@twinsearth/w2m-dsh-plugin 1.9.1 → 1.9.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.9.1",
+  "version": "1.9.5",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {
@@ -64,7 +64,7 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs test/gpw-colors.test.mjs test/gpw-recent-fold.test.mjs test/gpw-auto-approve.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs test/gpw-colors.test.mjs test/gpw-recent-fold.test.mjs test/gpw-auto-approve.test.mjs test/data-plane.test.mjs test/sealed-object.test.mjs test/joint-dev-dispatch.test.mjs test/joint-dev-loop.test.mjs test/joint-dev-audit.test.mjs test/joint-dev-redline.test.mjs test/relay-redline-guard.test.mjs test/relay-p0-projection.test.mjs test/guarded-dispatch.test.mjs test/p0-single-matcher.test.mjs test/path-policy.test.mjs test/path-policy-fs.test.mjs test/gpw-inheritance-table.test.mjs test/gpw-policy-adapter.test.mjs test/target-policy.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:account-join": "node --test --test-force-exit test/account-join.test.mjs",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.9.1",
+  "version": "1.9.5",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/agent/sinks/dir-sink.mjs

@@ -0,0 +1,33 @@
+/**
+ * 目录 sink（本地/局域网共享盘）：密封对象落盘、按内容哈希取回。
+ * 数据面适配器的最小实现；git/ssh 适配器同契约，后续补。
+ * 对象已经是 sealObject() 的密文，sink 不接触明文与密钥。
+ */
+import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, writeFileSync, existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+export function createDirSink({ root }) {
+  if (typeof root !== 'string' || root === '') throw new Error('SINK_ROOT_REQUIRED');
+  mkdirSync(root, { recursive: true });
+  return {
+    kind: 'dir',
+    async pushObject({ sealed }) {
+      if (sealed === null || typeof sealed !== 'object') return { ok: false, code: 'OBJECT_INVALID' };
+      const body = JSON.stringify(sealed);
+      const id = createHash('sha256').update(body, 'utf8').digest('hex');
+      const path = join(root, id + '.json');
+      writeFileSync(path, body, { encoding: 'utf8', mode: 0o600 });
+      return { ok: true, objectId: id, path, bytes: Buffer.byteLength(body, 'utf8') };
+    },
+    async fetchObject({ objectId }) {
+      if (typeof objectId !== 'string' || !/^[0-9a-f]{64}$/.test(objectId)) return { ok: false, code: 'OBJECT_ID_INVALID' };
+      const path = join(root, objectId + '.json');
+      if (!existsSync(path)) return { ok: false, code: 'OBJECT_NOT_FOUND' };
+      return { ok: true, sealed: JSON.parse(readFileSync(path, 'utf8')), path };
+    },
+    async listObjects() {
+      return readdirSync(root).filter((name) => name.endsWith('.json')).map((name) => name.replace(/\.json$/, ''));
+    },
+  };
+}

package/src/plugin/folder-policy.mjs

@@ -1,3 +1,4 @@
+import { decidePath } from './path-policy.mjs';
 /**
  * GPW v2 — folder policy for the approval gate (v1.7.5-beta.1).
  *
@@ -71,24 +72,15 @@ export function classifyPath(input) {
   const base = input.base ?? process.cwd();
   const target = normalizeFolder(input.target, { base, platform });
   const normalise = (list) => (Array.isArray(list) ? list : []).map((f) => normalizeFolder(f, { base, platform }));
-
-  for (const folder of normalise(input.blacklist)) {
-    if (isInside(target, folder, { platform })) {
-      return { decision: 'deny', target, folder, reason: `the folder "${folder}" is on the blacklist` };
-    }
-  }
-  for (const folder of normalise(input.whitelist)) {
-    if (isInside(target, folder, { platform })) {
-      return { decision: 'allow', target, folder, reason: `the folder "${folder}" is on the whitelist` };
-    }
-  }
-  if (typeof input.workspace === 'string' && input.workspace !== '') {
-    const workspace = normalizeFolder(input.workspace, { base, platform });
-    if (isInside(target, workspace, { platform })) {
-      return { decision: 'allow', target, folder: workspace, reason: 'the target is inside the workspace' };
-    }
-  }
-  return { decision: 'pass', target, folder: null, reason: 'no list mentions this target, so GPW asks the operator' };
+  const rules = [
+    ...normalise(input.blacklist).map((path) => ({ path, effect: 'deny', source: 'panel' })),
+    ...normalise(input.whitelist).map((path) => ({ path, effect: 'allow', source: 'panel' })),
+  ];
+  const verdict = decidePath({ target, rules, exceptions: [], workspace: input.workspace ?? null, platform });
+  // 兼容旧返回形状：approve 视为 pass（需要人工），判定仍由 decidePath 单一实现。
+  const decision = verdict.decision === 'approve' ? 'pass' : verdict.decision;
+  const folder = verdict.rule?.path ?? (verdict.source === 'workspace' ? normalizeFolder(input.workspace, { base, platform }) : null);
+  return { decision, target, folder, reason: verdict.reason };
 }
 
 /** Fields that carry a single filesystem path in the tool schemas this plugin sees. */

package/src/plugin/gpw-policy-adapter.mjs

@@ -0,0 +1,30 @@
+/**
+ * P0-1 / P0-2 适配层：gpw-colors 的唯一调用入口。
+ *
+ * 规则：白名单 = allow 规则，黑名单 = deny 规则；判定只走 path-policy.decideMany
+ * （分段比较、deny 优先、最长前缀、例外 approve）。颜色由 colorOf 渲染，
+ * 不参与判定；白名单/工作区全部命中时 skipBudget=true（不进 10 次/分预算）。
+ */
+import { DECISION, colorOf, decideMany } from './path-policy.mjs';
+
+export function evaluateCall(input) {
+  const platform = input?.platform ?? process.platform;
+  const paths = Array.isArray(input?.paths) ? input.paths : [];
+  const rules = [];
+  for (const path of input?.whitelist ?? []) rules.push({ path, effect: 'allow', source: 'panel' });
+  for (const path of input?.blacklist ?? []) rules.push({ path, effect: 'deny', source: 'panel' });
+  const verdict = decideMany({
+    targets: paths,
+    rules,
+    exceptions: input?.exceptions ?? [],
+    workspace: input?.workspace ?? null,
+    platform,
+  });
+  return {
+    decision: verdict.decision,
+    color: colorOf(verdict.decision),
+    skipBudget: verdict.decision === DECISION.ALLOW,
+    reason: verdict.reason,
+    results: verdict.results ?? [],
+  };
+}

package/src/plugin/joint-dev/audit-file.mjs

@@ -0,0 +1,83 @@
+/**
+ * 红线审计落盘：JSONL + fsync + 哈希链 + 校验。
+ * 只接受元数据字段（内容字段直接拒绝），链断裂/篡改可被定位。
+ */
+import { closeSync, fsyncSync, openSync, readFileSync, writeSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+
+export const AUDIT_FORBIDDEN = new Set(['content', 'data', 'file', 'files', 'patch', 'stdout', 'stderr', 'diff', 'blob', 'bytes', 'text', 'base64']);
+
+function stable(value) {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return '[' + value.map(stable).join(',') + ']';
+  return '{' + Object.keys(value).sort().map((key) => JSON.stringify(key) + ':' + stable(value[key])).join(',') + '}';
+}
+
+const sha256 = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
+
+/** 追加一条审计；写盘后 fsync。返回写入的记录。 */
+export function appendAudit(file, event) {
+  if (event === null || typeof event !== 'object' || Array.isArray(event)) {
+    return { ok: false, code: 'AUDIT_EVENT_INVALID' };
+  }
+  const bad = Object.keys(event).filter((key) => AUDIT_FORBIDDEN.has(key.toLowerCase()));
+  if (bad.length > 0) return { ok: false, code: 'AUDIT_CONTENT_FORBIDDEN', detail: { keys: bad } };
+
+  let previous = null;
+  let seq = 1;
+  try {
+    const lines = readFileSync(file, 'utf8').split('\n').filter((line) => line.trim() !== '');
+    if (lines.length > 0) {
+      const last = JSON.parse(lines[lines.length - 1]);
+      previous = last.record_sha256 ?? null;
+      seq = Number(last.seq ?? lines.length) + 1;
+    }
+  } catch { /* 新文件 */ }
+
+  const body = {
+    v: 1,
+    seq,
+    at: event.at ?? new Date().toISOString(),
+    event: typeof event.event === 'string' ? event.event : 'joint.event',
+    plan_sha256: event.plan_sha256 ?? null,
+    step_id: event.step_id ?? null,
+    task_id: event.task_id ?? null,
+    machine_id: event.machine_id ?? null,
+    outcome: event.outcome ?? null,
+    reason_code: event.reason_code ?? null,
+    control_bytes: Number.isInteger(event.control_bytes) ? event.control_bytes : null,
+    control_sha256: typeof event.control_sha256 === 'string' ? event.control_sha256 : null,
+    prev_sha256: previous,
+  };
+  const record = { ...body, record_sha256: sha256(stable(body)) };
+  const fd = openSync(file, 'a');
+  try {
+    writeSync(fd, JSON.stringify(record) + '\n');
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  return { ok: true, record };
+}
+
+/** 校验整条链；返回第一处问题的 seq。 */
+export function verifyAuditFile(file) {
+  let lines;
+  try {
+    lines = readFileSync(file, 'utf8').split('\n').filter((line) => line.trim() !== '');
+  } catch {
+    return { ok: true, count: 0, head: null };
+  }
+  let expectedPrev = null;
+  let head = null;
+  lines.forEach((line, index) => {
+    let record;
+    try { record = JSON.parse(line); } catch { throw new Error('AUDIT_JSON_BROKEN at line ' + (index + 1)); }
+    const { record_sha256: stored, ...body } = record;
+    if (body.prev_sha256 !== expectedPrev) throw new Error('AUDIT_CHAIN_BROKEN at seq ' + body.seq);
+    if (sha256(stable(body)) !== stored) throw new Error('AUDIT_ENTRY_TAMPERED at seq ' + body.seq);
+    expectedPrev = stored;
+    head = stored;
+  });
+  return { ok: true, count: lines.length, head };
+}

package/src/plugin/joint-dev/dispatch.mjs

@@ -0,0 +1,154 @@
+/**
+ * 联合开发：计划 → 控制面信封 → 分发（R1–R4 的生产接线点）。
+ *
+ * 只构造"任务指令 + 元数据"：任务 ID、机器、步骤、命令 hash、base commit、写范围。
+ * 任何用户代码/文件/输出字节都不允许出现在这里；发送前逐条过 redline.inspectControlMessage，
+ * 失败即拒绝并写审计（只记元数据）。本模块不做网络 I/O，sendFn 由调用方注入。
+ */
+import { createHash } from 'node:crypto';
+
+import { appendAudit } from './audit-file.mjs';
+import { createAudit, inspectControlMessage } from './redline.mjs';
+
+export const MAX_STEPS = 16;
+const DATA_KEYS = new Set(['data', 'file', 'files', 'content', 'patch', 'diff', 'blob', 'bytes', 'stdout', 'stderr', 'base64', 'text']);
+
+const sha256 = (value) => createHash('sha256').update(String(value), 'utf8').digest('hex');
+
+function scanData(value, path, hits) {
+  if (value === null || typeof value !== 'object') return;
+  if (Array.isArray(value)) { value.forEach((entry, index) => scanData(entry, path + '[' + index + ']', hits)); return; }
+  for (const [key, child] of Object.entries(value)) {
+    const keyPath = path === '' ? key : path + '.' + key;
+    if (DATA_KEYS.has(key.toLowerCase())) hits.push(keyPath);
+    scanData(child, keyPath, hits);
+  }
+}
+
+/**
+ * 校验计划：步骤唯一、依赖存在、无环、无数据字段、机器 ID 合法。
+ * @returns {{ok: true, plan: object} | {ok: false, code: string, detail: object}}
+ */
+export function buildPlan(input) {
+  if (input === null || typeof input !== 'object') return { ok: false, code: 'PLAN_INVALID', detail: {} };
+  const steps = Array.isArray(input.steps) ? input.steps : null;
+  if (steps === null || steps.length === 0 || steps.length > MAX_STEPS) {
+    return { ok: false, code: 'PLAN_STEPS_INVALID', detail: { count: steps === null ? null : steps.length } };
+  }
+  const hits = [];
+  scanData(input, '', hits);
+  if (hits.length > 0) return { ok: false, code: 'DATA_PLANE_FORBIDDEN', detail: { paths: hits.slice(0, 8) } };
+
+  const ids = new Set();
+  for (const step of steps) {
+    if (typeof step?.step_id !== 'string' || !/^[a-z][a-z0-9_-]{0,31}$/.test(step.step_id)) {
+      return { ok: false, code: 'PLAN_STEP_ID_INVALID', detail: { step_id: step?.step_id ?? null } };
+    }
+    if (ids.has(step.step_id)) return { ok: false, code: 'PLAN_STEP_DUPLICATE', detail: { step_id: step.step_id } };
+    ids.add(step.step_id);
+    if (typeof step.machine_id !== 'string' || step.machine_id === '') {
+      return { ok: false, code: 'PLAN_MACHINE_INVALID', detail: { step_id: step.step_id } };
+    }
+    if (!Array.isArray(step.command_argv) || step.command_argv.length === 0) {
+      return { ok: false, code: 'PLAN_ARGV_INVALID', detail: { step_id: step.step_id } };
+    }
+  }
+  const graph = new Map(steps.map((step) => [step.step_id, Array.isArray(step.depends_on) ? step.depends_on : []]));
+  for (const [id, deps] of graph) {
+    for (const dep of deps) {
+      if (!ids.has(dep)) return { ok: false, code: 'PLAN_DEP_UNKNOWN', detail: { step_id: id, dep } };
+    }
+  }
+  const visiting = new Set();
+  const done = new Set();
+  const visit = (id) => {
+    if (done.has(id)) return true;
+    if (visiting.has(id)) return false;
+    visiting.add(id);
+    for (const dep of graph.get(id) ?? []) if (!visit(dep)) return false;
+    visiting.delete(id);
+    done.add(id);
+    return true;
+  };
+  for (const id of ids) if (!visit(id)) return { ok: false, code: 'PLAN_CYCLE', detail: { step_id: id } };
+
+  const canonical = {
+    v: 1,
+    title: typeof input.title === 'string' ? input.title.slice(0, 200) : '',
+    base_commit: typeof input.base_commit === 'string' ? input.base_commit : null,
+    steps: steps.map((step) => ({
+      step_id: step.step_id,
+      machine_id: step.machine_id,
+      command_argv: step.command_argv.slice(0, 32),
+      command_hash: sha256(JSON.stringify(step.command_argv)),
+      write_scope: Array.isArray(step.write_scope) ? step.write_scope.slice(0, 8) : [],
+      depends_on: Array.isArray(step.depends_on) ? step.depends_on.slice(0, 8) : [],
+      timeout_ms: Number.isInteger(step.timeout_ms) ? step.timeout_ms : null,
+    })),
+  };
+  return { ok: true, plan: { ...canonical, plan_sha256: sha256(JSON.stringify(canonical)) } };
+}
+
+/** 计划 → 控制面信封（每个步骤一条 joint.dispatch，只含元数据）。 */
+export function buildControlEnvelopes(plan) {
+  return plan.steps.map((step) => ({
+    v: 1,
+    type: 'joint.dispatch',
+    body: {
+      plan_sha256: plan.plan_sha256,
+      step_id: step.step_id,
+      machine_id: step.machine_id,
+      base_commit: plan.base_commit,
+      command_argv: step.command_argv,
+      command_hash: step.command_hash,
+      write_scope: step.write_scope,
+      depends_on: step.depends_on,
+      ...(step.timeout_ms === null ? {} : { timeout_ms: step.timeout_ms }),
+    },
+  }));
+}
+
+/**
+ * 分发：逐条过红线 → 审计 → sendFn。失败即停，返回已完成与失败原因。
+ * @param {{plan: object, sendFn: Function, dryRun?: boolean, audit?: object}} input
+ */
+export async function dispatchPlan({ plan, sendFn, dryRun = false, audit = null, auditFile = null }) {
+  if (plan === null || typeof plan !== 'object' || typeof plan.plan_sha256 !== 'string') {
+    return { ok: false, code: 'PLAN_NOT_BUILT', sent: [], audits: [] };
+  }
+  const auditLog = audit ?? createAudit();
+  const envelopes = buildControlEnvelopes(plan);
+  const sent = [];
+  const audits = [];
+  for (const envelope of envelopes) {
+    const check = inspectControlMessage(envelope);
+    const bytes = Buffer.byteLength(JSON.stringify(envelope), 'utf8');
+    if (check.ok !== true) {
+      const record = { event: 'joint.dispatch.refused', plan_sha256: plan.plan_sha256, step_id: envelope.body.step_id, machine_id: envelope.body.machine_id, outcome: 'denied', reason_code: check.code, control_bytes: bytes, control_sha256: sha256(JSON.stringify(envelope)) };
+      auditLog.append(record);
+      audits.push(record);
+      return { ok: false, code: check.code, detail: check.detail, sent, audits };
+    }
+    if (dryRun) { sent.push({ step_id: envelope.body.step_id, bytes, dispatched: false }); continue; }
+    if (typeof auditFile === 'string') {
+      let written;
+      try { written = appendAudit(auditFile, { event: 'joint.dispatch.sending', plan_sha256: plan.plan_sha256, step_id: envelope.body.step_id, machine_id: envelope.body.machine_id, control_bytes: bytes, control_sha256: sha256(JSON.stringify(envelope)) }); } catch (error) { written = { ok: false, detail: String(error) }; }
+      if (written.ok !== true) return { ok: false, code: 'AUDIT_UNAVAILABLE', detail: written, sent, audits };
+    }
+    let response;
+    try {
+      response = await sendFn(envelope, { stepId: envelope.body.step_id, machineId: envelope.body.machine_id, bytes });
+    } catch (error) {
+      const record = { event: 'joint.dispatch.failed', plan_sha256: plan.plan_sha256, step_id: envelope.body.step_id, machine_id: envelope.body.machine_id, outcome: 'error', reason_code: 'SEND_FAILED', control_bytes: bytes, control_sha256: sha256(JSON.stringify(envelope)) };
+      auditLog.append(record);
+      audits.push(record);
+      return { ok: false, code: 'SEND_FAILED', detail: { step_id: envelope.body.step_id, error: String(error).slice(0, 120) }, sent, audits };
+    }
+    const record = { event: 'joint.dispatch.sent', plan_sha256: plan.plan_sha256, step_id: envelope.body.step_id, machine_id: envelope.body.machine_id, outcome: response?.ok === true ? 'ok' : 'rejected', reason_code: response?.code ?? null, control_bytes: bytes, control_sha256: sha256(JSON.stringify(envelope)) };
+    auditLog.append(record);
+    audits.push(record);
+    sent.push({ step_id: envelope.body.step_id, bytes, dispatched: true });
+    if (response?.ok !== true) return { ok: false, code: response?.code ?? 'DISPATCH_REJECTED', detail: { step_id: envelope.body.step_id }, sent, audits };
+  }
+  return { ok: true, sent, audits, auditHead: auditLog.head(), dryRun };
+}

package/src/plugin/joint-dev/loop.mjs

@@ -0,0 +1,73 @@
+/**
+ * 联合开发闭环（纯函数 + 注入传输）：collect → merge → verify。
+ * 数据字节只经直连 fetchFn；relay 只出现在控制面（dispatch.mjs）。
+ */
+
+/** 收集：按 ref 直连拉取，校验 sha256；缺失/不匹配即记为问题。 */
+export async function collectArtifacts({ refs, fetchFn, crypto }) {
+  const digest = (value) => crypto.createHash('sha256').update(value).digest('hex');
+  const artifacts = [];
+  const problems = [];
+  for (const ref of refs) {
+    if (ref === null || typeof ref !== 'object' || typeof ref.machine !== 'string') {
+      problems.push({ machine: ref?.machine ?? null, file: ref?.file ?? null, reason: 'REF_INVALID' });
+      continue;
+    }
+    let bytes;
+    try {
+      bytes = await fetchFn(ref);
+    } catch (error) {
+      problems.push({ machine: ref.machine, file: ref.file ?? null, reason: 'FETCH_FAILED', detail: String(error).slice(0, 80) });
+      continue;
+    }
+    if (bytes === undefined || bytes === null) {
+      problems.push({ machine: ref.machine, file: ref.file ?? null, reason: 'REF_MISSING' });
+      continue;
+    }
+    const hash = digest(Buffer.from(bytes));
+    if (ref.sha256 !== hash) {
+      problems.push({ machine: ref.machine, file: ref.file ?? null, reason: 'HASH_MISMATCH', expected: ref.sha256, actual: hash });
+      continue;
+    }
+    artifacts.push({ machine: ref.machine, file: ref.file, path: ref.path ?? ref.file, bytes: Buffer.from(bytes), sha256: hash });
+  }
+  return { ok: problems.length === 0, artifacts, problems };
+}
+
+/** 合并：按 (path) 检测同文件双改冲突；冲突时 head 不动，返回冲突明细。 */
+export function mergeArtifacts({ artifacts }) {
+  const byPath = new Map();
+  const conflicts = [];
+  for (const artifact of artifacts) {
+    const path = artifact.path ?? artifact.file;
+    const key = String(path).toLowerCase();
+    const existing = byPath.get(key);
+    if (existing === undefined) {
+      byPath.set(key, { path, machines: [artifact.machine], bytes: artifact.bytes, sha256: artifact.sha256 });
+      continue;
+    }
+    if (existing.sha256 === artifact.sha256) {
+      if (!existing.machines.includes(artifact.machine)) existing.machines.push(artifact.machine);
+      continue;
+    }
+    conflicts.push({ path, machines: [...new Set([...existing.machines, artifact.machine])], reason: 'CONTENT_CONFLICT', left: existing.sha256, right: artifact.sha256 });
+  }
+  if (conflicts.length > 0) return { ok: false, code: 'MERGE_CONFLICT', conflicts, files: [] };
+  const files = [...byPath.values()].map((entry) => ({ path: entry.path, sha256: entry.sha256, bytes: entry.bytes, machines: entry.machines }));
+  return { ok: true, files, conflicts: [] };
+}
+
+/** 复核：对合并结果逐机比对期望文件；只回结论与差异摘要。 */
+export function verifyReview({ merged, expectations }) {
+  const present = new Map(merged.files.map((file) => [String(file.path).toLowerCase(), file.sha256]));
+  const results = [];
+  for (const expectation of expectations) {
+    const actual = present.get(String(expectation.file).toLowerCase()) ?? null;
+    const pass = actual !== null && (expectation.sha256 === undefined || actual === expectation.sha256);
+    results.push(pass
+      ? { machine: expectation.machine, file: expectation.file, status: 'PASS' }
+      : { machine: expectation.machine, file: expectation.file, status: 'FAIL', reason: actual === null ? 'FILE_MISSING' : 'HASH_MISMATCH', expected: expectation.sha256 ?? null, actual });
+  }
+  const failed = results.filter((entry) => entry.status === 'FAIL');
+  return { ok: failed.length === 0, verdict: failed.length === 0 ? 'PASS' : 'FAIL', results, failed };
+}

package/src/plugin/joint-dev/plan-store.mjs

@@ -0,0 +1,66 @@
+/**
+ * joint-dev 计划持久化与人工审批门（本地文件，0600）。
+ * 未审批的计划禁止 dispatch；审批绑定 plan_sha256 与候选人。
+ */
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const sha256 = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
+const planDir = (stateDir) => join(stateDir, 'joint-dev', 'plans');
+const approvalDir = (stateDir) => join(stateDir, 'joint-dev', 'approvals');
+
+export function savePlan({ stateDir, plan, now = Date.now() }) {
+  if (typeof plan?.plan_sha256 !== 'string' || plan.plan_sha256.length !== 64) return { ok: false, code: 'PLAN_INVALID' };
+  mkdirSync(planDir(stateDir), { recursive: true });
+  const path = join(planDir(stateDir), plan.plan_sha256 + '.json');
+  if (existsSync(path)) return { ok: true, path, reused: true };
+  writeFileSync(path, JSON.stringify({ plan, saved_at: new Date(now).toISOString() }, null, 2), { encoding: 'utf8', mode: 0o600 });
+  return { ok: true, path, reused: false };
+}
+
+export function loadPlan({ stateDir, planSha }) {
+  const path = join(planDir(stateDir), planSha + '.json');
+  if (!existsSync(path)) return { ok: false, code: 'PLAN_NOT_FOUND' };
+  return { ok: true, ...JSON.parse(readFileSync(path, 'utf8')), path };
+}
+
+/**
+ * 人工审批。authority 建议 ≥70；审批只由操作员 CLI/UI 写入，不暴露给 agent 工具。
+ */
+export function approvePlan({ stateDir, planSha, approver, authority, note = '', now = Date.now() }) {
+  if (typeof planSha !== 'string' || planSha.length !== 64) return { ok: false, code: 'PLAN_SHA_INVALID' };
+  if (typeof approver !== 'string' || approver === '') return { ok: false, code: 'APPROVER_REQUIRED' };
+  if (!Number.isInteger(authority) || authority < 70) return { ok: false, code: 'APPROVAL_AUTHORITY_TOO_LOW', detail: { authority } };
+  if (!existsSync(join(planDir(stateDir), planSha + '.json'))) return { ok: false, code: 'PLAN_NOT_FOUND' };
+  mkdirSync(approvalDir(stateDir), { recursive: true });
+  const body = {
+    v: 1,
+    plan_sha256: planSha,
+    approver,
+    authority,
+    note: String(note).slice(0, 200),
+    approved_at: new Date(now).toISOString(),
+  };
+  const record = { ...body, approval_sha256: sha256(JSON.stringify(body)) };
+  const path = join(approvalDir(stateDir), planSha + '.json');
+  writeFileSync(path, JSON.stringify(record, null, 2), { encoding: 'utf8', mode: 0o600 });
+  return { ok: true, approval: record, path };
+}
+
+export function loadApproval({ stateDir, planSha }) {
+  const path = join(approvalDir(stateDir), planSha + '.json');
+  if (!existsSync(path)) return { ok: false, code: 'APPROVAL_REQUIRED' };
+  const record = JSON.parse(readFileSync(path, 'utf8'));
+  if (record.plan_sha256 !== planSha) return { ok: false, code: 'APPROVAL_STALE' };
+  return { ok: true, approval: record };
+}
+
+/** dispatch 前置门：计划必须存在且已审批。 */
+export function assertDispatchAllowed({ stateDir, planSha }) {
+  const plan = loadPlan({ stateDir, planSha });
+  if (plan.ok !== true) return { ok: false, code: 'PLAN_NOT_FOUND' };
+  const approval = loadApproval({ stateDir, planSha });
+  if (approval.ok !== true) return { ok: false, code: 'APPROVAL_REQUIRED' };
+  return { ok: true, plan: plan.plan, approval: approval.approval };
+}

package/src/plugin/joint-dev/redline.mjs

@@ -0,0 +1,16 @@
+/**
+ * 兼容入口：红线判据的唯一实现在 src/util/redline-core.mjs（relay 与插件共用）。
+ * 保留此文件是为了既有引用（joint-dev/*、测试）不发生破坏性改动。
+ */
+export {
+  MAX_CONTROL_BYTES,
+  CONTROL_VERSION,
+  CONTROL_TYPES,
+  DATA_PLANES,
+  CONTROL_ALLOWED_KEYS,
+  BODY_ALLOWED_KEYS,
+  FORBIDDEN_DATA_KEYS,
+  inspectControlMessage,
+  assertPlane,
+  createAudit,
+} from '../../util/redline-core.mjs';

package/src/plugin/npm-update.mjs

@@ -14,6 +14,7 @@ import { compareVersions } from './update-source.mjs';
 export const PLUGIN_PACKAGE_NAME = '@twinsearth/w2m-dsh-plugin';
 /** npm mirrors are fine here: the answer is only "which version is latest", and the tarball is verified separately. */
 export const DEFAULT_NPM_LATEST_URL = `https://registry.npmmirror.com/${encodeURIComponent(PLUGIN_PACKAGE_NAME)}/latest`;
+export const DEFAULT_NPM_LATEST_FALLBACK_URL = `https://registry.npmjs.org/${encodeURIComponent(PLUGIN_PACKAGE_NAME)}/latest`;
 export const NPM_CHECK_TIMEOUT_MS = 15_000;
 
 /**
@@ -61,19 +62,24 @@ export function decideNpmUpdate({ latest, currentVersion }) {
 export async function checkNpmUpdate(input) {
   const fetchImpl = input?.fetchImpl ?? globalThis.fetch;
   const url = input?.url ?? DEFAULT_NPM_LATEST_URL;
+  const urls = input?.url !== undefined ? [url] : [url, DEFAULT_NPM_LATEST_FALLBACK_URL];
   const timeoutMs = Number.isInteger(input?.timeoutMs) ? input.timeoutMs : NPM_CHECK_TIMEOUT_MS;
-  let doc;
-  try {
-    const response = await fetchImpl(url, {
-      headers: { accept: 'application/json' },
-      signal: typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function' ? AbortSignal.timeout(timeoutMs) : undefined,
-    });
-    if (response?.ok !== true) {
-      return decideNpmUpdate({ latest: { ok: false, error: `npm registry answered HTTP ${response?.status ?? '?'}` }, currentVersion: input?.currentVersion ?? null });
+  let last = { ok: false, error: 'npm latest could not be read' };
+  for (const candidate of urls) {
+    try {
+      const response = await fetchImpl(candidate, {
+        headers: { accept: 'application/json' },
+        signal: typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function' ? AbortSignal.timeout(timeoutMs) : undefined,
+      });
+      if (response?.ok !== true) { last = { ok: false, error: `npm registry answered HTTP ${response?.status ?? '?'}` }; continue; }
+      const doc = await response.json();
+      const parsed = parseNpmLatest(doc);
+      if (parsed.ok === true) return decideNpmUpdate({ latest: parsed, currentVersion: input?.currentVersion ?? null });
+      last = parsed;
+    } catch (error) {
+      last = { ok: false, error: error instanceof Error ? error.message : String(error) };
     }
-    doc = await response.json();
-  } catch (error) {
-    return decideNpmUpdate({ latest: { ok: false, error: error instanceof Error ? error.message : String(error) }, currentVersion: input?.currentVersion ?? null });
   }
-  return decideNpmUpdate({ latest: parseNpmLatest(doc), currentVersion: input?.currentVersion ?? null });
+  return decideNpmUpdate({ latest: last, currentVersion: input?.currentVersion ?? null });
 }
+