__ModuleLoader__.load({
       'background:var(--dsw-alias-bg-layer-1);box-shadow:var(--dsw-elevation-soft);',
       'font-size:13px;line-height:20px;color:var(--dsw-alias-label-primary)}',
       '.w2mTarget_note{padding:6px 8px;color:var(--dsw-alias-label-tertiary);font-weight:400}',
+      '.w2mTarget_relayFold{margin-top:2px;padding:4px 0;border-top:.5px solid var(--dsw-alias-border-l2)}',
+      '.w2mTarget_relayToggle{display:block;width:100%;box-sizing:border-box;padding:4px 8px;border:none;border-radius:var(--dsw-radius-sm);background:transparent;color:var(--dsw-alias-label-secondary);font:inherit;font-size:11px;text-align:left;cursor:pointer}',
+      '.w2mTarget_relayRow{display:flex;align-items:center;gap:6px;padding:2px 8px;font-size:11px;color:var(--dsw-alias-label-secondary)}',
+      '.w2mTarget_relayRole{flex:none;min-width:44px;color:var(--dsw-alias-label-tertiary)}',
+      '.w2mTarget_relayUrl{flex:1 1 auto;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}',
+      '.w2mTarget_relayRtt{flex:none;font-variant-numeric:tabular-nums;color:var(--dsw-alias-label-tertiary)}',
+      '.w2mTarget_relayHint{padding:2px 8px;font-size:11px;color:var(--dsw-alias-label-tertiary)}',
       '.w2mTarget_option{display:block;width:100%;box-sizing:border-box;padding:6px 8px;border:none;border-radius:var(--dsw-radius-sm);',
       'background:transparent;color:inherit;font:inherit;text-align:left;cursor:pointer}',
       '.w2mTarget_option:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}',
@@ -416,6 +435,9 @@ window.__ModuleLoader__.load({
      */
     function TargetSelect({ sessionId, locked: _locked, t }) {
       const [open, setOpen] = React.useState(false);
+      // v1.5.1: relay folding. The snapshot carries the pool; when it holds more than three nodes
+      // the menu shows a summary and this toggle reveals the folded ones.
+      const [relayOpen, setRelayOpen] = React.useState(false);
       const [reloadSeq, setReloadSeq] = React.useState(0);
       const [state, setState] = React.useState(null);
       const [error, setError] = React.useState(null);
@@ -493,6 +515,8 @@ window.__ModuleLoader__.load({
 
       const chosen = state?.selected?.machine_id ?? null;
       const machines = Array.isArray(state?.machines) ? state.machines : [];
+      // v1.5.1: the relay pool the host probed, already folded. `null` means a single-relay host.
+      const relayFold = state?.relays ?? null;
       const problem = error ?? fleetProblem(state, t);
       const disabled = typeof sessionId !== 'string' || sessionId === '';
       const label = state === null ? (provisionalLabel(state) ?? t('machine')) : labelOf(state, t);
@@ -576,6 +600,35 @@ window.__ModuleLoader__.load({
                     ? t('local')
                     : (machine.online === true ? (machine.os ?? t('online')) : machine.state)),
                 ]))),
+            relayFold === null ? null : h('div', {
+              key: '__relays__',
+              className: cls('relayFold'),
+              role: 'group',
+              'aria-label': t('relays'),
+            }, [
+              h('button', {
+                key: 'toggle',
+                type: 'button',
+                className: cls('relayToggle'),
+                'aria-expanded': relayOpen,
+                onClick: (event) => { event.stopPropagation(); setRelayOpen((wasOpen) => !wasOpen); },
+                title: relayOpen === true ? t('relayUnfold') : t('relayFold', { count: relayFold.hidden_count }),
+              }, `${t('relays')}: ${relayFold.online}/${relayFold.total} ${t('online')}`),
+              ...(relayOpen === true ? [...relayFold.shown, ...relayFold.hidden] : relayFold.shown).map((item, index) => h('div', {
+                key: `relay-${index}`,
+                className: cls('relayRow'),
+                'data-role': item.role,
+              }, [
+                h('span', { key: 'role', className: cls('relayRole') }, item.role === 'primary'
+                  ? t('relayPrimary')
+                  : (item.role === 'standby' ? t('relayStandby') : t('relayOffline'))),
+                h('span', { key: 'url', className: cls('relayUrl') }, String(item.url ?? '').replace(/^https?:\/\//, '').replace(/\/$/, '')),
+                h('span', { key: 'rtt', className: cls('relayRtt') }, item.rtt_ms === null || item.rtt_ms === undefined ? '—' : `${item.rtt_ms} ms`),
+              ])),
+              relayFold.hidden_count > 0 && relayOpen === false
+                ? h('div', { key: 'hint', className: cls('relayHint') }, t('relayFold', { count: relayFold.hidden_count }))
+                : null,
+            ]),
           ])
         : null;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/fleet-target.mjs

@@ -434,6 +434,85 @@ export async function readFleet(deps) {
   };
 }
 
+/**
+ * v1.5.1: the relay pool the client folds, derived from configuration.
+ *
+ * `relayUrls` (array) is the multi-relay form; the single `rabbitUrl` stays valid and is returned
+ * as a one-element pool, so a host that never configured a pool behaves exactly as it did.
+ *
+ * @param {{relayUrls?: unknown, rabbitUrl?: string|null}|null|undefined} cfg
+ * @returns {string[]} Normalized base URLs, order preserved, duplicates removed.
+ */
+export function relayUrlsFromConfig(cfg) {
+  const raw = Array.isArray(cfg?.relayUrls) ? cfg.relayUrls : [];
+  const urls = raw
+    .filter((entry) => typeof entry === 'string' && entry.trim() !== '')
+    .map((entry) => entry.trim().replace(/\/+$/, ''));
+  if (urls.length > 0) return [...new Set(urls)];
+  if (typeof cfg?.rabbitUrl === 'string' && cfg.rabbitUrl.trim() !== '') {
+    return [cfg.rabbitUrl.trim().replace(/\/+$/, '')];
+  }
+  return [];
+}
+
+/**
+ * Fold a relay pool for display: at most `limit` nodes are shown, the rest are counted.
+ *
+ * The client is expected to render `shown` and `hidden` exactly as given: a view that silently
+ * shows every node when there are dozens is the failure this helper exists to prevent.
+ *
+ * @param {object[]} items Probe results, best first.
+ * @param {number} [limit]
+ * @returns {{shown: object[], hidden: object[], hidden_count: number, total: number, online: number}}
+ */
+export function foldRelayItems(items, limit = 3) {
+  const list = Array.isArray(items) ? items : [];
+  const shown = list.slice(0, Math.max(0, limit));
+  const hidden = list.slice(Math.max(0, limit));
+  return {
+    shown,
+    hidden,
+    hidden_count: hidden.length,
+    total: list.length,
+    online: list.filter((item) => item?.ok === true).length,
+  };
+}
+
+/**
+ * Probe each relay's `/healthz` and return the pool sorted by round-trip time (fastest first).
+ * A relay that fails is kept and sorted last with `ok:false` — disappearing from the list would
+ * hide exactly the outage the operator needs to see.
+ *
+ * @param {string[]} urls
+ * @param {{timeoutMs?: number, fetchImpl?: Function}} [options]
+ * @returns {Promise<object[]>}
+ */
+export async function probeRelays(urls, options = {}) {
+  const timeoutMs = Number.isInteger(options.timeoutMs) ? options.timeoutMs : 1200;
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const list = Array.isArray(urls) ? urls : [];
+  const results = await Promise.all(list.map(async (url) => {
+    const started = Date.now();
+    try {
+      const response = await fetchImpl(`${url}/healthz`, {
+        signal: typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function'
+          ? AbortSignal.timeout(timeoutMs)
+          : undefined,
+      });
+      const body = await response.json().catch(() => ({}));
+      if (!response.ok || body?.ok !== true) {
+        return { url, ok: false, rtt_ms: null, error: `HTTP ${response.status}` };
+      }
+      return { url, ok: true, rtt_ms: Date.now() - started, relay_id: body.relay_id ?? null };
+    } catch (error) {
+      return { url, ok: false, rtt_ms: null, error: error instanceof Error ? error.message : String(error) };
+    }
+  }));
+  const reachable = results.filter((item) => item.ok === true).sort((a, b) => (a.rtt_ms ?? 0) - (b.rtt_ms ?? 0));
+  const unreachable = results.filter((item) => item.ok !== true);
+  return [...reachable, ...unreachable];
+}
+
 /**
  * Build the snapshot the browser renders.
  *
@@ -447,7 +526,7 @@ export async function readFleet(deps) {
  * @returns {object}
  */
 export function buildUiState(deps) {
-  const { store, sessionId, fleet, localMachineName = null, detailUnavailable = false } = deps;
+  const { store, sessionId, fleet, localMachineName = null, detailUnavailable = false, relays = null } = deps;
   const selection = store.get(sessionId);
   const machines = Array.isArray(fleet?.machines) ? fleet.machines : [];
   const selected = selection === null ? null : machines.find((machine) => machine.machine_id === selection.machine_id) ?? null;
@@ -479,6 +558,20 @@ export function buildUiState(deps) {
       // but cannot reach this half, and the honest answer is to say so rather than to look empty.
       detail_unavailable: detailUnavailable === true,
     },
+    // v1.5.1: the relay pool, folded. `null` means the host did not probe (single-relay host or
+    // probe disabled); the control then renders no relay section instead of inventing one.
+    relays: relays === null
+      ? null
+      : {
+          total: relays.total,
+          online: relays.online,
+          hidden_count: relays.hidden_count,
+          shown: relays.shown,
+          hidden: relays.hidden,
+          // Fastest reachable relay is the one a dispatch would prefer; naming it here keeps the
+          // fold honest when it hides nodes that the router would still consider.
+          primary_url: relays.shown.find((item) => item.ok === true)?.url ?? null,
+        },
   };
 }
 
@@ -680,12 +773,38 @@ function mountTargetRoutes(connection, deps, status, logger) {
     return value;
   };
 
+  /** v1.5.1: relay probing is cached like the fleet: opening the menu must not turn into a burst. */
+  let relayCache = { at: 0, value: null };
+  const relayPoolFor = async () => {
+    const now = Date.now();
+    if (relayCache.value !== null && now - relayCache.at < FLEET_CACHE_MS) return relayCache.value;
+    const urls = relayUrlsFromConfig(deps.cfg());
+    if (urls.length === 0) {
+      relayCache = { at: now, value: null };
+      return null;
+    }
+    const probed = await probeRelays(urls);
+    // The fold's primary is the fastest reachable node; every other reachable node is standby, and
+    // an unreachable one keeps its place at the end as `offline` rather than disappearing.
+    let reachableSeen = 0;
+    const items = probed.map((item) => {
+      if (item.ok !== true) return { ...item, role: 'offline' };
+      reachableSeen += 1;
+      return { ...item, role: reachableSeen === 1 ? 'primary' : 'standby' };
+    });
+    const folded = foldRelayItems(items, 3);
+    relayCache = { at: now, value: folded };
+    return folded;
+  };
+
   const snapshot = async (sessionId, signal) => {
     const cfg = deps.cfg();
     const identity = await deps.localIdentity();
     const fleet = await fleetFor(signal);
+    const relays = await relayPoolFor();
     return buildUiState({
       store: deps.store,
+      relays,
       sessionId,
       fleet,
       localMachineName: identity.machine_name ?? cfg.machineName ?? null,

package/src/plugin/tools.mjs

@@ -276,7 +276,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.5.0';
+const PLUGIN_VERSION = '1.5.1';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;