@twinsearth/w2m-dsh-plugin 1.6.6 → 1.6.8

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.6.6"
+    "version": "1.6.8"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.6.6",
+      "version": "1.6.8",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.6.6"
+  "version": "1.6.8"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.6.6",
+  "version": "1.6.8",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,35 @@
 
 All notable changes to this project are documented here.
 
+## [1.6.8] — 2026-10-24
+
+**插件面板新增「检查插件更新」按钮：npm 对比 → 自动更新 → 提示重启 DSH。**
+
+- 客户端：目标机器菜单 relay 区新增按钮。点击后：① GET `/api/w2m/plugin-update` 联网查 npm latest
+  并与已装版本比较；② 有新版时 POST `{action:"apply"}` 执行安装；③ 安装完成显示"请重启 DSH 以载入最新插件"。
+- 宿主：新增路由 `/api/w2m/plugin-update`。检查逻辑在 `src/plugin/npm-update.mjs`（纯函数，可单测：只认
+  `latest > installed`，网络失败是错误值而不是"已最新"）。
+- 安装复用**既有已验证更新器**（`auto-update.mjs` → `update-install.mjs`）：下载 tarball、用 release
+  SHA256SUMS 校验 SHA-256、备份旧包、替换新版——按钮点击不会引入第二套弱校验安装路径。
+- 测试：npm-update 4/4、client-bundle 26/26；证据 `docs/acceptance/1.6.8/PLUGIN-UPDATE-BUTTON.json`
+  （fleet task `01M5ANYMVMI9EHA`）。
+- 边界：DSH 插件管理页的「卸载」按钮属于宿主应用（打包在 app.asar 内），插件包无法直接注入其旁边；
+  本按钮位于 w2m 插件自己的面板中。若要放进宿主插件页，需要 DSH 侧提供插件动作扩展点（已列为待评估）。
+## [1.6.7] — 2026-10-24
+
+**修复 v1.6.6 failover 的阻塞 bug：远端 relay 模式下清理函数抛错，切换后无法重启 stack。**
+
+现场演练（停主 relay 180s）暴露：机器掉线后没有切到备用，恢复主 relay 后才重新上线。根因：
+
+- `startLocalStack` 的清理函数无条件执行 `await relay.close()`；而 `relay` 只在"本进程自建本地 relay"
+  时才非空，远端 relay 模式下是 `null` → 抛 TypeError；
+- failover 的切换流程 `await stop()` 抛错后被 catch 吞掉，**后续的 restart 从未执行**（stack 停了没起来）。
+
+修复：
+- 清理函数 null-safe/idempotent：仅当 `relay` 是带 `close()` 的对象才调用；`agent.stop()` 失败也继续清理。
+- 切换流程：`stop()` 失败不再跳过 restart；并写诊断日志 `xclient/relay-failover.log`（每轮探测/切换/重启错误）。
+- 测试：relay-failover 5/5、relay 200/200；证据 `docs/acceptance/1.6.7/FAILOVER-CLEANUP-FIX.json`
+  （fleet task `01M5ANYMVMFSSP3`）。
 ## [1.6.6] — 2026-10-24
 
 **relay 自动 failover：主 relay 故障时自动切到备用，恢复后自动切回。**

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.6.6", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.6.8", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/acceptance/1.6.7/FAILOVER-CLEANUP-FIX.json

@@ -0,0 +1,22 @@
+{
+  "version": "1.6.7",
+  "case": "FAILOVER-CLEANUP-FIX",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-24T13:31:02.803Z",
+  "executor": "lead",
+  "requirement": "a remote-relay in-process stack can be stopped and restarted for failover: the cleanup must not assume a local relay object, a failed stop must not skip the restart, and the switch must leave a diagnostics log",
+  "task_id": "01M5ANYMVMFSSP3",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "failover_suite": "5/5",
+      "relay_suite": "200/200",
+      "cleanup": "null-safe and idempotent",
+      "diagnostics": "xclient/relay-failover.log"
+    }
+  },
+  "note": "v1.6.6 field drill stopped the stack and never restarted it: relay.close() threw on remote-relay stacks"
+}

package/docs/acceptance/1.6.8/PLUGIN-UPDATE-BUTTON.json

@@ -0,0 +1,22 @@
+{
+  "version": "1.6.8",
+  "case": "PLUGIN-UPDATE-BUTTON",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-24T14:39:54.191Z",
+  "executor": "lead",
+  "requirement": "the plugin panel offers one update button: it checks npm for a newer version, installs it through the verified updater (SHA-256 checked, old package backed up), and tells the user to restart DSH",
+  "task_id": "01M5ANYMVMI9EHA",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "npm_update_suite": "4/4 pass",
+      "check": "only latest > installed",
+      "apply": "delegated to auto-update.mjs verified installer",
+      "restart_required": "true after install"
+    }
+  },
+  "note": "button lives in the w2m plugin panel; the DSH plugin-manager page is host UI packaged in app.asar and not editable by a plugin package"
+}

package/lib/client.js

@@ -78,6 +78,8 @@ window.__ModuleLoader__.load({
     const ROUTE = '/api/w2m/target';
     // v1.4.2: the UI-activated Node-code-execution switch (host: src/plugin/exec-capability-route.mjs).
     const CAPABILITY_ROUTE = '/api/w2m/capability';
+// v1.6.8: npm update check + verified install (host: src/plugin/update-route.mjs).
+const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
 
     /**
      * The locale namespace and its two dictionaries.
@@ -113,6 +115,12 @@ window.__ModuleLoader__.load({
         relayUnfold: '收起折叠的 relay',
         relayTemporary: '临时 Relay 节点（回退配置）',
         globalSummary: '全服：{fleetsOnline}/{fleets} 个编队 · {online}/{total} 台在线',
+        updateButton: '检查插件更新',
+        updateChecking: '正在检查 npm…',
+        updating: '正在更新…',
+        updateCurrent: '已是最新（{version}）',
+        updateInstalled: '已更新到 {version}',
+        restartHint: '请重启 DSH 以载入最新插件',
         capLabel: 'Node 执行：{state}',
         capDenied: '拒绝',
         capTemporary: '临时 24 小时',
@@ -145,6 +153,12 @@ window.__ModuleLoader__.load({
         relayUnfold: 'collapse the folded relays',
         relayTemporary: 'temporary relay nodes (fallback config)',
         globalSummary: 'fleets {fleetsOnline}/{fleets} · machines {online}/{total} online',
+        updateButton: 'check for plugin update',
+        updateChecking: 'checking npm…',
+        updating: 'updating…',
+        updateCurrent: 'up to date ({version})',
+        updateInstalled: 'updated to {version}',
+        restartHint: 'restart DSH to load the new plugin',
         capLabel: 'Node exec: {state}',
         capDenied: 'denied',
         capTemporary: 'temporary 24 h',
@@ -439,7 +453,48 @@ window.__ModuleLoader__.load({
      * target is a choice about the *next* dispatch, which is legitimate to change while a turn runs.
      * `t` arrives through the entry's inject face (see {@link apply}).
      */
-    function TargetSelect({ sessionId, locked: _locked, t }) {
+    /** v1.6.8: one button beside the relay rows: check npm for a newer plugin, install it, ask for a restart. */
+function PluginUpdate({ t }) {
+  const [state, setState] = React.useState({ status: 'idle', info: null, error: null });
+  const call = async (method, body) => {
+    const response = await fetch(PLUGIN_UPDATE_ROUTE, {
+      method, credentials: 'same-origin',
+      headers: { accept: 'application/json', ...(body === undefined ? {} : { 'content-type': 'application/json' }) },
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    });
+    let json = null;
+    try { json = await response.json(); } catch { /* keep null */ }
+    return { status: response.status, json };
+  };
+  const onClick = async () => {
+    setState({ status: 'checking', info: null, error: null });
+    try {
+      const checked = await call('GET');
+      const info = checked.json ?? {};
+      if (info.ok !== true) { setState({ status: 'error', info, error: info.error ?? 'update check failed' }); return; }
+      if (info.update_available !== true) { setState({ status: 'current', info, error: null }); return; }
+      setState({ status: 'applying', info, error: null });
+      const applied = await call('POST', { action: 'apply' });
+      const result = applied.json ?? {};
+      if (result.ok !== true) { setState({ status: 'error', info: result, error: result.error ?? result.reason ?? 'update failed' }); return; }
+      setState({ status: 'installed', info: result, error: null });
+    } catch (error) {
+      setState({ status: 'error', info: null, error: error instanceof Error ? error.message : String(error) });
+    }
+  };
+  const label = state.status === 'checking' ? t('updateChecking')
+    : state.status === 'applying' ? t('updating')
+    : state.status === 'current' ? t('updateCurrent', { version: state.info?.current ?? '?' })
+    : state.status === 'installed' ? t('updateInstalled', { version: state.info?.to ?? state.info?.latest ?? '?' })
+    : t('updateButton');
+  const disabled = state.status === 'checking' || state.status === 'applying';
+  return h('div', { className: cls('relayHint'), 'data-w2m-update': state.status }, [
+    h('button', { key: 'b', type: 'button', className: cls('relayToggle'), disabled, onClick: (event) => { event.stopPropagation(); onClick(); } }, label),
+    state.status === 'installed' ? h('div', { key: 'r', className: cls('relayHint') }, t('restartHint')) : null,
+    state.status === 'error' ? h('div', { key: 'e', className: cls('relayHint') }, String(state.error ?? 'error')) : null,
+  ]);
+}
+function TargetSelect({ sessionId, locked: _locked, t }) {
       const [open, setOpen] = React.useState(false);
       // v1.5.1: relay folding. The snapshot carries the pool; when it holds more than three nodes
       // the menu shows a summary and this toggle reveals the folded ones.
@@ -639,6 +694,7 @@ window.__ModuleLoader__.load({
                 online: relayFold.server.devices_online ?? '—',
                 total: relayFold.server.devices_total ?? '—',
               })),
+              h(PluginUpdate, { key: 'update', t }),
               relayFold.hidden_count > 0 && relayOpen === false
                 ? h('div', { key: 'hint', className: cls('relayHint') }, t('relayFold', { count: relayFold.hidden_count }))
                 : null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.6.6",
+  "version": "1.6.8",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {
@@ -64,7 +64,7 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:account-join": "node --test --test-force-exit test/account-join.test.mjs",
@@ -82,7 +82,7 @@
     "test:council-session": "node --test --test-force-exit test/council-session.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
     "test:crypto-blake2s": "node --test --test-force-exit test/crypto-blake2s.test.mjs",
-    "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs",
+    "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs",
     "test:exec-env": "node --test --test-force-exit test/exec-env-injection.test.mjs",
     "test:exit-channel": "node --test --test-force-exit test/exit-channel.test.mjs",
     "test:field-authority": "node --test --test-force-exit test/field-authority.test.mjs",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.6.6",
+  "version": "1.6.8",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/npm-update.mjs

@@ -0,0 +1,79 @@
+/**
+ * v1.6.8 — npm update check for the plugin panel's "更新" button.
+ *
+ * The button's first half is this module: ask the npm registry for `latest`, compare it against the
+ * version installed in the profile, and report the result. Nothing here writes or installs — the
+ * install half reuses the existing verified updater (`auto-update.mjs` → `update-install.mjs`),
+ * which already downloads a tarball, verifies its SHA-256 against the release's SHA256SUMS, swaps the
+ * package in the profile, and takes a backup. Keeping the check pure is what makes "NPM 对比" testable
+ * without a network or a profile.
+ */
+import { compareVersions } from './update-source.mjs';
+
+/** The package this plugin is. */
+export const PLUGIN_PACKAGE_NAME = '@twinsearth/w2m-dsh-plugin';
+/** npm mirrors are fine here: the answer is only "which version is latest", and the tarball is verified separately. */
+export const DEFAULT_NPM_LATEST_URL = `https://registry.npmmirror.com/${encodeURIComponent(PLUGIN_PACKAGE_NAME)}/latest`;
+export const NPM_CHECK_TIMEOUT_MS = 15_000;
+
+/**
+ * Normalise the npm `latest` document.
+ *
+ * @param {object} doc
+ * @returns {{ok: true, name: string, version: string, tarball: string|null}|{ok: false, error: string}}
+ */
+export function parseNpmLatest(doc) {
+  if (doc === null || typeof doc !== 'object' || Array.isArray(doc)) {
+    return { ok: false, error: 'the npm latest document is not a JSON object' };
+  }
+  const version = typeof doc.version === 'string' ? doc.version.trim() : '';
+  if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(version)) {
+    return { ok: false, error: `the npm latest document carries no usable version (got ${JSON.stringify(doc.version ?? null)})` };
+  }
+  const tarball = typeof doc.dist?.tarball === 'string' && doc.dist.tarball !== '' ? doc.dist.tarball : null;
+  const name = typeof doc.name === 'string' && doc.name !== '' ? doc.name : PLUGIN_PACKAGE_NAME;
+  return { ok: true, name, version, tarball };
+}
+
+/**
+ * Compare the installed version with npm latest.
+ *
+ * Update availability is `latest > installed`; equal or older is not an update (a profile can hold a
+ * beta/newer local build, and downgrading it from a button would be a surprise, not a service).
+ *
+ * @param {{latest: {ok: boolean, version?: string, error?: string, tarball?: string|null}, currentVersion: string|null}} input
+ * @returns {{ok: boolean, current: string|null, latest: string|null, update_available: boolean, tarball: string|null, error?: string}}
+ */
+export function decideNpmUpdate({ latest, currentVersion }) {
+  const current = typeof currentVersion === 'string' && currentVersion !== '' ? currentVersion : null;
+  if (latest?.ok !== true) {
+    return { ok: false, current, latest: null, update_available: false, tarball: null, error: latest?.error ?? 'npm latest could not be read' };
+  }
+  const available = current !== null && compareVersions(latest.version, current) > 0;
+  return { ok: true, current, latest: latest.version, update_available: available, tarball: latest.tarball ?? null };
+}
+
+/**
+ * Ask npm for `latest` and decide. Never throws: a network failure is a value with `error`.
+ *
+ * @param {{currentVersion: string|null, fetchImpl?: Function, url?: string, timeoutMs?: number}} input
+ */
+export async function checkNpmUpdate(input) {
+  const fetchImpl = input?.fetchImpl ?? globalThis.fetch;
+  const url = input?.url ?? DEFAULT_NPM_LATEST_URL;
+  const timeoutMs = Number.isInteger(input?.timeoutMs) ? input.timeoutMs : NPM_CHECK_TIMEOUT_MS;
+  let doc;
+  try {
+    const response = await fetchImpl(url, {
+      headers: { accept: 'application/json' },
+      signal: typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function' ? AbortSignal.timeout(timeoutMs) : undefined,
+    });
+    if (response?.ok !== true) {
+      return decideNpmUpdate({ latest: { ok: false, error: `npm registry answered HTTP ${response?.status ?? '?'}` }, currentVersion: input?.currentVersion ?? null });
+    }
+    doc = await response.json();
+  } catch (error) {
+    return decideNpmUpdate({ latest: { ok: false, error: error instanceof Error ? error.message : String(error) }, currentVersion: input?.currentVersion ?? null });
+  }
+  return decideNpmUpdate({ latest: parseNpmLatest(doc), currentVersion: input?.currentVersion ?? null });
+}

package/src/plugin/tools.mjs

@@ -190,6 +190,7 @@ import {
 // `w2m_chat` tool shipped first; this is the browser-facing half that was still missing.
 import { registerChatRoutes } from './fleet-chat-route.mjs';
 import { registerExecCapabilityRoutes } from './exec-capability-route.mjs';
+import { registerPluginUpdateRoutes } from './update-route.mjs';
 import { defaultExecCapabilityFile } from '../util/exec-capability.mjs';
 import { createFleetCouncil, fleetCouncilThread } from './council-fleet.mjs';
 import { renderMemoryView } from './memory-view.mjs';
@@ -281,7 +282,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.6.6';
+const PLUGIN_VERSION = '1.6.8';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -3513,6 +3514,9 @@ export async function apply(ctx, config = {}) {
   const capabilityRoutes = registerExecCapabilityRoutes(ctx, {
     capabilityFile: () => defaultExecCapabilityFile(),
   });
+  // v1.6.8: the plugin panel's "更新" button: GET checks npm latest, POST installs through the
+  // verified updater (SHA-256 checked, old package backed up, restart required afterwards).
+  const _updateRoutes = registerPluginUpdateRoutes(ctx, { profileDir: () => cfg.profileDir });
   if (capabilityRoutes.mounted !== true) {
     ctx.logger?.warn?.('w2m: the execution-capability control is inactive — ' + capabilityRoutes.reason);
   }
@@ -7407,6 +7411,19 @@ async function probeRelayHealth(url, timeoutMs) {
  * relay-failover.mjs and is unit-tested there; this function only supplies health and performs the
  * restart.
  */
+/** Append one line to the failover diagnostics log; failures are swallowed (diagnostics must not break the switch). */
+async function appendFailoverLog(cfg, line) {
+  try {
+    const { appendFileSync, mkdirSync, statSync, writeFileSync } = await import('node:fs');
+    const { join, dirname } = await import('node:path');
+    const { homedir } = await import('node:os');
+    const dir = cfg.stateDir ?? join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), 'xclient');
+    const file = join(dir, 'relay-failover.log');
+    mkdirSync(dirname(file), { recursive: true });
+    try { if (statSync(file).size > 256 * 1024) writeFileSync(file, ''); } catch { /* absent is fine */ }
+    appendFileSync(file, new Date().toISOString() + ' ' + line + '\n');
+  } catch { /* diagnostics only */ }
+}
 async function startFailoverStack(ctx, cfg) {
   let stop = await startLocalStack(ctx, cfg);
   const pool = relayPool(cfg);
@@ -7422,6 +7439,7 @@ async function startFailoverStack(ctx, cfg) {
     const health = {};
     await Promise.all(pool.map(async (url) => { health[url] = await probeRelayHealth(url, FAILOVER_DEFAULTS.probeTimeoutMs); }));
     const decision = failover.assess(health);
+    await appendFailoverLog(cfg, 'probe ' + JSON.stringify(health) + ' -> ' + decision.action + (decision.target ? ' ' + decision.target : ''));
     relayFailoverStatus = failover.snapshot();
     if (decision.action !== 'switch') return;
     switching = true;
@@ -8077,7 +8095,14 @@ async function startLocalStack(ctx, cfg) {
     ensureFleetJoin = null;
     inProcessAgentStatus = null;
     await agent.stop();
-    await relay.close();
+    // v1.6.7: `relay` is only a real relay object when THIS stack started a local relay; a remote-
+    // relay stack has null here. The unconditional close() threw, which is what made the first
+    // failover attempt stop the stack and never restart it.
+    if (relay !== null && typeof relay.close === 'function') {
+      try { await relay.close(); } catch (error) {
+        ctx.logger?.warn?.('w2m: local relay close failed: ' + (error instanceof Error ? error.message : String(error)));
+      }
+    }
   };
 }
 

package/src/plugin/update-route.mjs

@@ -0,0 +1,118 @@
+/**
+ * `/api/w2m/plugin-update` — the host half of the plugin panel's "更新" button (v1.6.8).
+ *
+ * Wire:
+ *   GET  /api/w2m/plugin-update[?check=1] -> { ok, current, latest, update_available, error? }
+ *   POST /api/w2m/plugin-update           { action: 'apply' }
+ *        -> { ok, outcome, from, to, installed, restart_required, error? }
+ *
+ * The GET half asks npm for `latest` (src/plugin/npm-update.mjs). The POST half delegates the write
+ * to the already-verified updater: `auto-update.mjs` downloads the release tarball, verifies its
+ * SHA-256 against SHA256SUMS, installs it over the profile package with a backup, and records the
+ * outcome. This module never writes the profile itself — that division is what keeps a button click
+ * from inventing a second install path with weaker checks.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { checkNpmUpdate } from './npm-update.mjs';
+
+export const PLUGIN_UPDATE_ROUTE_PATH = '/api/w2m/plugin-update';
+const NO_STORE = { 'cache-control': 'no-store' };
+
+/** Read the version installed in the profile's node_modules; null when it cannot be read. */
+export function readInstalledVersion(profileDir) {
+  try {
+    const text = readFileSync(join(profileDir, 'node_modules', '@twinsearth', 'w2m-dsh-plugin', 'package.json'), 'utf8');
+    const parsed = JSON.parse(text);
+    return typeof parsed.version === 'string' ? parsed.version : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Mount the route on the host's Connection fetch registry.
+ *
+ * @param {object} ctx Cordis context
+ * @param {{profileDir: () => string|null, createUpdater?: (options: object) => object}} deps
+ * @returns {{mounted: boolean, reason: string|null}}
+ */
+export function registerPluginUpdateRoutes(ctx, deps) {
+  const status = { mounted: false, reason: 'the host has no Connection service' };
+  if (typeof ctx?.inject !== 'function') return status;
+  ctx.inject(['connection'], (webCtx) => {
+    const registry = webCtx?.connection?.fetch;
+    if (registry === undefined || typeof registry.register !== 'function') {
+      status.reason = 'the connection service carries no fetch registry';
+      return;
+    }
+    registry.register({
+      path: PLUGIN_UPDATE_ROUTE_PATH,
+      methods: ['GET', 'POST'],
+      requestBody: 'buffered',
+      fetch: async (request) => {
+        if (request.method !== 'GET' && request.method !== 'POST') {
+          return Response.json({ ok: false, error: request.method + ' is not a method this route answers', reason_code: 'METHOD_NOT_ALLOWED' }, { status: 405, headers: NO_STORE });
+        }
+        const profileDir = typeof deps?.profileDir === 'function' ? deps.profileDir() : null;
+        if (typeof profileDir !== 'string' || profileDir === '') {
+          return Response.json({ ok: false, error: 'no DSH profile directory was found, so there is nothing to update', reason_code: 'NO_PROFILE' }, { status: 400, headers: NO_STORE });
+        }
+        const current = readInstalledVersion(profileDir);
+        if (request.method === 'GET') {
+          const checked = await checkNpmUpdate({ currentVersion: current });
+          return Response.json({ ...checked, profile_dir: profileDir }, { headers: NO_STORE });
+        }
+        let body = null;
+        try { body = await request.json(); } catch { /* refused below */ }
+        if (body === null || typeof body !== 'object' || body.action !== 'apply') {
+          return Response.json({ ok: false, error: 'a JSON body with {"action":"apply"} is required', reason_code: 'UPDATE_BODY_INVALID' }, { status: 400, headers: NO_STORE });
+        }
+        // Refuse before installing when npm says there is nothing newer.
+        const checked = await checkNpmUpdate({ currentVersion: current });
+        if (checked.ok !== true) {
+          return Response.json({ ok: false, outcome: 'check-failed', error: checked.error, current, restart_required: false }, { status: 502, headers: NO_STORE });
+        }
+        if (checked.update_available !== true) {
+          return Response.json({ ok: true, outcome: 'up-to-date', current, latest: checked.latest, installed: false, restart_required: false }, { headers: NO_STORE });
+        }
+        let updater;
+        try {
+          updater = deps?.createUpdater !== undefined ? deps.createUpdater({ profileDir, currentVersion: current }) : await defaultUpdater({ profileDir, currentVersion: current });
+        } catch (error) {
+          return Response.json({ ok: false, outcome: 'error', error: error instanceof Error ? error.message : String(error), current, restart_required: false }, { status: 500, headers: NO_STORE });
+        }
+        const result = await updater.check('manual');
+        const installedTo = typeof result?.to === 'string' && result.to !== '' ? result.to : null;
+        const installed = result?.outcome === 'installed' || installedTo !== null && installedTo !== current;
+        return Response.json({
+          ok: result?.ok === true && installed === true,
+          outcome: result?.outcome ?? 'unknown',
+          from: result?.from ?? current,
+          to: installedTo,
+          installed,
+          reason: result?.reason ?? null,
+          error: result?.error ?? null,
+          restart_required: installed === true,
+        }, { headers: NO_STORE });
+      },
+    });
+    status.mounted = true;
+    status.reason = null;
+  });
+  return status;
+}
+
+/** Build the verified updater for a manual install (lazy import keeps this route cheap to load). */
+async function defaultUpdater({ profileDir, currentVersion }) {
+  const { createAutoUpdater } = await import('./auto-update.mjs');
+  return createAutoUpdater({
+    profileDir,
+    currentVersion,
+    enabled: true,
+    // A button click is an explicit request: no daily minimum interval may swallow it.
+    intervalDays: 0,
+    log: () => {},
+  });
+}