@twinsearth/w2m-dsh-plugin 2.0.10 → 2.1.2

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "2.0.10"
+    "version": "2.1.2"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "2.0.10",
+      "version": "2.1.2",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "2.0.10"
+  "version": "2.1.2"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "2.0.10",
+  "version": "2.1.2",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,17 @@ All notable changes to this project are documented here.
 - `w2m_intent`: structured intents mapped onto allow-listed commands; unknown actions, parameters and types
   are refused by name (the fleet does not invent commands).
 
+## [2.1.2] - 2026-10-31
+
+- Remote-view preview: settings toggle, iMac sidebar entry, local 1fps JPEG viewer, target capture module, P2P view frame protocol, host /remote/start|frame|stop routes, encrypted-relay media broker (safety core).
+- Known gaps: P1.5 relay media is not wired end-to-end; peerKey/consent UI and real remote-desktop verification are pending. This release is a test candidate, not feature-complete.
+
+## [2.1.0] - 2026-10-31
+
+- Remote-view planning: REMOTE-DESKTOP-2.1.0.md and S2 capture probe (bin/remote-s2-capture.mjs).
+- Packaging: GitHub Packages artifact published as 2.1.0 for version alignment.
+- Status: the remote-desktop UI (settings toggle, iMac sidebar tab, viewer) is **not implemented yet**; 2.1.0 must not be described as feature-complete.
+
 ## [2.0.10] - 2026-10-31
 
 - remote-view S2: ship scripts/remote-s2-capture.mjs so macOS capture/TCC probes run as a normal script (no node -e, no reparse refusal); measures 1/2 fps capture timing, JPEG size, ffmpeg presence, writes w2m-s2-result.json and supports exit-code summary.

package/bin/remote-s2-capture.mjs

@@ -44,6 +44,25 @@ export function summaryBits(result) {
   return bits;
 }
 
+function captureWindows() {
+  const script = [
+    'Add-Type -AssemblyName System.Windows.Forms,System.Drawing',
+    '$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds',
+    '$bmp=New-Object System.Drawing.Bitmap $b.Width,$b.Height',
+    '$g=[System.Drawing.Graphics]::FromImage($bmp)',
+    '$g.CopyFromScreen($b.Left,$b.Top,0,0,$bmp.Size)',
+    '$ms=New-Object System.IO.MemoryStream',
+    '$bmp.Save($ms,[System.Drawing.Imaging.ImageFormat]::Jpeg)',
+    '[Convert]::ToBase64String($ms.ToArray())',
+  ].join(';');
+  const started = Date.now();
+  const run = spawnSync('powershell.exe', ['-NoProfile','-NonInteractive','-STA','-ExecutionPolicy','Bypass','-Command', script], { timeout: 20000, encoding: 'utf8' });
+  const ms = Date.now() - started;
+  const base64 = String(run.stdout ?? '').trim().split(/\r?\n/).filter(Boolean).pop() ?? '';
+  const bytes = /^[A-Za-z0-9+/=]{100,}$/.test(base64) ? Buffer.from(base64, 'base64').length : 0;
+  return { ok: run.status === 0 && bytes > 0, status: run.status, ms, bytes, width: null, height: null, error: run.status === 0 ? null : String(run.stderr ?? '').slice(0, 300) };
+}
+
 function capture(file, dimensions = true) {
   const started = Date.now();
   const run = spawnSync('screencapture', ['-x', '-t', 'jpg', file], { timeout: 15000, encoding: 'utf8' });
@@ -81,6 +100,16 @@ function main() {
     tcc_guess: 'unknown',
     code: null,
   };
+  if (process.platform === 'win32') {
+    result.captures.push(captureWindows());
+    spawnSync('ping', ['-n', opts.fps === 2 ? '1' : '2', '127.0.0.1'], { timeout: 5000 });
+    result.captures.push(captureWindows());
+    result.tcc_guess = 'not-applicable-windows';
+    result.ok = result.captures.every((entry) => entry.ok === true);
+    result.code = result.ok ? 'S2_CAPTURE_OK' : 'S2_CAPTURE_FAILED';
+    finish(result, opts, result.ok ? 0 : 3);
+    return;
+  }
   if (process.platform !== 'darwin') {
     result.code = 'S2_UNSUPPORTED_PLATFORM';
     finish(result, opts, 2);

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@2.0.10", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@2.1.0", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/lib/client.js

@@ -2115,6 +2115,153 @@ function TargetSelect({ sessionId, locked: _locked, t }) {
       ]);
     }
 
+    /* ------------------------------------------------------------------ */
+    /* v2.1.0 remote-view skeleton (view-only; media not wired yet)        */
+    /* ------------------------------------------------------------------ */
+
+    const REMOTE_VIEW_KEY = 'w2m.remoteView.enabled';
+    const REMOTE_CONFIG_URL = '/api/w2m/remote/config';
+    const REMOTE_FRAME_URL = '/api/w2m/remote/frame';
+    const readLocalFlag = () => {
+      try { return window.localStorage.getItem(REMOTE_VIEW_KEY) === '1'; } catch { return false; }
+    };
+    const cacheFlag = (value) => { try { window.localStorage.setItem(REMOTE_VIEW_KEY, value ? '1' : '0'); } catch { /* denied */ } };
+    const announceFlag = () => { try { window.dispatchEvent(new Event('w2m-remote-view-changed')); } catch { /* headless */ } };
+
+    function useRemoteViewFlag() {
+      const [enabled, setEnabledState] = React.useState(readLocalFlag);
+      const [ready, setReady] = React.useState(false);
+      React.useEffect(() => {
+        let alive = true;
+        fetch(REMOTE_CONFIG_URL, { credentials: 'same-origin', headers: { accept: 'application/json' } })
+          .then((response) => (response.ok ? response.json() : null))
+          .then((body) => {
+            if (!alive) return;
+            const value = body?.enabled === true;
+            cacheFlag(value);
+            setEnabledState(value);
+            setReady(true);
+          })
+          .catch(() => { if (alive) setReady(true); });
+        const sync = () => setEnabledState(readLocalFlag());
+        window.addEventListener('w2m-remote-view-changed', sync);
+        window.addEventListener('storage', sync);
+        return () => {
+          alive = false;
+          window.removeEventListener('w2m-remote-view-changed', sync);
+          window.removeEventListener('storage', sync);
+        };
+      }, []);
+      const setEnabled = (value) => {
+        const next = value === true;
+        cacheFlag(next);
+        setEnabledState(next);
+        announceFlag();
+        fetch(REMOTE_CONFIG_URL, {
+          method: 'POST', credentials: 'same-origin',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ enabled: next }),
+        }).catch(() => { /* local flag remains the fallback */ });
+      };
+      return [enabled, setEnabled, ready];
+    }
+
+    function RemoteViewSettings() {
+      const [enabled, setEnabled, ready] = useRemoteViewFlag();
+      return h('div', { style: { display: 'grid', gap: '10px', padding: '4px 0' } }, [
+        h('div', { key: 'title', style: { fontWeight: 600 } }, '远程桌面'),
+        h('label', { key: 'toggle', style: { display: 'flex', gap: '8px', alignItems: 'center', cursor: 'pointer', opacity: ready ? 1 : 0.6 } }, [
+          h('input', { key: 'box', type: 'checkbox', checked: enabled, onChange: (event) => setEnabled(event.target.checked) }),
+          h('span', { key: 'text' }, enabled ? '已开启' : '已关闭'),
+        ]),
+        h('div', { key: 'hint', style: { fontSize: '12px', opacity: 0.75, lineHeight: 1.5 } },
+          '仅查看，不发送鼠标/键盘输入。P1 目标为最高 1 帧/秒；实际帧率取决于目标机性能与网络。媒体优先 P2P，relay 只承载信令。'),
+        h('div', { key: 'status', style: { fontSize: '12px', opacity: 0.6 } }, 'P1 当前为本机回环查看；远端采集/P2P 在后续切片接入。'),
+      ]);
+    }
+
+    function RemoteViewSidebarIcon() {
+      const [enabled, , ready] = useRemoteViewFlag();
+      if (!ready || !enabled) return null;
+      return h('span', { title: '远程桌面', style: { display: 'inline-flex', alignItems: 'center', justifyContent: 'center' } }, h('svg', {
+        width: 20, height: 18, viewBox: '0 0 24 20', fill: 'none', stroke: 'currentColor', strokeWidth: 1.6, strokeLinecap: 'round', strokeLinejoin: 'round',
+      }, [
+        h('rect', { key: 'screen', x: 2.5, y: 2, width: 19, height: 12, rx: 1.5 }),
+        h('path', { key: 'stand', d: 'M8.5 18h7M12 14.2V18' }),
+      ]));
+    }
+
+    function RemoteViewMainPage() {
+      const [enabled] = useRemoteViewFlag();
+      const [machines, setMachines] = React.useState([]);
+      const [target, setTarget] = React.useState('');
+      const [session, setSession] = React.useState(null);
+      const [live, setLive] = React.useState(true);
+      const [frame, setFrame] = React.useState(null);
+      const [stats, setStats] = React.useState(null);
+      const [error, setError] = React.useState(null);
+      React.useEffect(() => {
+        if (!enabled) return undefined;
+        let alive = true;
+        fetch('/api/w2m/target?session_id=__global__', { credentials: 'same-origin', headers: { accept: 'application/json' } })
+          .then((response) => (response.ok ? response.json() : null))
+          .then((body) => { if (!alive) return; const list = Array.isArray(body?.machines) ? body.machines.filter((m) => m.online === true) : []; setMachines(list); if (list.length > 0) setTarget((current) => current || list[0].machine_id); })
+          .catch(() => { /* roster unavailable */ });
+        return () => { alive = false; };
+      }, [enabled]);
+      React.useEffect(() => {
+        if (!enabled || !live) return undefined;
+        let alive = true;
+        const tick = async () => {
+          try {
+            const response = await fetch(REMOTE_FRAME_URL, { method: 'POST', credentials: 'same-origin', headers: { accept: 'application/json' } });
+            const body = await response.json().catch(() => null);
+            if (!alive) return;
+            if (body?.ok === true) { setFrame(body); setStats({ capture_ms: body.capture_ms, bytes: body.bytes, at: body.at, encrypted: body.encrypted }); setError(null); }
+            else if (body?.code === 'VIEW_WAITING_FOR_FRAME') { setError(null); }
+            else { setError(body?.code ?? ('HTTP ' + response.status)); }
+          } catch (failure) { if (alive) setError(failure instanceof Error ? failure.message : String(failure)); }
+        };
+        tick();
+        const timer = setInterval(tick, 1000);
+        return () => { alive = false; clearInterval(timer); };
+      }, [enabled, live, session]);
+      const connect = async () => {
+        setError(null);
+        try {
+          const response = await fetch('/api/w2m/remote/start', { method: 'POST', credentials: 'same-origin', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ machine_id: target }) });
+          const body = await response.json().catch(() => null);
+          if (!response.ok || body?.ok !== true) { setError(body?.code ?? body?.error ?? ('HTTP ' + response.status)); return; }
+          setFrame(null); setSession(body);
+        } catch (failure) { setError(failure instanceof Error ? failure.message : String(failure)); }
+      };
+      const disconnect = async () => {
+        try { await fetch('/api/w2m/remote/stop', { method: 'POST', credentials: 'same-origin' }); } catch { /* best effort */ }
+        setSession(null); setFrame(null); setStats(null);
+      };
+      const ready = enabled && frame?.data_base64;
+      return h('div', { style: { padding: '16px', display: 'grid', gap: '12px', maxWidth: '1100px' } }, [
+        h('div', { key: 'title', style: { fontSize: '16px', fontWeight: 600 } }, '远程桌面 · 仅查看'),
+        h('div', { key: 'state', style: { fontSize: '13px', opacity: 0.8 } }, enabled ? (session ? ('P2P 会话：' + (session.machine_id ?? '') + (session.encrypted ? '（加密）' : '（未加密）')) : '未连接目标') : '插件设置中尚未开启远程桌面。'),
+        h('div', { key: 'controls', style: { display: 'flex', gap: '8px', alignItems: 'center', flexWrap: 'wrap' } }, [
+          h('select', { key: 'target', value: target, disabled: !enabled, onChange: (event) => setTarget(event.target.value), style: { minWidth: '180px' } }, machines.length === 0 ? h('option', { value: '' }, '无在线机器') : machines.map((machine) => h('option', { key: machine.machine_id, value: machine.machine_id }, (machine.name ?? machine.machine_id)))),
+          h('button', { key: 'connect', type: 'button', disabled: !enabled || target === '' || session !== null, onClick: connect }, '连接'),
+          h('button', { key: 'stop', type: 'button', disabled: session === null, onClick: disconnect }, '停止'),
+          h('button', { key: 'pause', type: 'button', disabled: !enabled, onClick: () => setLive((value) => !value) }, live ? '暂停' : '继续'),
+        ]),
+        h('div', { key: 'canvas', style: { minHeight: '320px', border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 'var(--dsw-radius-sm)', overflow: 'hidden', display: 'flex', alignItems: 'center', justifyContent: 'center', background: 'var(--dsw-alias-bg-layer-1)' } }, ready
+          ? h('img', { src: 'data:' + (frame.mime ?? 'image/jpeg') + ';base64,' + frame.data_base64, alt: '远程桌面画面', style: { maxWidth: '100%', maxHeight: '70vh', display: 'block' } })
+          : h('span', { style: { opacity: 0.6, fontSize: '13px' } }, !enabled ? '尚未开启' : (error ? ('查看失败：' + error) : (session ? '等待远端帧…' : '本机回环预览（选择目标后点连接）')))),
+        h('div', { key: 'statusline', style: { fontSize: '12px', opacity: 0.7, display: 'flex', gap: '14px', flexWrap: 'wrap' } }, [
+          h('span', { key: 'fps' }, '1 fps 上限'),
+          h('span', { key: 'channel' }, '通道：' + (session ? 'P2P' : '本机回环')),
+          h('span', { key: 'cap' }, '采集：' + (stats?.capture_ms ?? '—') + 'ms'),
+          h('span', { key: 'bytes' }, '帧：' + (stats?.bytes ?? '—') + 'B'),
+          h('span', { key: 'age' }, '最近帧：' + (stats?.at ?? '—')),
+        ]),
+      ]);
+    }
+
     function FleetChat({ sessionId, viewMode }) {
       // v1.9.18: chat emotes are local slash commands, never image bytes. The relay only sees text.
 const CHAT_COMMANDS = ['/微笑', '/火箭', '/烟花'];
@@ -2802,6 +2949,39 @@ const CHAT_EMOJIS = CHAT_COMMANDS;
           error,
         );
       }
+      // v2.1.0: remote-view skeleton — settings toggle, conditional iMac sidebar entry, viewer page.
+      try {
+        slots.inject('settings.section', () => slots.register({
+          name: 'settings.section',
+          id: 'w2m-remote-view',
+          order: 13,
+          label: () => '远程桌面',
+          inject: () => ({ t }),
+        }, RemoteViewSettings));
+      } catch (error) {
+        console.error('@twinsearth/w2m-dsh-plugin: the remote-view settings section was not mounted', error);
+      }
+      try {
+        slots.inject('sidebar.panellist', () => slots.register({
+          name: 'sidebar.panellist',
+          id: 'w2m-remote-view',
+          order: 5,
+          label: () => '',
+          inject: () => ({}),
+        }, RemoteViewSidebarIcon));
+      } catch (error) {
+        console.error('@twinsearth/w2m-dsh-plugin: the remote-view sidebar entry was not mounted', error);
+      }
+      try {
+        slots.inject('main', () => slots.register({
+          name: 'main',
+          key: 'w2m-remote-view',
+          label: () => '远程桌面',
+          inject: () => ({ t }),
+        }, RemoteViewMainPage));
+      } catch (error) {
+        console.error('@twinsearth/w2m-dsh-plugin: the remote-view main page was not mounted', error);
+      }
     }
 
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "2.0.10",
+  "version": "2.1.2",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {
@@ -66,7 +66,7 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs test/gpw-colors.test.mjs test/gpw-recent-fold.test.mjs test/gpw-auto-approve.test.mjs test/joint-dev-dispatch.test.mjs test/joint-dev-loop.test.mjs test/joint-dev-audit.test.mjs test/joint-dev-redline.test.mjs test/relay-redline-guard.test.mjs test/relay-p0-projection.test.mjs test/guarded-dispatch.test.mjs test/p0-single-matcher.test.mjs test/path-policy.test.mjs test/path-policy-fs.test.mjs test/gpw-inheritance-table.test.mjs test/gpw-policy-adapter.test.mjs test/target-policy.test.mjs test/relay-redline-audit.test.mjs test/relay-repair-ledger.test.mjs test/relay-purge-blobs.test.mjs test/relay-scrub.test.mjs test/joint-dev-plan-store.test.mjs test/relay-basepath-blobs.test.mjs test/operator-token.test.mjs test/relay-health-capabilities.test.mjs test/joint-relay-dispatch.test.mjs test/operator-token-route.test.mjs test/relay-scrub-task-projection.test.mjs test/operator-key-approval.test.mjs test/relay-offer-journal.test.mjs test/joint-r5-wiring.test.mjs test/p1-hardening.test.mjs test/joint-merge-engine.test.mjs test/artifact-ref-dir-sink.test.mjs test/chat-sticker-guard.test.mjs test/relay-task-progress.test.mjs test/gpw-modes.test.mjs test/joint-cli.test.mjs test/joint-command-hash.test.mjs test/joint-dispatch-audit.test.mjs test/tools-cancel-auth.test.mjs test/fleet-mirror.test.mjs test/sink-git-ssh.test.mjs test/agent-sse-watchdog.test.mjs test/version-gate.test.mjs test/joint-merge-cli.test.mjs test/joint-progress.test.mjs test/project-room-truncation.test.mjs test/chat-crypto-aad.test.mjs test/agent-artifact-delivery.test.mjs test/dataplane-sink-route.test.mjs test/artifact-sink-e2e.test.mjs test/project-room-persistence.test.mjs test/project-room-disk-persistence.test.mjs test/project-stream-route.test.mjs test/chat-v2-gate.test.mjs test/xiangqi.test.mjs test/xfer-foundation.test.mjs test/xfer-ferry.test.mjs test/xfer-publish.test.mjs test/xfer-want-block.test.mjs test/p2p-cipher-diag.test.mjs test/chacha-fallback.test.mjs test/fleet-binding.test.mjs test/xfer-channel.test.mjs test/p2p-race.test.mjs test/path-scheduler.test.mjs test/transport.test.mjs test/iroh-sidecar.test.mjs test/discovery.test.mjs test/p2p-rtt.test.mjs test/artifact-ref-v3.test.mjs test/xfer-recovery.test.mjs test/xfer-router.test.mjs test/remote-s2-capture.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs test/gpw-colors.test.mjs test/gpw-recent-fold.test.mjs test/gpw-auto-approve.test.mjs test/joint-dev-dispatch.test.mjs test/joint-dev-loop.test.mjs test/joint-dev-audit.test.mjs test/joint-dev-redline.test.mjs test/relay-redline-guard.test.mjs test/relay-p0-projection.test.mjs test/guarded-dispatch.test.mjs test/p0-single-matcher.test.mjs test/path-policy.test.mjs test/path-policy-fs.test.mjs test/gpw-inheritance-table.test.mjs test/gpw-policy-adapter.test.mjs test/target-policy.test.mjs test/relay-redline-audit.test.mjs test/relay-repair-ledger.test.mjs test/relay-purge-blobs.test.mjs test/relay-scrub.test.mjs test/joint-dev-plan-store.test.mjs test/relay-basepath-blobs.test.mjs test/operator-token.test.mjs test/relay-health-capabilities.test.mjs test/joint-relay-dispatch.test.mjs test/operator-token-route.test.mjs test/relay-scrub-task-projection.test.mjs test/operator-key-approval.test.mjs test/relay-offer-journal.test.mjs test/joint-r5-wiring.test.mjs test/p1-hardening.test.mjs test/joint-merge-engine.test.mjs test/artifact-ref-dir-sink.test.mjs test/chat-sticker-guard.test.mjs test/relay-task-progress.test.mjs test/gpw-modes.test.mjs test/joint-cli.test.mjs test/joint-command-hash.test.mjs test/joint-dispatch-audit.test.mjs test/tools-cancel-auth.test.mjs test/fleet-mirror.test.mjs test/sink-git-ssh.test.mjs test/agent-sse-watchdog.test.mjs test/version-gate.test.mjs test/joint-merge-cli.test.mjs test/joint-progress.test.mjs test/project-room-truncation.test.mjs test/chat-crypto-aad.test.mjs test/agent-artifact-delivery.test.mjs test/dataplane-sink-route.test.mjs test/artifact-sink-e2e.test.mjs test/project-room-persistence.test.mjs test/project-room-disk-persistence.test.mjs test/project-stream-route.test.mjs test/chat-v2-gate.test.mjs test/xiangqi.test.mjs test/xfer-foundation.test.mjs test/xfer-ferry.test.mjs test/xfer-publish.test.mjs test/xfer-want-block.test.mjs test/p2p-cipher-diag.test.mjs test/chacha-fallback.test.mjs test/fleet-binding.test.mjs test/xfer-channel.test.mjs test/p2p-race.test.mjs test/path-scheduler.test.mjs test/transport.test.mjs test/iroh-sidecar.test.mjs test/discovery.test.mjs test/p2p-rtt.test.mjs test/artifact-ref-v3.test.mjs test/xfer-recovery.test.mjs test/xfer-router.test.mjs test/remote-s2-capture.test.mjs test/view-capture.test.mjs test/view-frame-channel.test.mjs test/remote-view-route.test.mjs test/remote-media.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:account-join": "node --test --test-force-exit test/account-join.test.mjs",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "2.0.10",
+  "version": "2.1.2",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/agent/agent.mjs

@@ -70,6 +70,8 @@ import {
 } from '../util/exec-capability.mjs';
 import { CRYPTO_REASON, DEVICE_KEY_FILE, DeviceKey, PeerKeyStore, deriveSigningKey } from './crypto.mjs';
 import { createXferFrameRouter } from './transfer/router.mjs';
+import { captureScreen } from './view/capture.mjs';
+import { createViewTarget } from './view/frame-channel.mjs';
 import { DEFAULT_P2P_MODE, P2P_DEFAULTS, P2PNode, normalizeP2PMode, normalizeP2PPort } from './p2p-node.mjs';
 import { punchSession, reverseDialSession } from './p2p.mjs';
 import { createSigner } from '../signing.mjs';
@@ -3966,6 +3968,15 @@ let attemptAttached = false;
       xferRouter.handle(payload, { channel: event.channel });
       return;
     }
+    if (payload !== null && typeof payload.type === 'string' && payload.type.startsWith('view.')) {
+      const target = createViewTarget({
+        capture: () => captureScreen({}),
+        allow: process.env.W2M_VIEW_ALLOW === '1',
+        send: (frame) => { try { event.channel.send(frame); } catch { /* peer gone */ } },
+      });
+      target.handle(payload);
+      return;
+    }
     if (payload === null) {
       log('warn', 'ignoring non-JSON frame on a P2P channel', {
         peer: event.peer ?? null,

package/src/agent/view/capture.mjs

@@ -0,0 +1,111 @@
+/**
+ * Target-side screen capture for remote-view P1.
+ *
+ * One JPEG per call, bounded by a timeout, injectable `run` so tests never
+ * launch PowerShell or screencapture. Errors are named, never "capture failed"
+ * without a reason.
+ */
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+export const VIEW_CAPTURE_CODE = Object.freeze({
+  OK: 'CAPTURE_OK',
+  UNSUPPORTED: 'CAPTURE_UNSUPPORTED_PLATFORM',
+  DENIED: 'CAPTURE_DENIED',
+  BLANK: 'CAPTURE_BLANK',
+  FAILED: 'CAPTURE_FAILED',
+  TOO_LARGE: 'CAPTURE_TOO_LARGE',
+});
+
+export const DEFAULT_MAX_FRAME_BYTES = 96 * 1024;
+
+const defaultRun = (argv, options = {}) => spawnSync(argv[0], argv.slice(1), {
+  timeout: options.timeoutMs ?? 15000,
+  encoding: options.encoding ?? 'utf8',
+  env: options.env ?? process.env,
+});
+
+function windowsCaptureScript(maxBytes) {
+  return [
+    'Add-Type -AssemblyName System.Windows.Forms,System.Drawing',
+    '$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds',
+    '$src=New-Object System.Drawing.Bitmap $b.Width,$b.Height',
+    '$g=[System.Drawing.Graphics]::FromImage($src)',
+    '$g.CopyFromScreen($b.Left,$b.Top,0,0,$src.Size)',
+    '$codec=[System.Drawing.Imaging.ImageCodecInfo]::GetImageEncoders() | Where-Object { $_.MimeType -eq "image/jpeg" }',
+    '$max=' + String(maxBytes),
+    '$best=$null',
+    'foreach($w in @(1280,1024,800,640)){',
+    '  $h=[int]($b.Height*$w/$b.Width)',
+    '  $dst=New-Object System.Drawing.Bitmap $w,$h',
+    '  $dg=[System.Drawing.Graphics]::FromImage($dst)',
+    '  $dg.InterpolationMode=[System.Drawing.Drawing2D.InterpolationMode]::HighQualityBicubic',
+    '  $dg.DrawImage($src,0,0,$w,$h)',
+    '  foreach($q in @(70,55,40)){',
+    '    $p=New-Object System.Drawing.Imaging.EncoderParameters(1)',
+    '    $p.Param[0]=New-Object System.Drawing.Imaging.EncoderParameter([System.Drawing.Imaging.Encoder]::Quality,[long]$q)',
+    '    $ms=New-Object System.IO.MemoryStream',
+    '    $dst.Save($ms,$codec,$p)',
+    '    $bytes=$ms.ToArray()',
+    '    if($best -eq $null -or $bytes.Length -lt $best.Length){$best=$bytes}',
+    '    if($bytes.Length -le $max){[Convert]::ToBase64String($bytes); exit 0}',
+    '  }',
+    '}',
+    '[Convert]::ToBase64String($best)',
+  ].join(';');
+}
+
+
+/**
+ * @param {{platform?: NodeJS.Platform, run?: Function, tempRoot?: string, maxBytes?: number}} [options]
+ * @returns {{ok: true, code: string, mime: string, data: Buffer, base64: string, bytes: number, capture_ms: number, width: number|null, height: number|null}
+ *   | {ok: false, code: string, error: string, capture_ms: number}}
+ */
+export function captureScreen(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const run = options.run ?? defaultRun;
+  const maxBytes = Number.isInteger(options.maxBytes) ? options.maxBytes : DEFAULT_MAX_FRAME_BYTES;
+  const started = Date.now();
+  try {
+    let base64 = null;
+    let width = null;
+    let height = null;
+    if (platform === 'win32') {
+      const result = run(['powershell.exe', '-NoProfile', '-NonInteractive', '-STA', '-ExecutionPolicy', 'Bypass', '-Command', windowsCaptureScript(maxBytes)], { timeoutMs: 20000 });
+      if (result.code !== 0) return { ok: false, code: VIEW_CAPTURE_CODE.DENIED, error: `PowerShell capture failed (exit ${result.code ?? 'null'}${result.signal ? ', signal ' + result.signal : ''}${result.error?.message ? ', ' + result.error.message : ''})`, capture_ms: Date.now() - started };
+      base64 = String(result.stdout ?? '').trim().split(/\r?\n/).filter(Boolean).pop() ?? '';
+      if (!/^[A-Za-z0-9+/=]{100,}$/.test(base64)) return { ok: false, code: VIEW_CAPTURE_CODE.FAILED, error: 'PowerShell returned no JPEG', capture_ms: Date.now() - started };
+    } else if (platform === 'darwin') {
+      const dir = mkdtempSync(join(options.tempRoot ?? tmpdir(), 'w2m-view-'));
+      const file = join(dir, 'frame.jpg');
+      try {
+        const result = run(['/usr/sbin/screencapture', '-x', '-t', 'jpg', file], { timeoutMs: 15000 });
+        if (result.code !== 0) return { ok: false, code: VIEW_CAPTURE_CODE.DENIED, error: `screencapture failed (exit ${result.code})`, capture_ms: Date.now() - started };
+        const data = readFileSync(file);
+        base64 = data.toString('base64');
+        const sips = run(['sips', '-g', 'pixelWidth', '-g', 'pixelHeight', file], { timeoutMs: 5000 });
+        const w = /pixelWidth:\s*(\d+)/.exec(sips?.stdout ?? '');
+        const h = /pixelHeight:\s*(\d+)/.exec(sips?.stdout ?? '');
+        width = w === null ? null : Number(w[1]);
+        height = h === null ? null : Number(h[1]);
+      } finally {
+        try { rmSync(dir, { recursive: true, force: true }); } catch { /* best effort */ }
+      }
+    } else {
+      return { ok: false, code: VIEW_CAPTURE_CODE.UNSUPPORTED, error: `screen capture is not implemented for ${platform}`, capture_ms: Date.now() - started };
+    }
+    const data = Buffer.from(base64, 'base64');
+    if (data.length < 1000) return { ok: false, code: VIEW_CAPTURE_CODE.BLANK, error: 'captured JPEG is too small to be a screen', capture_ms: Date.now() - started };
+    if (data.length > maxBytes) return { ok: false, code: VIEW_CAPTURE_CODE.TOO_LARGE, error: `frame ${data.length} > ${maxBytes}`, capture_ms: Date.now() - started };
+    return { ok: true, code: VIEW_CAPTURE_CODE.OK, mime: 'image/jpeg', data, base64, bytes: data.length, capture_ms: Date.now() - started, width, height };
+  } catch (error) {
+    return { ok: false, code: VIEW_CAPTURE_CODE.FAILED, error: error instanceof Error ? error.message : String(error), capture_ms: Date.now() - started };
+  }
+}
+
+/** Test/util helper: file size without reading the whole image. */
+export function frameBytes(file) {
+  try { return statSync(file).size; } catch { return 0; }
+}

package/src/agent/view/frame-channel.mjs

@@ -0,0 +1,114 @@
+/**
+ * P2P view frame channel (P1, view-only).
+ *
+ * Frames are JSON on the existing P2PChannel (one JPEG per frame, ≤96 KiB).
+ * The target defaults to DENY; consent is a separate decision supplied by the
+ * caller (`allow: true`). Nothing here accepts input events.
+ */
+export const VIEW_FRAME = Object.freeze({
+  REQUEST: 'view.request',
+  FRAME: 'view.frame',
+  STOP: 'view.stop',
+  ERROR: 'view.error',
+});
+
+export const VIEW_CODE = Object.freeze({
+  CONSENT_REQUIRED: 'VIEW_CONSENT_REQUIRED',
+  DISABLED: 'VIEW_DISABLED',
+  FRAME_TOO_LARGE: 'VIEW_FRAME_TOO_LARGE',
+  BAD_FRAME: 'VIEW_BAD_FRAME',
+  CAPTURE_FAILED: 'VIEW_CAPTURE_FAILED',
+  INPUT_FORBIDDEN: 'VIEW_INPUT_FORBIDDEN',
+});
+
+const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const isInputFrame = (type) => /^(mouse|key|pointer|input)\./.test(type);
+
+export function parseViewFrame(payload) {
+  try {
+    const frame = Buffer.isBuffer(payload) || typeof payload === 'string' ? JSON.parse(Buffer.from(payload).toString('utf8')) : payload;
+    if (!isObject(frame) || typeof frame.type !== 'string' || !frame.type.startsWith('view.')) return null;
+    return frame;
+  } catch { return null; }
+}
+
+/**
+ * Target side: answer view.request with one JPEG frame; refuse by default.
+ *
+ * @param {{capture: Function, allow?: boolean, send: Function, maxBytes?: number, fps?: number}} deps
+ */
+export function createViewTarget({ capture, allow = false, send, maxBytes = 96 * 1024, fps = 1 } = {}) {
+  if (typeof capture !== 'function' || typeof send !== 'function') return { ok: false, code: VIEW_CODE.BAD_FRAME };
+  let seq = 0;
+  let stopped = false;
+  const reply = (frame) => { try { send(JSON.stringify(frame)); } catch { /* channel gone */ } };
+  return {
+    ok: true,
+    handle(payload) {
+      let raw = null;
+      try { raw = Buffer.isBuffer(payload) || typeof payload === 'string' ? JSON.parse(Buffer.from(payload).toString('utf8')) : payload; } catch { raw = null; }
+      if (isObject(raw) && typeof raw.type === 'string' && isInputFrame(raw.type)) {
+        reply({ type: VIEW_FRAME.ERROR, code: VIEW_CODE.INPUT_FORBIDDEN, session_id: raw.session_id ?? null });
+        return true;
+      }
+      const frame = parseViewFrame(payload);
+      if (frame === null) return false;
+      if (frame.type === VIEW_FRAME.STOP) { stopped = true; return true; }
+      if (frame.type !== VIEW_FRAME.REQUEST) return true;
+      if (allow !== true) { reply({ type: VIEW_FRAME.ERROR, code: VIEW_CODE.CONSENT_REQUIRED, session_id: frame.session_id ?? null }); return true; }
+      if (stopped) { reply({ type: VIEW_FRAME.ERROR, code: VIEW_CODE.DISABLED, session_id: frame.session_id ?? null }); return true; }
+      const result = capture({ maxBytes });
+      if (result?.ok !== true) {
+        reply({ type: VIEW_FRAME.ERROR, code: result?.code ?? VIEW_CODE.CAPTURE_FAILED, session_id: frame.session_id ?? null });
+        return true;
+      }
+      seq += 1;
+      reply({
+        type: VIEW_FRAME.FRAME,
+        session_id: frame.session_id ?? null,
+        seq,
+        ts_ms: Date.now(),
+        mime: result.mime ?? 'image/jpeg',
+        bytes: result.bytes,
+        data_b64: result.base64,
+      });
+      return true;
+    },
+    stats() { return { seq, stopped, allow: allow === true, fps, max_bytes: maxBytes }; },
+  };
+}
+
+/**
+ * Viewer side: request a frame and accept/validate the response.
+ *
+ * @param {{send: Function, onFrame: Function, maxBytes?: number}} deps
+ */
+export function createViewClient({ send, onFrame, maxBytes = 96 * 1024 } = {}) {
+  if (typeof send !== 'function' || typeof onFrame !== 'function') return { ok: false, code: VIEW_CODE.BAD_FRAME };
+  let sessionId = null;
+  let lastSeq = 0;
+  return {
+    ok: true,
+    request({ machineId, session }) {
+      sessionId = session ?? ('view-' + Date.now());
+      send(JSON.stringify({ type: VIEW_FRAME.REQUEST, session_id: sessionId, machine_id: machineId ?? null, fps: 1, max_bytes: maxBytes }));
+      return sessionId;
+    },
+    accept(payload) {
+      const frame = parseViewFrame(payload);
+      if (frame === null) return false;
+      if (frame.type === VIEW_FRAME.ERROR) { onFrame({ ok: false, code: frame.code ?? VIEW_CODE.CAPTURE_FAILED }); return true; }
+      if (frame.type !== VIEW_FRAME.FRAME) return true;
+      if (sessionId !== null && frame.session_id !== sessionId) return true;
+      if (!Number.isInteger(frame.seq) || frame.seq <= lastSeq) return true;
+      if (typeof frame.data_b64 !== 'string' || frame.data_b64 === '') { onFrame({ ok: false, code: VIEW_CODE.BAD_FRAME }); return true; }
+      const bytes = Buffer.from(frame.data_b64, 'base64').length;
+      if (bytes > maxBytes) { onFrame({ ok: false, code: VIEW_CODE.FRAME_TOO_LARGE }); return true; }
+      lastSeq = frame.seq;
+      onFrame({ ok: true, seq: frame.seq, ts_ms: frame.ts_ms, mime: frame.mime ?? 'image/jpeg', bytes, data_b64: frame.data_b64 });
+      return true;
+    },
+    stop() { if (sessionId !== null) send(JSON.stringify({ type: VIEW_FRAME.STOP, session_id: sessionId })); },
+    stats() { return { sessionId, lastSeq }; },
+  };
+}

package/src/plugin/remote-view-route.mjs

@@ -0,0 +1,144 @@
+/**
+ * v2.1.x remote-view host routes.
+ *
+ * local  : /frame captures this host (P1 fallback, no target selected)
+ * remote : /start dials the target over P2P and asks its agent for view frames;
+ *          /frame serves the newest cached frame; /stop ends the session.
+ *
+ * Remote frames never traverse the relay. A P2P failure is P2P_UNAVAILABLE,
+ * never satisfied by a relay/plaintext media fallback.
+ */
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { captureHostScreen } from './capture-route.mjs';
+
+export const REMOTE_CONFIG_PATH = '/api/w2m/remote/config';
+export const REMOTE_FRAME_PATH = '/api/w2m/remote/frame';
+export const REMOTE_START_PATH = '/api/w2m/remote/start';
+export const REMOTE_STOP_PATH = '/api/w2m/remote/stop';
+const NO_STORE = { 'cache-control': 'no-store' };
+
+function readConfig(file) {
+  try { return { ok: true, enabled: JSON.parse(readFileSync(file, 'utf8').replace(/^\uFEFF/, ''))?.enabled === true }; }
+  catch { return { ok: true, enabled: false }; }
+}
+
+function writeConfig(file, enabled) {
+  mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+  const tmp = file + '.tmp-' + process.pid;
+  writeFileSync(tmp, JSON.stringify({ enabled: enabled === true, updatedAt: new Date().toISOString() }), { encoding: 'utf8', mode: 0o600 });
+  renameSync(tmp, file);
+}
+
+function payloadJson(payload) {
+  try { return Buffer.isBuffer(payload) || typeof payload === 'string' ? JSON.parse(Buffer.from(payload).toString('utf8')) : payload; }
+  catch { return null; }
+}
+
+/**
+ * @param {object} ctx Cordis context
+ * @param {{stateDir:string, p2p?:object, capture?:Function, platform?:NodeJS.Platform, maxBytes?:number}} deps
+ */
+export function registerRemoteViewRoutes(ctx, deps = {}) {
+  const status = { mounted: false, reason: 'the host has no Connection service', configPath: null };
+  if (typeof ctx?.inject !== 'function') return status;
+  if (typeof deps.stateDir !== 'string' || deps.stateDir === '') { status.reason = 'stateDir is not configured'; return status; }
+  const file = join(deps.stateDir, 'remote-view.json');
+  const capture = deps.capture ?? captureHostScreen;
+  const platform = deps.platform ?? process.platform;
+  const p2p = deps.p2p ?? null;
+  const maxBytes = Number.isInteger(deps.maxBytes) ? deps.maxBytes : 96 * 1024;
+  let active = null;
+  let listener = null;
+
+  const stopActive = async () => {
+    if (active === null) return;
+    try { await active.channel?.send?.(JSON.stringify({ type: 'view.stop', session_id: active.sessionId })); } catch { /* peer gone */ }
+    try { active.channel?.close?.(); } catch { /* already closed */ }
+    if (p2p?.node && typeof p2p.node.off === 'function' && listener !== null) p2p.node.off('message', listener);
+    active = null;
+    listener = null;
+  };
+
+  ctx.inject(['connection'], (webCtx) => {
+    const registry = webCtx?.connection?.fetch;
+    if (registry === undefined || typeof registry.register !== 'function') { status.reason = 'the connection service carries no fetch registry'; return; }
+    registry.register({
+      path: REMOTE_CONFIG_PATH,
+      methods: ['GET', 'POST'],
+      requestBody: 'buffered',
+      fetch: async (request) => {
+        if (request.method === 'GET') return Response.json({ ok: true, ...readConfig(file), session: active === null ? null : { machine_id: active.machineId, encrypted: active.encrypted === true } }, { headers: NO_STORE });
+        let body = null;
+        try { body = await request.json(); } catch { /* refused below */ }
+        if (body === null || typeof body.enabled !== 'boolean') return Response.json({ ok: false, error: 'a JSON body with {"enabled": true|false} is required' }, { status: 400, headers: NO_STORE });
+        if (body.enabled === false) await stopActive();
+        writeConfig(file, body.enabled);
+        return Response.json({ ok: true, enabled: body.enabled }, { headers: NO_STORE });
+      },
+    });
+
+    registry.register({
+      path: REMOTE_START_PATH,
+      methods: ['POST'],
+      requestBody: 'buffered',
+      fetch: async (request) => {
+        if (readConfig(file).enabled !== true) return Response.json({ ok: false, code: 'VIEW_DISABLED' }, { status: 403, headers: NO_STORE });
+        let body = null;
+        try { body = await request.json(); } catch { /* refused below */ }
+        const machineId = typeof body?.machine_id === 'string' ? body.machine_id : '';
+        if (machineId === '') return Response.json({ ok: false, error: 'a JSON body with {"machine_id": "..."} is required' }, { status: 400, headers: NO_STORE });
+        if (p2p?.node === null || p2p?.node === undefined) return Response.json({ ok: false, code: 'P2P_UNAVAILABLE', error: 'no P2P node on this host' }, { status: 503, headers: NO_STORE });
+        await stopActive();
+        try { await p2p.node.start?.(); } catch (error) {
+          return Response.json({ ok: false, code: 'P2P_UNAVAILABLE', error: error instanceof Error ? error.message : String(error) }, { status: 503, headers: NO_STORE });
+        }
+        const dialled = await p2p.node.dial(machineId, {});
+        if (dialled?.ok !== true) return Response.json({ ok: false, code: 'P2P_UNAVAILABLE', error: dialled?.error ?? 'P2P_DIAL_FAILED' }, { status: 502, headers: NO_STORE });
+        const sessionId = 'view-' + Date.now().toString(36);
+        active = { machineId, sessionId, channel: dialled.channel, encrypted: dialled.channel?.encryption?.encrypted === true, latest: null, error: null, startedAt: Date.now() };
+        listener = (event) => {
+          const frame = payloadJson(event?.payload);
+          if (frame === null || frame?.session_id !== sessionId) return;
+          if (frame.type === 'view.frame') {
+            const bytes = typeof frame.data_b64 === 'string' ? Buffer.from(frame.data_b64, 'base64').length : 0;
+            if (bytes > maxBytes) { active.error = 'VIEW_FRAME_TOO_LARGE'; return; }
+            active.latest = { seq: frame.seq ?? null, mime: frame.mime ?? 'image/jpeg', bytes, data_base64: frame.data_b64, at: new Date().toISOString(), encrypted: active.encrypted };
+          } else if (frame.type === 'view.error') {
+            active.error = frame.code ?? 'VIEW_ERROR';
+          }
+        };
+        p2p.node.on('message', listener);
+        await dialled.channel.send(JSON.stringify({ type: 'view.request', session_id: sessionId, machine_id: machineId, fps: 1, max_bytes: maxBytes }));
+        return Response.json({ ok: true, machine_id: machineId, session_id: sessionId, encrypted: active.encrypted, channel: 'p2p' }, { headers: NO_STORE });
+      },
+    });
+
+    registry.register({
+      path: REMOTE_STOP_PATH,
+      methods: ['POST'],
+      fetch: async () => { await stopActive(); return Response.json({ ok: true }, { headers: NO_STORE }); },
+    });
+
+    registry.register({
+      path: REMOTE_FRAME_PATH,
+      methods: ['POST'],
+      fetch: async () => {
+        if (readConfig(file).enabled !== true) return Response.json({ ok: false, code: 'VIEW_DISABLED' }, { status: 403, headers: NO_STORE });
+        if (active !== null) {
+          if (active.latest !== null) return Response.json({ ok: true, ...active.latest }, { headers: NO_STORE });
+          if (active.error !== null) return Response.json({ ok: false, code: active.error }, { status: 502, headers: NO_STORE });
+          return Response.json({ ok: false, code: 'VIEW_WAITING_FOR_FRAME', machine_id: active.machineId }, { status: 202, headers: NO_STORE });
+        }
+        const started = Date.now();
+        const result = await capture({ platform });
+        if (result.ok !== true) return Response.json({ ok: false, code: 'CAPTURE_FAILED', error: result.error ?? null }, { status: 502, headers: NO_STORE });
+        return Response.json({ ok: true, mime: result.mime ?? 'image/jpeg', data_base64: result.data_base64, bytes: Math.ceil((result.data_base64?.length ?? 0) * 3 / 4), capture_ms: Date.now() - started, at: new Date().toISOString() }, { headers: NO_STORE });
+      },
+    });
+    status.mounted = true;
+    status.reason = null;
+    status.configPath = file;
+  });
+  return status;
+}

package/src/plugin/tools.mjs

@@ -198,7 +198,8 @@ import { registerProjectStreamRoute } from './project-stream-route.mjs';
 import { planProgress } from './joint-dev/progress.mjs';
 import { registerJointTools } from './tools-joint.mjs';
 import { fingerprintOf, readOperatorToken } from './operator-token.mjs';
-import { registerCaptureRoutes } from './capture-route.mjs';
+import { registerCaptureRoutes } from './capture-route.mjs';
+import { registerRemoteViewRoutes } from './remote-view-route.mjs';
 import { defaultExecCapabilityFile } from '../util/exec-capability.mjs';
 import { createFleetCouncil, fleetCouncilThread } from './council-fleet.mjs';
 import { renderMemoryView } from './memory-view.mjs';
@@ -291,7 +292,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '2.0.10';
+const PLUGIN_VERSION = '2.1.2';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -3609,7 +3610,11 @@ export async function apply(ctx, config = {}) {
   // v1.7.1: host-side screenshot + clipboard fallbacks. The DSH desktop shell does not grant the
   // renderer getDisplayMedia/navigator.clipboard, so the chat panel needs a host route that does not
   // depend on those permissions.
-  registerCaptureRoutes(ctx);
+  registerCaptureRoutes(ctx);
+  const remoteViewRoutes = registerRemoteViewRoutes(ctx, { stateDir: cfg.stateDir ?? '', p2p });
+  if (remoteViewRoutes.mounted !== true) {
+    ctx.logger?.info?.('w2m: remote-view routes inactive — ' + remoteViewRoutes.reason);
+  }
   if (capabilityRoutes.mounted !== true) {
     ctx.logger?.warn?.('w2m: the execution-capability control is inactive — ' + capabilityRoutes.reason);
   }

package/src/relay/remote-media.mjs

@@ -0,0 +1,87 @@
+/**
+ * P1.5 encrypted relay media broker (in-memory only).
+ *
+ * The relay never sees a JPEG or a session key:
+ *   - payloads are opaque ciphertext, size-capped to fit the relay frame budget;
+ *   - one newest frame per session (latest-frame-wins), no history;
+ *   - every entry expires; nothing is written to disk or logged.
+ *
+ * HTTP/agent wiring is a separate slice; this module is the safety contract.
+ */
+export const REMOTE_MEDIA_CODE = Object.freeze({
+  OK: 'REMOTE_MEDIA_OK',
+  BAD_SESSION: 'REMOTE_MEDIA_BAD_SESSION',
+  BAD_PAYLOAD: 'REMOTE_MEDIA_BAD_PAYLOAD',
+  TOO_LARGE: 'REMOTE_MEDIA_TOO_LARGE',
+  NOT_FOUND: 'REMOTE_MEDIA_NOT_FOUND',
+  EXPIRED: 'REMOTE_MEDIA_EXPIRED',
+});
+
+export const DEFAULT_REMOTE_MEDIA_MAX_BYTES = 47 * 1024;
+export const DEFAULT_REMOTE_MEDIA_TTL_MS = 15_000;
+
+const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+/**
+ * @param {{maxBytes?: number, ttlMs?: number, now?: () => number}} [options]
+ */
+export function createRemoteMediaBroker(options = {}) {
+  const maxBytes = Number.isInteger(options.maxBytes) ? options.maxBytes : DEFAULT_REMOTE_MEDIA_MAX_BYTES;
+  const ttlMs = Number.isInteger(options.ttlMs) ? options.ttlMs : DEFAULT_REMOTE_MEDIA_TTL_MS;
+  const now = typeof options.now === 'function' ? options.now : Date.now;
+  const sessions = new Map();
+
+  const prune = () => {
+    const at = now();
+    for (const [id, entry] of sessions) if (entry.expiresAt <= at) sessions.delete(id);
+  };
+
+  return {
+    maxBytes,
+    ttlMs,
+    /** Open or refresh a session addressed to one target machine. */
+    open(sessionId, targetMachineId) {
+      if (typeof sessionId !== 'string' || sessionId === '' || typeof targetMachineId !== 'string' || targetMachineId === '') {
+        return { ok: false, code: REMOTE_MEDIA_CODE.BAD_SESSION };
+      }
+      sessions.set(sessionId, { target: targetMachineId, frame: null, expiresAt: now() + ttlMs });
+      return { ok: true, code: REMOTE_MEDIA_CODE.OK, session_id: sessionId, target: targetMachineId };
+    },
+    /** Store one opaque ciphertext frame (latest wins). */
+    put(sessionId, targetMachineId, ciphertext) {
+      prune();
+      const entry = sessions.get(sessionId);
+      if (entry === undefined) return { ok: false, code: REMOTE_MEDIA_CODE.NOT_FOUND };
+      if (entry.target !== targetMachineId) return { ok: false, code: REMOTE_MEDIA_CODE.BAD_SESSION };
+      if (!(ciphertext instanceof Uint8Array) || ciphertext.byteLength === 0) return { ok: false, code: REMOTE_MEDIA_CODE.BAD_PAYLOAD };
+      if (ciphertext.byteLength > maxBytes) return { ok: false, code: REMOTE_MEDIA_CODE.TOO_LARGE };
+      entry.frame = { ciphertext: Buffer.from(ciphertext), bytes: ciphertext.byteLength, at: now() };
+      entry.expiresAt = now() + ttlMs;
+      return { ok: true, code: REMOTE_MEDIA_CODE.OK, bytes: ciphertext.byteLength };
+    },
+    /** Read and consume the newest frame, or report why not. */
+    take(sessionId, targetMachineId) {
+      prune();
+      const entry = sessions.get(sessionId);
+      if (entry === undefined) return { ok: false, code: REMOTE_MEDIA_CODE.EXPIRED };
+      if (entry.target !== targetMachineId) return { ok: false, code: REMOTE_MEDIA_CODE.BAD_SESSION };
+      if (entry.frame === null) return { ok: false, code: REMOTE_MEDIA_CODE.NOT_FOUND };
+      const frame = entry.frame;
+      entry.frame = null;
+      return { ok: true, code: REMOTE_MEDIA_CODE.OK, ...frame };
+    },
+    close(sessionId) { sessions.delete(sessionId); },
+    stats() { prune(); return { sessions: sessions.size, maxBytes, ttlMs }; },
+  };
+}
+
+/** Validate the JSON body of a frame write without decoding the ciphertext. */
+export function parseRemoteFrame(body) {
+  if (!isObject(body)) return { ok: false, code: REMOTE_MEDIA_CODE.BAD_PAYLOAD };
+  if (typeof body.session_id !== 'string' || body.session_id === '') return { ok: false, code: REMOTE_MEDIA_CODE.BAD_SESSION };
+  if (typeof body.target !== 'string' || body.target === '') return { ok: false, code: REMOTE_MEDIA_CODE.BAD_SESSION };
+  if (typeof body.ct !== 'string' || body.ct === '') return { ok: false, code: REMOTE_MEDIA_CODE.BAD_PAYLOAD };
+  let ciphertext;
+  try { ciphertext = Buffer.from(body.ct, 'base64'); } catch { return { ok: false, code: REMOTE_MEDIA_CODE.BAD_PAYLOAD }; }
+  return { ok: true, session_id: body.session_id, target: body.target, ciphertext };
+}