@twinsearth/w2m-dsh-plugin 1.6.0 → 1.6.1

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.6.0"
+    "version": "1.6.1"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.6.0",
+      "version": "1.6.1",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.6.0"
+  "version": "1.6.1"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,23 @@
 
 All notable changes to this project are documented here.
 
+## [1.6.1] — 2026-10-24
+
+**Node 执行开关改为「仅人工 UI 手动、进程内存态」：文件/远程/自动化一律无法授权。**
+
+本次实机验证暴露了一个必须修掉的现实：grant 任务可以远程写 `~/.w2m/exec-capability.json`，
+从而远程把机器变成可执行任意 Node 代码——与"最高权限只允许人工手动选中"直接冲突。
+
+- 能力状态改为**进程内存**唯一权威：`readExecCapability` 不再读磁盘；旧文件（含 permanent）被忽略；
+  只有 host 路由 `/api/w2m/capability`（composer 人工点击）能写。
+- **不随重启保留**：进程退出即回到 denied（"永久"= 本次进程生命周期）；
+  `describe` 明确返回 `survives_restart: false`、`manual_only: true`、`file_ignored: true`。
+- 三态语义不变：denied / temporary（默认 24h，上限 7 天，过期即失效）/ permanent（本进程内）。
+- 测试重写：`test/exec-capability.test.mjs` 6/6（含"磁盘写 permanent 仍 denied""路由是唯一 setter"
+  "重启即撤销"）；agent.test 161 项通过（PATH 环境问题已在本机修复，非代码缺陷）。
+- 修复 allow-list 解释器身份回归：当 argv[0] 是 **运行 agent 的同一个 node（process.execPath）** 时，
+  bare 条目 `node` 应放行（此前机器 PATH 里 node 指向别的程序时会误拒，实测 12 个 e2e 失败）。
+- 证据 `docs/acceptance/1.6.1/MANUAL-ONLY-CAPABILITY.json`（fleet task `01M5ANYMVLDYWBH`）。
 ## [1.6.0] — 2026-10-24
 
 **一台 relay 承载 N 个编队：每个 DeepSeek 账号一个编队，共享 relay 但互相隔离。**

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.6.0", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.6.1", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/acceptance/1.6.1/MANUAL-ONLY-CAPABILITY.json

@@ -0,0 +1,22 @@
+{
+  "version": "1.6.1",
+  "case": "MANUAL-ONLY-CAPABILITY",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-23T19:51:58.929Z",
+  "executor": "lead",
+  "requirement": "the highest-privilege Node execution switch can only be changed by a human UI action: it lives in host process memory, disk files are ignored, remote tasks/automation cannot enable it, and a restart revokes it",
+  "task_id": "01M5ANYMVLDYWBH",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "capability_policy_suite": "6/6 pass",
+      "disk_permanent_file_ignored": "true",
+      "route_is_single_setter": "true",
+      "restart_revokes": "true"
+    }
+  },
+  "note": "suite ran as a real fleet task; policy invariant pinned by test"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/agent/allowed-commands.mjs

@@ -491,6 +491,16 @@ function executableIdentity(argv0, prefix0, options) {
     const bundled = bundledExecutable(prefix0, options.env ?? process.env);
     if (bundled !== null && sameFile(argv0, bundled)) return { kind: 'match', detail: null };
   }
+    // v1.6.1: the interpreter executing this agent is the tool a bare entry names.
+    // Measured on a real machine (2026-10-24): DSH runs on its bundled node, a grant runner passes
+    // [process.execPath, '-e', ...], and the entry is the bare name `node` -- but PATH resolves `node`
+    // to an unrelated application binary. process.execPath needs no dependencies-directory lookup:
+    // it is the running interpreter, by definition the program the node entry names. A copy of the
+    // binary elsewhere is still refused (this compares identity, not the bare name).
+    if (!prefixIsPath && argvIsPath && sameFile(argv0, process.execPath)) {
+      const base = (value) => String(value).split(/[\\/]/).pop().replace(/\.exe$/i, '').toLowerCase();
+      if (base(argv0) === base(prefix0)) return { kind: 'match', detail: null };
+    }
 
   return {
     kind: 'path-mismatch',

package/src/plugin/tools.mjs

@@ -277,7 +277,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.6.0';
+const PLUGIN_VERSION = '1.6.1';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;

package/src/util/exec-capability.mjs

@@ -1,21 +1,32 @@
 /**
- * Node-code-execution capability: the machine-local switch behind the plugin UI.
+ * Node-code-execution capability (v1.6.1 hardening): a **manual, in-process** switch.
  *
- * The allow-list is a standing decision made by the machine owner in a config file. This module is the
- * *UI-activated* form of the same decision, scoped to one dangerous ability -- running arbitrary Node code
- * (`node -e`) -- with an explicit state: denied, temporary (24 h by default) or permanent. The DSH plugin
- * client renders the switch; the host route writes this file; the agent reads it before every task and
- * treats an active capability exactly like an additional allow-list prefix.
+ * ## Policy
  *
- * Fail-closed rules:
- *   * a missing, unreadable or malformed file means `denied` (the standing default), never "on";
- *   * `temporary` whose `expires_at_ms` has passed reads as `denied` and says `expired`, so an expiry
- *     cannot be mistaken for a configuration error;
- *   * the only prefix a capability can ever add is `node -e` -- a fixed constant, not caller input.
+ * This is the machine's highest-privilege switch: it allows `node -e`, i.e. arbitrary code. The policy
+ * is deliberately stricter than "a file the operator can toggle":
+ *
+ *   1. **Only a human UI action may change it.** The capability lives in the host process's memory and
+ *      is written exclusively by the same-origin host route (`/api/w2m/capability`) that the composer
+ *      control calls. There is no file that can be edited, no relay field, no task/document that can
+ *      grant it.
+ *   2. **Nothing a machine or automation runs can enable it.** Agent tasks (grant or not) run in a
+ *      child process; they can write any file they like, because files are no longer consulted. A
+ *      remote caller, a scheduled task, a bootstrap answer, or another process on the machine cannot
+ *      reach this module's memory.
+ *   3. **It does not survive a restart.** "Permanent" means "until this host process exits", never
+ *      "forever": a machine left unattended must not stay remote-code-executable across reboots.
+ *
+ * Old builds stored the state in `~/.w2m/exec-capability.json`. That file is **ignored** by this
+ * implementation, and the UI reports the in-memory truth, so a stale permanent file from an older
+ * version cannot silently re-grant execution.
+ *
+ * Fail-closed rules stay as before: absent/invalid state is `denied`; an expired `temporary` reads
+ * `denied` with reason `expired`; the only prefix an active capability can add is the fixed
+ * `node -e` constant.
  */
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { join } from 'node:path';
 
 export const EXEC_CAPABILITY_PROTOCOL = 'w2m-exec-capability/v1';
 export const EXEC_CAPABILITY_ROUTE_PATH = '/api/w2m/capability';
@@ -25,7 +36,10 @@ export const EXEC_CAPABILITY_STATES = Object.freeze(['denied', 'temporary', 'per
 export const DEFAULT_TEMPORARY_TTL_MS = 24 * 60 * 60 * 1000;
 export const MAX_TEMPORARY_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 export const EXEC_CAPABILITY_WARNING = 'node code execution: allows any Node code on this machine (RCE)';
+/** Why a capability file on disk never authorises anything. Surfaced by the UI/status. */
+export const EXEC_CAPABILITY_MANUAL_ONLY = 'capability is manual-only: set through the host UI, held in process memory, ignored from disk, relay or tasks';
 
+/** Path kept for compatibility with old builds; it is never read and never written. */
 export function defaultExecCapabilityFile(home = homedir()) {
   return join(home, '.w2m', 'exec-capability.json');
 }
@@ -35,46 +49,35 @@ export function normalizeExecCapabilityState(value) {
   return typeof value === 'string' && EXEC_CAPABILITY_STATES.includes(value) ? value : null;
 }
 
+/** The authoritative state. Module-level on purpose: one process, one switch. */
+let memory = Object.freeze({ state: 'denied', activated_at_ms: null, expires_at_ms: null, actor: null, changed_at_ms: null });
+
+/** Test/support hook: drop back to the standing default without touching any file. */
+export function resetExecCapability() {
+  memory = Object.freeze({ state: 'denied', activated_at_ms: null, expires_at_ms: null, actor: null, changed_at_ms: null });
+}
+
 /**
- * Read the capability state. Never throws: a broken file is `denied` with reason `unreadable`/`invalid`.
+ * Read the capability state from process memory.
  *
- * @param {string} file
+ * @param {string} [_file] accepted for API compatibility; deliberately NOT read.
  * @param {number} [nowMs]
- * @returns {{state: string, effective: boolean, expires_at_ms: number|null, activated_at_ms: number|null, actor: object|null, reason: string|null}}
+ * @returns {{state: string, effective: boolean, expires_at_ms: number|null, activated_at_ms: number|null,
+ *            actor: object|null, reason: string|null, source: 'process-memory', file_ignored: true}}
  */
-export function readExecCapability(file, nowMs = Date.now()) {
-  const denied = (reason) => ({ state: 'denied', effective: false, expires_at_ms: null, activated_at_ms: null, actor: null, reason });
-  let text;
-  try {
-    text = readFileSync(file, 'utf8');
-  } catch (error) {
-    return denied(error?.code === 'ENOENT' ? 'absent' : 'unreadable');
-  }
-  let raw;
-  try {
-    raw = JSON.parse(text);
-  } catch {
-    return denied('invalid');
-  }
-  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return denied('invalid');
-  const state = normalizeExecCapabilityState(raw.state);
-  if (state === null) return denied('invalid');
-  if (state === 'denied') return denied(null);
-  const expiresAt = Number.isFinite(raw.expires_at_ms) ? raw.expires_at_ms : null;
-  const activatedAt = Number.isFinite(raw.activated_at_ms) ? raw.activated_at_ms : null;
-  if (state === 'temporary') {
-    if (expiresAt === null) return denied('invalid');
-    if (expiresAt <= nowMs) return { state: 'denied', effective: false, expires_at_ms: expiresAt, activated_at_ms: activatedAt, actor: null, reason: 'expired' };
-  }
-  if (state === 'permanent' && expiresAt !== null) return denied('invalid');
-  return {
-    state,
-    effective: true,
-    expires_at_ms: state === 'temporary' ? expiresAt : null,
-    activated_at_ms: activatedAt,
-    actor: typeof raw.actor === 'object' && raw.actor !== null ? { ...raw.actor } : null,
-    reason: null,
+export function readExecCapability(_file, nowMs = Date.now()) {
+  const base = {
+    state: 'denied', effective: false, expires_at_ms: null, activated_at_ms: null, actor: null,
+    reason: 'manual_default', source: 'process-memory', file_ignored: true,
   };
+  if (memory.state === 'denied') return base;
+  if (memory.state === 'temporary') {
+    if (memory.expires_at_ms !== null && memory.expires_at_ms <= nowMs) {
+      return { ...base, expires_at_ms: memory.expires_at_ms, activated_at_ms: memory.activated_at_ms, reason: 'expired' };
+    }
+    return { ...base, state: 'temporary', effective: true, reason: null, expires_at_ms: memory.expires_at_ms, activated_at_ms: memory.activated_at_ms, actor: memory.actor };
+  }
+  return { ...base, state: 'permanent', effective: true, reason: null, activated_at_ms: memory.activated_at_ms, actor: memory.actor };
 }
 
 /** The prefixes an active capability adds, or an empty array when it is denied/expired. */
@@ -83,21 +86,20 @@ export function effectiveExecCapabilityPrefixes(file, nowMs = Date.now()) {
 }
 
 /**
- * Write one capability decision. `temporary` requires a TTL and records an absolute expiry.
+ * Change the capability. This is the host route's write path and the only way the switch moves.
+ *
+ * The `_file` argument is accepted for compatibility and ignored: a caller that expected a disk write
+ * (an older route, a script, a test helper) still gets the value back, but the authority is memory.
  *
  * @returns {{ok: boolean, code?: string, detail?: string, capability?: object}}
  */
-export function writeExecCapability(file, input, nowMs = Date.now()) {
+export function writeExecCapability(_file, input, nowMs = Date.now()) {
   const state = normalizeExecCapabilityState(input?.state);
   if (state === null) return { ok: false, code: 'CAPABILITY_STATE_INVALID', detail: 'state must be denied, temporary or permanent' };
+  const actor = typeof input?.actor === 'object' && input.actor !== null ? { ...input.actor } : null;
   if (state === 'denied') {
-    try {
-      mkdirSync(dirname(file), { recursive: true });
-      writeFileSync(file, JSON.stringify({ protocol: EXEC_CAPABILITY_PROTOCOL, state: 'denied', activated_at_ms: nowMs, actor: input.actor ?? null }, null, 2) + '\n');
-    } catch (error) {
-      return { ok: false, code: 'CAPABILITY_WRITE_FAILED', detail: error?.message ?? String(error) };
-    }
-    return { ok: true, capability: readExecCapability(file, nowMs) };
+    memory = Object.freeze({ state: 'denied', activated_at_ms: nowMs, expires_at_ms: null, actor, changed_at_ms: nowMs });
+    return { ok: true, capability: describeExecCapability(undefined, nowMs) };
   }
   let ttlMs = input?.ttl_ms;
   if (state === 'temporary') {
@@ -105,23 +107,17 @@ export function writeExecCapability(file, input, nowMs = Date.now()) {
     if (ttlMs > MAX_TEMPORARY_TTL_MS) return { ok: false, code: 'CAPABILITY_TTL_TOO_LONG', detail: 'temporary activation is limited to ' + MAX_TEMPORARY_TTL_MS + ' ms' };
     ttlMs = Math.floor(ttlMs);
   }
-  const record = {
-    protocol: EXEC_CAPABILITY_PROTOCOL,
+  memory = Object.freeze({
     state,
     activated_at_ms: nowMs,
     expires_at_ms: state === 'temporary' ? nowMs + ttlMs : null,
-    actor: typeof input?.actor === 'object' && input.actor !== null ? { ...input.actor } : null,
-  };
-  try {
-    mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, JSON.stringify(record, null, 2) + '\n');
-  } catch (error) {
-    return { ok: false, code: 'CAPABILITY_WRITE_FAILED', detail: error?.message ?? String(error) };
-  }
-  return { ok: true, capability: readExecCapability(file, nowMs) };
+    actor,
+    changed_at_ms: nowMs,
+  });
+  return { ok: true, capability: describeExecCapability(undefined, nowMs) };
 }
 
-/** The JSON the UI renders: state, effective, remaining time and the one prefix it would allow. */
+/** The JSON the UI renders: state, effective, remaining time, the fixed prefix, and the manual-only rule. */
 export function describeExecCapability(file, nowMs = Date.now()) {
   const capability = readExecCapability(file, nowMs);
   return {
@@ -134,5 +130,10 @@ export function describeExecCapability(file, nowMs = Date.now()) {
     remaining_ms: capability.state === 'temporary' && capability.expires_at_ms !== null ? Math.max(0, capability.expires_at_ms - nowMs) : null,
     allows: capability.effective === true ? EXEC_CAPABILITY_PREFIXES.map((prefix) => prefix.join(' ')) : [],
     warning: EXEC_CAPABILITY_WARNING,
+    manual_only: true,
+    source: 'process-memory',
+    file_ignored: true,
+    policy: EXEC_CAPABILITY_MANUAL_ONLY,
+    survives_restart: false,
   };
 }