@twinsearth/w2m-dsh-plugin 1.9.16 → 1.9.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.9.16",
+  "version": "1.9.19",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {
@@ -64,7 +64,7 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs test/gpw-colors.test.mjs test/gpw-recent-fold.test.mjs test/gpw-auto-approve.test.mjs test/data-plane.test.mjs test/sealed-object.test.mjs test/joint-dev-dispatch.test.mjs test/joint-dev-loop.test.mjs test/joint-dev-audit.test.mjs test/joint-dev-redline.test.mjs test/relay-redline-guard.test.mjs test/relay-p0-projection.test.mjs test/guarded-dispatch.test.mjs test/p0-single-matcher.test.mjs test/path-policy.test.mjs test/path-policy-fs.test.mjs test/gpw-inheritance-table.test.mjs test/gpw-policy-adapter.test.mjs test/target-policy.test.mjs test/relay-redline-audit.test.mjs test/relay-repair-ledger.test.mjs test/relay-purge-blobs.test.mjs test/relay-scrub.test.mjs test/joint-dev-plan-store.test.mjs test/relay-basepath-blobs.test.mjs test/operator-token.test.mjs test/relay-health-capabilities.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs test/gpw-colors.test.mjs test/gpw-recent-fold.test.mjs test/gpw-auto-approve.test.mjs test/data-plane.test.mjs test/sealed-object.test.mjs test/joint-dev-dispatch.test.mjs test/joint-dev-loop.test.mjs test/joint-dev-audit.test.mjs test/joint-dev-redline.test.mjs test/relay-redline-guard.test.mjs test/relay-p0-projection.test.mjs test/guarded-dispatch.test.mjs test/p0-single-matcher.test.mjs test/path-policy.test.mjs test/path-policy-fs.test.mjs test/gpw-inheritance-table.test.mjs test/gpw-policy-adapter.test.mjs test/target-policy.test.mjs test/relay-redline-audit.test.mjs test/relay-repair-ledger.test.mjs test/relay-purge-blobs.test.mjs test/relay-scrub.test.mjs test/joint-dev-plan-store.test.mjs test/relay-basepath-blobs.test.mjs test/operator-token.test.mjs test/relay-health-capabilities.test.mjs test/joint-relay-dispatch.test.mjs test/operator-token-route.test.mjs test/relay-scrub-task-projection.test.mjs test/operator-key-approval.test.mjs test/relay-offer-journal.test.mjs test/joint-r5-wiring.test.mjs test/p1-hardening.test.mjs test/joint-merge-engine.test.mjs test/artifact-ref-dir-sink.test.mjs test/chat-sticker-guard.test.mjs test/relay-task-progress.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:account-join": "node --test --test-force-exit test/account-join.test.mjs",
@@ -208,7 +208,8 @@
     "w2m-hidden-task": "bin/w2m-hidden-task.mjs",
     "w2m-self-update": "bin/w2m-self-update.mjs",
     "w2m-joint": "bin/w2m-joint.mjs",
-    "w2m-operator": "bin/w2m-operator.mjs"
+    "w2m-operator": "bin/w2m-operator.mjs",
+    "w2m-scrub": "bin/w2m-scrub.mjs"
   },
   "disclosure": {
     "cloud": true,

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.9.16",
+  "version": "1.9.19",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/agent/agent.mjs

@@ -23,7 +23,7 @@
 
 import { Readable } from 'node:stream';
 import { access, constants as fsConstants } from 'node:fs/promises';
-import { existsSync, mkdirSync, mkdtempSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { commitTaskChanges, createWorktree, listChangedFiles, producePatch, removeWorktree } from './worktree.mjs';
 import { describePatchArtifact } from './patch-artifact.mjs';
@@ -31,6 +31,7 @@ import { ferryMaintenance, maintenancePaths } from './maintenance-ferry.mjs';
 import { authorizeWithGrant } from './grant-gate.mjs';
 import { tmpdir } from 'node:os';
 import { randomUUID , sign as signBytes } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
 
 import {
   EMPTY_SHA256,
@@ -2122,6 +2123,10 @@ export function createAgent(options) {
       python: caps.python ?? null,
       npm: caps.npm ?? null,
       git,
+      plugin_version: (() => {
+        try { return JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'package.json'), 'utf8')).version ?? null; } catch { return null; }
+      })(),
+      joint_dev: 'v2',
     };
     return toolchainCache;
   }

package/src/agent/sinks/dir-sink.mjs

@@ -1,33 +1,79 @@
 /**
- * 目录 sink（本地/局域网共享盘）：密封对象落盘、按内容哈希取回。
- * 数据面适配器的最小实现；git/ssh 适配器同契约，后续补。
- * 对象已经是 sealObject() 的密文，sink 不接触明文与密钥。
+ * 目录 sink（本地/局域网共享盘）：ArtifactRef v1 的对象落盘与取回。
+ *
+ * 对象已经是调用方封装好的密文字节，sink 不接触明文与密钥。写入是原子的
+ * （tmp → fsync → rename，0600），取回时校验对象 id 形状与期望的 cipher sha256。
  */
 import { createHash } from 'node:crypto';
-import { mkdirSync, readFileSync, writeFileSync, existsSync, readdirSync } from 'node:fs';
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, unlinkSync, writeSync } from 'node:fs';
 import { join } from 'node:path';
 
+const OBJECT_ID = /^[0-9a-f]{32,64}$/;
+const sha256 = (buf) => createHash('sha256').update(buf).digest('hex');
+
 export function createDirSink({ root }) {
   if (typeof root !== 'string' || root === '') throw new Error('SINK_ROOT_REQUIRED');
   mkdirSync(root, { recursive: true });
+
+  const pathOf = (objectId) => join(root, objectId + '.json');
+
+  /** Write the sealed object bytes atomically under `<objectId>.json`. */
+  async function writeObject({ objectId, body, expectSha256 = null }) {
+    if (typeof objectId !== 'string' || !OBJECT_ID.test(objectId)) return { ok: false, code: 'OBJECT_ID_INVALID' };
+    const bytes = Buffer.isBuffer(body) ? body : Buffer.from(typeof body === 'string' ? body : JSON.stringify(body), 'utf8');
+    const actual = sha256(bytes);
+    if (typeof expectSha256 === 'string' && expectSha256 !== '' && expectSha256 !== actual) {
+      return { ok: false, code: 'OBJECT_HASH_MISMATCH', detail: { expected: expectSha256, actual } };
+    }
+    const path = pathOf(objectId);
+    const tmp = path + '.tmp-' + process.pid + '-' + Date.now().toString(36);
+    const fd = openSync(tmp, 'w', 0o600);
+    try {
+      writeSync(fd, bytes);
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    renameSync(tmp, path);
+    return { ok: true, objectId, path, rel_path: objectId + '.json', sha256: actual, bytes: bytes.length };
+  }
+
+  /** Read the object bytes back and verify the expected cipher sha256. */
+  async function readObject({ objectId, expectSha256 = null }) {
+    if (typeof objectId !== 'string' || !OBJECT_ID.test(objectId)) return { ok: false, code: 'OBJECT_ID_INVALID' };
+    const path = pathOf(objectId);
+    if (!existsSync(path)) return { ok: false, code: 'OBJECT_NOT_FOUND' };
+    let bytes;
+    try { bytes = readFileSync(path); } catch { return { ok: false, code: 'OBJECT_UNREADABLE' }; }
+    const actual = sha256(bytes);
+    if (typeof expectSha256 === 'string' && expectSha256 !== '' && expectSha256 !== actual) {
+      return { ok: false, code: 'OBJECT_HASH_MISMATCH', detail: { expected: expectSha256, actual } };
+    }
+    return { ok: true, objectId, path, sha256: actual, bytes };
+  }
+
   return {
     kind: 'dir',
+    writeObject,
+    readObject,
+    // Backwards-compatible adapters for the pre-v2 callers: the object id is derived from the body.
     async pushObject({ sealed }) {
       if (sealed === null || typeof sealed !== 'object') return { ok: false, code: 'OBJECT_INVALID' };
       const body = JSON.stringify(sealed);
-      const id = createHash('sha256').update(body, 'utf8').digest('hex');
-      const path = join(root, id + '.json');
-      writeFileSync(path, body, { encoding: 'utf8', mode: 0o600 });
-      return { ok: true, objectId: id, path, bytes: Buffer.byteLength(body, 'utf8') };
+      const id = createHash('sha256').update(body, 'utf8').digest('hex').slice(0, 32);
+      const written = await writeObject({ objectId: id, body });
+      return written.ok === true ? { ok: true, objectId: id, path: written.path, bytes: written.bytes } : written;
     },
     async fetchObject({ objectId }) {
-      if (typeof objectId !== 'string' || !/^[0-9a-f]{64}$/.test(objectId)) return { ok: false, code: 'OBJECT_ID_INVALID' };
-      const path = join(root, objectId + '.json');
-      if (!existsSync(path)) return { ok: false, code: 'OBJECT_NOT_FOUND' };
-      return { ok: true, sealed: JSON.parse(readFileSync(path, 'utf8')), path };
+      const read = await readObject({ objectId });
+      if (read.ok !== true) return read;
+      try { return { ok: true, sealed: JSON.parse(read.bytes.toString('utf8')), path: read.path }; } catch { return { ok: false, code: 'OBJECT_UNREADABLE' }; }
     },
     async listObjects() {
-      return readdirSync(root).filter((name) => name.endsWith('.json')).map((name) => name.replace(/\.json$/, ''));
+      return readdirSync(root).filter((name) => name.endsWith('.json') && OBJECT_ID.test(name.slice(0, -5))).map((name) => name.slice(0, -5));
+    },
+    removeObject(objectId) {
+      try { unlinkSync(pathOf(objectId)); return { ok: true }; } catch { return { ok: false, code: 'OBJECT_NOT_FOUND' }; }
     },
   };
 }

package/src/plugin/fleet-chat-route.mjs

@@ -156,6 +156,12 @@ export function registerChatRoutes(ctx, deps) {
    * The session files are never written and nothing is injected into DSH: the transcript is read, the user's messages
    * are extracted, and only the new ones are published. A failure here must not disturb the panel or the route.
    */
+  const MIRROR_MAX_BYTES = 3500;
+  const truncateUtf8 = (value, max) => {
+    const bytes = Buffer.from(value, 'utf8');
+    if (bytes.length <= max) return value;
+    return bytes.subarray(0, max).toString('utf8').replace(/\uFFFD+$/, '') + ' …(已截断)';
+  };
   const mirrorOnce = async () => {
     const identity = await identityOf();
     if (identity.conversationKey === null) return;
@@ -165,7 +171,7 @@ export function registerChatRoutes(ctx, deps) {
     try { messages = extractUserMessages(decodeTranscript(readFileSync(file))); } catch { return; }
     for (const payload of sync.pending(messages)) {
       await postToRelay(identity, {
-        text: payload.text,
+        text: truncateUtf8(payload.text, MIRROR_MAX_BYTES),
         machine_id: identity.machineId,
         machine_name: identity.machineName,
         origin: 'session',

package/src/plugin/joint-dev/audit-file.mjs

@@ -2,11 +2,42 @@
  * 红线审计落盘：JSONL + fsync + 哈希链 + 校验。
  * 只接受元数据字段（内容字段直接拒绝），链断裂/篡改可被定位。
  */
-import { closeSync, fsyncSync, openSync, readFileSync, writeSync } from 'node:fs';
+import { closeSync, existsSync, fsyncSync, openSync, readFileSync, statSync, unlinkSync, writeSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 
 export const AUDIT_FORBIDDEN = new Set(['content', 'data', 'file', 'files', 'patch', 'stdout', 'stderr', 'diff', 'blob', 'bytes', 'text', 'base64']);
 
+/** Recursively collect forbidden content keys: a nested payload must not slip past the top level. */
+function contentKeysDeep(value, path = '', hits = []) {
+  if (value === null || typeof value !== 'object') return hits;
+  if (Array.isArray(value)) { value.forEach((entry, index) => contentKeysDeep(entry, path + '[' + index + ']', hits)); return hits; }
+  for (const [key, child] of Object.entries(value)) {
+    const keyPath = path === '' ? key : path + '.' + key;
+    if (AUDIT_FORBIDDEN.has(key.toLowerCase())) hits.push(keyPath);
+    else contentKeysDeep(child, keyPath, hits);
+  }
+  return hits;
+}
+
+const sleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+
+function withLock(file, fn) {
+  const lock = file + '.lock';
+  for (let attempt = 0; attempt < 50; attempt += 1) {
+    try {
+      const fd = openSync(lock, 'wx', 0o600);
+      try { writeSync(fd, String(process.pid)); } finally { closeSync(fd); }
+      try { return fn(); } finally { try { unlinkSync(lock); } catch { /* already gone */ } }
+    } catch (error) {
+      if (error?.code !== 'EEXIST') throw error;
+      try { if (Date.now() - statSync(lock).mtimeMs > 10_000) { unlinkSync(lock); continue; } } catch { /* raced */ }
+      sleep(20);
+    }
+  }
+  return { ok: false, code: 'AUDIT_BUSY' };
+}
+
+
 function stable(value) {
   if (value === null || typeof value !== 'object') return JSON.stringify(value);
   if (Array.isArray(value)) return '[' + value.map(stable).join(',') + ']';
@@ -20,44 +51,46 @@ export function appendAudit(file, event) {
   if (event === null || typeof event !== 'object' || Array.isArray(event)) {
     return { ok: false, code: 'AUDIT_EVENT_INVALID' };
   }
-  const bad = Object.keys(event).filter((key) => AUDIT_FORBIDDEN.has(key.toLowerCase()));
+  const bad = contentKeysDeep(event);
   if (bad.length > 0) return { ok: false, code: 'AUDIT_CONTENT_FORBIDDEN', detail: { keys: bad } };
-
-  let previous = null;
-  let seq = 1;
-  try {
-    const lines = readFileSync(file, 'utf8').split('\n').filter((line) => line.trim() !== '');
-    if (lines.length > 0) {
-      const last = JSON.parse(lines[lines.length - 1]);
-      previous = last.record_sha256 ?? null;
-      seq = Number(last.seq ?? lines.length) + 1;
+  return withLock(file, () => {
+    let previous = null;
+    let seq = 1;
+    if (existsSync(file)) {
+      const lines = readFileSync(file, 'utf8').split('\n').filter((line) => line.trim() !== '');
+      if (lines.length > 0) {
+        // A corrupt tail is refused, never treated as "a new file": resetting the chain hides tampering.
+        let last;
+        try { last = JSON.parse(lines[lines.length - 1]); } catch { return { ok: false, code: 'AUDIT_TAIL_CORRUPT', detail: { line: lines.length } }; }
+        previous = last.record_sha256 ?? null;
+        seq = Number(last.seq ?? lines.length) + 1;
+      }
     }
-  } catch { /* 新文件 */ }
-
-  const body = {
-    v: 1,
-    seq,
-    at: event.at ?? new Date().toISOString(),
-    event: typeof event.event === 'string' ? event.event : 'joint.event',
-    plan_sha256: event.plan_sha256 ?? null,
-    step_id: event.step_id ?? null,
-    task_id: event.task_id ?? null,
-    machine_id: event.machine_id ?? null,
-    outcome: event.outcome ?? null,
-    reason_code: event.reason_code ?? null,
-    control_bytes: Number.isInteger(event.control_bytes) ? event.control_bytes : null,
-    control_sha256: typeof event.control_sha256 === 'string' ? event.control_sha256 : null,
-    prev_sha256: previous,
-  };
-  const record = { ...body, record_sha256: sha256(stable(body)) };
-  const fd = openSync(file, 'a');
-  try {
-    writeSync(fd, JSON.stringify(record) + '\n');
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
-  return { ok: true, record };
+    const body = {
+      v: 1,
+      seq,
+      at: event.at ?? new Date().toISOString(),
+      event: typeof event.event === 'string' ? event.event : 'joint.event',
+      plan_sha256: event.plan_sha256 ?? null,
+      step_id: event.step_id ?? null,
+      task_id: event.task_id ?? null,
+      machine_id: event.machine_id ?? null,
+      outcome: event.outcome ?? null,
+      reason_code: event.reason_code ?? null,
+      control_bytes: Number.isInteger(event.control_bytes) ? event.control_bytes : null,
+      control_sha256: typeof event.control_sha256 === 'string' ? event.control_sha256 : null,
+      prev_sha256: previous,
+    };
+    const record = { ...body, record_sha256: sha256(stable(body)) };
+    const fd = openSync(file, 'a');
+    try {
+      writeSync(fd, JSON.stringify(record) + '\n');
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    return { ok: true, record };
+  });
 }
 
 /** 校验整条链；返回第一处问题的 seq。 */

package/src/plugin/joint-dev/merge-engine.mjs

@@ -0,0 +1,102 @@
+/**
+ * S5 MergeEngine: apply machine patches in order inside an integration worktree.
+ *
+ * Local git only. The engine never touches the target ref: `advanceTarget` is a separate,
+ * compare-and-swap step the operator runs only after the user approves the merged head. A conflict
+ * is a first-class refusal (`MERGE_CONFLICT`) — patches are not auto-resolved and force is never
+ * passed to git.
+ */
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const defaultRunGit = (args, cwd) => execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+
+function assertBaseCommit(repoDir, baseCommit, runGit) {
+  try { runGit(['cat-file', '-e', `${baseCommit}^{commit}`], repoDir); return true; } catch { return false; }
+}
+
+/** @returns {{ok: true, worktree: string, integration_head: string, applied: object[]} | {ok: false, code: string, detail?: object}} */
+export function mergePatches({ repoDir, baseCommit, patches, runGit = defaultRunGit }) {
+  if (typeof repoDir !== 'string' || repoDir === '') return { ok: false, code: 'MERGE_REPO_REQUIRED' };
+  if (typeof baseCommit !== 'string' || !/^[0-9a-f]{7,40}$/.test(baseCommit)) return { ok: false, code: 'MERGE_BASE_INVALID' };
+  if (!Array.isArray(patches) || patches.length === 0) return { ok: false, code: 'MERGE_PATCHES_REQUIRED' };
+  if (assertBaseCommit(repoDir, baseCommit, runGit) !== true) return { ok: false, code: 'MERGE_BASE_MISMATCH', detail: { base_commit: baseCommit } };
+
+  const worktree = mkdtempSync(join(tmpdir(), 'w2m-merge-'));
+  const cleanup = () => {
+    try { runGit(['worktree', 'remove', '--force', worktree], repoDir); } catch { /* already gone */ }
+    try { rmSync(worktree, { recursive: true, force: true }); } catch { /* best effort */ }
+  };
+  try {
+    runGit(['worktree', 'add', '--detach', worktree, baseCommit], repoDir);
+  } catch (error) {
+    cleanup();
+    return { ok: false, code: 'MERGE_WORKTREE_FAILED', detail: { message: error instanceof Error ? error.message : String(error) } };
+  }
+
+  const applied = [];
+  try {
+    for (const patch of patches) {
+      if (typeof patch?.step_id !== 'string' || typeof patch?.patch !== 'string' || patch.patch === '') {
+        cleanup();
+        return { ok: false, code: 'MERGE_PATCH_INVALID', detail: { step_id: patch?.step_id ?? null } };
+      }
+      const file = join(worktree, '.w2m-patch-' + patch.step_id.replace(/[^A-Za-z0-9_-]/g, '_') + '.diff');
+      writeFileSync(file, patch.patch, 'utf8');
+      try {
+        runGit(['apply', '--3way', '--check', file], worktree);
+      } catch {
+        const files = (() => {
+          try { return runGit(['apply', '--check', '--numstat', file], worktree).split('\n').map((line) => line.split('\t').pop()).filter(Boolean); } catch { return []; }
+        })();
+        cleanup();
+        return { ok: false, code: 'MERGE_CONFLICT', detail: { step_id: patch.step_id, machine_id: patch.machine_id ?? null, files } };
+      }
+      try {
+        runGit(['apply', '--3way', file], worktree);
+      } catch {
+        const applyFailed = { step_id: patch.step_id, machine_id: patch.machine_id ?? null };
+        cleanup();
+        return { ok: false, code: 'MERGE_CONFLICT', detail: applyFailed };
+      }
+      runGit(['add', '-A'], worktree);
+      runGit(['commit', '-m', `w2m: ${patch.step_id} (${patch.machine_id ?? 'unknown'})`, '--no-verify'], worktree);
+      applied.push({ step_id: patch.step_id, machine_id: patch.machine_id ?? null });
+    }
+    const integrationHead = runGit(['rev-parse', 'HEAD'], worktree);
+    return { ok: true, worktree, integration_head: integrationHead, applied };
+  } catch (error) {
+    cleanup();
+    return { ok: false, code: 'MERGE_APPLY_FAILED', detail: { message: error instanceof Error ? error.message : String(error) } };
+  }
+}
+
+/** Compare-and-swap the target ref; force is impossible here because update-ref takes the old value. */
+export function advanceTarget({ repoDir, targetRef, expectedOld, newCommit, rollbackRef, runGit = defaultRunGit }) {
+  if (typeof targetRef !== 'string' || !/^refs\/heads\/[\w./-]+$/.test(targetRef)) return { ok: false, code: 'MERGE_TARGET_INVALID' };
+  if (typeof newCommit !== 'string' || !/^[0-9a-f]{7,40}$/.test(newCommit)) return { ok: false, code: 'MERGE_COMMIT_INVALID' };
+  if (typeof expectedOld !== 'string' || !/^[0-9a-f]{7,40}$/.test(expectedOld)) return { ok: false, code: 'MERGE_OLD_REQUIRED' };
+  const current = (() => { try { return runGit(['rev-parse', targetRef], repoDir); } catch { return null; } })();
+  if (current !== expectedOld) return { ok: false, code: 'MERGE_BASE_MISMATCH', detail: { expected: expectedOld, current } };
+  if (typeof rollbackRef === 'string' && rollbackRef !== '') {
+    if (!/^refs\/w2m\/rollback\/[\w./-]+$/.test(rollbackRef)) return { ok: false, code: 'MERGE_ROLLBACK_REF_INVALID' };
+    runGit(['update-ref', rollbackRef, expectedOld], repoDir);
+  }
+  try {
+    runGit(['update-ref', targetRef, newCommit, expectedOld], repoDir);
+  } catch (error) {
+    return { ok: false, code: 'MERGE_CAS_FAILED', detail: { message: error instanceof Error ? error.message : String(error) } };
+  }
+  return { ok: true, target_ref: targetRef, head: newCommit, rollback_ref: typeof rollbackRef === 'string' && rollbackRef !== '' ? rollbackRef : null };
+}
+
+/** Remove an integration worktree (after a merge, a refusal or an abort). */
+export function abortMerge({ repoDir, worktree, runGit = defaultRunGit }) {
+  if (typeof worktree === 'string' && worktree !== '') {
+    try { runGit(['worktree', 'remove', '--force', worktree], repoDir); } catch { /* already gone */ }
+    try { rmSync(worktree, { recursive: true, force: true }); } catch { /* best effort */ }
+  }
+  return { ok: true };
+}