@twinsearth/w2m-dsh-plugin 1.5.4 → 1.6.0

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.5.4"
+    "version": "1.6.0"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.5.4",
+      "version": "1.6.0",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.5.4"
+  "version": "1.6.0"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.5.4",
+  "version": "1.6.0",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,33 @@
 
 All notable changes to this project are documented here.
 
+## [1.6.0] — 2026-10-24
+
+**一台 relay 承载 N 个编队：每个 DeepSeek 账号一个编队，共享 relay 但互相隔离。**
+
+- bootstrap 答案从"单个编队的归属"改为"relay 拓扑声明"：签名与有效期仍严格，fleet_id 不匹配不再拒绝
+  （`strictFleet: true` 保留旧行为）。一份 operator 签名即可服务全部编队，新账号机器无需人工重签。
+- `scripts/verify-fleet-isolation.mjs` 扩展到 **3 个编队** 14 项检查（设备枚举/任务/聊天/记忆），全过。
+- 新增 `docs/MULTI-FLEET.md`：编排模型、运维视图、零人工接入新账号、配额与边界。
+- 测试：bootstrap 6/6（含拓扑答案用例）、fleet isolation 14/14；证据 `docs/acceptance/1.6.0/N-FLEET.json`
+  （fleet task `01M5ANYMVLBU716`）。
+## [1.5.5] — 2026-10-23
+
+**跨编队隔离：同 relay 上的另一账号机器不再出现在本编队的枚举/任务/聊天/记忆里。**
+
+现场：另一账号的机器（自己的 fleet_id、自己的 fleet_key）出现在我们的机器列表里，被读成"非本账号
+机器进入编队"。排查结论：该机器的编队绑定本身是正确的，问题在于 relay 的**读取面没有按 fleet 过滤**
+（派发侧自 v0.7.7 起已按 fleet 隔离，operator token 为 relay 级权限属于设计）。
+
+- `GET /v1/devices`：按请求设备的 fleet 过滤（无 fleet 的旧设备在未配置 fleet 的 relay 上保持历史行为）。
+- `GET /v1/tasks`：任务记录携带 `fleet_id`，列表按调用者 fleet 过滤（operator 派发是 relay 级，不会进入
+  某个编队的列表）。
+- `POST /v1/fleet/messages`：`fleet_id` 取自已认证设备，忽略 body（防止把消息标成别的编队）。
+- `GET /v1/fleet/messages`：读取时按调用者 fleet 过滤。
+- fleet memory 文档按 fleet 前缀隔离（无 fleet 设备沿用历史键，单编队 relay 不受影响）。
+- 新增 `scripts/verify-fleet-isolation.mjs`：真实 relay + 两个 fleet 的黑盒验证（设备/任务/聊天/记忆
+  共 11 项检查），可作为部署前门禁脚本运行。
+- 验证：脚本 11/11 通过（fleet task `01M5ANYMVL2Q8PD`）；relay.test 200/200 通过。
 ## [1.5.4] — 2026-10-23
 
 **验签 bootstrap 的结果覆盖过期的显式 relay（现场故障：设备仍指向 127.0.0.1）。**

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.5.4", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.6.0", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/MULTI-FLEET.md

@@ -0,0 +1,38 @@
+# 多编队（N Fleets）：每个 DeepSeek 账号一个编队
+
+一台 relay 可以同时承载多个编队。编队身份**不需要注册**：每个账号派生自己的 fleet key，
+`sha256(fleet_key)` 就是它的 fleet id；任意机器配对时携带自己的 fleet key，relay 就把它记进对应编队。
+
+## 一、编排模型
+
+```
+DeepSeek 账号 A ── fleet_key_A ── sha256 ──► fleet_id_A ──┐
+DeepSeek 账号 B ── fleet_key_B ── sha256 ──► fleet_id_B ──┼── 同一台 relay（共享基础设施）
+DeepSeek 账号 C ── fleet_key_C ── sha256 ──► fleet_id_C ──┘
+```
+
+- **每账号一个编队**：fleet_id 不同即不同编队，机器之间在设备列表、任务、聊天、共享记忆四个面互相不可见（v1.5.5 隔离）。
+- **relay 无状态注册**：不需要预创建编队、不需要分配名额；第一台机器配对即产生该编队。
+- **operator 只签一次**：bootstrap 签名描述的是 relay 拓扑（哪些 relay 节点），一份签名服务全部编队（v1.6.0）。
+  需要把某台机器强制绑定到指定 fleet 时，用 `strictFleet: true` 保留旧行为。
+
+## 二、运维视图
+
+- 查看编队成员：`GET /v1/devices`（按调用者编队过滤）；relay 侧的 `devices.json` 里每个设备带 `fleet_id` / `fleet_source`。
+- 编队聊天：`/v1/fleet/messages`，POST 的 fleet 取自已认证设备，GET 只返回本编队消息。
+- 共享记忆：`/v1/fleet/memory/<doc>`，文档按 `fleet_id` 前缀隔离存储。
+- 任务：记录携带 `fleet_id`，`GET /v1/tasks` 只列本编队；operator token 的派发是 relay 级权限。
+- 配额：relay 级限制（任务/结果/配对码等）按 relay 计数；每编队建议自行控制设备数量（例如 ≤50），
+  以便故障时 lease 与任务表保持可读。
+
+## 三、接入新账号（零人工）
+
+1. 机器安装插件 **1.6.0+**（内置 bootstrap 端点 + operator 公钥）；
+2. 该机器登录对应 DeepSeek 账号 → 账号派生 fleet key → 自动配对到自己的编队；
+3. `w2m_status` 的 `bootstrap` 字段会显示 `source`、`relays`、`fleet_mismatch`（拓扑答案跨编队时）与 `last_error`。
+
+## 四、边界与注意
+
+- 跨编队不共享任何**读写面**；共享的只有 relay 进程、磁盘与网络带宽。
+- 运维账号（operator token）是 relay 级凭据，可跨编队派发任务/管理 grant——它不等同于任一编队成员。
+- 清理编队：删除该编队的设备记录即可（设备 token 失效后需重新配对）；relay 不保留编队级历史数据。

package/docs/acceptance/1.5.5/FLEET-ISOLATION.json

@@ -0,0 +1,23 @@
+{
+  "version": "1.5.5",
+  "case": "FLEET-ISOLATION",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-23T14:37:27.768Z",
+  "executor": "lead",
+  "requirement": "two fleets paired on one relay reach neither the other fleet device list, task list, fleet chat nor fleet memory",
+  "task_id": "01M5ANYMVL2Q8PD",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "verify_script": "11/11 checks passed",
+      "device_enumeration": "scoped",
+      "task_list": "scoped",
+      "fleet_chat": "scoped",
+      "fleet_memory": "scoped"
+    }
+  },
+  "note": "scripts/verify-fleet-isolation.mjs ran as a real fleet task against a real relay process"
+}

package/docs/acceptance/1.6.0/N-FLEET.json

@@ -0,0 +1,21 @@
+{
+  "version": "1.6.0",
+  "case": "N-FLEET",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-23T18:52:24.400Z",
+  "executor": "lead",
+  "requirement": "one relay hosts N fleets (one per DeepSeek account) isolated from each other, and one operator-signed bootstrap answer serves all of them",
+  "task_id": "01M5ANYMVLBU716",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "verify_script": "14/14 checks over 3 fleets",
+      "bootstrap_suite": "6/6",
+      "topology_answer": "fleet mismatch tolerated unless strictFleet"
+    }
+  },
+  "note": "real relay process, three fleets paired with three fleet keys"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.5.4",
+  "version": "1.6.0",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {
@@ -162,7 +162,8 @@
     "test:evidence": "node --test --test-force-exit test/evidence.test.mjs",
     "test:grant-issue": "node --test --test-force-exit test/grant-issue.test.mjs",
     "test:project-refs": "node --test --test-force-exit test/project-refs.test.mjs",
-    "test:secondary-link": "node --test --test-force-exit test/secondary-link.test.mjs"
+    "test:secondary-link": "node --test --test-force-exit test/secondary-link.test.mjs",
+    "verify:fleet-isolation": "node scripts/verify-fleet-isolation.mjs"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.5.4",
+  "version": "1.6.0",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/bootstrap.mjs

@@ -155,8 +155,18 @@ export function verifyBootstrapAnswer(answer, input) {
   // v1.5.3: when the machine cannot derive a fleet key yet, it still must not be stranded: the
   // signed relay list is public routing information, so a signature-only answer is adopted for relay
   // assignment. Joining the fleet still needs the account-derived key, which is a separate step.
-  if (input.fleetId !== null && input.fleetId !== undefined && (typeof answer.fleet_id !== 'string' || answer.fleet_id !== input.fleetId)) {
-    return refuse(BOOTSTRAP_REFUSAL.WRONG_FLEET, 'the answer names a different fleet; it is not for this machine');
+  /**
+   * v1.6.0: a signed answer states relay topology, not one fleet's identity.
+   *
+   * Every DeepSeek account derives its own fleet key and therefore its own fleet id; on a shared
+   * relay those fleets coexist and are isolated per fleet (v1.5.5). The relay list is the same for
+   * all of them, so one operator-signed answer can serve N fleets -- refusing it for a fleet id
+   * mismatch would require the operator to re-sign per account, which is exactly the manual step
+   * this release removes. The signature and expiry remain strict; only the fleet binding relaxes.
+   */
+  const fleetMismatch = typeof input.fleetId === 'string' && answer.fleet_id !== input.fleetId;
+  if (fleetMismatch && input.strictFleet === true) {
+    return refuse(BOOTSTRAP_REFUSAL.WRONG_FLEET, 'the answer names a different fleet and strictFleet is set');
   }
   const relays = Array.isArray(answer.relays)
     ? [...new Set(answer.relays.filter((url) => typeof url === 'string' && url.trim() !== '').map((url) => url.trim().replace(/\/+$/, '')))]
@@ -194,7 +204,7 @@ export function verifyBootstrapAnswer(answer, input) {
   if (!verifiedSignatureOk(signatureOk)) {
     return refuse(BOOTSTRAP_REFUSAL.BAD_SIGNATURE, 'the answer signature does not match the pinned operator key and the canonical payload');
   }
-  return { ok: true, relays, issued_at: answer.issued_at, expires_at: answer.expires_at };
+  return { ok: true, relays, issued_at: answer.issued_at, expires_at: answer.expires_at, answer_fleet_id: typeof answer.fleet_id === 'string' ? answer.fleet_id : null, fleet_mismatch: fleetMismatch };
 }
 
 /** Kept separate so a test can assert the failure branch without a real crypto fault. */

package/src/plugin/tools.mjs

@@ -277,7 +277,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.5.4';
+const PLUGIN_VERSION = '1.6.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;

package/src/relay/server.mjs

@@ -1350,13 +1350,30 @@ export class RelayServer {
     }
 
     if (method === 'GET' && path === '/v1/devices') {
-      return sendJson(res, 200, {
-        protocol_version: PROTOCOL_VERSION,
-        rabbit_time: this.state.nowIso(),
-        devices: this.state.listDevices(),
-      });
-    }
-    if (method === 'GET' && path === '/v1/tasks') {
+        /**
+         * v1.5.5: device enumeration is fleet-scoped.
+         *
+         * This endpoint used to return every device on the relay; state.mjs even recorded the narrowing
+         * as a pending step. The observation that forced it: another account's machine (its own fleet id,
+         * its own fleet key) appeared in this fleet's machine list -- correct fleet binding, wrong list.
+         *
+         * Migration rule, the same one task dispatch already obeys: a relay with no fleet configured
+         * keeps the historical behaviour for fleetless devices, a scoped relay serves its own fleet, and
+         * a fleet-bound device always sees exactly its own fleet and nothing else.
+         */
+        const callerFleet = typeof device?.fleet_id === 'string' && device.fleet_id !== '' ? device.fleet_id : null;
+        const relayFleet = this.state.fleetId ?? null;
+        const allDevices = this.state.listDevices();
+        const devices = callerFleet === null
+          ? (relayFleet === null ? allDevices : allDevices.filter((entry) => entry.fleet_id === relayFleet))
+          : allDevices.filter((entry) => entry.fleet_id === callerFleet);
+        return sendJson(res, 200, {
+          protocol_version: PROTOCOL_VERSION,
+          rabbit_time: this.state.nowIso(),
+          devices,
+          });
+      }
+      if (method === 'GET' && path === '/v1/tasks') {
       const rawLimit = url.searchParams.get('limit');
       let limit = 50;
       if (rawLimit !== null) {
@@ -1368,7 +1385,7 @@ export class RelayServer {
       return sendJson(res, 200, {
         protocol_version: PROTOCOL_VERSION,
         rabbit_time: this.state.nowIso(),
-        tasks: this.state.listTasks({ limit }),
+        tasks: this.state.listTasks({ limit, fleetId: device.fleet_id ?? null }),
       });
     }
 
@@ -1532,7 +1549,7 @@ export class RelayServer {
       const body = takeJson();
       const posted = this.fleetMessages.post({
         session_id: body.session_id,
-        fleet_id: typeof body.fleet_id === 'string' ? body.fleet_id : null,
+        fleet_id: device.fleet_id ?? null,
         machine_id: device.machine_id,
         to: body.to,
         thread_id: body.thread_id,
@@ -1599,7 +1616,10 @@ export class RelayServer {
         limit: limitRaw === null ? 50 : Number(limitRaw),
         // Addressing/correlation filters. `for_me=1` is answered from the authenticated device identity, never from a
         // caller-supplied machine id: a reader must not be able to ask for another machine's private messages.
-        for_machine_id: url.searchParams.get('for_me') === '1' ? device.machine_id : null,
+        // v1.5.5: a reader sees the chat of the fleet it belongs to; a device without a fleet keeps the
+          // historical unqualified view.
+          fleet_id: device.fleet_id ?? null,
+          for_machine_id: url.searchParams.get('for_me') === '1' ? device.machine_id : null,
         thread_id: url.searchParams.get('thread_id'),
         to: url.searchParams.get('to'),
       });
@@ -1607,6 +1627,8 @@ export class RelayServer {
         protocol_version: PROTOCOL_VERSION,
         rabbit_time: this.state.nowIso(),
         ...listed,
+          // v1.5.5: only the caller's fleet messages leave the process.
+          messages: (listed.messages ?? []).filter((m) => (m.fleet_id ?? null) === (device.fleet_id ?? null)),
         usage: this.fleetMessages.usage(),   // shown with every read so a client can warn before the quota refuses a post
       });
     }
@@ -1618,14 +1640,16 @@ export class RelayServer {
     if (path.startsWith('/v1/fleet/memory/')) {
       const doc = decodeURIComponent(path.slice('/v1/fleet/memory/'.length));
       if (doc === '') throw new ProtocolError('BAD_REQUEST', 'memory doc is required', { method, path });
+        // v1.5.5: a fleet's memory must not be addressable by another fleet on the same relay.
+        const docKey = typeof device.fleet_id === 'string' && device.fleet_id !== '' ? device.fleet_id + '::' + doc : doc;
       this.fleetMemory ??= createFleetMemory({ now: () => this.state.nowMs() });
       if (method === 'GET') {
-        return sendJson(res, 200, { protocol_version: PROTOCOL_VERSION, rabbit_time: this.state.nowIso(), ...this.fleetMemory.get(doc) });
+        return sendJson(res, 200, { protocol_version: PROTOCOL_VERSION, rabbit_time: this.state.nowIso(), ...this.fleetMemory.get(docKey) });
       }
       if (method === 'PUT') {
         const body = takeJson();
         const appended = this.fleetMemory.append({
-          doc,
+          doc: docKey,
           if_revision: Number.isInteger(body.if_revision) ? body.if_revision : null,
           author_machine_id: device.machine_id,
           records: Array.isArray(body.records) ? body.records : (typeof body.text === 'string' ? [body.text] : []),

package/src/relay/state.mjs

@@ -1942,6 +1942,13 @@ export class RabbitState {
       include_offline: input.include_offline === true,
       halt,
       created_by: input.created_by ?? null,
+        // v1.5.5: the fleet a task belongs to, so list endpoints can scope by it.
+        // v1.5.5: the fleet this task belongs to, computed from the same requester rule fleet scoping
+        // uses. scopedRequester is declared further down (target selection), so it cannot be referenced
+        // from the task literal; this expression reads the same sources and stays a pure lookup.
+        fleet_id: ((typeof input.created_by === 'string' ? this.devices.get(input.created_by) : null) ||
+          (typeof input.requester_machine_id === 'string' ? this.devices.get(input.requester_machine_id) : null) ||
+          (this.fleetId !== null ? { fleet_id: this.fleetId } : null))?.fleet_id ?? null,
       created_at_ms: now,
       command_hash: commandHash,
       attempt: 1,
@@ -2492,9 +2499,11 @@ export class RabbitState {
     return { count: taskIds.length, task_ids: taskIds };
   }
 
-  listTasks({ limit = 50 } = {}) {
+  listTasks({ limit = 50, fleetId = null } = {}) {
     const n = Number.isInteger(limit) && limit > 0 ? limit : 50;
     return [...this.tasks.values()]
+      // v1.5.5: a fleet-bound caller lists only its own fleet's tasks; null fleet keeps the old view.
+      .filter((task) => fleetId === null || task.fleet_id === fleetId)
       .sort((a, b) => b.created_at_ms - a.created_at_ms)
       .slice(0, n)
       .map((t) => this.taskSummary(t));