@twinsearth/w2m-dsh-plugin 1.9.15 → 1.9.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.9.15",
+  "version": "1.9.17",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {
@@ -64,7 +64,7 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs test/gpw-colors.test.mjs test/gpw-recent-fold.test.mjs test/gpw-auto-approve.test.mjs test/data-plane.test.mjs test/sealed-object.test.mjs test/joint-dev-dispatch.test.mjs test/joint-dev-loop.test.mjs test/joint-dev-audit.test.mjs test/joint-dev-redline.test.mjs test/relay-redline-guard.test.mjs test/relay-p0-projection.test.mjs test/guarded-dispatch.test.mjs test/p0-single-matcher.test.mjs test/path-policy.test.mjs test/path-policy-fs.test.mjs test/gpw-inheritance-table.test.mjs test/gpw-policy-adapter.test.mjs test/target-policy.test.mjs test/relay-redline-audit.test.mjs test/relay-repair-ledger.test.mjs test/relay-purge-blobs.test.mjs test/relay-scrub.test.mjs test/joint-dev-plan-store.test.mjs test/relay-basepath-blobs.test.mjs test/operator-token.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs test/gpw-colors.test.mjs test/gpw-recent-fold.test.mjs test/gpw-auto-approve.test.mjs test/data-plane.test.mjs test/sealed-object.test.mjs test/joint-dev-dispatch.test.mjs test/joint-dev-loop.test.mjs test/joint-dev-audit.test.mjs test/joint-dev-redline.test.mjs test/relay-redline-guard.test.mjs test/relay-p0-projection.test.mjs test/guarded-dispatch.test.mjs test/p0-single-matcher.test.mjs test/path-policy.test.mjs test/path-policy-fs.test.mjs test/gpw-inheritance-table.test.mjs test/gpw-policy-adapter.test.mjs test/target-policy.test.mjs test/relay-redline-audit.test.mjs test/relay-repair-ledger.test.mjs test/relay-purge-blobs.test.mjs test/relay-scrub.test.mjs test/joint-dev-plan-store.test.mjs test/relay-basepath-blobs.test.mjs test/operator-token.test.mjs test/relay-health-capabilities.test.mjs test/joint-relay-dispatch.test.mjs test/operator-token-route.test.mjs test/relay-scrub-task-projection.test.mjs test/operator-key-approval.test.mjs test/relay-offer-journal.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:account-join": "node --test --test-force-exit test/account-join.test.mjs",
@@ -208,7 +208,8 @@
     "w2m-hidden-task": "bin/w2m-hidden-task.mjs",
     "w2m-self-update": "bin/w2m-self-update.mjs",
     "w2m-joint": "bin/w2m-joint.mjs",
-    "w2m-operator": "bin/w2m-operator.mjs"
+    "w2m-operator": "bin/w2m-operator.mjs",
+    "w2m-scrub": "bin/w2m-scrub.mjs"
   },
   "disclosure": {
     "cloud": true,

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.9.15",
+  "version": "1.9.17",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/joint-dev/plan-store.mjs

@@ -1,24 +1,29 @@
 /**
  * joint-dev 计划持久化与人工审批门（本地文件，0600）。
  *
- * 安全不变量（v2 预置）：
+ * 安全不变量（v2）：
  *   · plan_sha256 必须由本模块重算，与文件内容不符即 PLAN_TAMPERED；
  *   · planSha 必须是 64 位小写十六进制，禁止路径穿越；
- *   · 审批绑定 plan_sha256 + approver + authority + 过期时间，approval_sha256 读回时重算；
- *   · 未审批的计划禁止 dispatch（assertDispatchAllowed 是唯一入口）。
- *
- * 审批只由操作员 CLI/UI 写入，不暴露为 agent 工具。
+ *   · 审批绑定 plan_sha256 + approver + authority(70..100) + 有效期（60s..10min）；
+ *   · 审批由 operator Ed25519 私钥签名；签名覆盖除 sig/approval_sha256/operator_key 外的记录体，
+ *     key_id 必须等于公钥指纹（防换公钥），可选 trustedOperatorKeyIds 做信任锚；
+ *   · 审批写入原子（tmp→rename），dispatch 前置门可强制要求签名；
+ *   · consumeApproval 用 O_EXCL 保证"一次审批只能派发一次"。
  */
 import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, statSync, writeSync } from 'node:fs';
 import { join } from 'node:path';
 
+import { keyIdOf, verifyApprovalPayload } from '../operator-key.mjs';
+
 const sha256 = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
 const PLAN_SHA = /^[0-9a-f]{64}$/;
-const DEFAULT_APPROVAL_TTL_MS = 24 * 60 * 60 * 1000;
+const APPROVAL_TTL_MIN_MS = 60_000;
+const APPROVAL_TTL_MAX_MS = 10 * 60 * 1000;
 
 const planDir = (stateDir) => join(stateDir, 'joint-dev', 'plans');
 const approvalDir = (stateDir) => join(stateDir, 'joint-dev', 'approvals');
+const consumedDir = (stateDir) => join(stateDir, 'joint-dev', 'consumed');
 
 /** Hash of the plan body WITHOUT plan_sha256 — the same rule buildPlan uses. */
 export function planHashOf(plan) {
@@ -42,6 +47,18 @@ function readPlanFile(stateDir, planSha) {
   return { ok: true, plan, path, saved_at: parsed.saved_at ?? null };
 }
 
+function writeFileAtomic(path, text) {
+  const tmp = path + '.tmp-' + process.pid + '-' + Date.now().toString(36);
+  const fd = openSync(tmp, 'w', 0o600);
+  try {
+    writeSync(fd, text);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(tmp, path);
+}
+
 export function savePlan({ stateDir, plan, now = Date.now() }) {
   if (plan === null || typeof plan !== 'object' || !PLAN_SHA.test(String(plan.plan_sha256 ?? ''))) {
     return { ok: false, code: 'PLAN_INVALID' };
@@ -53,10 +70,7 @@ export function savePlan({ stateDir, plan, now = Date.now() }) {
   mkdirSync(planDir(stateDir), { recursive: true });
   const path = join(planDir(stateDir), plan.plan_sha256 + '.json');
   if (existsSync(path)) return { ok: true, path, reused: true };
-  const tmp = path + '.tmp-' + process.pid;
-  writeFileSync(tmp, JSON.stringify({ plan, saved_at: new Date(now).toISOString() }, null, 2), { encoding: 'utf8', mode: 0o600 });
-  // rename is atomic on the same volume; a crash leaves only the tmp file behind.
-  renameSync(tmp, path);
+  writeFileAtomic(path, JSON.stringify({ plan, saved_at: new Date(now).toISOString() }, null, 2));
   return { ok: true, path, reused: false };
 }
 
@@ -72,30 +86,38 @@ export function listPlans({ stateDir, limit = 50 }) {
   const entries = [];
   for (const name of readdirSync(dir)) {
     if (!name.endsWith('.json')) continue;
-    const path = join(dir, name);
+    const sha = name.slice(0, -5);
+    if (!PLAN_SHA.test(sha)) continue;
     try {
-      const stat = statSync(path);
-      entries.push({ plan_sha256: name.slice(0, -5), saved_at_ms: stat.mtimeMs });
-    } catch { /* a vanished plan is simply absent */ }
+      entries.push({ plan_sha256: sha, saved_at_ms: statSync(join(dir, name)).mtimeMs });
+    } catch { /* absent */ }
   }
   entries.sort((a, b) => b.saved_at_ms - a.saved_at_ms);
   return { ok: true, plans: entries.slice(0, Math.max(1, Math.min(200, limit))), total: entries.length };
 }
 
 /**
- * 人工审批。authority 最低 70；TTL 默认 24h；过期/哈希不符/计划被替换时 dispatch 拒绝。
+ * 人工审批。authority 70..100；TTL 60s..10min（决策 2）；传入 signer 时审批带 Ed25519 签名。
+ * signer 只被调用一次：签名覆盖最终要落盘的 body（不含 operator_key / sig / approval_sha256）。
+ *
+ * @param {{stateDir: string, planSha: string, approver: string, authority: number, note?: string, now?: number, ttlMs?: number,
+ *          signer?: (body: object) => {sig: string, key_id: string, public_key_pem: string}}} input
  */
-export function approvePlan({ stateDir, planSha, approver, authority, note = '', now = Date.now(), ttlMs = DEFAULT_APPROVAL_TTL_MS }) {
+export function approvePlan(input) {
+  const { stateDir, planSha, approver, authority, note = '', now = Date.now(), ttlMs = APPROVAL_TTL_MAX_MS, signer } = input;
   if (!PLAN_SHA.test(String(planSha ?? ''))) return { ok: false, code: 'PLAN_SHA_INVALID' };
   if (typeof approver !== 'string' || approver.trim() === '') return { ok: false, code: 'APPROVER_REQUIRED' };
-  if (!Number.isInteger(authority) || authority < 70) return { ok: false, code: 'APPROVAL_AUTHORITY_TOO_LOW', detail: { authority } };
-  if (!Number.isInteger(ttlMs) || ttlMs < 60_000 || ttlMs > 7 * 24 * 60 * 60 * 1000) {
+  if (!Number.isInteger(authority) || authority < 70 || authority > 100) {
+    return { ok: false, code: 'APPROVAL_AUTHORITY_INVALID', detail: { authority } };
+  }
+  if (!Number.isInteger(ttlMs) || ttlMs < APPROVAL_TTL_MIN_MS || ttlMs > APPROVAL_TTL_MAX_MS) {
     return { ok: false, code: 'APPROVAL_TTL_INVALID', detail: { ttlMs } };
   }
   const loaded = readPlanFile(stateDir, planSha);
   if (loaded.ok !== true) return loaded;
   mkdirSync(approvalDir(stateDir), { recursive: true });
-  const body = {
+
+  const base = {
     v: 2,
     plan_sha256: planSha,
     approver,
@@ -104,13 +126,29 @@ export function approvePlan({ stateDir, planSha, approver, authority, note = '',
     approved_at: new Date(now).toISOString(),
     expires_at: new Date(now + ttlMs).toISOString(),
   };
-  const record = { ...body, approval_sha256: sha256(JSON.stringify(body)) };
+  let record = base;
+  if (typeof signer === 'function') {
+    const material = signer({ ...base });
+    if (typeof material?.sig !== 'string' || material.sig === '' || typeof material?.public_key_pem !== 'string') {
+      return { ok: false, code: 'APPROVAL_SIGN_FAILED' };
+    }
+    const keyId = String(material.key_id ?? '');
+    if (keyId === '' || keyId !== keyIdOf(material.public_key_pem)) {
+      return { ok: false, code: 'APPROVAL_KEY_MISMATCH' };
+    }
+    record = { ...base, operator_key: { key_id: keyId, public_key_pem: material.public_key_pem }, sig: material.sig };
+  }
+  const stored = { ...record, approval_sha256: sha256(JSON.stringify(record)) };
   const path = join(approvalDir(stateDir), planSha + '.json');
-  writeFileSync(path, JSON.stringify(record, null, 2), { encoding: 'utf8', mode: 0o600 });
-  return { ok: true, approval: record, path };
+  writeFileAtomic(path, JSON.stringify(stored, null, 2));
+  return { ok: true, approval: stored, path, signed: typeof record.sig === 'string' };
 }
 
-export function loadApproval({ stateDir, planSha, now = Date.now() }) {
+/**
+ * @param {{stateDir: string, planSha: string, now?: number, trustedOperatorKeyIds?: string[]}} input
+ */
+export function loadApproval(input) {
+  const { stateDir, planSha, now = Date.now(), trustedOperatorKeyIds } = input;
   if (!PLAN_SHA.test(String(planSha ?? ''))) return { ok: false, code: 'PLAN_SHA_INVALID' };
   const path = join(approvalDir(stateDir), planSha + '.json');
   if (!existsSync(path)) return { ok: false, code: 'APPROVAL_REQUIRED' };
@@ -119,19 +157,66 @@ export function loadApproval({ stateDir, planSha, now = Date.now() }) {
   if (record?.plan_sha256 !== planSha) return { ok: false, code: 'APPROVAL_STALE' };
   const { approval_sha256: declared, ...body } = record;
   if (sha256(JSON.stringify(body)) !== declared) return { ok: false, code: 'APPROVAL_SIGNATURE_INVALID' };
-  if (!Number.isInteger(record.authority) || record.authority < 70) {
-    return { ok: false, code: 'APPROVAL_AUTHORITY_TOO_LOW', detail: { authority: record.authority } };
+  if (!Number.isInteger(record.authority) || record.authority < 70 || record.authority > 100) {
+    return { ok: false, code: 'APPROVAL_AUTHORITY_INVALID', detail: { authority: record.authority } };
   }
+  const approved = Date.parse(record.approved_at ?? '');
   const expires = Date.parse(record.expires_at ?? '');
-  if (Number.isFinite(expires) && now > expires) return { ok: false, code: 'APPROVAL_EXPIRED', detail: { expires_at: record.expires_at } };
-  return { ok: true, approval: record };
+  if (!Number.isFinite(approved) || !Number.isFinite(expires)) return { ok: false, code: 'APPROVAL_EXPIRY_INVALID' };
+  if (expires - approved < APPROVAL_TTL_MIN_MS || expires - approved > APPROVAL_TTL_MAX_MS) {
+    return { ok: false, code: 'APPROVAL_TTL_INVALID' };
+  }
+  if (now > expires) return { ok: false, code: 'APPROVAL_EXPIRED', detail: { expires_at: record.expires_at } };
+  let strength = 'digest';
+  if (typeof record.sig === 'string') {
+    const pem = record?.operator_key?.public_key_pem;
+    const keyId = record?.operator_key?.key_id;
+    if (typeof pem !== 'string' || pem === '' || typeof keyId !== 'string' || keyId === '') {
+      return { ok: false, code: 'APPROVAL_SIGNATURE_INVALID' };
+    }
+    if (keyId !== keyIdOf(pem)) return { ok: false, code: 'APPROVAL_KEY_MISMATCH' };
+    if (Array.isArray(trustedOperatorKeyIds) && !trustedOperatorKeyIds.includes(keyId)) {
+      return { ok: false, code: 'APPROVAL_KEY_UNTRUSTED', detail: { key_id: keyId } };
+    }
+    if (verifyApprovalPayload(record, record.sig, pem) !== true) {
+      return { ok: false, code: 'APPROVAL_SIGNATURE_INVALID' };
+    }
+    strength = 'signature';
+  }
+  return { ok: true, approval: record, strength };
 }
 
-/** dispatch 前置门：计划必须存在、未被篡改，且已审批、未过期。 */
-export function assertDispatchAllowed({ stateDir, planSha, now = Date.now() }) {
+/**
+ * 一次性消费：O_EXCL 写 consumed/<approval_sha>.json；第二次调用返回 APPROVAL_ALREADY_USED。
+ */
+export function consumeApproval({ stateDir, planSha, approvalSha, now = Date.now() }) {
+  if (!PLAN_SHA.test(String(planSha ?? '')) || !PLAN_SHA.test(String(approvalSha ?? ''))) {
+    return { ok: false, code: 'APPROVAL_SHA_INVALID' };
+  }
+  mkdirSync(consumedDir(stateDir), { recursive: true });
+  const path = join(consumedDir(stateDir), approvalSha + '.json');
+  try {
+    const fd = openSync(path, 'wx', 0o600);
+    try {
+      writeSync(fd, JSON.stringify({ plan_sha256: planSha, approval_sha256: approvalSha, consumed_at: new Date(now).toISOString() }));
+      fsyncSync(fd);
+    } finally { closeSync(fd); }
+    return { ok: true, path };
+  } catch (error) {
+    if (error?.code === 'EEXIST') return { ok: false, code: 'APPROVAL_ALREADY_USED', detail: { path } };
+    return { ok: false, code: 'APPROVAL_CONSUME_FAILED', detail: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+/** dispatch 前置门：计划存在未篡改、审批有效且未过期；requireSignature 时必须是签名审批。 */
+export function assertDispatchAllowed(input) {
+  const { stateDir, planSha, now = Date.now(), requireSignature = false, trustedOperatorKeyIds } = input;
   const plan = loadPlan({ stateDir, planSha });
   if (plan.ok !== true) return { ok: false, code: plan.code ?? 'PLAN_NOT_FOUND' };
-  const approval = loadApproval({ stateDir, planSha, now });
+  const approval = loadApproval({ stateDir, planSha, now, trustedOperatorKeyIds });
   if (approval.ok !== true) return { ok: false, code: approval.code ?? 'APPROVAL_REQUIRED' };
-  return { ok: true, plan: plan.plan, approval: approval.approval };
+  if (requireSignature === true && approval.strength !== 'signature') {
+    return { ok: false, code: 'APPROVAL_SIGNATURE_REQUIRED' };
+  }
+  return { ok: true, plan: plan.plan, approval: approval.approval, strength: approval.strength };
 }

package/src/plugin/joint-dev/relay-dispatch.mjs

@@ -0,0 +1,89 @@
+/**
+ * Joint-dev relay dispatch (v2 S2).
+ *
+ * Turns an approved plan into relay tasks: one step = one broadcast task pinned to the step's
+ * machine via `executor_machine_id`. Capabilities are negotiated first (an older relay that cannot
+ * honour the pin is refused, never assumed), and the leases the relay returns are checked: a lease
+ * on any machine other than the pinned one cancels the task and fails the dispatch.
+ *
+ * Only the control plane is written here: plan digest, step id, command hash and the argv the
+ * executor needs. Nothing is uploaded; artifacts are the separate sink path (S4).
+ */
+import { readRelayCapabilities, negotiateFeatures } from '../relay-capabilities.mjs';
+
+const trimBase = (value) => (typeof value === 'string' ? value.replace(/\/+$/, '') : '');
+
+/**
+ * @param {{rabbitUrl: string, token: string, plan: object, approval: object, fetchImpl?: Function, timeoutMs?: number, includeOffline?: boolean}} input
+ */
+export async function dispatchPlanToRelay(input) {
+  const rabbitUrl = trimBase(input?.rabbitUrl);
+  const token = typeof input?.token === 'string' ? input.token : '';
+  const plan = input?.plan ?? null;
+  const approval = input?.approval ?? null;
+  if (rabbitUrl === '') return { ok: false, code: 'RELAY_URL_REQUIRED' };
+  if (token === '') return { ok: false, code: 'OPERATOR_TOKEN_MISSING' };
+  if (plan === null || typeof plan.plan_sha256 !== 'string') return { ok: false, code: 'PLAN_INVALID' };
+  if (approval === null || typeof approval.approval_sha256 !== 'string') return { ok: false, code: 'APPROVAL_REQUIRED' };
+
+  const fetchImpl = input?.fetchImpl ?? globalThis.fetch;
+  const timeoutMs = Number.isInteger(input?.timeoutMs) ? input.timeoutMs : 60_000;
+  const signalOf = () => (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function' ? AbortSignal.timeout(timeoutMs) : undefined);
+  const headers = { authorization: `Bearer ${token}`, 'content-type': 'application/json', accept: 'application/json' };
+
+  const capabilities = await readRelayCapabilities({ rabbitUrl, fetchImpl, timeoutMs });
+  const negotiation = negotiateFeatures(capabilities);
+  if (negotiation.ok !== true) {
+    return { ok: false, code: negotiation.code ?? 'RELAY_CAPABILITIES_MISSING', detail: { missing: negotiation.missing ?? null, relay: rabbitUrl } };
+  }
+
+  const tasks = [];
+  for (const step of plan.steps) {
+    const body = {
+      mode: 'broadcast',
+      executor_machine_id: step.machine_id,
+      command_argv: step.command_argv,
+      command_hash: step.command_hash,
+      base_commit: plan.base_commit,
+      plan_sha256: plan.plan_sha256,
+      approval_sha256: approval.approval_sha256,
+      step_id: step.step_id,
+      ...(step.timeout_ms === undefined ? {} : { timeout_ms: step.timeout_ms }),
+      ...(input?.includeOffline === false ? {} : { include_offline: true }),
+    };
+    let response;
+    try {
+      response = await fetchImpl(`${rabbitUrl}/v1/task`, { method: 'POST', headers, body: JSON.stringify(body), signal: signalOf() });
+    } catch (error) {
+      return { ok: false, code: 'RELAY_UNREACHABLE', detail: error instanceof Error ? error.message : String(error) };
+    }
+    const doc = await response.json().catch(() => null);
+    if (response.ok !== true) {
+      return { ok: false, code: doc?.error?.code ?? 'RELAY_REFUSED', status: response.status, detail: doc?.error ?? doc };
+    }
+    const taskId = doc?.task_id ?? doc?.task?.task_id ?? null;
+    const leases = Array.isArray(doc?.leases) ? doc.leases : [];
+    const foreign = leases.filter((lease) => lease?.state !== 'observing' && lease?.machine_id !== step.machine_id);
+    if (foreign.length > 0) {
+      if (taskId !== null) {
+        try {
+          await fetchImpl(`${rabbitUrl}/v1/tasks/${encodeURIComponent(taskId)}/cancel`, {
+            method: 'POST', headers, body: JSON.stringify({ reason: 'SELECTION_NOT_HONOURED' }), signal: signalOf(),
+          });
+        } catch { /* the refusal below is still the answer */ }
+      }
+      return {
+        ok: false,
+        code: 'SELECTION_NOT_HONOURED',
+        detail: { step_id: step.step_id, named: step.machine_id, leased: foreign.map((lease) => lease.machine_id), task_id: taskId },
+        tasks,
+      };
+    }
+    tasks.push({
+      step_id: step.step_id,
+      task_id: taskId,
+      leases: leases.map((lease) => ({ machine_id: lease?.machine_id ?? null, state: lease?.state ?? null })),
+    });
+  }
+  return { ok: true, relay_version: capabilities.relay_version ?? null, features: capabilities.features ?? null, tasks };
+}

package/src/plugin/operator-key.mjs

@@ -0,0 +1,73 @@
+/**
+ * Operator Ed25519 key (v2 decisions 1 & 2).
+ *
+ * The key is generated once, stored as a 0600 PKCS#8 PEM under `~/.w2m/operator-key.pem`
+ * (`W2M_OPERATOR_KEY_FILE` overrides), and used to sign plan approvals. The public key travels
+ * with the approval; the private key never leaves this machine and is never logged.
+ */
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+export function operatorKeyPath(env = process.env) {
+  const explicit = typeof env.W2M_OPERATOR_KEY_FILE === 'string' ? env.W2M_OPERATOR_KEY_FILE.trim() : '';
+  if (explicit !== '') return explicit;
+  return join(homedir(), '.w2m', 'operator-key.pem');
+}
+
+export function keyIdOf(publicKeyPem) {
+  return createHash('sha256').update(publicKeyPem, 'utf8').digest('hex').slice(0, 16);
+}
+
+/** The exact bytes that are signed: the approval body without its signature fields. */
+export function approvalPayloadOf(body) {
+  const { sig, approval_sha256: _ignored, operator_key: _key, ...rest } = body ?? {};
+  return Buffer.from(JSON.stringify(rest), 'utf8');
+}
+
+export function signApprovalPayload(body, privateKey) {
+  return sign(null, approvalPayloadOf(body), privateKey).toString('base64');
+}
+
+export function verifyApprovalPayload(body, signatureBase64, publicKeyPem) {
+  try {
+    const key = createPublicKey(publicKeyPem);
+    return verify(null, approvalPayloadOf(body), key, Buffer.from(String(signatureBase64), 'base64'));
+  } catch { return false; }
+}
+
+/** Load the existing key, or create one and write it 0600. */
+export function ensureOperatorKey(options = {}) {
+  const env = options.env ?? process.env;
+  const path = options.path ?? operatorKeyPath(env);
+  if (existsSync(path)) {
+    const loaded = loadOperatorKey({ path });
+    return loaded.ok === true ? { ...loaded, created: false } : loaded;
+  }
+  try {
+    const { privateKey } = generateKeyPairSync('ed25519');
+    const pem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, pem, { encoding: 'utf8', mode: 0o600 });
+    try { chmodSync(path, 0o600); } catch { /* Windows ACL */ }
+    const loaded = loadOperatorKey({ path });
+    return loaded.ok === true ? { ...loaded, created: true } : loaded;
+  } catch (error) {
+    return { ok: false, code: 'OPERATOR_KEY_CREATE_FAILED', detail: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+export function loadOperatorKey(options = {}) {
+  const env = options.env ?? process.env;
+  const path = options.path ?? operatorKeyPath(env);
+  if (!existsSync(path)) return { ok: false, code: 'OPERATOR_KEY_MISSING', path };
+  try {
+    const pem = readFileSync(path, 'utf8');
+    const privateKey = createPrivateKey(pem);
+    const publicKeyPem = createPublicKey(privateKey).export({ type: 'spki', format: 'pem' });
+    return { ok: true, path, privateKey, publicKeyPem, key_id: keyIdOf(publicKeyPem) };
+  } catch (error) {
+    return { ok: false, code: 'OPERATOR_KEY_UNREADABLE', path, detail: error instanceof Error ? error.message : String(error) };
+  }
+}

package/src/plugin/operator-token-route.mjs

@@ -0,0 +1,71 @@
+/**
+ * `/api/w2m/operator-token` (v2 S0-1): the settings-page half of the secure token setup.
+ *
+ * Wire:
+ *   GET  /api/w2m/operator-token -> { ok, configured, source, fingerprint, path }
+ *   POST /api/w2m/operator-token { token } -> { ok, configured: true, source: 'file', fingerprint, path }
+ *
+ * The token value is written straight into the 0600 file and never echoed back: the response carries
+ * only a fingerprint, so the page can confirm "configured" without the secret ever entering a log,
+ * a transcript or the DOM's value after the save.
+ */
+import { fingerprintOf, readOperatorToken, writeOperatorToken } from './operator-token.mjs';
+
+export const OPERATOR_TOKEN_ROUTE_PATH = '/api/w2m/operator-token';
+const NO_STORE = { 'cache-control': 'no-store' };
+
+/**
+ * @param {object} ctx Cordis context
+ * @param {{path?: () => string|null, configuredToken?: () => string|null}} [deps]
+ */
+export function registerOperatorTokenRoute(ctx, deps = {}) {
+  const status = { mounted: false, reason: 'the host has no Connection service' };
+  if (typeof ctx?.inject !== 'function') return status;
+  ctx.inject(['connection'], (webCtx) => {
+    const registry = webCtx?.connection?.fetch;
+    if (registry === undefined || typeof registry.register !== 'function') {
+      status.reason = 'the connection service carries no fetch registry';
+      return;
+    }
+    const pathOf = () => {
+      const configured = typeof deps?.path === 'function' ? deps.path() : null;
+      return typeof configured === 'string' && configured !== '' ? configured : undefined;
+    };
+    registry.register({
+      path: OPERATOR_TOKEN_ROUTE_PATH,
+      methods: ['GET', 'POST'],
+      requestBody: 'buffered',
+      fetch: async (request) => {
+        if (request.method === 'GET') {
+          const path = pathOf();
+          const read = path === undefined ? readOperatorToken() : readOperatorToken({ path });
+          const configuredToken = typeof deps?.configuredToken === 'function' ? deps.configuredToken() : null;
+          const fromFile = read.configured === true;
+          const source = fromFile ? 'file' : (typeof configuredToken === 'string' && configuredToken !== '' ? 'config-or-env' : null);
+          return Response.json({
+            ok: true,
+            configured: fromFile || source !== null,
+            source,
+            fingerprint: fromFile ? read.fingerprint : (source === null ? null : fingerprintOf(configuredToken)),
+            path: read.path ?? path ?? null,
+          }, { headers: NO_STORE });
+        }
+        let body = null;
+        try { body = await request.json(); } catch { /* refused below */ }
+        const token = typeof body?.token === 'string' ? body.token : '';
+        if (token.trim() === '') {
+          return Response.json({ ok: false, code: 'OPERATOR_TOKEN_REQUIRED' }, { status: 400, headers: NO_STORE });
+        }
+        const path = pathOf();
+        const written = path === undefined ? writeOperatorToken(token) : writeOperatorToken(token, { path });
+        if (written.ok !== true) {
+          return Response.json({ ok: false, code: written.code, detail: written.detail ?? null }, { status: 400, headers: NO_STORE });
+        }
+        return Response.json({ ok: true, configured: true, source: 'file', fingerprint: written.fingerprint, path: written.path }, { headers: NO_STORE });
+      },
+    });
+    status.mounted = true;
+    status.reason = null;
+  });
+  return status;
+}

package/src/plugin/relay-capabilities.mjs

@@ -0,0 +1,66 @@
+/**
+ * Relay capability negotiation (v2 G0-2).
+ *
+ * A joint-dev dispatch names machines on the wire and expects the relay to honour
+ * `target_machines`/`executor_machine_id`. An older relay silently ignores those fields, which
+ * widens an intended single-machine dispatch to the whole online fleet. The dispatcher therefore
+ * reads the relay's advertised features first and refuses when a required feature is missing.
+ *
+ * A relay with no `features` field at all is older than this protocol: callers decide policy
+ * (joint-dev refuses; ordinary dispatch keeps its post-dispatch lease check).
+ */
+
+/** Features a joint-dev dispatch requires from the relay. */
+export const JOINT_REQUIRED_FEATURES = Object.freeze(['target-machines', 'result-projection']);
+
+/**
+ * Read `/healthz` and normalise the capability fields.
+ *
+ * @param {{rabbitUrl: string, fetchImpl?: Function, timeoutMs?: number}} input
+ * @returns {Promise<{ok: boolean, relay_version?: string|null, features?: string[]|null, protocol_version?: number|null, error?: string}>}
+ */
+export async function readRelayCapabilities(input) {
+  const base = typeof input?.rabbitUrl === 'string' ? input.rabbitUrl.replace(/\/$/, '') : '';
+  if (base === '') return { ok: false, error: 'rabbitUrl is required' };
+  const fetchImpl = input?.fetchImpl ?? globalThis.fetch;
+  const timeoutMs = Number.isInteger(input?.timeoutMs) ? input.timeoutMs : 15_000;
+  try {
+    const response = await fetchImpl(`${base}/healthz`, {
+      headers: { accept: 'application/json' },
+      signal: typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function' ? AbortSignal.timeout(timeoutMs) : undefined,
+    });
+    if (response?.ok !== true) return { ok: false, error: `healthz answered HTTP ${response?.status ?? '?'}` };
+    const doc = await response.json();
+    const features = Array.isArray(doc?.features) ? doc.features.filter((entry) => typeof entry === 'string') : null;
+    return {
+      ok: true,
+      relay_version: typeof doc?.relay_version === 'string' ? doc.relay_version : (typeof doc?.version === 'string' ? doc.version : null),
+      features,
+      protocol_version: Number.isInteger(doc?.protocol_version) ? doc.protocol_version : null,
+      operator_token_required: doc?.operator_token_required === true,
+    };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+/**
+ * Decide whether the advertised capabilities satisfy a required set.
+ *
+ * @param {{features?: string[]|null}|null} capabilities
+ * @param {string[]} [required]
+ * @returns {{ok: boolean, code?: string, missing?: string[], unknown?: boolean}}
+ */
+export function negotiateFeatures(capabilities, required = JOINT_REQUIRED_FEATURES) {
+  if (capabilities === null || capabilities?.ok !== true) {
+    return { ok: false, code: 'RELAY_CAPABILITIES_UNAVAILABLE', unknown: true };
+  }
+  const features = capabilities.features;
+  if (!Array.isArray(features)) {
+    // No advertisement at all: an older relay. Callers that need the fields must not guess.
+    return { ok: false, code: 'RELAY_CAPABILITIES_MISSING', missing: [...required], unknown: true };
+  }
+  const missing = required.filter((feature) => !features.includes(feature));
+  if (missing.length > 0) return { ok: false, code: 'RELAY_CAPABILITIES_MISSING', missing, unknown: false };
+  return { ok: true };
+}

package/src/plugin/tools.mjs

@@ -191,6 +191,7 @@ import {
 import { registerChatRoutes } from './fleet-chat-route.mjs';
 import { registerExecCapabilityRoutes } from './exec-capability-route.mjs';
 import { registerPluginUpdateRoutes } from './update-route.mjs';
+import { registerOperatorTokenRoute } from './operator-token-route.mjs';
 import { fingerprintOf, readOperatorToken } from './operator-token.mjs';
 import { registerCaptureRoutes } from './capture-route.mjs';
 import { defaultExecCapabilityFile } from '../util/exec-capability.mjs';
@@ -284,7 +285,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.9.15';
+const PLUGIN_VERSION = '1.9.17';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -3583,6 +3584,7 @@ export async function apply(ctx, config = {}) {
   // v1.6.8: the plugin panel's "更新" button: GET checks npm latest, POST installs through the
   // verified updater (SHA-256 checked, old package backed up, restart required afterwards).
   const _updateRoutes = registerPluginUpdateRoutes(ctx, { profileDir: () => cfg.profileDir });
+    const _operatorTokenRoute = registerOperatorTokenRoute(ctx, { configuredToken: () => cfg.operatorToken });
 
   // v1.7.1: host-side screenshot + clipboard fallbacks. The DSH desktop shell does not grant the
   // renderer getDisplayMedia/navigator.clipboard, so the chat panel needs a host route that does not
@@ -4896,6 +4898,8 @@ const result = await request({
             protocol_version: health.protocol_version ?? null,
             error: probe.ok ? null : (probe.error?.code ?? `HTTP ${probe.status}`),
             relay_id: health.relay_id ?? null,
+            relay_version: health.relay_version ?? health.version ?? null,
+            features: Array.isArray(health.features) ? health.features : null,
             uptime_ms: typeof health.uptime_ms === 'number' ? health.uptime_ms : null,
             started_at: health.started_at ?? null,
             base_path: health.base_path ?? null,
@@ -4906,7 +4910,7 @@ const result = await request({
             persistence: health.persistence ?? null,
             // Which of the §4 fields this relay actually sent. A v1 relay sends none of them, and a
             // reader should be able to tell "field absent" from "field false".
-            diagnostics_present: ['relay_id', 'uptime_ms', 'base_path', 'effective_scheme', 'operator_token_required']
+            diagnostics_present: ['relay_id', 'uptime_ms', 'base_path', 'effective_scheme', 'operator_token_required', 'relay_version', 'features']
               .filter((key) => health[key] !== undefined && health[key] !== null),
           };
         } catch (error) {