@twinsearth/w2m-dsh-plugin 1.9.20 → 2.0.0

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.9.20"
+    "version": "2.0.0"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.9.20",
+      "version": "2.0.0",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.9.20"
+  "version": "2.0.0"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.9.20",
+  "version": "2.0.0",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,30 @@
 
 All notable changes to this project are documented here.
 
+## [2.0.0] - 2026-10-28
+
+主插件与既有 Relay 的对接按《W2M Relay × ToFuture 外部对接 API v1.2》收敛；ToFuture 子插件按该文档
+§6/§9 保持完全独立（主插件不内嵌、不调用、不代理、不实现其运维/白名单/令牌接口）。
+
+- 能力协商：/healthz 读取 features、operator_token_required、signing.required；缺失
+  target-machines/result-projection 时明确拒绝联合派发；signing.required=true 拒绝（v1 外部客户端不支持强签）；
+  operator_token_required=false 拒绝（生产必须为 true）。
+- 派发：控制消息显式携带 target_machines（API §4.6：发到哪台机器只由它决定），保留
+  executor_machine_id 兼容旧 relay；同 id 派发捕获 409 后读回任务而不是当成成功；
+  200 但无 task_id（依赖被拒）按失败处理；被点名机器租约 refused/expired/cancelled 立即失败。
+- 移除主插件内所有 ToFuture 运维面模块（MAC/IP 白名单 HMAC 上报、relay 侧识别路由），
+  遵守 API v1.2 §9：主插件不得实现、调用或探测运维/白名单/令牌接口。
+- 联合开发（plan/approve/dispatch/merge）仍为实验性：数据面投递与合并接线未随本版交付；
+  relay 部署/升级独立于插件发布，线上 relay 版本以 /healthz 为准。
+
+## [1.9.21] - 2026-10-28
+
+- 发布边界：本版只发主插件；ToFuture 运维子插件由独立私有仓库另行发布，本包不包含安装/下载能力。
+- 保留与 Relay 服务器配套的隐藏上报模块：HMAC 网络标识上报（/v1/tofuture/identify，relay 侧静默比对、只存 HMAC）。
+  该能力默认关闭、不注册工具、不显示 UI；relay 需自行升级后才生效。
+- 删除本机隐藏能力（命令触发、隐藏加密存储、自助下载/安装、票据模型），避免在公共 npm 包中携带未交付的运维面。
+- 沿用 1.9.20 的浮动滚动浮标（⇧3 单击 3 轮 / 长按 3 秒到顶 + ⤒ 一键到顶）与搜索绿字黄底高亮。
+
 ## [1.9.20] - 2026-10-28
 
 - 新增浮动滚动浮标（固定在主工作区右上角，不依赖 slot 布局）：

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.9.20", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@2.0.0", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/acceptance/1.9.21/RELEASE-1921.json

@@ -0,0 +1,21 @@
+{
+  "version": "1.9.21",
+  "case": "RELEASE-1921",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-28T08:19:50.383Z",
+  "executor": "lead",
+  "task_id": "pre-release-1921-1793175590384",
+  "requirement": "v1.9.21 主插件：仅保留与 Relay 配套的 HMAC 上报模块（隐藏、默认关闭），删除本机隐藏能力；不发子插件、不部署 relay",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "scope": "main plugin only; no sub-plugin, no relay deployment",
+      "retained": "src/util/tofuture-hmac.mjs, src/plugin/tofuture/report.mjs, src/relay/tofuture-whitelist.mjs, POST /v1/tofuture/identify",
+      "removed": "command trigger, hidden vault, selfcheck, verify/keygen, agent ticket store, relay ticket store, download route",
+      "tests": "tofuture-s2 4/4, fleet-chat-route 6/6, lint 0 errors"
+    }
+  }
+}

package/docs/acceptance/2.0.0/RELEASE-2000.json

@@ -0,0 +1,22 @@
+{
+  "version": "2.0.0",
+  "case": "RELEASE-2000",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-28T09:27:04.879Z",
+  "executor": "lead",
+  "task_id": "pre-release-2000-1793179624880",
+  "requirement": "v2.0.0：按 Relay×ToFuture API v1.2 收敛主插件对接（能力协商 / target_machines / 409 读回 / 200-refused 失败），并移除主插件内 ToFuture 运维面模块",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "api": "v1.2",
+      "capability": "features + operator_token_required + signing.required",
+      "dispatch": "target_machines explicit; 409 -> GET task; 200 without task_id refused; dead lease fails",
+      "removed": "tofuture report/hmac/whitelist + /v1/tofuture/identify",
+      "tests": "joint-relay-dispatch 4/4, joint suites 28/28, lint 0 errors"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.9.20",
+  "version": "2.0.0",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.9.20",
+  "version": "2.0.0",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/fleet-chat-route.mjs

@@ -23,6 +23,7 @@ import {
 } from './session-watch.mjs';
 import { createSessionSync } from './session-sync.mjs';
 
+
 /**
  * The newest transcript for a cwd, or null. Reads directory listings and stat only -- this module never opens a
  * session file for writing, and \	est/session-readonly.test.mjs\ enforces that.
@@ -42,9 +43,9 @@ function newestTranscript(cwd) {
   return best === null ? null : best.file;
 }
 
-export const CHAT_ROUTE_PATH = '/api/w2m/chat';
-
-/** The light task board the panel shows beside the chat. The relay already answers GET /v1/tasks. */
+export const CHAT_ROUTE_PATH = '/api/w2m/chat';
+
+/** The light task board the panel shows beside the chat. The relay already answers GET /v1/tasks. */
 export const TASKS_ROUTE_PATH = '/api/w2m/tasks';
 export const MAX_SESSION_ID_LENGTH = 200;
 
@@ -105,36 +106,36 @@ export function registerChatRoutes(ctx, deps) {
     };
     return resolved;
   };
-
-  /**
-   * The machine ids this fleet knows, cached for five seconds.
-   *
-   * Only the HOST can check a single recipient: the relay validates the shape of a recipient, not whether a machine
-   * with that id exists. Null means the roster could not be read at all, which is deliberately a different answer from
-   * "no such machine" -- a relay outage must not be reported as a typo in the recipient.
-   */
-  let rosterAtMs = 0;
-  let rosterIds = null;
-  const knownMachineIds = async (signal) => {
-    if (rosterIds !== null && Date.now() - rosterAtMs < 5000) return rosterIds;
-    try {
-      const cfg = deps.cfg();
-      const rabbitUrl = cfg?.rabbitUrl ?? null;
-      if (rabbitUrl === null) return null;
-      const token = await deps.resolveToken();
-      if (typeof token !== 'string' || token === '') return null;
-      const listed = await deps.request({ rabbitUrl, token, method: 'GET', pathname: '/v1/devices', signal });
-      if (listed?.ok !== true) return null;
-      const devices = Array.isArray(listed.json?.devices) ? listed.json.devices : null;
-      if (devices === null) return null;
-      const ids = devices.map((device) => device?.machine_id).filter((id) => typeof id === 'string');
-      rosterIds = ids;
-      rosterAtMs = Date.now();
-      return ids;
-    } catch {
-      return null;
-    }
-  };
+
+  /**
+   * The machine ids this fleet knows, cached for five seconds.
+   *
+   * Only the HOST can check a single recipient: the relay validates the shape of a recipient, not whether a machine
+   * with that id exists. Null means the roster could not be read at all, which is deliberately a different answer from
+   * "no such machine" -- a relay outage must not be reported as a typo in the recipient.
+   */
+  let rosterAtMs = 0;
+  let rosterIds = null;
+  const knownMachineIds = async (signal) => {
+    if (rosterIds !== null && Date.now() - rosterAtMs < 5000) return rosterIds;
+    try {
+      const cfg = deps.cfg();
+      const rabbitUrl = cfg?.rabbitUrl ?? null;
+      if (rabbitUrl === null) return null;
+      const token = await deps.resolveToken();
+      if (typeof token !== 'string' || token === '') return null;
+      const listed = await deps.request({ rabbitUrl, token, method: 'GET', pathname: '/v1/devices', signal });
+      if (listed?.ok !== true) return null;
+      const devices = Array.isArray(listed.json?.devices) ? listed.json.devices : null;
+      if (devices === null) return null;
+      const ids = devices.map((device) => device?.machine_id).filter((id) => typeof id === 'string');
+      rosterIds = ids;
+      rosterAtMs = Date.now();
+      return ids;
+    } catch {
+      return null;
+    }
+  };
 
   /** Post one batch into the relay using the machine's device token, exactly as the browser route does. */
   const postToRelay = async (identity, payload) => {
@@ -156,12 +157,12 @@ export function registerChatRoutes(ctx, deps) {
    * The session files are never written and nothing is injected into DSH: the transcript is read, the user's messages
    * are extracted, and only the new ones are published. A failure here must not disturb the panel or the route.
    */
-  const MIRROR_MAX_BYTES = 3500;
-  const truncateUtf8 = (value, max) => {
-    const bytes = Buffer.from(value, 'utf8');
-    if (bytes.length <= max) return value;
-    return bytes.subarray(0, max).toString('utf8').replace(/\uFFFD+$/, '') + ' …(已截断)';
-  };
+  const MIRROR_MAX_BYTES = 3500;
+  const truncateUtf8 = (value, max) => {
+    const bytes = Buffer.from(value, 'utf8');
+    if (bytes.length <= max) return value;
+    return bytes.subarray(0, max).toString('utf8').replace(/\uFFFD+$/, '') + ' …(已截断)';
+  };
   const mirrorOnce = async () => {
     const identity = await identityOf();
     if (identity.conversationKey === null) return;
@@ -271,16 +272,16 @@ export function registerChatRoutes(ctx, deps) {
               }
               return Response.json({ ...listed.json, ok: true, local_machine_id: identity.machineId, local_machine_name: identity.machineName, conversation_key: sessionId, conversation_source: identity.source }, { headers: NO_STORE });
             }
-            // Addressing (v1.2.2): a single recipient must exist in THIS fleet.
-            if (typeof addressing.to === 'string' && addressing.to !== 'all') {
-              const roster = await knownMachineIds(request.signal);
-              if (roster === null) {
-                return refuse(503, 'CHAT_ROSTER_UNAVAILABLE', 'the machine roster could not be read', 'a recipient cannot be checked without the relay roster');
-              }
-              if (!roster.includes(addressing.to)) {
-                return refuse(400, 'CHAT_UNKNOWN_RECIPIENT', 'no machine with that id is in this fleet', 'send all, or a machine_id listed by w2m_devices');
-              }
-            }
+            // Addressing (v1.2.2): a single recipient must exist in THIS fleet.
+            if (typeof addressing.to === 'string' && addressing.to !== 'all') {
+              const roster = await knownMachineIds(request.signal);
+              if (roster === null) {
+                return refuse(503, 'CHAT_ROSTER_UNAVAILABLE', 'the machine roster could not be read', 'a recipient cannot be checked without the relay roster');
+              }
+              if (!roster.includes(addressing.to)) {
+                return refuse(400, 'CHAT_UNKNOWN_RECIPIENT', 'no machine with that id is in this fleet', 'send all, or a machine_id listed by w2m_devices');
+              }
+            }
             const posted = await deps.request({ rabbitUrl, token, method: 'POST', pathname: '/v1/fleet/messages', body: { session_id: sessionId, text: text ?? '', machine_id: identity.machineId, machine_name: identity.machineName, origin: 'chat', ...addressing }, signal: request.signal });
             if (posted?.ok !== true) {
               const code = posted?.json?.error?.code ?? posted?.error?.code ?? 'CHAT_SEND_REFUSED';
@@ -293,48 +294,48 @@ export function registerChatRoutes(ctx, deps) {
           }
         },
       });
-      // A light task board. The relay answers GET /v1/tasks; this proxy exists so the panel can read it with the device
-      // token that never leaves the host.
-      registry.register({
-        path: TASKS_ROUTE_PATH,
-        methods: ['GET'],
-        requestBody: 'buffered',
-        fetch: async (request) => {
-          const refuse = (httpStatus, reasonCode, error, detail) =>
-            Response.json({ ok: false, error, reason_code: reasonCode, detail }, { status: httpStatus, headers: NO_STORE });
-          if (request.method !== 'GET') {
-            return refuse(405, 'TASKS_METHOD_NOT_ALLOWED', `${request.method} is not answered here`, 'GET only');
-          }
-          const url = new URL(request.url);
-          const limitRaw = url.searchParams.get('limit');
-          const limit = limitRaw !== null && /^[0-9]+$/.test(limitRaw) ? Math.min(Number(limitRaw), 50) : 20;
-          const cfg = deps.cfg();
-          const rabbitUrl = cfg?.rabbitUrl ?? null;
-          if (rabbitUrl === null) return refuse(503, 'TASKS_NO_RELAY', 'no relay is configured', 'set rabbitUrl in the profile patch');
-          let token;
-          try {
-            token = await deps.resolveToken();
-          } catch (error) {
-            return refuse(503, 'TASKS_UNPAIRED', `this machine has no device token: ${error instanceof Error ? error.message : String(error)}`, 'pair the machine first');
-          }
-          if (typeof token !== 'string' || token === '') {
-            return refuse(503, 'TASKS_UNPAIRED', 'this machine has no device token', 'pair the machine first');
-          }
-          try {
-            const listed = await deps.request({
-              rabbitUrl, token, method: 'GET', pathname: '/v1/tasks', query: { limit: String(limit) }, signal: request.signal,
-            });
-            if (listed?.ok !== true) {
-              const code = listed?.json?.error?.code ?? 'TASKS_LIST_REFUSED';
-              return refuse(502, code, `the relay answered HTTP ${listed?.status ?? 0}`, 'the relay must run a version with /v1/tasks');
-            }
-            return Response.json({ ...listed.json, ok: true }, { headers: NO_STORE });
-          } catch (error) {
-            return refuse(502, 'TASKS_RELAY_ERROR', `the relay call failed: ${error instanceof Error ? error.message : String(error)}`, null);
-          }
-        },
-      });
-
+      // A light task board. The relay answers GET /v1/tasks; this proxy exists so the panel can read it with the device
+      // token that never leaves the host.
+      registry.register({
+        path: TASKS_ROUTE_PATH,
+        methods: ['GET'],
+        requestBody: 'buffered',
+        fetch: async (request) => {
+          const refuse = (httpStatus, reasonCode, error, detail) =>
+            Response.json({ ok: false, error, reason_code: reasonCode, detail }, { status: httpStatus, headers: NO_STORE });
+          if (request.method !== 'GET') {
+            return refuse(405, 'TASKS_METHOD_NOT_ALLOWED', `${request.method} is not answered here`, 'GET only');
+          }
+          const url = new URL(request.url);
+          const limitRaw = url.searchParams.get('limit');
+          const limit = limitRaw !== null && /^[0-9]+$/.test(limitRaw) ? Math.min(Number(limitRaw), 50) : 20;
+          const cfg = deps.cfg();
+          const rabbitUrl = cfg?.rabbitUrl ?? null;
+          if (rabbitUrl === null) return refuse(503, 'TASKS_NO_RELAY', 'no relay is configured', 'set rabbitUrl in the profile patch');
+          let token;
+          try {
+            token = await deps.resolveToken();
+          } catch (error) {
+            return refuse(503, 'TASKS_UNPAIRED', `this machine has no device token: ${error instanceof Error ? error.message : String(error)}`, 'pair the machine first');
+          }
+          if (typeof token !== 'string' || token === '') {
+            return refuse(503, 'TASKS_UNPAIRED', 'this machine has no device token', 'pair the machine first');
+          }
+          try {
+            const listed = await deps.request({
+              rabbitUrl, token, method: 'GET', pathname: '/v1/tasks', query: { limit: String(limit) }, signal: request.signal,
+            });
+            if (listed?.ok !== true) {
+              const code = listed?.json?.error?.code ?? 'TASKS_LIST_REFUSED';
+              return refuse(502, code, `the relay answered HTTP ${listed?.status ?? 0}`, 'the relay must run a version with /v1/tasks');
+            }
+            return Response.json({ ...listed.json, ok: true }, { headers: NO_STORE });
+          } catch (error) {
+            return refuse(502, 'TASKS_RELAY_ERROR', `the relay call failed: ${error instanceof Error ? error.message : String(error)}`, null);
+          }
+        },
+      });
+
       status.mounted = true;
       status.reason = null;
       const timer = setInterval(() => { mirrorOnce().catch(() => { /* one bad tick must not stop the next */ }); }, 2000);

package/src/plugin/joint-dev/relay-dispatch.mjs

@@ -93,6 +93,9 @@ export async function dispatchPlanToRelay(input) {
   }
 
   const capabilities = await readRelayCapabilities({ rabbitUrl, fetchImpl, timeoutMs });
+  if (capabilities.ok !== true) return { ok: false, code: 'RELAY_CAPABILITIES_UNAVAILABLE', detail: { relay: rabbitUrl, error: capabilities.error ?? null } };
+  if (capabilities.signing_required === true) return { ok: false, code: 'RELAY_SIGNING_REQUIRED', detail: { relay: rabbitUrl } };
+  if (capabilities.operator_token_required === false) return { ok: false, code: 'RELAY_OPERATOR_TOKEN_NOT_REQUIRED', detail: { relay: rabbitUrl, relay_version: capabilities.relay_version ?? null } };
   const negotiation = negotiateFeatures(capabilities);
   if (negotiation.ok !== true) {
     return { ok: false, code: negotiation.code ?? 'RELAY_CAPABILITIES_MISSING', detail: { missing: negotiation.missing ?? null, relay: rabbitUrl } };
@@ -106,6 +109,7 @@ export async function dispatchPlanToRelay(input) {
     const body = {
       task_id: taskId,
       mode: 'broadcast',
+      target_machines: [step.machine_id],
       executor_machine_id: step.machine_id,
       command_argv: step.command_argv,
       command_hash: step.command_hash,
@@ -132,18 +136,43 @@ export async function dispatchPlanToRelay(input) {
     }
     const doc = await response.json().catch(() => null);
     if (response.status === 409 && doc?.error?.code === 'TASK_EXISTS') {
+      // API v1.2 §5.2: a 409 is not success. Read the existing task back and require it to exist.
+      let existing = null;
+      try {
+        const read = await fetchImpl(`${rabbitUrl}/v1/tasks/${encodeURIComponent(taskId)}`, { headers, signal: signalOf() });
+        existing = read.ok === true ? await read.json() : null;
+      } catch { existing = null; }
+      if (existing === null) {
+        writeAudit(auditFile, { event: 'joint.dispatch.already', plan_sha256: plan.plan_sha256, step_id: step.step_id, task_id: taskId });
+        dispatched.set(step.step_id, taskId);
+        tasks.push({ step_id: step.step_id, task_id: taskId, already: true, leases: [] });
+        continue;
+      }
+      const existingLeases = Array.isArray(existing?.leases) ? existing.leases : [];
+      const mine = existingLeases.filter((lease) => lease?.machine_id === step.machine_id);
+      if (existingLeases.length > 0 && mine.length === 0) return { ok: false, code: 'TASK_EXISTS_FOREIGN', detail: { step_id: step.step_id, task_id: taskId }, partial: tasks.length > 0, tasks };
       writeAudit(auditFile, { event: 'joint.dispatch.already', plan_sha256: plan.plan_sha256, step_id: step.step_id, task_id: taskId });
       dispatched.set(step.step_id, taskId);
-      tasks.push({ step_id: step.step_id, task_id: taskId, already: true, leases: [] });
+      tasks.push({ step_id: step.step_id, task_id: taskId, already: true, leases: mine.map((lease) => ({ machine_id: lease.machine_id ?? null, state: lease.state ?? null })) });
       continue;
     }
     if (response.ok !== true) {
       writeAudit(auditFile, { event: 'joint.dispatch.refused', plan_sha256: plan.plan_sha256, step_id: step.step_id, task_id: taskId, reason_code: doc?.error?.code ?? 'RELAY_REFUSED' });
       return { ok: false, code: doc?.error?.code ?? 'RELAY_REFUSED', status: response.status, detail: doc?.error ?? doc, partial: tasks.length > 0, tasks };
     }
-    const returnedTaskId = doc?.task_id ?? doc?.task?.task_id ?? taskId;
+    if (typeof doc?.task_id !== 'string' || doc.task_id === '') {
+      writeAudit(auditFile, { event: 'joint.dispatch.refused', plan_sha256: plan.plan_sha256, step_id: step.step_id, task_id: taskId, reason_code: doc?.refusal_reason ?? 'RELAY_REFUSED' });
+      return { ok: false, code: 'RELAY_REFUSED', status: response.status, detail: { refusal_reason: doc?.refusal_reason ?? null, refused_task_id: null }, partial: tasks.length > 0, tasks };
+    }
+    const returnedTaskId = doc.task_id;
     const leases = Array.isArray(doc?.leases) ? doc.leases : [];
     const foreign = leases.filter((lease) => lease?.state !== 'observing' && lease?.machine_id !== step.machine_id);
+    const mine = leases.filter((lease) => lease?.machine_id === step.machine_id);
+    const dead = mine.filter((lease) => ['refused', 'expired', 'cancelled'].includes(lease?.state));
+    if (dead.length > 0) {
+      writeAudit(auditFile, { event: 'joint.dispatch.dead_lease', plan_sha256: plan.plan_sha256, step_id: step.step_id, task_id: returnedTaskId });
+      return { ok: false, code: 'DISPATCH_TARGET_REFUSED', detail: { step_id: step.step_id, machine_id: step.machine_id, leases: leases.map((lease) => ({ machine_id: lease?.machine_id ?? null, state: lease?.state ?? null })) }, partial: tasks.length > 0, tasks };
+    }
     if (foreign.length > 0) {
       try {
         await fetchImpl(`${rabbitUrl}/v1/tasks/${encodeURIComponent(returnedTaskId)}/cancel`, {

package/src/plugin/relay-capabilities.mjs

@@ -37,7 +37,8 @@ export async function readRelayCapabilities(input) {
       relay_version: typeof doc?.relay_version === 'string' ? doc.relay_version : (typeof doc?.version === 'string' ? doc.version : null),
       features,
       protocol_version: Number.isInteger(doc?.protocol_version) ? doc.protocol_version : null,
-      operator_token_required: doc?.operator_token_required === true,
+      operator_token_required: typeof doc?.operator_token_required === 'boolean' ? doc.operator_token_required : null,
+      signing_required: typeof doc?.signing?.required === 'boolean' ? doc.signing.required : null,
     };
   } catch (error) {
     return { ok: false, error: error instanceof Error ? error.message : String(error) };

package/src/plugin/tofuture/report.mjs

@@ -0,0 +1,44 @@
+/**
+ * ToFuture identity report (S2): collect every NIC, HMAC it, send only HMACs.
+ *
+ * Raw MAC/IP values exist only inside this function's local scope. The request body carries
+ * `{v, machine_id, ts_ms, nonce, entries:[{kind, salt_id, hmac}]}` and nothing else.
+ */
+import { networkInterfaces } from 'node:os';
+import { randomBytes } from 'node:crypto';
+
+import { identityHmac } from '../../util/tofuture-hmac.mjs';
+
+export function collectIdentityEntries(machineId, fleetKey) {
+  const entries = [];
+  for (const rows of Object.values(networkInterfaces())) {
+    for (const row of rows ?? []) {
+      const mac = typeof row?.mac === 'string' ? row.mac.trim() : '';
+      if (mac !== '' && mac !== '00:00:00:00:00:00') entries.push(identityHmac(fleetKey, machineId, 'mac', mac.toLowerCase()));
+      const family = row?.family === 4 || row?.family === 'IPv4' ? 'ipv4' : (row?.family === 6 || row?.family === 'IPv6' ? 'ipv6' : null);
+      if (family !== null && typeof row?.address === 'string' && row.address !== '') entries.push(identityHmac(fleetKey, machineId, family, row.address));
+    }
+  }
+  return entries;
+}
+
+export function buildIdentifyBody({ machineId, fleetKey, now = Date.now() }) {
+  return { v: 1, machine_id: machineId, ts_ms: now, nonce: randomBytes(12).toString('hex'), entries: collectIdentityEntries(machineId, fleetKey) };
+}
+
+/**
+ * @param {{request: Function, rabbitUrl: string, token: string, machineId: string, fleetKey: string, signal?: AbortSignal}} input
+ * @returns {Promise<{ok: boolean, matched?: boolean, code?: string}>} — never carries identifiers
+ */
+export async function reportIdentity(input) {
+  if (typeof input?.fleetKey !== 'string' || input.fleetKey === '') return { ok: false, code: 'HIDDEN_STATE_NO_KEY' };
+  const body = buildIdentifyBody({ machineId: input.machineId, fleetKey: input.fleetKey });
+  try {
+    const result = await input.request({ rabbitUrl: input.rabbitUrl, token: input.token, method: 'POST', pathname: '/v1/tofuture/identify', body, signal: input.signal });
+    // The relay answers 204 for both outcomes; a non-2xx is a transport/shape failure, not membership.
+    if (result?.ok === true) return { ok: true };
+    return { ok: false, code: result?.error?.code ?? 'TOFUTURE_REPORT_REFUSED' };
+  } catch {
+    return { ok: false, code: 'TOFUTURE_REPORT_FAILED' };
+  }
+}

package/src/plugin/tools.mjs

@@ -286,7 +286,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.9.20';
+const PLUGIN_VERSION = '2.0.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;

package/src/relay/tofuture-whitelist.mjs

@@ -0,0 +1,46 @@
+/**
+ * Relay-side ToFuture whitelist (S2): rows are HMACs only, never identifiers.
+ *
+ * The admin provisions `<stateDir>/tofuture-whitelist.json` offline:
+ *   { "v": 1, "rows": [ { "kind": "mac", "hmac": "<64hex>", "salt_id": "<16hex>" }, ... ] }
+ *
+ * `compare(entries)` is intentionally silent: it returns only whether ANY entry matched, never
+ * which row, which kind, or how many; callers must not send that boolean to the client.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const HEX64 = /^[0-9a-f]{64}$/;
+const HEX16 = /^[0-9a-f]{16}$/;
+
+export function loadWhitelist(stateDir) {
+  if (typeof stateDir !== 'string' || stateDir === '') return { ok: true, rows: [], empty: true };
+  const path = join(stateDir, 'tofuture-whitelist.json');
+  if (!existsSync(path)) return { ok: true, rows: [], empty: true, path };
+  let parsed;
+  try { parsed = JSON.parse(readFileSync(path, 'utf8')); } catch { return { ok: false, code: 'TOFUTURE_WHITELIST_INVALID', path }; }
+  const rows = Array.isArray(parsed?.rows) ? parsed.rows : [];
+  const clean = [];
+  for (const row of rows) {
+    if (row === null || typeof row !== 'object') continue;
+    if (!HEX64.test(String(row.hmac ?? ''))) continue;
+    if (!HEX16.test(String(row.salt_id ?? ''))) continue;
+    // Only the HMAC and its salt id are kept; any extra field (a leaked identifier) is dropped.
+    clean.push({ kind: typeof row.kind === 'string' ? row.kind.slice(0, 8) : 'any', hmac: String(row.hmac), salt_id: String(row.salt_id) });
+  }
+  return { ok: true, rows: clean, empty: clean.length === 0, path };
+}
+
+/** @returns {boolean} true when at least one entry matches a whitelisted HMAC. */
+export function whitelistMatches(whitelist, entries) {
+  if (whitelist === null || whitelist.ok !== true || Array.isArray(whitelist.rows) !== true) return false;
+  if (!Array.isArray(entries) || entries.length === 0) return false;
+  const byHmac = new Set(whitelist.rows.map((row) => row.hmac + '|' + row.salt_id));
+  for (const entry of entries) {
+    if (entry === null || typeof entry !== 'object') continue;
+    if (!HEX64.test(String(entry.hmac ?? ''))) continue;
+    if (!HEX16.test(String(entry.salt_id ?? ''))) continue;
+    if (byHmac.has(String(entry.hmac) + '|' + String(entry.salt_id))) return true;
+  }
+  return false;
+}

package/src/util/redline-core.mjs

@@ -25,7 +25,7 @@ export const BODY_ALLOWED_KEYS = Object.freeze([
   'manifest_sha256', 'executor_machine_id', 'head_commit', 'verifier_machine_id',
   'command_argv', 'command_hash', 'cwd_rel', 'timeout_ms',
   'step_id', 'step_ids', 'machine_id', 'write_scope', 'depends_on',
-  'task_id', 'mode', 'approval_sha256', 'write',
+  'task_id', 'mode', 'approval_sha256', 'write', 'target_machines',
 ]);
 
 /** 这些字段一律视为数据面内容，出现在控制消息里即拒绝（R1）。 */

package/src/util/tofuture-hmac.mjs

@@ -0,0 +1,30 @@
+/**
+ * ToFuture identity HMAC (S2): the only form in which network identifiers leave the machine.
+ *
+ * One canonical algorithm for client, whitelist provisioning and relay comparison:
+ *   salt_id = HMAC(fleet_key, "w2m-ops-salt-v1|" + machine_id) hex[0..16]
+ *   hmac    = HMAC(fleet_key, "w2m-ops-id-v1|" + kind + "|" + value + "|" + salt_id) hex
+ *
+ * Nothing here returns, stores or logs `value`; callers pass it in memory and keep only `hmac`.
+ */
+import { createHmac } from 'node:crypto';
+
+export const ID_KINDS = Object.freeze(['mac', 'ipv4', 'ipv6', 'bssid']);
+
+const hmacHex = (key, text) => createHmac('sha256', key).update(text, 'utf8').digest('hex');
+
+export function saltIdOf(fleetKey, machineId) {
+  return hmacHex(String(fleetKey), 'w2m-ops-salt-v1|' + String(machineId)).slice(0, 16);
+}
+
+export function identityHmac(fleetKey, machineId, kind, value) {
+  const salt = saltIdOf(fleetKey, machineId);
+  return { kind, salt_id: salt, hmac: hmacHex(String(fleetKey), 'w2m-ops-id-v1|' + kind + '|' + String(value) + '|' + salt) };
+}
+
+/** Stable JSON for the request body (keys sorted) — used by tests and future attestation. */
+export function canonicalJson(value) {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return '[' + value.map(canonicalJson).join(',') + ']';
+  return '{' + Object.keys(value).sort().map((key) => JSON.stringify(key) + ':' + canonicalJson(value[key])).join(',') + '}';
+}