@twinsearth/w2m-dsh-plugin 2.0.3 → 2.0.5

package/src/plugin/joint-dev/progress.mjs

@@ -0,0 +1,107 @@
+/**
+ * A5 progress consumer: read the relay's per-task progress for a dispatched joint plan.
+ *
+ * The relay stores no argv/content on the projection either, and this module enforces the same on
+ * the way out: the projection is rebuilt from a small allow-list, and any forbidden key found in the
+ * relay's answer is stripped and reported (never echoed). A relay that predates the `progress` key
+ * (1.9.16) yields PROGRESS_UNSUPPORTED instead of an empty success.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const FORBIDDEN = /^(?:argv|command|command_argv|command_hash|text|content|stdout|stderr|stdout_head|stderr_head|head|tail|patch|diff|env|token|secret|password|base64|blob|blobs|bytes|buffer|files?)$/i;
+
+function sanitize(value, seen = new Set()) {
+  if (value === null || typeof value !== 'object') return value;
+  if (seen.has(value)) return null;
+  seen.add(value);
+  if (Array.isArray(value)) return value.map((entry) => sanitize(entry, seen));
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (FORBIDDEN.test(key)) continue;
+    if (typeof child === 'string' && /(?:[A-Za-z0-9+/]{512,}|[0-9a-fA-F]{512,})/.test(child)) continue;
+    out[key] = sanitize(child, seen);
+  }
+  return out;
+}
+
+const hasForbidden = (value, seen = new Set()) => {
+  if (value === null || typeof value !== 'object') return false;
+  if (seen.has(value)) return false;
+  seen.add(value);
+  if (Array.isArray(value)) return value.some((entry) => hasForbidden(entry, seen));
+  return Object.entries(value).some(([key, child]) => FORBIDDEN.test(key) || hasForbidden(child, seen));
+};
+
+function readDispatchRecord(stateDir, planSha) {
+  if (typeof stateDir !== 'string' || stateDir === '' || typeof planSha !== 'string' || !/^[0-9a-f]{64}$/.test(planSha)) return { ok: false, code: 'NOT_DISPATCHED' };
+  const path = join(stateDir, 'joint-dev', 'dispatches', planSha + '.json');
+  if (!existsSync(path)) return { ok: false, code: 'NOT_DISPATCHED' };
+  try {
+    const record = JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''));
+    if (record?.plan_sha256 !== planSha || !Array.isArray(record.tasks)) return { ok: false, code: 'DISPATCH_RECORD_INVALID' };
+    return { ok: true, record };
+  } catch {
+    return { ok: false, code: 'DISPATCH_RECORD_UNREADABLE' };
+  }
+}
+
+/**
+ * @param {{stateDir: string, planSha: string, relayUrl: string, deviceToken: string,
+ *          fetchImpl?: Function, timeoutMs?: number, taskIds?: Map<string,string>}} input
+ */
+export async function planProgress(input) {
+  const record = readDispatchRecord(input?.stateDir, input?.planSha);
+  if (record.ok !== true) return { ok: false, code: record.code };
+  const fetchImpl = typeof input?.fetchImpl === 'function' ? input.fetchImpl : globalThis.fetch;
+  const timeoutMs = Number.isInteger(input?.timeoutMs) ? input.timeoutMs : 15_000;
+  const base = typeof input?.relayUrl === 'string' ? input.relayUrl.replace(/\/$/, '') : '';
+  if (base === '') return { ok: false, code: 'RELAY_URL_REQUIRED' };
+  const token = typeof input?.deviceToken === 'string' ? input.deviceToken : '';
+  if (token === '') return { ok: false, code: 'DEVICE_TOKEN_REQUIRED' };
+  const steps = [];
+  for (const task of record.record.tasks) {
+    const taskId = String(task?.task_id ?? '');
+    const stepId = String(task?.step_id ?? '');
+    if (taskId === '') continue;
+    let response = null;
+    try {
+      const signal = typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function' ? AbortSignal.timeout(timeoutMs) : undefined;
+      response = await fetchImpl(base + '/v1/tasks/' + encodeURIComponent(taskId), { headers: { authorization: 'Bearer ' + token, accept: 'application/json' }, signal });
+    } catch {
+      steps.push({ step_id: stepId, task_id: taskId, state: 'unreadable', code: 'TASK_UNREADABLE' });
+      continue;
+    }
+    if (response.ok !== true) {
+      steps.push({ step_id: stepId, task_id: taskId, state: 'unavailable', code: response.status === 404 ? 'TASK_NOT_FOUND' : 'TASK_UNREADABLE', http_status: response.status });
+      continue;
+    }
+    let body = null;
+    try { body = await response.json(); } catch { body = null; }
+    if (body === null || typeof body !== 'object') {
+      steps.push({ step_id: stepId, task_id: taskId, state: 'unavailable', code: 'TASK_UNREADABLE' });
+      continue;
+    }
+    const progress = body.progress ?? body.task?.progress ?? null;
+    const row = {
+      step_id: stepId,
+      task_id: taskId,
+      status: body.task?.status ?? body.status ?? null,
+      progress: progress === null ? null : sanitize(progress),
+      leases: Array.isArray(body.leases) ? body.leases.map((lease) => ({ machine_id: lease?.machine_id ?? null, state: lease?.state ?? null })) : [],
+    };
+    if (progress === null) { row.progress_state = 'unavailable'; row.code = 'PROGRESS_UNSUPPORTED'; }
+    if (hasForbidden(body)) row.leak_fields_stripped = true;
+    steps.push(row);
+  }
+  const unavailable = steps.filter((step) => step.progress_state === 'unavailable').length;
+  return {
+    ok: true,
+    plan_sha256: record.record.plan_sha256,
+    approval_sha256: record.record.approval_sha256 ?? null,
+    dispatched_at: record.record.dispatched_at ?? null,
+    progress_state: steps.length > 0 && unavailable === steps.length ? 'unavailable' : 'partial',
+    code: steps.length > 0 && unavailable === steps.length ? 'PROGRESS_UNSUPPORTED' : null,
+    steps,
+  };
+}

package/src/plugin/joint-dev/relay-dispatch.mjs

@@ -12,6 +12,8 @@
  *     returns are checked: a lease on a machine that was not pinned cancels the task and fails.
  */
 import { createHash } from 'node:crypto';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 
 import { appendAudit } from './audit-file.mjs';
 import { inspectControlMessage } from './redline.mjs';
@@ -42,8 +44,13 @@ function orderSteps(steps) {
 }
 
 function writeAudit(file, event) {
-  if (typeof file !== 'string' || file === '') return;
-  try { appendAudit(file, event); } catch { /* an audit write must not change the dispatch outcome */ }
+  // No audit file requested (library callers): nothing to write, and that is not a failure.
+  if (typeof file !== 'string' || file === '') return { ok: true, skipped: true };
+  try {
+    return appendAudit(file, event);
+  } catch (error) {
+    return { ok: false, code: 'AUDIT_WRITE_FAILED', detail: error instanceof Error ? error.message : String(error) };
+  }
 }
 
 /**
@@ -74,35 +81,52 @@ export async function dispatchPlanToRelay(input) {
   const headers = { authorization: `Bearer ${token}`, 'content-type': 'application/json', accept: 'application/json' };
   const auditFile = typeof input?.auditFile === 'string' ? input.auditFile : '';
 
-  // R3: when a device token is supplied, every target machine must advertise the same plugin version.
-  if (typeof input?.deviceToken === 'string' && input.deviceToken !== '') {
-    const expected = typeof input?.expectedVersion === 'string' ? input.expectedVersion : null;
-    if (expected !== null) {
-      let fleet;
+  // D2 (B5): the version gate is observable and defaults to warn. It becomes a refusal only when the
+  // caller explicitly asks for enforce; a mixed-version fleet is reported, not silently assumed clean.
+  const versionGate = input?.versionGate === 'off' || input?.versionGate === 'enforce' ? input.versionGate : 'warn';
+  const warnings = [];
+  const expectedVersion = typeof input?.expectedVersion === 'string' && input.expectedVersion !== '' ? input.expectedVersion : null;
+  if (expectedVersion !== null && !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(expectedVersion)) {
+    return { ok: false, code: 'VERSION_UNPARSED', detail: { expected: expectedVersion } };
+  }
+  if (versionGate !== 'off' && expectedVersion !== null) {
+    const deviceToken = typeof input?.deviceToken === 'string' && input.deviceToken !== '' ? input.deviceToken : '';
+    let fleet = null;
+    if (deviceToken !== '') {
       try {
-        const response = await fetchImpl(`${rabbitUrl}/v1/devices`, { headers: { authorization: `Bearer ${input.deviceToken}`, accept: 'application/json' }, signal: signalOf() });
+        const response = await fetchImpl(`${rabbitUrl}/v1/devices`, { headers: { authorization: `Bearer ${deviceToken}`, accept: 'application/json' }, signal: signalOf() });
         fleet = response.ok === true ? await response.json() : null;
       } catch { fleet = null; }
-      if (fleet === null || !Array.isArray(fleet.devices)) return { ok: false, code: 'VERSION_UNVERIFIABLE', detail: { reason: 'the relay device list could not be read' } };
+    }
+    if (fleet === null || !Array.isArray(fleet.devices)) {
+      if (versionGate === 'enforce') return { ok: false, code: 'VERSION_UNVERIFIABLE', detail: { reason: 'the relay device list could not be read', expected: expectedVersion } };
+      warnings.push({ code: 'VERSION_UNVERIFIABLE', detail: 'the relay device list could not be read' });
+    } else {
       const byId = new Map(fleet.devices.map((device) => [device.machine_id, device]));
       const skew = ordered.steps
         .map((step) => ({ machine_id: step.machine_id, version: byId.get(step.machine_id)?.caps?.plugin_version ?? null }))
-        .filter((row) => row.version !== expected);
-      if (skew.length > 0) return { ok: false, code: 'VERSION_SKEW', detail: { expected, machines: skew } };
+        .filter((row) => row.version !== expectedVersion);
+      if (skew.length > 0) {
+        if (versionGate === 'enforce') return { ok: false, code: 'VERSION_SKEW', detail: { expected: expectedVersion, machines: skew } };
+        warnings.push({ code: 'VERSION_SKEW', detail: { expected: expectedVersion, machines: skew } });
+      }
     }
   }
 
   const capabilities = await readRelayCapabilities({ rabbitUrl, fetchImpl, timeoutMs });
   if (capabilities.ok !== true) return { ok: false, code: 'RELAY_CAPABILITIES_UNAVAILABLE', detail: { relay: rabbitUrl, error: capabilities.error ?? null } };
-  if (capabilities.signing_required === true) return { ok: false, code: 'RELAY_SIGNING_REQUIRED', detail: { relay: rabbitUrl } };
-  if (capabilities.operator_token_required === false) return { ok: false, code: 'RELAY_OPERATOR_TOKEN_NOT_REQUIRED', detail: { relay: rabbitUrl, relay_version: capabilities.relay_version ?? null } };
   const negotiation = negotiateFeatures(capabilities);
   if (negotiation.ok !== true) {
     return { ok: false, code: negotiation.code ?? 'RELAY_CAPABILITIES_MISSING', detail: { missing: negotiation.missing ?? null, relay: rabbitUrl } };
   }
+  if (capabilities.signing_required !== false) {
+    return { ok: false, code: capabilities.signing_required === true ? 'RELAY_SIGNING_REQUIRED' : 'SIGNING_UNVERIFIABLE', detail: { relay: rabbitUrl, signing_required: capabilities.signing_required } };
+  }
+  if (capabilities.operator_token_required !== true) return { ok: false, code: capabilities.operator_token_required === false ? 'RELAY_OPERATOR_TOKEN_NOT_REQUIRED' : 'OPERATOR_TOKEN_UNVERIFIED', detail: { relay: rabbitUrl, relay_version: capabilities.relay_version ?? null } };
 
   const dispatched = new Map(); // step_id -> task_id
   const tasks = [];
+  const dispatchDir = typeof input?.dispatchDir === 'string' && input.dispatchDir !== '' ? input.dispatchDir : null;
   for (const step of ordered.steps) {
     const taskId = taskIdOf(plan.plan_sha256, step.step_id);
     const dependsOn = (step.depends_on ?? []).map((dep) => dispatched.get(dep)).filter((id) => typeof id === 'string');
@@ -113,6 +137,7 @@ export async function dispatchPlanToRelay(input) {
       executor_machine_id: step.machine_id,
       command_argv: step.command_argv,
       command_hash: step.command_hash,
+      cwd_rel: typeof step.cwd_rel === 'string' && step.cwd_rel !== '' ? step.cwd_rel : '.',
       base_commit: plan.base_commit,
       plan_sha256: plan.plan_sha256,
       approval_sha256: approval.approval_sha256,
@@ -120,16 +145,19 @@ export async function dispatchPlanToRelay(input) {
       ...(dependsOn.length > 0 ? { depends_on: dependsOn } : {}),
       ...(Array.isArray(step.write_scope) && step.write_scope.length > 0 ? { write: true, write_scope: step.write_scope } : {}),
       ...(step.timeout_ms === undefined ? {} : { timeout_ms: step.timeout_ms }),
-      ...(input?.includeOffline === false ? {} : { include_offline: true }),
+      ...(input?.includeOffline === true ? { include_offline: true } : {}),
     };
     const check = inspectControlMessage({ v: 1, type: 'joint.dispatch', body });
     if (check.ok !== true) {
       writeAudit(auditFile, { event: 'joint.dispatch.refused', plan_sha256: plan.plan_sha256, step_id: step.step_id, reason_code: check.code ?? 'CONTROL_REFUSED' });
       return { ok: false, code: check.code ?? 'CONTROL_REFUSED', detail: check.detail ?? null, partial: tasks.length > 0, tasks };
     }
+    const controlText = JSON.stringify(body);
+    const audited = writeAudit(auditFile, { event: 'joint.dispatch.sending', plan_sha256: plan.plan_sha256, step_id: step.step_id, task_id: taskId, machine_id: step.machine_id, control_bytes: Buffer.byteLength(controlText), control_sha256: sha256(controlText) });
+    if (audited.ok !== true) return { ok: false, code: 'AUDIT_UNAVAILABLE', detail: audited, partial: tasks.length > 0, tasks };
     let response;
     try {
-      response = await fetchImpl(`${rabbitUrl}/v1/task`, { method: 'POST', headers, body: JSON.stringify(body), signal: signalOf() });
+      response = await fetchImpl(`${rabbitUrl}/v1/task`, { method: 'POST', headers, body: controlText, signal: signalOf() });
     } catch (error) {
       writeAudit(auditFile, { event: 'joint.dispatch.failed', plan_sha256: plan.plan_sha256, step_id: step.step_id, task_id: taskId, reason_code: 'RELAY_UNREACHABLE' });
       return { ok: false, code: 'RELAY_UNREACHABLE', detail: error instanceof Error ? error.message : String(error), partial: tasks.length > 0, tasks };
@@ -142,12 +170,7 @@ export async function dispatchPlanToRelay(input) {
         const read = await fetchImpl(`${rabbitUrl}/v1/tasks/${encodeURIComponent(taskId)}`, { headers, signal: signalOf() });
         existing = read.ok === true ? await read.json() : null;
       } catch { existing = null; }
-      if (existing === null) {
-        writeAudit(auditFile, { event: 'joint.dispatch.already', plan_sha256: plan.plan_sha256, step_id: step.step_id, task_id: taskId });
-        dispatched.set(step.step_id, taskId);
-        tasks.push({ step_id: step.step_id, task_id: taskId, already: true, leases: [] });
-        continue;
-      }
+      if (existing === null) return { ok: false, code: 'TASK_EXISTS_UNVERIFIED', detail: { step_id: step.step_id, task_id: taskId }, partial: tasks.length > 0, tasks };
       const existingLeases = Array.isArray(existing?.leases) ? existing.leases : [];
       const mine = existingLeases.filter((lease) => lease?.machine_id === step.machine_id);
       if (existingLeases.length > 0 && mine.length === 0) return { ok: false, code: 'TASK_EXISTS_FOREIGN', detail: { step_id: step.step_id, task_id: taskId }, partial: tasks.length > 0, tasks };
@@ -196,5 +219,12 @@ export async function dispatchPlanToRelay(input) {
       leases: leases.map((lease) => ({ machine_id: lease?.machine_id ?? null, state: lease?.state ?? null })),
     });
   }
-  return { ok: true, relay_version: capabilities.relay_version ?? null, features: capabilities.features ?? null, tasks };
+  if (dispatchDir !== null) {
+    try {
+      mkdirSync(dispatchDir, { recursive: true, mode: 0o700 });
+      const file = join(dispatchDir, plan.plan_sha256 + '.json');
+      writeFileSync(file, JSON.stringify({ v: 1, plan_sha256: plan.plan_sha256, approval_sha256: approval.approval_sha256, dispatched_at: new Date().toISOString(), tasks: tasks.map((task) => ({ step_id: task.step_id, task_id: task.task_id, machine_id: task.leases?.[0]?.machine_id ?? null, already: task.already === true })) }, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+    } catch { /* the progress view is best effort; dispatch itself already happened */ }
+  }
+  return { ok: true, relay_version: capabilities.relay_version ?? null, features: capabilities.features ?? null, version_gate: versionGate, ...(warnings.length > 0 ? { warnings } : {}), tasks };
 }

package/src/plugin/project-stream-route.mjs

@@ -0,0 +1,58 @@
+/**
+ * `/api/w2m/project-stream` (A6): authenticated SSE proxy for the read-only project panel.
+ *
+ * The browser cannot set an Authorization header on EventSource, and the device token must not be
+ * exposed to client code. This route takes the project id and cursor from the local user, attaches
+ * the device token server-side and streams the relay's frames through unchanged (including the
+ * PROJECT_REPLAY_TRUNCATED notice).
+ */
+export const PROJECT_STREAM_ROUTE_PATH = '/api/w2m/project-stream';
+const NO_STORE = { 'cache-control': 'no-store' };
+
+/**
+ * @param {object} ctx Cordis context
+ * @param {{relayUrl?: () => string|null, deviceToken?: () => Promise<string|null>|string|null}} [deps]
+ */
+export function registerProjectStreamRoute(ctx, deps = {}) {
+  const status = { mounted: false, reason: 'the host has no Connection service' };
+  if (typeof ctx?.inject !== 'function') return status;
+  ctx.inject(['connection'], (webCtx) => {
+    const registry = webCtx?.connection?.fetch;
+    if (registry === undefined || typeof registry.register !== 'function') {
+      status.reason = 'the connection service carries no fetch registry';
+      return;
+    }
+    registry.register({
+      path: PROJECT_STREAM_ROUTE_PATH,
+      methods: ['GET'],
+      fetch: async (request) => {
+        const url = new URL(request.url ?? 'http://local.invalid/api/w2m/project-stream');
+        const projectId = url.searchParams.get('project_id') ?? '';
+        if (!/^[A-Za-z0-9._-]{1,80}$/.test(projectId)) {
+          return Response.json({ ok: false, code: 'PROJECT_ID_INVALID' }, { status: 400, headers: NO_STORE });
+        }
+        const sinceRaw = url.searchParams.get('since_seq') ?? '0';
+        if (!/^[0-9]+$/.test(sinceRaw)) return Response.json({ ok: false, code: 'PROJECT_CURSOR_INVALID' }, { status: 400, headers: NO_STORE });
+        const relayUrl = typeof deps?.relayUrl === 'function' ? deps.relayUrl() : null;
+        if (typeof relayUrl !== 'string' || relayUrl === '') return Response.json({ ok: false, code: 'RELAY_URL_REQUIRED' }, { status: 503, headers: NO_STORE });
+        const token = typeof deps?.deviceToken === 'function' ? await deps.deviceToken() : null;
+        if (typeof token !== 'string' || token === '') return Response.json({ ok: false, code: 'DEVICE_TOKEN_REQUIRED' }, { status: 503, headers: NO_STORE });
+        const target = relayUrl.replace(/\/$/, '') + '/v1/projects/' + encodeURIComponent(projectId) + '/stream?since_seq=' + sinceRaw;
+        let upstream = null;
+        try {
+          upstream = await fetch(target, { headers: { authorization: 'Bearer ' + token, accept: 'text/event-stream' }, signal: request.signal });
+        } catch {
+          return Response.json({ ok: false, code: 'PROJECT_STREAM_UNAVAILABLE' }, { status: 502, headers: NO_STORE });
+        }
+        if (upstream.ok !== true || upstream.body === null) return Response.json({ ok: false, code: 'PROJECT_STREAM_REFUSED', http_status: upstream.status }, { status: 502, headers: NO_STORE });
+        return new Response(upstream.body, {
+          status: 200,
+          headers: { 'content-type': 'text/event-stream', 'cache-control': 'no-store', connection: 'keep-alive' },
+        });
+      },
+    });
+    status.mounted = true;
+    status.reason = null;
+  });
+  return status;
+}

package/src/plugin/tools-joint.mjs

@@ -11,7 +11,7 @@ import { loadOperatorKey } from './operator-key.mjs';
 
 const json = (value) => JSON.stringify(value, null, 2);
 
-export function registerJointTools(ctx, { defineTool, stateDir, machineName, output }) {
+export function registerJointTools(ctx, { defineTool, stateDir, machineName, output, progress }) {
   const requireStateDir = () => {
     if (typeof stateDir === 'string' && stateDir !== '') return stateDir;
     return null;
@@ -69,12 +69,17 @@ export function registerJointTools(ctx, { defineTool, stateDir, machineName, out
       'returns argv, output or file bytes, and it cannot approve or dispatch.',
     parameters: {
       plan_sha256: { type: 'string', description: 'the 64-hex plan id' },
+      action: { type: 'string', enum: ['status', 'progress'], description: 'status (default) or progress (relay projection; PROGRESS_UNSUPPORTED on an old relay)' },
     },
     output: output ?? { type: 'json' },
     async execute(args) {
       const dir = requireStateDir();
       if (dir === null) return json({ ok: false, code: 'JOINT_STATE_UNAVAILABLE' });
       const planSha = String(args?.plan_sha256 ?? '');
+      if ((args?.action ?? 'status') === 'progress') {
+        if (typeof progress !== 'function') return json({ ok: false, code: 'PROGRESS_UNAVAILABLE' });
+        return json(await progress({ planSha }));
+      }
       const plan = loadPlan({ stateDir: dir, planSha });
       if (plan.ok !== true) return json(plan);
       const key = loadOperatorKey();

package/src/plugin/tools.mjs

@@ -191,7 +191,10 @@ import {
 import { registerChatRoutes } from './fleet-chat-route.mjs';
 import { registerExecCapabilityRoutes } from './exec-capability-route.mjs';
 import { registerPluginUpdateRoutes } from './update-route.mjs';
-import { registerOperatorTokenRoute } from './operator-token-route.mjs';
+import { registerOperatorTokenRoute } from './operator-token-route.mjs';
+import { registerDataplaneSinkRoute } from './dataplane-sink-route.mjs';
+import { registerProjectStreamRoute } from './project-stream-route.mjs';
+import { planProgress } from './joint-dev/progress.mjs';
 import { registerJointTools } from './tools-joint.mjs';
 import { fingerprintOf, readOperatorToken } from './operator-token.mjs';
 import { registerCaptureRoutes } from './capture-route.mjs';
@@ -286,7 +289,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '2.0.3';
+const PLUGIN_VERSION = '2.0.5';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -3586,6 +3589,10 @@ export async function apply(ctx, config = {}) {
   // verified updater (SHA-256 checked, old package backed up, restart required afterwards).
   const _updateRoutes = registerPluginUpdateRoutes(ctx, { profileDir: () => cfg.profileDir });
     const _operatorTokenRoute = registerOperatorTokenRoute(ctx, { configuredToken: () => cfg.operatorToken });
+  // A3/S4: local-user authorization of the artifact sink. Not reachable from any tool schema.
+  const _dataplaneSinkRoute = registerDataplaneSinkRoute(ctx, { stateDir: () => resolveStateDir(cfg.stateDir, 'joint-dev') });
+  // A6: read-only project SSE proxy (device token stays in the host process).
+  const _projectStreamRoute = registerProjectStreamRoute(ctx, { relayUrl: () => cfg.rabbitUrl, deviceToken: () => resolveToken(cfg) });
 
   // v1.7.1: host-side screenshot + clipboard fallbacks. The DSH desktop shell does not grant the
   // renderer getDisplayMedia/navigator.clipboard, so the chat panel needs a host route that does not
@@ -3628,8 +3635,21 @@ export async function apply(ctx, config = {}) {
   // -------------------------------------------------------------------------------------------
   // 1. w2m_device - read-only
   // -------------------------------------------------------------------------------------------
-  registerJointTools(ctx, { defineTool, stateDir: cfg.stateDir, machineName: cfg.machineName, output: jsonOutput });
-
+  registerJointTools(ctx, {
+    defineTool,
+    stateDir: resolveStateDir(cfg.stateDir, 'joint-dev'),
+    machineName: cfg.machineName,
+    output: jsonOutput,
+    progress: async ({ planSha }) => {
+      try {
+        const token = await resolveToken(cfg);
+        return await planProgress({ stateDir: resolveStateDir(cfg.stateDir, 'joint-dev'), planSha, relayUrl: cfg.rabbitUrl, deviceToken: token });
+      } catch {
+        return { ok: false, code: 'PROGRESS_UNAVAILABLE' };
+      }
+    },
+  });
+
   ctx.tools.register(defineTool({
     name: 'w2m_devices',
     description:
@@ -7309,7 +7329,7 @@ hint: 'the local fleet-memory.md is unchanged; action read/show still reads loca
       const base = requireRabbit(cfg);
       const taskId = typeof args?.task_id === 'string' ? args.task_id.trim() : '';
       if (taskId === '') throw new W2MError('W2M_BAD_TASK_ID', '`task_id` must be a non-empty string');
-      const token = await resolveToken(cfg);
+      const token = requireOperatorToken(cfg);
       const cancelled = await request({
         rabbitUrl: base,
         token,

package/src/relay/fleet-messages.mjs

@@ -35,6 +35,11 @@ export const RETENTION_DAYS = 7;
 /** One message. Text is cheap; a 4 KiB cap keeps a single paste from eating the budget. */
 export const MAX_MESSAGE_BYTES = 4 * 1024;
 
+/** The only cipher the relay accepts in an `enc` envelope (it never holds a key). */
+const CHAT_ALG = 'aes-256-gcm';
+/** AEAD v2: adds an AAD object binding the ciphertext to session/machine/message id. */
+const CHAT_ENC_V2 = 2;
+
 const DAY_MS = 24 * 60 * 60 * 1000;
 
 /**
@@ -101,10 +106,10 @@ export function createFleetMessages(options = {}) {
     if (sessionId === '') return { ok: false, code: 'BAD_SESSION' };
     const machineId = typeof input?.machine_id === 'string' ? input.machine_id.trim() : '';
     if (machineId === '') return { ok: false, code: 'BAD_MACHINE' };
-    // v1.9.18: chat carries text and slash-command text only; images never travel over the relay.
-    const MEDIA_FIELDS = ['image', 'image_url', 'image_base64', 'image_bytes', 'picture', 'photo', 'thumb', 'thumbnail', 'attachment', 'attachments', 'file', 'files', 'data', 'base64', 'blob', 'binary', 'buffer', 'media', 'sticker_image', 'sticker_data', 'gif', 'png', 'jpeg', 'webp'];
-    const mediaField = Object.keys(input ?? {}).find((key) => MEDIA_FIELDS.includes(key.toLowerCase()));
-    if (mediaField !== undefined) return { ok: false, code: 'CHAT_FIELD_FORBIDDEN', detail: { field: mediaField } };
+    // v1.9.18: chat carries text and slash-command text only; images never travel over the relay.
+    const MEDIA_FIELDS = ['image', 'image_url', 'image_base64', 'image_bytes', 'picture', 'photo', 'thumb', 'thumbnail', 'attachment', 'attachments', 'file', 'files', 'data', 'base64', 'blob', 'binary', 'buffer', 'media', 'sticker_image', 'sticker_data', 'gif', 'png', 'jpeg', 'webp'];
+    const mediaField = Object.keys(input ?? {}).find((key) => MEDIA_FIELDS.includes(key.toLowerCase()));
+    if (mediaField !== undefined) return { ok: false, code: 'CHAT_FIELD_FORBIDDEN', detail: { field: mediaField } };
     if (typeof input?.text !== 'string') return { ok: false, code: 'NOT_TEXT' };
     const text = input.text;
     if (text.trim() === '') return { ok: false, code: 'EMPTY_TEXT' };
@@ -128,30 +133,49 @@ export function createFleetMessages(options = {}) {
     const rawEnc = input?.enc;
     let enc = null;
     if (rawEnc !== undefined && rawEnc !== null) {
+      if (typeof rawEnc !== 'object' || Array.isArray(rawEnc)) return { ok: false, code: 'BAD_ENCRYPTION' };
       const ivOk = typeof rawEnc.iv === 'string' && rawEnc.iv.length > 0 && rawEnc.iv.length <= 64;
       const tagOk = typeof rawEnc.tag === 'string' && rawEnc.tag.length > 0 && rawEnc.tag.length <= 64;
-      if (rawEnc.v !== 1 || rawEnc.alg !== 'aes-256-gcm' || !ivOk || !tagOk) return { ok: false, code: 'BAD_ENCRYPTION' };
-      enc = { v: 1, alg: 'aes-256-gcm', iv: rawEnc.iv, tag: rawEnc.tag };
+      if (rawEnc.alg !== CHAT_ALG || !ivOk || !tagOk) return { ok: false, code: 'BAD_ENCRYPTION' };
+      if (rawEnc.v === 1) {
+        enc = { v: 1, alg: CHAT_ALG, iv: rawEnc.iv, tag: rawEnc.tag };
+      } else if (rawEnc.v === CHAT_ENC_V2) {
+        // AEAD v2 binds the ciphertext to its context. The AAD travels in the clear so every
+        // reader can rebuild it, and the GCM tag authenticates those exact bytes. The relay knows
+        // session_id/machine_id, so it refuses clear AAD naming another session or machine; it never
+        // sees a key and never inspects the ciphertext.
+        const aad = rawEnc.aad;
+        if (aad === null || typeof aad !== 'object' || Array.isArray(aad)) return { ok: false, code: 'CHAT_AAD_MISSING' };
+        const aadSession = typeof aad.session_id === 'string' ? aad.session_id : '';
+        const aadMachine = typeof aad.machine_id === 'string' ? aad.machine_id : '';
+        const aadMessage = typeof aad.message_id === 'string' ? aad.message_id : '';
+        if (aadSession !== sessionId || aadMachine !== machineId) return { ok: false, code: 'CHAT_AAD_MISMATCH' };
+        // eslint-disable-next-line no-control-regex
+        if (aadMessage === '' || aadMessage.length > 64 || /[\u0000-\u001F]/.test(aadMessage)) return { ok: false, code: 'CHAT_AAD_INVALID' };
+        enc = { v: CHAT_ENC_V2, alg: CHAT_ALG, iv: rawEnc.iv, tag: rawEnc.tag, aad: { session_id: aadSession, machine_id: aadMachine, message_id: aadMessage } };
+      } else {
+        return { ok: false, code: 'BAD_ENCRYPTION' };
+      }
+    }
+
+    // v1.9.18: a plain-text message may not smuggle an image payload. Encrypted text is exempt:
+    // it is base64 ciphertext by design and the relay cannot (and must not) inspect it.
+    if (enc === null) {
+      if (/data:(?:image|video|audio)\//i.test(text) || /!\[[^\]]*\]\(/i.test(text)) {
+        return { ok: false, code: 'TEXT_IMAGE_FORBIDDEN' };
+      }
+      const block = text.match(/[A-Za-z0-9+/]{256,}={0,2}/);
+      if (block !== null) {
+        try {
+          const head = Buffer.from(block[0].slice(0, 32), 'base64');
+          const magic = head.slice(0, 4).toString('latin1');
+          if ((head[0] === 0x89 && head.slice(1, 4).toString('latin1') === 'PNG') || (head[0] === 0xff && head[1] === 0xd8) || magic.startsWith('GIF8') || magic.startsWith('RIFF')) {
+            return { ok: false, code: 'TEXT_BINARY_FORBIDDEN' };
+          }
+        } catch { /* not base64 that matters */ }
+      }
     }
 
-    // v1.9.18: a plain-text message may not smuggle an image payload. Encrypted text is exempt:
-    // it is base64 ciphertext by design and the relay cannot (and must not) inspect it.
-    if (enc === null) {
-      if (/data:(?:image|video|audio)\//i.test(text) || /!\[[^\]]*\]\(/i.test(text)) {
-        return { ok: false, code: 'TEXT_IMAGE_FORBIDDEN' };
-      }
-      const block = text.match(/[A-Za-z0-9+/]{256,}={0,2}/);
-      if (block !== null) {
-        try {
-          const head = Buffer.from(block[0].slice(0, 32), 'base64');
-          const magic = head.slice(0, 4).toString('latin1');
-          if ((head[0] === 0x89 && head.slice(1, 4).toString('latin1') === 'PNG') || (head[0] === 0xff && head[1] === 0xd8) || magic.startsWith('GIF8') || magic.startsWith('RIFF')) {
-            return { ok: false, code: 'TEXT_BINARY_FORBIDDEN' };
-          }
-        } catch { /* not base64 that matters */ }
-      }
-    }
-
     // v1.2.5 idempotency: replay the first message instead of storing the text twice.
     const idempotencyKey = typeof input?.idempotency_key === 'string' && input.idempotency_key.trim() !== ''
       ? input.idempotency_key.trim().slice(0, 64)

package/src/relay/project-room.mjs

@@ -147,8 +147,20 @@ export function createProjectRoom({ now = () => Date.now(), onEvent = null } = {
     /** Incremental events for one project, seq strictly greater than sinceSeq. */
     events({ projectId, sinceSeq = 0, limit = 200 }) {
       requireProject(projectId);
-      const slice = events.filter((event) => event.project_id === projectId && event.seq > sinceSeq).slice(0, limit);
-      return { events: slice.map((event) => ({ ...event, payload: { ...event.payload } })), next_seq: slice.length > 0 ? slice[slice.length - 1].seq : sinceSeq };
+      const projectEvents = events.filter((event) => event.project_id === projectId);
+      const available = projectEvents.filter((event) => event.seq > sinceSeq);
+      const slice = available.slice(0, Math.max(0, limit));
+      const latestSeq = projectEvents.length > 0 ? projectEvents[projectEvents.length - 1].seq : sinceSeq;
+      return {
+        events: slice.map((event) => ({ ...event, payload: { ...event.payload } })),
+        next_seq: slice.length > 0 ? slice[slice.length - 1].seq : sinceSeq,
+        latest_seq: latestSeq,
+        oldest_available_seq: available.length > 0 ? available[0].seq : null,
+        // More events exist than this page returned: the client must page with next_seq instead of
+        // assuming the replay is complete (the old shape made an over-limit page look final).
+        truncated: available.length > slice.length,
+        remaining: Math.max(0, available.length - slice.length),
+      };
     },
     /** Projects a member belongs to. */
     listProjects({ member }) {
@@ -158,6 +170,39 @@ export function createProjectRoom({ now = () => Date.now(), onEvent = null } = {
       requireProject(projectId);
       return { ok: true, event: emit(projectId, type, actor, payload) };
     },
+    /**
+     * A6: self-contained state for persistence. Projects and the event log are plain data, so the
+     * snapshot is the exact object that <stateDir>/projects can be rebuilt from.
+     */
+    toSnapshot() {
+      return {
+        v: 1,
+        counter,
+        seq,
+        last_event_seq: seq,
+        projects: [...projects.values()].map((project) => JSON.parse(JSON.stringify(project))),
+        events: events.map((event) => JSON.parse(JSON.stringify(event))),
+      };
+    },
+    /** Restore a snapshot produced by toSnapshot; refuses anything not shaped like one. */
+    restore(snapshot) {
+      if (snapshot === null || typeof snapshot !== 'object' || snapshot.v !== 1 || !Array.isArray(snapshot.projects) || !Array.isArray(snapshot.events)) {
+        throw new ProjectRoomError('BAD_SNAPSHOT', 'project room snapshot is not shaped like v1');
+      }
+      projects.clear();
+      for (const project of snapshot.projects) {
+        if (typeof project?.project_id !== 'string' || !Array.isArray(project.members)) throw new ProjectRoomError('BAD_SNAPSHOT', 'project entry is invalid');
+        projects.set(project.project_id, project);
+      }
+      events.length = 0;
+      for (const event of snapshot.events) {
+        if (event === null || typeof event !== 'object' || !Number.isInteger(event.seq) || typeof event.project_id !== 'string') throw new ProjectRoomError('BAD_SNAPSHOT', 'event entry is invalid');
+        events.push(event);
+      }
+      seq = Math.max(Number.isInteger(snapshot.seq) ? snapshot.seq : 0, Number.isInteger(snapshot.last_event_seq) ? snapshot.last_event_seq : 0);
+      counter = Number.isInteger(snapshot.counter) ? snapshot.counter : snapshot.projects.length;
+      return { ok: true, projects: projects.size, events: events.length, last_event_seq: seq };
+    },
     size() { return { projects: projects.size, events: events.length, last_seq: seq }; },
   };
 }

package/src/relay/server.mjs

@@ -31,8 +31,9 @@ export const RELAY_FEATURES = Object.freeze([
   'target-machines',
   'result-projection',
   'guard-v1',
-  'relay-version-v1',
+  'relay-version-v1',
   'chat-text-only-v1',
+  'chat-enc-v2',
 ]);
 import fs from 'node:fs';
 import os from 'node:os';
@@ -1101,8 +1102,13 @@ export class RelayServer {
       const frame = (entry) => {
         try { res.write('id: ' + entry.seq + '\nevent: project.event\ndata: ' + JSON.stringify({ project_id: entry.project_id, seq: entry.seq, type: entry.type, payload: entry.payload }) + '\n\n'); } catch { /* closed */ }
       };
-      const replayed = this.state.projects.events({ projectId, sinceSeq });
-      res.write('event: ready\ndata: ' + JSON.stringify({ protocol_version: PROTOCOL_VERSION, project_id: projectId, last_event_seq: replayed.next_seq }) + '\n\n');
+      const replayed = this.state.projects.events({ projectId, sinceSeq, limit: 500 });
+      if (replayed.truncated === true) {
+        // An aborted stream that missed more events than one page holds must be told so explicitly;
+        // otherwise it believes ready.last_event_seq is the whole story.
+        res.write('event: notice\ndata: ' + JSON.stringify({ code: 'PROJECT_REPLAY_TRUNCATED', project_id: projectId, next_seq: replayed.next_seq, latest_seq: replayed.latest_seq, remaining: replayed.remaining }) + '\n\n');
+      }
+      res.write('event: ready\ndata: ' + JSON.stringify({ protocol_version: PROTOCOL_VERSION, project_id: projectId, last_event_seq: replayed.latest_seq ?? replayed.next_seq, replayed_through: replayed.next_seq }) + '\n\n');
       for (const entry of replayed.events) frame(entry);
       const unsubscribe = this.state.onProjectEvent((entry) => { if (entry.project_id === projectId) frame(entry); });
       const keepalive = setInterval(() => { try { res.write(': keepalive\n\n'); } catch { /* closed */ } }, this.keepaliveMs);
@@ -1250,8 +1256,8 @@ export class RelayServer {
     if (method === 'POST' && path === '/v1/result') {
       const body = takeJson();
       // B1 方案 A：window 模式接收旧信封（含 argv/head）并投影后存储；enforce 才硬拒。
-    const dataPlaneGuardMode = String(process.env.W2M_DATA_PLANE_GUARD ?? 'window');
-    // decision 5: enforce is not allowed. The flag is read and reported, but never changes behaviour.
+    const dataPlaneGuardMode = String(process.env.W2M_DATA_PLANE_GUARD ?? 'window');
+    // decision 5: enforce is not allowed. The flag is read and reported, but never changes behaviour.
     if (dataPlaneGuardMode === 'enforce' && this.allowDataPlaneGuardEnforce === true) {
       const resultGuard = guardResultEnvelope(body);
       if (resultGuard.ok !== true) {