@twinsearth/w2m-dsh-plugin 2.0.4 → 2.0.5

package/src/plugin/tools.mjs

@@ -191,7 +191,10 @@ import {
 import { registerChatRoutes } from './fleet-chat-route.mjs';
 import { registerExecCapabilityRoutes } from './exec-capability-route.mjs';
 import { registerPluginUpdateRoutes } from './update-route.mjs';
-import { registerOperatorTokenRoute } from './operator-token-route.mjs';
+import { registerOperatorTokenRoute } from './operator-token-route.mjs';
+import { registerDataplaneSinkRoute } from './dataplane-sink-route.mjs';
+import { registerProjectStreamRoute } from './project-stream-route.mjs';
+import { planProgress } from './joint-dev/progress.mjs';
 import { registerJointTools } from './tools-joint.mjs';
 import { fingerprintOf, readOperatorToken } from './operator-token.mjs';
 import { registerCaptureRoutes } from './capture-route.mjs';
@@ -286,7 +289,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '2.0.4';
+const PLUGIN_VERSION = '2.0.5';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -3586,6 +3589,10 @@ export async function apply(ctx, config = {}) {
   // verified updater (SHA-256 checked, old package backed up, restart required afterwards).
   const _updateRoutes = registerPluginUpdateRoutes(ctx, { profileDir: () => cfg.profileDir });
     const _operatorTokenRoute = registerOperatorTokenRoute(ctx, { configuredToken: () => cfg.operatorToken });
+  // A3/S4: local-user authorization of the artifact sink. Not reachable from any tool schema.
+  const _dataplaneSinkRoute = registerDataplaneSinkRoute(ctx, { stateDir: () => resolveStateDir(cfg.stateDir, 'joint-dev') });
+  // A6: read-only project SSE proxy (device token stays in the host process).
+  const _projectStreamRoute = registerProjectStreamRoute(ctx, { relayUrl: () => cfg.rabbitUrl, deviceToken: () => resolveToken(cfg) });
 
   // v1.7.1: host-side screenshot + clipboard fallbacks. The DSH desktop shell does not grant the
   // renderer getDisplayMedia/navigator.clipboard, so the chat panel needs a host route that does not
@@ -3628,8 +3635,21 @@ export async function apply(ctx, config = {}) {
   // -------------------------------------------------------------------------------------------
   // 1. w2m_device - read-only
   // -------------------------------------------------------------------------------------------
-  registerJointTools(ctx, { defineTool, stateDir: cfg.stateDir, machineName: cfg.machineName, output: jsonOutput });
-
+  registerJointTools(ctx, {
+    defineTool,
+    stateDir: resolveStateDir(cfg.stateDir, 'joint-dev'),
+    machineName: cfg.machineName,
+    output: jsonOutput,
+    progress: async ({ planSha }) => {
+      try {
+        const token = await resolveToken(cfg);
+        return await planProgress({ stateDir: resolveStateDir(cfg.stateDir, 'joint-dev'), planSha, relayUrl: cfg.rabbitUrl, deviceToken: token });
+      } catch {
+        return { ok: false, code: 'PROGRESS_UNAVAILABLE' };
+      }
+    },
+  });
+
   ctx.tools.register(defineTool({
     name: 'w2m_devices',
     description:
@@ -7309,7 +7329,7 @@ hint: 'the local fleet-memory.md is unchanged; action read/show still reads loca
       const base = requireRabbit(cfg);
       const taskId = typeof args?.task_id === 'string' ? args.task_id.trim() : '';
       if (taskId === '') throw new W2MError('W2M_BAD_TASK_ID', '`task_id` must be a non-empty string');
-      const token = await resolveToken(cfg);
+      const token = requireOperatorToken(cfg);
       const cancelled = await request({
         rabbitUrl: base,
         token,

package/src/relay/fleet-messages.mjs

@@ -35,6 +35,11 @@ export const RETENTION_DAYS = 7;
 /** One message. Text is cheap; a 4 KiB cap keeps a single paste from eating the budget. */
 export const MAX_MESSAGE_BYTES = 4 * 1024;
 
+/** The only cipher the relay accepts in an `enc` envelope (it never holds a key). */
+const CHAT_ALG = 'aes-256-gcm';
+/** AEAD v2: adds an AAD object binding the ciphertext to session/machine/message id. */
+const CHAT_ENC_V2 = 2;
+
 const DAY_MS = 24 * 60 * 60 * 1000;
 
 /**
@@ -101,10 +106,10 @@ export function createFleetMessages(options = {}) {
     if (sessionId === '') return { ok: false, code: 'BAD_SESSION' };
     const machineId = typeof input?.machine_id === 'string' ? input.machine_id.trim() : '';
     if (machineId === '') return { ok: false, code: 'BAD_MACHINE' };
-    // v1.9.18: chat carries text and slash-command text only; images never travel over the relay.
-    const MEDIA_FIELDS = ['image', 'image_url', 'image_base64', 'image_bytes', 'picture', 'photo', 'thumb', 'thumbnail', 'attachment', 'attachments', 'file', 'files', 'data', 'base64', 'blob', 'binary', 'buffer', 'media', 'sticker_image', 'sticker_data', 'gif', 'png', 'jpeg', 'webp'];
-    const mediaField = Object.keys(input ?? {}).find((key) => MEDIA_FIELDS.includes(key.toLowerCase()));
-    if (mediaField !== undefined) return { ok: false, code: 'CHAT_FIELD_FORBIDDEN', detail: { field: mediaField } };
+    // v1.9.18: chat carries text and slash-command text only; images never travel over the relay.
+    const MEDIA_FIELDS = ['image', 'image_url', 'image_base64', 'image_bytes', 'picture', 'photo', 'thumb', 'thumbnail', 'attachment', 'attachments', 'file', 'files', 'data', 'base64', 'blob', 'binary', 'buffer', 'media', 'sticker_image', 'sticker_data', 'gif', 'png', 'jpeg', 'webp'];
+    const mediaField = Object.keys(input ?? {}).find((key) => MEDIA_FIELDS.includes(key.toLowerCase()));
+    if (mediaField !== undefined) return { ok: false, code: 'CHAT_FIELD_FORBIDDEN', detail: { field: mediaField } };
     if (typeof input?.text !== 'string') return { ok: false, code: 'NOT_TEXT' };
     const text = input.text;
     if (text.trim() === '') return { ok: false, code: 'EMPTY_TEXT' };
@@ -128,30 +133,49 @@ export function createFleetMessages(options = {}) {
     const rawEnc = input?.enc;
     let enc = null;
     if (rawEnc !== undefined && rawEnc !== null) {
+      if (typeof rawEnc !== 'object' || Array.isArray(rawEnc)) return { ok: false, code: 'BAD_ENCRYPTION' };
       const ivOk = typeof rawEnc.iv === 'string' && rawEnc.iv.length > 0 && rawEnc.iv.length <= 64;
       const tagOk = typeof rawEnc.tag === 'string' && rawEnc.tag.length > 0 && rawEnc.tag.length <= 64;
-      if (rawEnc.v !== 1 || rawEnc.alg !== 'aes-256-gcm' || !ivOk || !tagOk) return { ok: false, code: 'BAD_ENCRYPTION' };
-      enc = { v: 1, alg: 'aes-256-gcm', iv: rawEnc.iv, tag: rawEnc.tag };
+      if (rawEnc.alg !== CHAT_ALG || !ivOk || !tagOk) return { ok: false, code: 'BAD_ENCRYPTION' };
+      if (rawEnc.v === 1) {
+        enc = { v: 1, alg: CHAT_ALG, iv: rawEnc.iv, tag: rawEnc.tag };
+      } else if (rawEnc.v === CHAT_ENC_V2) {
+        // AEAD v2 binds the ciphertext to its context. The AAD travels in the clear so every
+        // reader can rebuild it, and the GCM tag authenticates those exact bytes. The relay knows
+        // session_id/machine_id, so it refuses clear AAD naming another session or machine; it never
+        // sees a key and never inspects the ciphertext.
+        const aad = rawEnc.aad;
+        if (aad === null || typeof aad !== 'object' || Array.isArray(aad)) return { ok: false, code: 'CHAT_AAD_MISSING' };
+        const aadSession = typeof aad.session_id === 'string' ? aad.session_id : '';
+        const aadMachine = typeof aad.machine_id === 'string' ? aad.machine_id : '';
+        const aadMessage = typeof aad.message_id === 'string' ? aad.message_id : '';
+        if (aadSession !== sessionId || aadMachine !== machineId) return { ok: false, code: 'CHAT_AAD_MISMATCH' };
+        // eslint-disable-next-line no-control-regex
+        if (aadMessage === '' || aadMessage.length > 64 || /[\u0000-\u001F]/.test(aadMessage)) return { ok: false, code: 'CHAT_AAD_INVALID' };
+        enc = { v: CHAT_ENC_V2, alg: CHAT_ALG, iv: rawEnc.iv, tag: rawEnc.tag, aad: { session_id: aadSession, machine_id: aadMachine, message_id: aadMessage } };
+      } else {
+        return { ok: false, code: 'BAD_ENCRYPTION' };
+      }
+    }
+
+    // v1.9.18: a plain-text message may not smuggle an image payload. Encrypted text is exempt:
+    // it is base64 ciphertext by design and the relay cannot (and must not) inspect it.
+    if (enc === null) {
+      if (/data:(?:image|video|audio)\//i.test(text) || /!\[[^\]]*\]\(/i.test(text)) {
+        return { ok: false, code: 'TEXT_IMAGE_FORBIDDEN' };
+      }
+      const block = text.match(/[A-Za-z0-9+/]{256,}={0,2}/);
+      if (block !== null) {
+        try {
+          const head = Buffer.from(block[0].slice(0, 32), 'base64');
+          const magic = head.slice(0, 4).toString('latin1');
+          if ((head[0] === 0x89 && head.slice(1, 4).toString('latin1') === 'PNG') || (head[0] === 0xff && head[1] === 0xd8) || magic.startsWith('GIF8') || magic.startsWith('RIFF')) {
+            return { ok: false, code: 'TEXT_BINARY_FORBIDDEN' };
+          }
+        } catch { /* not base64 that matters */ }
+      }
     }
 
-    // v1.9.18: a plain-text message may not smuggle an image payload. Encrypted text is exempt:
-    // it is base64 ciphertext by design and the relay cannot (and must not) inspect it.
-    if (enc === null) {
-      if (/data:(?:image|video|audio)\//i.test(text) || /!\[[^\]]*\]\(/i.test(text)) {
-        return { ok: false, code: 'TEXT_IMAGE_FORBIDDEN' };
-      }
-      const block = text.match(/[A-Za-z0-9+/]{256,}={0,2}/);
-      if (block !== null) {
-        try {
-          const head = Buffer.from(block[0].slice(0, 32), 'base64');
-          const magic = head.slice(0, 4).toString('latin1');
-          if ((head[0] === 0x89 && head.slice(1, 4).toString('latin1') === 'PNG') || (head[0] === 0xff && head[1] === 0xd8) || magic.startsWith('GIF8') || magic.startsWith('RIFF')) {
-            return { ok: false, code: 'TEXT_BINARY_FORBIDDEN' };
-          }
-        } catch { /* not base64 that matters */ }
-      }
-    }
-
     // v1.2.5 idempotency: replay the first message instead of storing the text twice.
     const idempotencyKey = typeof input?.idempotency_key === 'string' && input.idempotency_key.trim() !== ''
       ? input.idempotency_key.trim().slice(0, 64)

package/src/relay/project-room.mjs

@@ -147,8 +147,20 @@ export function createProjectRoom({ now = () => Date.now(), onEvent = null } = {
     /** Incremental events for one project, seq strictly greater than sinceSeq. */
     events({ projectId, sinceSeq = 0, limit = 200 }) {
       requireProject(projectId);
-      const slice = events.filter((event) => event.project_id === projectId && event.seq > sinceSeq).slice(0, limit);
-      return { events: slice.map((event) => ({ ...event, payload: { ...event.payload } })), next_seq: slice.length > 0 ? slice[slice.length - 1].seq : sinceSeq };
+      const projectEvents = events.filter((event) => event.project_id === projectId);
+      const available = projectEvents.filter((event) => event.seq > sinceSeq);
+      const slice = available.slice(0, Math.max(0, limit));
+      const latestSeq = projectEvents.length > 0 ? projectEvents[projectEvents.length - 1].seq : sinceSeq;
+      return {
+        events: slice.map((event) => ({ ...event, payload: { ...event.payload } })),
+        next_seq: slice.length > 0 ? slice[slice.length - 1].seq : sinceSeq,
+        latest_seq: latestSeq,
+        oldest_available_seq: available.length > 0 ? available[0].seq : null,
+        // More events exist than this page returned: the client must page with next_seq instead of
+        // assuming the replay is complete (the old shape made an over-limit page look final).
+        truncated: available.length > slice.length,
+        remaining: Math.max(0, available.length - slice.length),
+      };
     },
     /** Projects a member belongs to. */
     listProjects({ member }) {
@@ -158,6 +170,39 @@ export function createProjectRoom({ now = () => Date.now(), onEvent = null } = {
       requireProject(projectId);
       return { ok: true, event: emit(projectId, type, actor, payload) };
     },
+    /**
+     * A6: self-contained state for persistence. Projects and the event log are plain data, so the
+     * snapshot is the exact object that <stateDir>/projects can be rebuilt from.
+     */
+    toSnapshot() {
+      return {
+        v: 1,
+        counter,
+        seq,
+        last_event_seq: seq,
+        projects: [...projects.values()].map((project) => JSON.parse(JSON.stringify(project))),
+        events: events.map((event) => JSON.parse(JSON.stringify(event))),
+      };
+    },
+    /** Restore a snapshot produced by toSnapshot; refuses anything not shaped like one. */
+    restore(snapshot) {
+      if (snapshot === null || typeof snapshot !== 'object' || snapshot.v !== 1 || !Array.isArray(snapshot.projects) || !Array.isArray(snapshot.events)) {
+        throw new ProjectRoomError('BAD_SNAPSHOT', 'project room snapshot is not shaped like v1');
+      }
+      projects.clear();
+      for (const project of snapshot.projects) {
+        if (typeof project?.project_id !== 'string' || !Array.isArray(project.members)) throw new ProjectRoomError('BAD_SNAPSHOT', 'project entry is invalid');
+        projects.set(project.project_id, project);
+      }
+      events.length = 0;
+      for (const event of snapshot.events) {
+        if (event === null || typeof event !== 'object' || !Number.isInteger(event.seq) || typeof event.project_id !== 'string') throw new ProjectRoomError('BAD_SNAPSHOT', 'event entry is invalid');
+        events.push(event);
+      }
+      seq = Math.max(Number.isInteger(snapshot.seq) ? snapshot.seq : 0, Number.isInteger(snapshot.last_event_seq) ? snapshot.last_event_seq : 0);
+      counter = Number.isInteger(snapshot.counter) ? snapshot.counter : snapshot.projects.length;
+      return { ok: true, projects: projects.size, events: events.length, last_event_seq: seq };
+    },
     size() { return { projects: projects.size, events: events.length, last_seq: seq }; },
   };
 }

package/src/relay/server.mjs

@@ -31,8 +31,9 @@ export const RELAY_FEATURES = Object.freeze([
   'target-machines',
   'result-projection',
   'guard-v1',
-  'relay-version-v1',
+  'relay-version-v1',
   'chat-text-only-v1',
+  'chat-enc-v2',
 ]);
 import fs from 'node:fs';
 import os from 'node:os';
@@ -1101,8 +1102,13 @@ export class RelayServer {
       const frame = (entry) => {
         try { res.write('id: ' + entry.seq + '\nevent: project.event\ndata: ' + JSON.stringify({ project_id: entry.project_id, seq: entry.seq, type: entry.type, payload: entry.payload }) + '\n\n'); } catch { /* closed */ }
       };
-      const replayed = this.state.projects.events({ projectId, sinceSeq });
-      res.write('event: ready\ndata: ' + JSON.stringify({ protocol_version: PROTOCOL_VERSION, project_id: projectId, last_event_seq: replayed.next_seq }) + '\n\n');
+      const replayed = this.state.projects.events({ projectId, sinceSeq, limit: 500 });
+      if (replayed.truncated === true) {
+        // An aborted stream that missed more events than one page holds must be told so explicitly;
+        // otherwise it believes ready.last_event_seq is the whole story.
+        res.write('event: notice\ndata: ' + JSON.stringify({ code: 'PROJECT_REPLAY_TRUNCATED', project_id: projectId, next_seq: replayed.next_seq, latest_seq: replayed.latest_seq, remaining: replayed.remaining }) + '\n\n');
+      }
+      res.write('event: ready\ndata: ' + JSON.stringify({ protocol_version: PROTOCOL_VERSION, project_id: projectId, last_event_seq: replayed.latest_seq ?? replayed.next_seq, replayed_through: replayed.next_seq }) + '\n\n');
       for (const entry of replayed.events) frame(entry);
       const unsubscribe = this.state.onProjectEvent((entry) => { if (entry.project_id === projectId) frame(entry); });
       const keepalive = setInterval(() => { try { res.write(': keepalive\n\n'); } catch { /* closed */ } }, this.keepaliveMs);
@@ -1250,8 +1256,8 @@ export class RelayServer {
     if (method === 'POST' && path === '/v1/result') {
       const body = takeJson();
       // B1 方案 A：window 模式接收旧信封（含 argv/head）并投影后存储；enforce 才硬拒。
-    const dataPlaneGuardMode = String(process.env.W2M_DATA_PLANE_GUARD ?? 'window');
-    // decision 5: enforce is not allowed. The flag is read and reported, but never changes behaviour.
+    const dataPlaneGuardMode = String(process.env.W2M_DATA_PLANE_GUARD ?? 'window');
+    // decision 5: enforce is not allowed. The flag is read and reported, but never changes behaviour.
     if (dataPlaneGuardMode === 'enforce' && this.allowDataPlaneGuardEnforce === true) {
       const resultGuard = guardResultEnvelope(body);
       if (resultGuard.ok !== true) {

package/src/relay/state.mjs

@@ -24,6 +24,8 @@ import { deviceFleetFields } from '../chatops/fleet-wiring.mjs';
 import { scopeFleetId } from '../chatops/fleet-wiring.mjs';
 // v0.8.1: the account-derived fleet key, so a machine can join with no pairing code.
 import { planJoin } from '../chatops/fleet-join.mjs';
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { validateTaskDependencies } from './task-deps.mjs';
 import { buildMembers, isMemberRole, setMemberRole as applyMemberRole } from './fleet-members.mjs';
 import { canonicalSignedPayload, publicKeyFromBase64 } from '../util/envelope-signature.mjs';
@@ -269,9 +271,22 @@ export const P2P_MODES = Object.freeze(['auto', 'direct', 'relay']);
  */
 export const TRANSPORT_VALUES = Object.freeze(['p2p', 'relay']);
 
+/**
+ * Canonical form of a relative working directory. Both the relay and the agent hash this string, so
+ * it is normalized in exactly one place per side and the two definitions are asserted to agree:
+ * backslashes become slashes, './' and repeated/trailing slashes disappear, empty means '.'.
+ */
+export function normalizeCwdRel(value) {
+  if (value === null || value === undefined) return '.';
+  let out = String(value).replace(/\\/g, '/');
+  while (out.startsWith('./')) out = out.slice(2);
+  out = out.replace(/\/{2,}/g, '/').replace(/\/+$/, '');
+  return out === '' ? '.' : out;
+}
+
 /** §4.4 helper: command_hash = sha256(JCS(argv)+"|"+shell_id+"|"+cwd_rel). */
 export function computeCommandHash(commandArgv, shellId = SHELL_ID_DIRECT, cwdRel = '.') {
-  return sha256Hex(`${jcs(commandArgv)}|${shellId}|${cwdRel}`);
+  return sha256Hex(`${jcs(commandArgv)}|${shellId}|${normalizeCwdRel(cwdRel)}`);
 }
 
 /**
@@ -288,7 +303,7 @@ export function computeCommandHash(commandArgv, shellId = SHELL_ID_DIRECT, cwdRe
 export function computePipelineCommandHash(stages, shellId = SHELL_ID_DIRECT) {
   const canonical = stages.map((s) => ({
     command_argv: s.command_argv,
-    cwd_rel: s.cwd_rel ?? '.',
+    cwd_rel: normalizeCwdRel(s.cwd_rel),
     continue_on_failure: s.continue_on_failure === true,
   }));
   return sha256Hex(`${jcs(canonical)}|${shellId}|pipeline`);
@@ -560,6 +575,7 @@ export class RabbitState {
     const metricsEvent = (event) => {
       try { this.metrics.inc('wm_project_events_total', { type: event.type }); } catch { /* metrics never break the room */ }
       for (const listener of this.projectSubscribers) { try { listener(event); } catch { /* a subscriber never breaks the room */ } }
+      if (typeof this._persistProjects === 'function') this._persistProjects();
       const notified = NOTIFIED[event.type];
       if (notified !== undefined) {
         try {
@@ -568,6 +584,18 @@ export class RabbitState {
       }
     };
     this.projects = createProjectRoom({ now: () => this.nowMs(), onEvent: metricsEvent });
+    // A6: the room snapshot is the durable form of projects/members/events. Written after every room
+    // event (0600, tmp+rename) and restored before the relay answers anything, so a restart keeps the
+    // project object and its cursor instead of silently starting from an empty room.
+    this._projectsFile = typeof this.persistence?.dir === 'string' && this.persistence.dir !== ''
+      ? join(this.persistence.dir, 'projects', 'room-snapshot.json')
+      : null;
+    if (this._projectsFile !== null) {
+      try {
+        const snapshot = JSON.parse(readFileSync(this._projectsFile, 'utf8').replace(/^\uFEFF/, ''));
+        this.projects.restore(snapshot);
+      } catch { /* absent or corrupt: start empty rather than failing to boot */ }
+    }
     this.defaultProjectId = 'default';
     // M5 primitives share the project room's event stream: a lock, review or notification is a project event with the
     // module's own sequence attached, so one reader can reconstruct "what happened" from a single cursor.
@@ -622,6 +650,17 @@ export class RabbitState {
   /** Inject/replace the persistence backend (also used by tests). */
   setPersistence(persistence) { this._persist = persistence ?? null; return this._persist; }
 
+  /** A6: atomic write of the project room snapshot (0600). */
+  _persistProjects() {
+    if (typeof this._projectsFile !== 'string' || this._projectsFile === '') return;
+    try {
+      mkdirSync(dirname(this._projectsFile), { recursive: true, mode: 0o700 });
+      const tmp = this._projectsFile + '.tmp-' + process.pid + '-' + Date.now().toString(36);
+      writeFileSync(tmp, JSON.stringify(this.projects.toSnapshot()), { encoding: 'utf8', mode: 0o600 });
+      renameSync(tmp, this._projectsFile);
+    } catch { /* a failed snapshot write must not break the live room */ }
+  }
+
   /* ---------------- v1.0.7: the content-addressed blob channel (#1) ---------------- */
 
   /**
@@ -1788,7 +1827,7 @@ export class RabbitState {
     }
 
     const now = this.nowMs();
-    const cwdRel = typeof input.cwd_rel === 'string' && input.cwd_rel ? input.cwd_rel : '.';
+    const cwdRel = normalizeCwdRel(input.cwd_rel);
     const baseTree = input.base_tree ?? null;
     // v2 R5: a joint dispatch must be auditable; a malformed binding is refused, never nulled.
     for (const key of ['plan_sha256', 'approval_sha256']) {
@@ -2825,6 +2864,26 @@ export class RabbitState {
    * of nothing -- a fake "the work is still being done" signal, which is the most
    * dangerous lie this relay can tell.
    */
+  /**
+   * Merge a small, typed bag of machine-advertised capabilities into the device row.
+   *
+   * Only scalars are copied (strings <= 64 chars, booleans, null) and only a bounded number of
+   * keys, so a heartbeat cannot turn the roster into an unbounded side channel.
+   */
+  _mergeAdvertisedCaps(device, caps) {
+    if (device === null || typeof device !== 'object') return;
+    if (caps === null || typeof caps !== 'object' || Array.isArray(caps)) return;
+    const next = { ...(device.caps ?? {}) };
+    let count = 0;
+    for (const [key, value] of Object.entries(caps)) {
+      if (count >= 32) break;
+      if (typeof key !== 'string' || key.length === 0 || key.length > 32) continue;
+      if (typeof value === 'string' && value.length <= 64) { next[key] = value; count += 1; continue; }
+      if (typeof value === 'boolean' || value === null) { next[key] = value; count += 1; }
+    }
+    device.caps = next;
+  }
+
   diagnosticHeartbeat(input = {}) {
     const machineId = typeof input.machine_id === 'string' && input.machine_id !== ''
       ? input.machine_id : null;
@@ -2837,6 +2896,7 @@ export class RabbitState {
     this._validatePhaseProgress(input);
 
     const device = this.touchDevice(machineId);
+    this._mergeAdvertisedCaps(device, input.caps);
     this.recordHeartbeatMetrics(machineId, input);
     return {
       // No lease is involved, and the response says so instead of inventing one.

package/src/util/chat-crypto.mjs

@@ -71,7 +71,7 @@ export function encryptChatText(key, text) {
  * @param {{text?: string, enc?: object|null}} message
  * @returns {{ok: true, text: string} | {ok: false, code: string}}
  */
-export function decryptChatMessage(key, message = {}) {
+function decryptV1Message(key, message = {}) {
   const enc = message?.enc ?? null;
   if (enc === null || enc === undefined) {
     // Plaintext: the pre-encryption shape, still readable by everyone.
@@ -92,6 +92,75 @@ export function decryptChatMessage(key, message = {}) {
   }
 }
 
+
+/** Chat cipher v2: same AES-256-GCM, with AAD binding the message to its session and sender. */
+export const CHAT_CIPHER_V2 = Object.freeze({ version: 2, alg: 'aes-256-gcm' });
+
+/**
+ * AAD = w2m-chat-v2 | session_id | from_machine | message_id
+ *
+ * The AAD is transmitted in the clear inside `enc.aad` so every reader can rebuild it, but the GCM
+ * tag authenticates those exact bytes: changing any of them makes decryption fail. A caller that
+ * knows the expected context must pass it, which is what turns a whole encrypted message copied into
+ * another session into a refusal instead of a successfully decrypted but mis-attributed message.
+ */
+export function chatAadV2({ sessionId, machineId, messageId }) {
+  return Buffer.from('w2m-chat-v2|' + String(sessionId) + '|' + String(machineId) + '|' + String(messageId), 'utf8');
+}
+
+export function encryptChatTextV2(key, text, context = {}) {
+  if (key === null || !Buffer.isBuffer(key) || key.length !== KEY_BYTES) return { ok: false, code: 'CHAT_NO_KEY' };
+  if (typeof text !== 'string' || text === '') return { ok: false, code: 'CHAT_EMPTY_TEXT' };
+  const sessionId = typeof context.sessionId === 'string' ? context.sessionId : '';
+  const machineId = typeof context.machineId === 'string' ? context.machineId : '';
+  const messageId = typeof context.messageId === 'string' ? context.messageId : '';
+  if (sessionId === '' || machineId === '' || messageId === '') return { ok: false, code: 'CHAT_AAD_CONTEXT_REQUIRED' };
+  const aad = chatAadV2({ sessionId, machineId, messageId });
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv('aes-256-gcm', key, iv);
+  cipher.setAAD(aad);
+  const ciphertext = Buffer.concat([cipher.update(Buffer.from(text, 'utf8')), cipher.final()]);
+  return {
+    ok: true,
+    text: ciphertext.toString('base64'),
+    enc: { v: CHAT_CIPHER_V2.version, alg: CHAT_CIPHER_V2.alg, iv: iv.toString('base64'), tag: cipher.getAuthTag().toString('base64'), aad: { session_id: sessionId, machine_id: machineId, message_id: messageId } },
+  };
+}
+
+export function decryptChatMessageV2(key, message = {}, context = {}) {
+  if (key === null || !Buffer.isBuffer(key) || key.length !== KEY_BYTES) return { ok: false, code: 'CHAT_NO_KEY' };
+  const enc = message?.enc ?? null;
+  if (enc === null || typeof enc !== 'object' || enc.v !== CHAT_CIPHER_V2.version || enc.alg !== CHAT_CIPHER_V2.alg) return { ok: false, code: 'CHAT_UNSUPPORTED_CIPHER' };
+  const aad = enc.aad ?? {};
+  const expectedSession = typeof context.sessionId === 'string' ? context.sessionId : null;
+  const expectedMachine = typeof context.machineId === 'string' ? context.machineId : null;
+  if (expectedSession !== null && String(aad.session_id ?? '') !== expectedSession) return { ok: false, code: 'CHAT_AAD_MISMATCH', detail: { field: 'session_id' } };
+  if (expectedMachine !== null && String(aad.machine_id ?? '') !== expectedMachine) return { ok: false, code: 'CHAT_AAD_MISMATCH', detail: { field: 'machine_id' } };
+  try {
+    const iv = Buffer.from(String(enc.iv ?? ''), 'base64');
+    const tag = Buffer.from(String(enc.tag ?? ''), 'base64');
+    if (iv.length !== IV_BYTES || tag.length !== 16) return { ok: false, code: 'CHAT_BAD_ENCRYPTION' };
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAAD(chatAadV2({ sessionId: aad.session_id, machineId: aad.machine_id, messageId: aad.message_id }));
+    decipher.setAuthTag(tag);
+    const plain = Buffer.concat([decipher.update(Buffer.from(String(message.text ?? ''), 'base64')), decipher.final()]);
+    return { ok: true, text: plain.toString('utf8'), version: 2 };
+  } catch {
+    return { ok: false, code: 'CHAT_DECRYPT_FAILED' };
+  }
+}
+
+/**
+ * v1 is read-only compatible forever; v2 requires the expected context to bind the message to its
+ * session/sender. Unknown versions are refused rather than treated as v1.
+ */
+export function decryptChatMessage(key, message = {}, context = {}) {
+  const enc = message?.enc ?? null;
+  if (enc !== null && typeof enc === 'object' && enc.v === CHAT_CIPHER_V2.version) return decryptChatMessageV2(key, message, context);
+  if (enc !== null && typeof enc === 'object' && enc.v !== CHAT_CIPHER.version) return { ok: false, code: 'CHAT_UNSUPPORTED_CIPHER' };
+  return decryptV1Message(key, message);
+}
+
 /** True when a message carries the encryption metadata, whatever its text looks like. */
 export function isEncrypted(message) {
   return message?.enc !== null && message?.enc !== undefined && typeof message.enc === 'object';