@twinsearth/w2m-dsh-plugin 1.5.3 → 1.5.5

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.5.3"
+    "version": "1.5.5"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.5.3",
+      "version": "1.5.5",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.5.3"
+  "version": "1.5.5"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.5.3",
+  "version": "1.5.5",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,36 @@
 
 All notable changes to this project are documented here.
 
+## [1.5.5] — 2026-10-23
+
+**跨编队隔离：同 relay 上的另一账号机器不再出现在本编队的枚举/任务/聊天/记忆里。**
+
+现场：另一账号的机器（自己的 fleet_id、自己的 fleet_key）出现在我们的机器列表里，被读成"非本账号
+机器进入编队"。排查结论：该机器的编队绑定本身是正确的，问题在于 relay 的**读取面没有按 fleet 过滤**
+（派发侧自 v0.7.7 起已按 fleet 隔离，operator token 为 relay 级权限属于设计）。
+
+- `GET /v1/devices`：按请求设备的 fleet 过滤（无 fleet 的旧设备在未配置 fleet 的 relay 上保持历史行为）。
+- `GET /v1/tasks`：任务记录携带 `fleet_id`，列表按调用者 fleet 过滤（operator 派发是 relay 级，不会进入
+  某个编队的列表）。
+- `POST /v1/fleet/messages`：`fleet_id` 取自已认证设备，忽略 body（防止把消息标成别的编队）。
+- `GET /v1/fleet/messages`：读取时按调用者 fleet 过滤。
+- fleet memory 文档按 fleet 前缀隔离（无 fleet 设备沿用历史键，单编队 relay 不受影响）。
+- 新增 `scripts/verify-fleet-isolation.mjs`：真实 relay + 两个 fleet 的黑盒验证（设备/任务/聊天/记忆
+  共 11 项检查），可作为部署前门禁脚本运行。
+- 验证：脚本 11/11 通过（fleet task `01M5ANYMVL2Q8PD`）；relay.test 200/200 通过。
+## [1.5.4] — 2026-10-23
+
+**验签 bootstrap 的结果覆盖过期的显式 relay（现场故障：设备仍指向 127.0.0.1）。**
+
+现场证据：DSH 升级到 v1.5.3 后仍报 `W2M_UNREACHABLE: could not reach the Rabbit at
+http://127.0.0.1:8787`——它的 profile 仍显式写着本机地址，v1.5.3 只在“无显式 relay”时才采用
+bootstrap 池，于是拿到池却继续拨 loopback。
+
+- bootstrap 验签成功后**总是采用** `relays[0]` 作为 `rabbitUrl`，并 warn 记录被替换的旧地址；
+  想固定 relay 的运维应显式设置 `relayUrls`（此时 bootstrap 分支不执行）。
+- 只影响“验签通过”的答案；失败仍保持原配置并写 `w2m_status.bootstrap.last_error`。
+- 测试：bootstrap 6/6、bootstrap-cli 6/6；证据 `docs/acceptance/1.5.4/BOOTSTRAP-WINS.json`
+  （fleet task `01M5ANYMVL0FV9C`）。
 ## [1.5.3] — 2026-10-23
 
 **零接触自动入队：只能升级插件的机器也能自己找到编队。**

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.5.3", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.5.5", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/acceptance/1.5.4/BOOTSTRAP-WINS.json

@@ -0,0 +1,20 @@
+{
+  "version": "1.5.4",
+  "case": "BOOTSTRAP-WINS",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-23T13:33:16.362Z",
+  "executor": "lead",
+  "requirement": "a verified bootstrap answer replaces a stale explicit rabbitUrl, so an upgrade-only machine that named a dead local relay still reaches the operator relay pool",
+  "task_id": "01M5ANYMVL0FV9C",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "bootstrap_suite": "6/6 pass",
+      "override_branch": "adopted relays[0] with a warning naming the replaced URL"
+    }
+  },
+  "note": "suites ran as a real fleet task; the override is the v1.5.4 delta"
+}

package/docs/acceptance/1.5.5/FLEET-ISOLATION.json

@@ -0,0 +1,23 @@
+{
+  "version": "1.5.5",
+  "case": "FLEET-ISOLATION",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-23T14:37:27.768Z",
+  "executor": "lead",
+  "requirement": "two fleets paired on one relay reach neither the other fleet device list, task list, fleet chat nor fleet memory",
+  "task_id": "01M5ANYMVL2Q8PD",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "verify_script": "11/11 checks passed",
+      "device_enumeration": "scoped",
+      "task_list": "scoped",
+      "fleet_chat": "scoped",
+      "fleet_memory": "scoped"
+    }
+  },
+  "note": "scripts/verify-fleet-isolation.mjs ran as a real fleet task against a real relay process"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.5.3",
+  "version": "1.5.5",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {
@@ -162,7 +162,8 @@
     "test:evidence": "node --test --test-force-exit test/evidence.test.mjs",
     "test:grant-issue": "node --test --test-force-exit test/grant-issue.test.mjs",
     "test:project-refs": "node --test --test-force-exit test/project-refs.test.mjs",
-    "test:secondary-link": "node --test --test-force-exit test/secondary-link.test.mjs"
+    "test:secondary-link": "node --test --test-force-exit test/secondary-link.test.mjs",
+    "verify:fleet-isolation": "node scripts/verify-fleet-isolation.mjs"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.5.3",
+  "version": "1.5.5",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/tools.mjs

@@ -277,7 +277,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.5.3';
+const PLUGIN_VERSION = '1.5.5';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -7400,7 +7400,15 @@ async function startLocalStack(ctx, cfg) {
       });
       if (outcome.ok === true) {
         cfg.relayUrls = outcome.relays;
-        if (cfg.rabbitSource === 'shared-default' || !cfg.rabbitUrl) { cfg.rabbitUrl = outcome.relays[0]; cfg.rabbitSource = 'bootstrap'; }
+          const previousRelay = cfg.rabbitUrl; // v1.5.4: capture what a stale profile pinned
+        // v1.5.4: a verified bootstrap answer WINS over a stale explicit rabbitUrl. A field machine
+          // still named 127.0.0.1:8787 (a local relay that is not running), so v1.5.3 adopted the pool but
+          // kept dialing loopback and reported W2M_UNREACHABLE. To pin a relay instead, set relayUrls.
+          cfg.rabbitUrl = outcome.relays[0];
+          cfg.rabbitSource = 'bootstrap';
+          if (typeof previousRelay === 'string' && previousRelay !== outcome.relays[0]) {
+            ctx.logger?.warn?.('w2m: bootstrap replaced the configured relay ' + previousRelay + ' with ' + outcome.relays[0]);
+          }
         cfg.bootstrap = { configured: true, url: cfg.bootstrapUrl, source: outcome.source, relays: outcome.relays, expires_at: outcome.expires_at, last_error: null };
         ctx.logger?.info?.('w2m: bootstrap assigned relays (' + outcome.relays.join(', ') + ')');
       } else {

package/src/relay/server.mjs

@@ -1350,13 +1350,30 @@ export class RelayServer {
     }
 
     if (method === 'GET' && path === '/v1/devices') {
-      return sendJson(res, 200, {
-        protocol_version: PROTOCOL_VERSION,
-        rabbit_time: this.state.nowIso(),
-        devices: this.state.listDevices(),
-      });
-    }
-    if (method === 'GET' && path === '/v1/tasks') {
+        /**
+         * v1.5.5: device enumeration is fleet-scoped.
+         *
+         * This endpoint used to return every device on the relay; state.mjs even recorded the narrowing
+         * as a pending step. The observation that forced it: another account's machine (its own fleet id,
+         * its own fleet key) appeared in this fleet's machine list -- correct fleet binding, wrong list.
+         *
+         * Migration rule, the same one task dispatch already obeys: a relay with no fleet configured
+         * keeps the historical behaviour for fleetless devices, a scoped relay serves its own fleet, and
+         * a fleet-bound device always sees exactly its own fleet and nothing else.
+         */
+        const callerFleet = typeof device?.fleet_id === 'string' && device.fleet_id !== '' ? device.fleet_id : null;
+        const relayFleet = this.state.fleetId ?? null;
+        const allDevices = this.state.listDevices();
+        const devices = callerFleet === null
+          ? (relayFleet === null ? allDevices : allDevices.filter((entry) => entry.fleet_id === relayFleet))
+          : allDevices.filter((entry) => entry.fleet_id === callerFleet);
+        return sendJson(res, 200, {
+          protocol_version: PROTOCOL_VERSION,
+          rabbit_time: this.state.nowIso(),
+          devices,
+          });
+      }
+      if (method === 'GET' && path === '/v1/tasks') {
       const rawLimit = url.searchParams.get('limit');
       let limit = 50;
       if (rawLimit !== null) {
@@ -1368,7 +1385,7 @@ export class RelayServer {
       return sendJson(res, 200, {
         protocol_version: PROTOCOL_VERSION,
         rabbit_time: this.state.nowIso(),
-        tasks: this.state.listTasks({ limit }),
+        tasks: this.state.listTasks({ limit, fleetId: device.fleet_id ?? null }),
       });
     }
 
@@ -1532,7 +1549,7 @@ export class RelayServer {
       const body = takeJson();
       const posted = this.fleetMessages.post({
         session_id: body.session_id,
-        fleet_id: typeof body.fleet_id === 'string' ? body.fleet_id : null,
+        fleet_id: device.fleet_id ?? null,
         machine_id: device.machine_id,
         to: body.to,
         thread_id: body.thread_id,
@@ -1599,7 +1616,10 @@ export class RelayServer {
         limit: limitRaw === null ? 50 : Number(limitRaw),
         // Addressing/correlation filters. `for_me=1` is answered from the authenticated device identity, never from a
         // caller-supplied machine id: a reader must not be able to ask for another machine's private messages.
-        for_machine_id: url.searchParams.get('for_me') === '1' ? device.machine_id : null,
+        // v1.5.5: a reader sees the chat of the fleet it belongs to; a device without a fleet keeps the
+          // historical unqualified view.
+          fleet_id: device.fleet_id ?? null,
+          for_machine_id: url.searchParams.get('for_me') === '1' ? device.machine_id : null,
         thread_id: url.searchParams.get('thread_id'),
         to: url.searchParams.get('to'),
       });
@@ -1607,6 +1627,8 @@ export class RelayServer {
         protocol_version: PROTOCOL_VERSION,
         rabbit_time: this.state.nowIso(),
         ...listed,
+          // v1.5.5: only the caller's fleet messages leave the process.
+          messages: (listed.messages ?? []).filter((m) => (m.fleet_id ?? null) === (device.fleet_id ?? null)),
         usage: this.fleetMessages.usage(),   // shown with every read so a client can warn before the quota refuses a post
       });
     }
@@ -1618,14 +1640,16 @@ export class RelayServer {
     if (path.startsWith('/v1/fleet/memory/')) {
       const doc = decodeURIComponent(path.slice('/v1/fleet/memory/'.length));
       if (doc === '') throw new ProtocolError('BAD_REQUEST', 'memory doc is required', { method, path });
+        // v1.5.5: a fleet's memory must not be addressable by another fleet on the same relay.
+        const docKey = typeof device.fleet_id === 'string' && device.fleet_id !== '' ? device.fleet_id + '::' + doc : doc;
       this.fleetMemory ??= createFleetMemory({ now: () => this.state.nowMs() });
       if (method === 'GET') {
-        return sendJson(res, 200, { protocol_version: PROTOCOL_VERSION, rabbit_time: this.state.nowIso(), ...this.fleetMemory.get(doc) });
+        return sendJson(res, 200, { protocol_version: PROTOCOL_VERSION, rabbit_time: this.state.nowIso(), ...this.fleetMemory.get(docKey) });
       }
       if (method === 'PUT') {
         const body = takeJson();
         const appended = this.fleetMemory.append({
-          doc,
+          doc: docKey,
           if_revision: Number.isInteger(body.if_revision) ? body.if_revision : null,
           author_machine_id: device.machine_id,
           records: Array.isArray(body.records) ? body.records : (typeof body.text === 'string' ? [body.text] : []),

package/src/relay/state.mjs

@@ -1942,6 +1942,13 @@ export class RabbitState {
       include_offline: input.include_offline === true,
       halt,
       created_by: input.created_by ?? null,
+        // v1.5.5: the fleet a task belongs to, so list endpoints can scope by it.
+        // v1.5.5: the fleet this task belongs to, computed from the same requester rule fleet scoping
+        // uses. scopedRequester is declared further down (target selection), so it cannot be referenced
+        // from the task literal; this expression reads the same sources and stays a pure lookup.
+        fleet_id: ((typeof input.created_by === 'string' ? this.devices.get(input.created_by) : null) ||
+          (typeof input.requester_machine_id === 'string' ? this.devices.get(input.requester_machine_id) : null) ||
+          (this.fleetId !== null ? { fleet_id: this.fleetId } : null))?.fleet_id ?? null,
       created_at_ms: now,
       command_hash: commandHash,
       attempt: 1,
@@ -2492,9 +2499,11 @@ export class RabbitState {
     return { count: taskIds.length, task_ids: taskIds };
   }
 
-  listTasks({ limit = 50 } = {}) {
+  listTasks({ limit = 50, fleetId = null } = {}) {
     const n = Number.isInteger(limit) && limit > 0 ? limit : 50;
     return [...this.tasks.values()]
+      // v1.5.5: a fleet-bound caller lists only its own fleet's tasks; null fleet keeps the old view.
+      .filter((task) => fleetId === null || task.fleet_id === fleetId)
       .sort((a, b) => b.created_at_ms - a.created_at_ms)
       .slice(0, n)
       .map((t) => this.taskSummary(t));