@twinsearth/w2m-dsh-plugin 1.6.3 → 1.6.5

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.6.3"
+    "version": "1.6.5"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.6.3",
+      "version": "1.6.5",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.6.3"
+  "version": "1.6.5"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.6.3",
+  "version": "1.6.5",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,29 @@
 
 All notable changes to this project are documented here.
 
+## [1.6.5] — 2026-10-24
+
+**Windows 后台自动化不再弹窗：VBScript 隐藏包装 + 计划任务工具 + 文档。**
+
+现场故障：给 standby 守护（每 2 分钟）和 TwinsEarth 守望（每 5 分钟）用 `schtasks /TR "node.exe ..."`
+注册任务，导致桌面每隔几分钟弹出一个控制台窗口（守望脚本还会累积进程）。
+
+- 新增 `src/util/windows-hidden-task.mjs`：纯函数构造 VBScript 包装（`WScript.Shell.Run` 窗口样式 0、
+  不等待）与 `schtasks` 参数；命令行/参数先按 Windows 规则引用，再整体做一次 VBScript 转义（避免二次转义）。
+- 新增 `bin/w2m-hidden-task.mjs`：`--name/--every-minutes/--command/--arg/--workdir/--delete`，
+  一条命令注册“无窗口”计划任务。
+- 新增 `docs/WINDOWS-BACKGROUND-TASKS.md`：故障原因、正确做法、原则（分钟级任务只放短检查；一次性任务用完即删）。
+- 测试：windows-hidden-task 5/5（含转义与参数校验）；证据
+  `docs/acceptance/1.6.5/HIDDEN-BACKGROUND-TASKS.json`（fleet task `01M5ANYMVM30H98`）。
+## [1.6.4] — 2026-10-24
+
+**修复：`/healthz` 漏发 `fleets_online`（1.6.3 的 `fleetSummary` 已计算，但 `stats()` 没带到公开字段）。**
+
+- `stats()` 现在同时输出 `fleets_total` 与 `fleets_online`；
+- 面板可正确显示 `全服：X/Y 个编队 · M/T 台在线`（X = 至少一台机器在线的编队数）；
+- relay 主机升级到 1.6.4（含 1.6.3/1.6.2/1.6.1 全部内容）。
+- 测试：relay 200/200、fleet-target 49/49；证据 `docs/acceptance/1.6.4/HEALTHZ-FLEETS-ONLINE.json`
+  （fleet task `01M5ANYMVLX3MI7`）。
 ## [1.6.3] — 2026-10-24
 
 **编队与机器同构显示：在线编队数/编队总数 + 在线机器/机器总数。**

package/bin/w2m-hidden-task.mjs

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+/**
+ * w2m-hidden-task — schedule a command on Windows **without any console window**.
+ *
+ * Why this tool exists: `schtasks /TR "node.exe ..."` produces a visible console window every time
+ * the task fires. On a 2-minute keeper that is a window every two minutes; on a long-running watcher
+ * it also accumulates processes. This tool writes a VBScript wrapper and registers
+ * `wscript.exe //B wrapper.vbs`, which starts the command hidden and does not wait.
+ *
+ * Usage:
+ *   node bin/w2m-hidden-task.mjs --name w2m-keeper --every-minutes 2 \
+ *     --command "C:\...\node.exe" --arg "C:\...\script.mjs" \
+ *     [--workdir "C:\..."] [--delete]
+ */
+import { execFileSync } from 'node:child_process';
+import { writeFileSync, mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import os from 'node:os';
+
+import { buildHiddenWrapper, hiddenTaskArgs } from '../src/util/windows-hidden-task.mjs';
+
+/** Parse `--flag value` pairs plus repeatable `--arg`; unknown flags are refused by name. */
+export function parseHiddenTaskArgs(argv) {
+  const out = { name: null, everyMinutes: null, command: null, args: [], workdir: null, delete: false, vbsPath: null };
+  for (let i = 0; i < argv.length; i += 1) {
+    const flag = argv[i];
+    const next = () => {
+      const value = argv[i + 1];
+      if (typeof value !== 'string' || value.startsWith('--')) throw new Error(`${flag} needs a value`);
+      i += 1;
+      return value;
+    };
+    switch (flag) {
+      case '--name': out.name = next(); break;
+      case '--every-minutes': out.everyMinutes = Number(next()); break;
+      case '--command': out.command = next(); break;
+      case '--arg': out.args.push(next()); break;
+      case '--workdir': out.workdir = next(); break;
+      case '--vbs': out.vbsPath = next(); break;
+      case '--delete': out.delete = true; break;
+      case '--help':
+      case '-h': out.help = true; break;
+      default: throw new Error(`unknown flag: ${flag}`);
+    }
+  }
+  if (out.delete === true) {
+    if (typeof out.name !== 'string' || out.name.trim() === '') throw new Error('--delete needs --name');
+    return out;
+  }
+  if (out.name === null || out.command === null || out.everyMinutes === null) {
+    throw new Error('--name, --command and --every-minutes are required');
+  }
+  if (out.vbsPath === null) {
+    const safe = String(out.name).replace(/[^A-Za-z0-9._-]/g, '_');
+    out.vbsPath = join(os.homedir(), '.dsh', 'xclient', `${safe}-hidden.vbs`);
+  }
+  return out;
+}
+
+async function main() {
+  let args;
+  try {
+    args = parseHiddenTaskArgs(process.argv.slice(2));
+  } catch (error) {
+    process.stderr.write(`w2m-hidden-task: ${error.message}\n`);
+    process.exit(2);
+  }
+  if (args.help === true) {
+    process.stdout.write('usage: w2m-hidden-task.mjs --name <task> --every-minutes <n> --command <exe> [--arg <a>]... [--workdir <dir>] [--vbs <path>]\n'
+      + '       w2m-hidden-task.mjs --delete --name <task>\n');
+    return;
+  }
+  if (args.delete === true) {
+    try {
+      execFileSync('schtasks', ['/Delete', '/TN', args.name, '/F'], { stdio: 'ignore' });
+      process.stdout.write(`deleted ${args.name}\n`);
+    } catch {
+      process.stdout.write(`no task named ${args.name}\n`);
+    }
+    return;
+  }
+  if (process.platform !== 'win32') throw new Error('hidden scheduled tasks are a Windows feature');
+  mkdirSync(dirname(args.vbsPath), { recursive: true });
+  writeFileSync(args.vbsPath, buildHiddenWrapper({ command: args.command, args: args.args, workingDirectory: args.workdir }), 'utf8');
+  const taskArgs = hiddenTaskArgs({ taskName: args.name, everyMinutes: args.everyMinutes, vbsPath: args.vbsPath });
+  execFileSync('schtasks', taskArgs, { stdio: 'ignore' });
+  process.stdout.write(`scheduled ${args.name} every ${args.everyMinutes} min (hidden wrapper ${args.vbsPath})\n`);
+}
+
+const invokedDirectly = process.argv[1] !== undefined && import.meta.url === new URL(`file://${process.argv[1].replace(/\\/g, '/')}`).href;
+if (invokedDirectly) {
+  main().catch((error) => {
+    process.stderr.write(`w2m-hidden-task: ${error?.message ?? error}\n`);
+    process.exit(1);
+  });
+}

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.6.3", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.6.5", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/WINDOWS-BACKGROUND-TASKS.md

@@ -0,0 +1,53 @@
+# Windows 后台任务：不弹窗的正确做法
+
+## 现象
+
+用 `schtasks /TR "node.exe script.mjs"` 创建的计划任务，每次触发都会在桌面**弹出一个控制台窗口**。
+本机曾因此出现"每隔 2–5 分钟自动弹窗"，来源是守护/守望任务：
+
+| 任务 | 频率 | 实际行为 |
+|---|---|---|
+| standby keeper | 每 2 分钟 | 起 `powershell.exe` → 窗口闪烁 |
+| TwinsEarth watcher | 每 5 分钟 | 起 `node.exe`，且脚本设计跑 6 小时 → 窗口+进程累积 |
+
+## 正确做法
+
+用 `wscript.exe //B wrapper.vbs` 注册任务；VBScript 里：
+
+```vbs
+Set sh = CreateObject("WScript.Shell")
+sh.Run """C:\...\node.exe"" ""C:\...\script.mjs"" --flag", 0, False
+```
+
+- `0` = 隐藏窗口（不显示控制台）
+- `False` = 不等待（任务立即返回）
+
+## 用工具生成（v1.6.5 起）
+
+```powershell
+node bin/w2m-hidden-task.mjs `
+  --name w2m-standby-keeper `
+  --every-minutes 2 `
+  --command "E:\DS\resources\runtime\primary-runtime\dependencies\node\bin\node.exe" `
+  --arg "C:\Users\you\.dsh\xclient\standby-keeper.mjs" `
+  --workdir "C:\Users\you"
+```
+
+输出：
+
+```
+scheduled w2m-standby-keeper every 2 min (hidden wrapper C:\Users\you\.dsh\xclient\w2m-standby-keeper-hidden.vbs)
+```
+
+删除：
+
+```powershell
+node bin/w2m-hidden-task.mjs --delete --name w2m-standby-keeper
+```
+
+## 原则
+
+1. **不要**把长驻脚本挂到分钟级计划任务上（每次触发都会起一个新实例）——分钟级任务里只放"检查并退出"的短脚本；
+2. 计划任务一律通过 VBS 隐藏包装启动，不要直接 `node.exe`；
+3. 长期守护优先用系统服务/launchd/启动项，而不是高频计划任务；
+4. 一次性任务（如远程重启）用完即删，避免残留（本机曾残留 3 个 `w2m-restart-*`）。

package/docs/acceptance/1.6.4/HEALTHZ-FLEETS-ONLINE.json

@@ -0,0 +1,20 @@
+{
+  "version": "1.6.4",
+  "case": "HEALTHZ-FLEETS-ONLINE",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-24T04:47:35.562Z",
+  "executor": "lead",
+  "requirement": "/healthz carries fleets_online beside fleets_total so the panel can show online fleets / total fleets",
+  "task_id": "01M5ANYMVLX3MI7",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "relay_suite": "200/200",
+      "stats": "fleets_online present"
+    }
+  },
+  "note": "1.6.3 shipped fleetSummary.fleets_online but headlz stats omitted it; this release adds it"
+}

package/docs/acceptance/1.6.5/HIDDEN-BACKGROUND-TASKS.json

@@ -0,0 +1,21 @@
+{
+  "version": "1.6.5",
+  "case": "HIDDEN-BACKGROUND-TASKS",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-24T07:33:03.150Z",
+  "executor": "lead",
+  "requirement": "Windows background automation never creates a console window: tasks run through a VBScript wrapper with window style 0, and the helper refuses incomplete input",
+  "task_id": "01M5ANYMVM30H98",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "hidden_task_suite": "5/5 pass",
+      "wrapper": "Run(...,0,False)",
+      "task_line": "wscript.exe //B"
+    }
+  },
+  "note": "field symptom: a 2-minute keeper and a 5-minute watcher produced recurring console windows"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.6.3",
+  "version": "1.6.5",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {
@@ -64,7 +64,7 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:account-join": "node --test --test-force-exit test/account-join.test.mjs",
@@ -82,7 +82,7 @@
     "test:council-session": "node --test --test-force-exit test/council-session.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
     "test:crypto-blake2s": "node --test --test-force-exit test/crypto-blake2s.test.mjs",
-    "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs",
+    "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs",
     "test:exec-env": "node --test --test-force-exit test/exec-env-injection.test.mjs",
     "test:exit-channel": "node --test --test-force-exit test/exit-channel.test.mjs",
     "test:field-authority": "node --test --test-force-exit test/field-authority.test.mjs",
@@ -204,7 +204,8 @@
     "w2m-grant": "./bin/w2m-grant.mjs",
     "w2m-secondary-link": "bin/w2m-secondary-link.mjs",
     "w2m-bootstrap": "bin/w2m-bootstrap.mjs",
-    "w2m-bootstrap-sign": "bin/w2m-bootstrap-sign.mjs"
+    "w2m-bootstrap-sign": "bin/w2m-bootstrap-sign.mjs",
+    "w2m-hidden-task": "bin/w2m-hidden-task.mjs"
   },
   "disclosure": {
     "cloud": true,

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.6.3",
+  "version": "1.6.5",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/tools.mjs

@@ -277,7 +277,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.6.3';
+const PLUGIN_VERSION = '1.6.5';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;

package/src/relay/state.mjs

@@ -3280,6 +3280,8 @@ export class RabbitState {
       devices: this.devices.size,
       // v1.6.2: whole-relay totals on the public health probe.
       fleets_total: this.fleetSummary().fleets_total,
+      // v1.6.4: 1.6.3 forgot to surface this on /healthz (the panel reads it there).
+      fleets_online: this.fleetSummary().fleets_online,
       devices_online: this.fleetSummary().devices_online,
       devices_total: this.devices.size,
       tasks: this.tasks.size,

package/src/util/windows-hidden-task.mjs

@@ -0,0 +1,86 @@
+/**
+ * Windows background tasks without popups (v1.6.5).
+ *
+ * ## The problem this fixes
+ *
+ * The standby keeper and the fleet watcher were scheduled with
+ * `schtasks /TR "node.exe script.mjs"`. Windows Task Scheduler runs such a command in the
+ * interactive session, which creates a **console window every time the task fires** — a 2-minute
+ * keeper means a window every two minutes, and a 5-minute watcher that itself runs for hours
+ * accumulates both windows and processes. That is a real usability defect: the operator sees the
+ * machine "randomly opening windows" and cannot tell what is happening.
+ *
+ * ## The fix
+ *
+ * `wscript.exe //B wrapper.vbs` runs invisibly. The wrapper (VBScript) starts the real command with
+ * `WScript.Shell.Run(command, 0, False)`: window style 0 = hidden, third argument = do not wait. No
+ * console window, no lingering `cmd`, and the task still runs on schedule.
+ *
+ * Everything here is pure string construction (and one CLI that calls `schtasks`), so the escaping
+ * rules — the part that silently breaks hidden wrappers — are unit-testable without touching a real
+ * scheduler.
+ */
+
+/**
+ * Command line for Task Scheduler that hides the window.
+ *
+ * @param {string} vbsPath Absolute path of the wrapper .vbs.
+ * @returns {string} e.g. `wscript.exe //B "C:\...\wrapper.vbs"`
+ */
+export function hiddenTaskCommandLine(vbsPath) {
+  if (typeof vbsPath !== 'string' || vbsPath.trim() === '') throw new TypeError('vbsPath is required');
+  return `wscript.exe //B "${vbsPath}"`;
+}
+
+/** Escape one literal for the inside of a VBScript double-quoted string. */
+export function vbsString(value) {
+  return '"' + String(value).replace(/"/g, '""') + '"';
+}
+
+/**
+ * Build the wrapper script that runs `command` hidden.
+ *
+ * The command itself is passed through verbatim, and `arguments` is appended in the same
+ * double-quote-escaped form Windows uses on the command line (`""` inside a VBS string becomes one
+ * literal quote when the shell rebuilds the command). Every argument is quoted individually so a
+ * path with spaces cannot split into two arguments.
+ *
+ * @param {{command: string, args?: string[], workingDirectory?: string|null}} input
+ * @returns {string} VBScript source.
+ */
+export function buildHiddenWrapper({ command, args = [], workingDirectory = null }) {
+  if (typeof command !== 'string' || command.trim() === '') throw new TypeError('command is required');
+  // Build the real command line first (Windows quoting), THEN escape the whole line once for
+  // VBScript. Escaping each argument separately and escaping again for the script string would
+  // double the quotes twice — the subtle over-escaping that makes a wrapper run the wrong token.
+  const quoteWin = (value) => (/[\s"]/.test(String(value)) ? '"' + String(value).replace(/"/g, '\\"') + '"' : String(value));
+  const parts = [quoteWin(command), ...(Array.isArray(args) ? args : []).map(quoteWin)];
+  const lines = [
+    "' Generated by w2m-hidden-task (v1.6.5): run a command with NO console window.",
+    'Set sh = CreateObject("WScript.Shell")',
+  ];
+  if (typeof workingDirectory === 'string' && workingDirectory !== '') {
+    lines.push(`sh.CurrentDirectory = ${vbsString(workingDirectory)}`);
+  }
+  lines.push(`sh.Run ${vbsString(parts.join(' '))}, 0, False`);
+  return lines.join('\r\n') + '\r\n';
+}
+
+/**
+ * The `schtasks /Create` argument list for a hidden wrapper, without executing anything.
+ *
+ * @param {{taskName: string, everyMinutes: number, vbsPath: string}} input
+ * @returns {string[]}
+ */
+export function hiddenTaskArgs({ taskName, everyMinutes, vbsPath }) {
+  if (typeof taskName !== 'string' || taskName.trim() === '') throw new TypeError('taskName is required');
+  const minutes = Number(everyMinutes);
+  if (!Number.isInteger(minutes) || minutes < 1) throw new TypeError('everyMinutes must be a positive integer');
+  return [
+    '/Create', '/F',
+    '/SC', 'MINUTE',
+    '/MO', String(minutes),
+    '/TN', taskName,
+    '/TR', hiddenTaskCommandLine(vbsPath),
+  ];
+}