@twinsearth/w2m-dsh-plugin 2.0.4 → 2.0.6

package/src/plugin/dataplane-sink-route.mjs

@@ -0,0 +1,118 @@
+/**
+ * `/api/w2m/dataplane-sink` (A3): the settings-page half of the S4 data-plane authorization.
+ *
+ *   GET  -> { ok, configured, kind, root|host/user/dir, saved_at }
+ *   POST -> { ok, configured: true, kind, ... } and writes <stateDir>/dataplane/sink.json (0600)
+ *
+ * Authorization is a LOCAL USER action through this host route. Model/tool parameters can never
+ * authorize a sink: the tool schemas do not expose this path, and this route does not accept an
+ * operator/device token as the authority (the host's same-origin fence is the boundary).
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative } from 'node:path';
+import { randomBytes } from 'node:crypto';
+
+export const DATAPLANE_SINK_ROUTE_PATH = '/api/w2m/dataplane-sink';
+const NO_STORE = { 'cache-control': 'no-store' };
+const KINDS = new Set(['dir', 'lan-git', 'ssh']);
+const CREDENTIAL_KEYS = /^(?:password|passphrase|key|private_key|token|secret|credential|identity)$/i;
+
+function configPath(stateDir) {
+  return join(stateDir, 'dataplane', 'sink.json');
+}
+
+function readConfig(stateDir) {
+  const file = configPath(stateDir);
+  if (!existsSync(file)) return null;
+  try { return JSON.parse(readFileSync(file, 'utf8').replace(/^\uFEFF/, '')); } catch { return null; }
+}
+
+function insideStateDir(stateDir, target) {
+  // Compare canonical paths: Windows temp dirs come back as RUNNER~1 here and runneradmin in the
+  // realpath, and macOS /var is a symlink to /private/var, so a raw prefix test lets an inside path
+  // through on CI even though it is inside the state dir.
+  let base = stateDir;
+  try { base = realpathSync.native ? realpathSync.native(stateDir) : realpathSync(stateDir); } catch { /* keep raw */ }
+  const rel = relative(base, target);
+  return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+}
+
+/** Strip anything that looks like a secret; the file only holds references, never credentials. */
+function publicView(config) {
+  if (config === null) return { configured: false, kind: null };
+  if (config.kind === 'ssh') return { configured: true, kind: config.kind, host: config.host ?? null, user: config.user ?? null, dir: config.dir ?? null, port: config.port ?? null, saved_at: config.saved_at ?? null };
+  return { configured: true, kind: config.kind, root: config.root ?? null, remote: config.remote ?? null, branch: config.branch ?? null, saved_at: config.saved_at ?? null };
+}
+
+/**
+ * @param {object} ctx Cordis context
+ * @param {{stateDir?: () => string|null}} [deps]
+ */
+export function registerDataplaneSinkRoute(ctx, deps = {}) {
+  const status = { mounted: false, reason: 'the host has no Connection service' };
+  if (typeof ctx?.inject !== 'function') return status;
+  ctx.inject(['connection'], (webCtx) => {
+    const registry = webCtx?.connection?.fetch;
+    if (registry === undefined || typeof registry.register !== 'function') {
+      status.reason = 'the connection service carries no fetch registry';
+      return;
+    }
+    const stateDirOf = () => (typeof deps?.stateDir === 'function' ? deps.stateDir() : null);
+    registry.register({
+      path: DATAPLANE_SINK_ROUTE_PATH,
+      methods: ['GET', 'POST'],
+      requestBody: 'buffered',
+      fetch: async (request) => {
+        const stateDir = stateDirOf();
+        if (typeof stateDir !== 'string' || stateDir === '') {
+          return Response.json({ ok: false, code: 'DATAPLANE_STATE_UNAVAILABLE' }, { status: 503, headers: NO_STORE });
+        }
+        if (request.method === 'GET') {
+          return Response.json({ ok: true, ...publicView(readConfig(stateDir)) }, { headers: NO_STORE });
+        }
+        let body = null;
+        try { body = await request.json(); } catch { /* refused below */ }
+        if (body === null || typeof body !== 'object') return Response.json({ ok: false, code: 'SINK_BODY_REQUIRED' }, { status: 400, headers: NO_STORE });
+        for (const key of Object.keys(body)) {
+          if (CREDENTIAL_KEYS.test(key)) return Response.json({ ok: false, code: 'SINK_CREDENTIALS_NOT_ACCEPTED', detail: key }, { status: 400, headers: NO_STORE });
+        }
+        const kind = typeof body.kind === 'string' ? body.kind : '';
+        if (!KINDS.has(kind)) return Response.json({ ok: false, code: 'SINK_KIND_INVALID' }, { status: 400, headers: NO_STORE });
+        const config = { v: 1, kind, saved_at: new Date().toISOString(), approved_by: 'local-user' };
+        if (kind === 'ssh') {
+          if (typeof body.host !== 'string' || !/^[A-Za-z0-9.-]{1,253}$/.test(body.host)) return Response.json({ ok: false, code: 'SINK_SSH_HOST_INVALID' }, { status: 400, headers: NO_STORE });
+          if (typeof body.user !== 'string' || !/^[A-Za-z0-9._-]{1,64}$/.test(body.user)) return Response.json({ ok: false, code: 'SINK_SSH_USER_INVALID' }, { status: 400, headers: NO_STORE });
+          if (typeof body.dir !== 'string' || !isAbsolute(body.dir)) return Response.json({ ok: false, code: 'SINK_SSH_DIR_INVALID' }, { status: 400, headers: NO_STORE });
+          if (body.port !== undefined && !(Number.isInteger(body.port) && body.port >= 1 && body.port <= 65535)) return Response.json({ ok: false, code: 'SINK_SSH_PORT_INVALID' }, { status: 400, headers: NO_STORE });
+          config.host = body.host;
+          config.user = body.user;
+          config.dir = body.dir;
+          if (body.port !== undefined) config.port = body.port;
+        } else {
+          if (typeof body.root !== 'string' || !isAbsolute(body.root)) return Response.json({ ok: false, code: 'SINK_ROOT_INVALID' }, { status: 400, headers: NO_STORE });
+          const resolved = realpathSync.native ? (() => { try { return realpathSync.native(body.root); } catch { return null; } })() : null;
+          if (resolved === null) return Response.json({ ok: false, code: 'SINK_ROOT_NOT_FOUND' }, { status: 400, headers: NO_STORE });
+          const stat = statSync(resolved);
+          if (!stat.isDirectory()) return Response.json({ ok: false, code: 'SINK_ROOT_NOT_DIRECTORY' }, { status: 400, headers: NO_STORE });
+          if (insideStateDir(stateDir, resolved)) return Response.json({ ok: false, code: 'SINK_ROOT_INSIDE_STATE' }, { status: 400, headers: NO_STORE });
+          if (kind === 'lan-git' && !existsSync(join(resolved, '.git'))) return Response.json({ ok: false, code: 'SINK_GIT_NOT_A_REPO' }, { status: 400, headers: NO_STORE });
+          config.root = resolved;
+          if (kind === 'lan-git') {
+            if (typeof body.remote === 'string' && body.remote !== '') config.remote = body.remote;
+            if (typeof body.branch === 'string' && body.branch !== '') config.branch = body.branch;
+          }
+        }
+        const file = configPath(stateDir);
+        mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+        const tmp = file + '.tmp-' + process.pid + '-' + randomBytes(4).toString('hex');
+        writeFileSync(tmp, JSON.stringify(config, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+        renameSync(tmp, file);
+        try { chmodSync(file, 0o600); } catch { /* Windows ACL */ }
+        return Response.json({ ok: true, ...publicView(config) }, { headers: NO_STORE });
+      },
+    });
+    status.mounted = true;
+    status.reason = null;
+  });
+  return status;
+}

package/src/plugin/fleet-chat-route.mjs

@@ -23,6 +23,13 @@ import {
 } from './session-watch.mjs';
 import { createSessionSync } from './session-sync.mjs';
 
+/** Session prompts are mirrored only when the operator opts in; the default is off. */
+export const DEFAULT_MIRROR_MODE = 'off';
+export function mirrorModeOf(cfg) {
+  const mode = cfg?.fleetChatMirror;
+  return mode === 'plaintext' || mode === 'encrypted' ? mode : DEFAULT_MIRROR_MODE;
+}
+
 
 /**
  * The newest transcript for a cwd, or null. Reads directory listings and stat only -- this module never opens a
@@ -158,12 +165,16 @@ export function registerChatRoutes(ctx, deps) {
    * are extracted, and only the new ones are published. A failure here must not disturb the panel or the route.
    */
   const MIRROR_MAX_BYTES = 3500;
+
   const truncateUtf8 = (value, max) => {
     const bytes = Buffer.from(value, 'utf8');
     if (bytes.length <= max) return value;
     return bytes.subarray(0, max).toString('utf8').replace(/\uFFFD+$/, '') + ' …(已截断)';
   };
   const mirrorOnce = async () => {
+    const mode = mirrorModeOf(deps.cfg());
+    if (mode === 'off') return;
+    if (mode === 'encrypted') return; // encrypted mirroring lands with the AEAD v2 slice
     const identity = await identityOf();
     if (identity.conversationKey === null) return;
     const file = newestTranscript(projectDirOf());

package/src/plugin/joint-dev/dispatch.mjs

@@ -7,6 +7,8 @@
  */
 import { createHash } from 'node:crypto';
 
+import { computeCommandHash, normalizeCwdRel, SHELL_ID_DIRECT } from '../../relay/state.mjs';
+
 import { appendAudit } from './audit-file.mjs';
 import { createAudit, inspectControlMessage } from './redline.mjs';
 
@@ -80,7 +82,8 @@ export function buildPlan(input) {
       step_id: step.step_id,
       machine_id: step.machine_id,
       command_argv: step.command_argv.slice(0, 32),
-      command_hash: sha256(JSON.stringify(step.command_argv)),
+      cwd_rel: normalizeCwdRel(step.cwd_rel),
+      command_hash: computeCommandHash(step.command_argv, SHELL_ID_DIRECT, normalizeCwdRel(step.cwd_rel)),
       write_scope: Array.isArray(step.write_scope) ? step.write_scope.slice(0, 8) : [],
       depends_on: Array.isArray(step.depends_on) ? step.depends_on.slice(0, 8) : [],
       timeout_ms: Number.isInteger(step.timeout_ms) ? step.timeout_ms : null,
@@ -101,6 +104,7 @@ export function buildControlEnvelopes(plan) {
       base_commit: plan.base_commit,
       command_argv: step.command_argv,
       command_hash: step.command_hash,
+      cwd_rel: step.cwd_rel ?? '.',
       write_scope: step.write_scope,
       depends_on: step.depends_on,
       ...(step.timeout_ms === null ? {} : { timeout_ms: step.timeout_ms }),

package/src/plugin/joint-dev/merge-approval.mjs

@@ -0,0 +1,115 @@
+/**
+ * Merge approval (A4/D4): the second human signature in the joint-dev SOP.
+ *
+ * A plan approval authorises *sending work*; a merge approval authorises *moving a branch*. It binds
+ * the plan, repository, base commit, target ref, the old value the CAS will replace, and the exact
+ * integration head that was reviewed. Signed with the same operator Ed25519 key, TTL-capped, and
+ * consumed once (O_EXCL) so a replay cannot move a second branch.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { ensureOperatorKey, keyIdOf, signApprovalPayload, verifyApprovalPayload } from '../operator-key.mjs';
+
+const HEX64 = /^[0-9a-f]{64}$/;
+const SHA = /^[0-9a-f]{7,40}$/;
+const sha256 = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
+
+export function bodyOf(input) {
+  const approvedAtIn = typeof input.approvedAt === 'string' ? input.approvedAt : (typeof input.approved_at === 'string' ? input.approved_at : null);
+  const expiresAtIn = typeof input.expiresAt === 'string' ? input.expiresAt : (typeof input.expires_at === 'string' ? input.expires_at : null);
+  const now = Number.isInteger(input.now) ? input.now : (approvedAtIn !== null ? Date.parse(approvedAtIn) : Date.now());
+  const approvedAt = approvedAtIn !== null ? approvedAtIn : new Date(now).toISOString();
+  const expiresAt = expiresAtIn !== null ? expiresAtIn : new Date(now + (Number.isInteger(input.ttlMs) ? input.ttlMs : 600_000)).toISOString();
+  return {
+    v: 1,
+    type: 'joint.merge',
+    plan_sha256: typeof input.planSha === 'string' && input.planSha !== '' ? input.planSha : (typeof input.plan_sha256 === 'string' && input.plan_sha256 !== '' ? input.plan_sha256 : null),
+    repo: String(input.repo ?? ''),
+    base_commit: String(input.baseCommit ?? input.base_commit ?? ''),
+    target_ref: String(input.targetRef ?? input.target_ref ?? ''),
+    expected_old: String(input.expectedOld ?? input.expected_old ?? ''),
+    integration_head: String(input.integrationHead ?? input.integration_head ?? ''),
+    approver: String(input.approver ?? ''),
+    authority: Number.isInteger(input.authority) ? input.authority : 0,
+    approved_at: approvedAt,
+    expires_at: expiresAt,
+  };
+}
+
+/**
+ * @param {{stateDir: string, planSha?: string|null, repo: string, baseCommit: string, targetRef: string,
+ *          expectedOld: string, integrationHead: string, approver: string, authority: number,
+ *          ttlMs?: number, now?: number, key?: {privateKey: string, publicKeyPem: string, key_id: string}}} input
+ */
+export function createMergeApproval(input) {
+  if (!SHA.test(String(input.baseCommit ?? ''))) return { ok: false, code: 'MERGE_APPROVAL_BASE_INVALID' };
+  if (!SHA.test(String(input.expectedOld ?? ''))) return { ok: false, code: 'MERGE_APPROVAL_OLD_INVALID' };
+  if (!SHA.test(String(input.integrationHead ?? ''))) return { ok: false, code: 'MERGE_APPROVAL_HEAD_INVALID' };
+  if (!Number.isInteger(input.authority) || input.authority < 70 || input.authority > 100) return { ok: false, code: 'MERGE_APPROVAL_AUTHORITY_INVALID' };
+  const key = input.key ?? ensureOperatorKey();
+  if (key === null || key === undefined || key.ok !== true || key.privateKey === undefined) return { ok: false, code: key?.code ?? 'OPERATOR_KEY_MISSING' };
+  const body = bodyOf(input);
+  const approvalSha = sha256(JSON.stringify(body));
+  const record = {
+    ...body,
+    approval_sha256: approvalSha,
+    operator_key: { key_id: key.key_id ?? keyIdOf(key.publicKeyPem), public_key_pem: key.publicKeyPem },
+    sig: signApprovalPayload(body, key.privateKey),
+  };
+  const dir = join(input.stateDir, 'joint-dev', 'merge-approvals');
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const path = join(dir, approvalSha + '.json');
+  const tmp = path + '.tmp-' + process.pid + '-' + randomBytes(4).toString('hex');
+  writeFileSync(tmp, JSON.stringify(record, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+  renameSync(tmp, path);
+  try { chmodSync(path, 0o600); } catch { /* Windows ACL */ }
+  return { ok: true, approval: record, approval_sha256: approvalSha, path };
+}
+
+/**
+ * Verify signature, TTL and the exact binding the caller is about to apply.
+ *
+ * @param {{stateDir: string, approvalSha: string, trustedOperatorKeyIds?: string[], now?: number,
+ *          repo: string, baseCommit: string, targetRef: string, expectedOld: string, integrationHead: string,
+ *          planSha?: string|null}} input
+ */
+export function loadMergeApproval(input) {
+  if (typeof input?.approvalSha !== 'string' || !HEX64.test(input.approvalSha)) return { ok: false, code: 'MERGE_APPROVAL_ID_INVALID' };
+  const path = join(input.stateDir, 'joint-dev', 'merge-approvals', input.approvalSha + '.json');
+  if (!existsSync(path)) return { ok: false, code: 'MERGE_APPROVAL_NOT_FOUND' };
+  let record = null;
+  try { record = JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, '')); } catch { return { ok: false, code: 'MERGE_APPROVAL_UNREADABLE' }; }
+  if (record?.type !== 'joint.merge') return { ok: false, code: 'MERGE_APPROVAL_TYPE_INVALID' };
+  if (record.approval_sha256 !== sha256(JSON.stringify(bodyOf(record)))) return { ok: false, code: 'MERGE_APPROVAL_TAMPERED' };
+  const pem = record?.operator_key?.public_key_pem;
+  if (typeof pem !== 'string' || record?.operator_key?.key_id !== keyIdOf(pem)) return { ok: false, code: 'MERGE_APPROVAL_KEY_MISMATCH' };
+  const trusted = Array.isArray(input.trustedOperatorKeyIds) ? input.trustedOperatorKeyIds : null;
+  if (trusted !== null && !trusted.includes(record.operator_key.key_id)) return { ok: false, code: 'MERGE_APPROVAL_KEY_UNTRUSTED' };
+  if (verifyApprovalPayload(record, record.sig, pem) !== true) return { ok: false, code: 'MERGE_APPROVAL_SIGNATURE_INVALID' };
+  const now = Number.isInteger(input.now) ? input.now : Date.now();
+  if (Date.parse(record.expires_at) <= now) return { ok: false, code: 'MERGE_APPROVAL_EXPIRED' };
+  for (const [field, expected] of [['repo', input.repo], ['base_commit', input.baseCommit], ['target_ref', input.targetRef], ['expected_old', input.expectedOld], ['integration_head', input.integrationHead]]) {
+    if (record[field] !== expected) return { ok: false, code: 'MERGE_APPROVAL_MISMATCH', detail: { field, expected, actual: record[field] } };
+  }
+  if (input.planSha !== undefined && input.planSha !== null && record.plan_sha256 !== input.planSha) {
+    return { ok: false, code: 'MERGE_APPROVAL_MISMATCH', detail: { field: 'plan_sha256', expected: input.planSha, actual: record.plan_sha256 } };
+  }
+  return { ok: true, approval: record, strength: 'signature' };
+}
+
+/** One-shot consumption: the marker is created with O_EXCL, so a second apply cannot reuse the signature. */
+export function consumeMergeApproval({ stateDir, approvalSha }) {
+  if (typeof approvalSha !== 'string' || !HEX64.test(approvalSha)) return { ok: false, code: 'MERGE_APPROVAL_ID_INVALID' };
+  const dir = join(stateDir, 'joint-dev', 'merge-consumed');
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const marker = join(dir, approvalSha);
+  try {
+    writeFileSync(marker, new Date().toISOString() + '\n', { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    return { ok: true };
+  } catch (error) {
+    if (error?.code === 'EEXIST') return { ok: false, code: 'MERGE_APPROVAL_ALREADY_USED' };
+    return { ok: false, code: 'MERGE_APPROVAL_CONSUME_FAILED', detail: error instanceof Error ? error.message : String(error) };
+  }
+}

package/src/plugin/joint-dev/progress.mjs

@@ -0,0 +1,107 @@
+/**
+ * A5 progress consumer: read the relay's per-task progress for a dispatched joint plan.
+ *
+ * The relay stores no argv/content on the projection either, and this module enforces the same on
+ * the way out: the projection is rebuilt from a small allow-list, and any forbidden key found in the
+ * relay's answer is stripped and reported (never echoed). A relay that predates the `progress` key
+ * (1.9.16) yields PROGRESS_UNSUPPORTED instead of an empty success.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const FORBIDDEN = /^(?:argv|command|command_argv|command_hash|text|content|stdout|stderr|stdout_head|stderr_head|head|tail|patch|diff|env|token|secret|password|base64|blob|blobs|bytes|buffer|files?)$/i;
+
+function sanitize(value, seen = new Set()) {
+  if (value === null || typeof value !== 'object') return value;
+  if (seen.has(value)) return null;
+  seen.add(value);
+  if (Array.isArray(value)) return value.map((entry) => sanitize(entry, seen));
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (FORBIDDEN.test(key)) continue;
+    if (typeof child === 'string' && /(?:[A-Za-z0-9+/]{512,}|[0-9a-fA-F]{512,})/.test(child)) continue;
+    out[key] = sanitize(child, seen);
+  }
+  return out;
+}
+
+const hasForbidden = (value, seen = new Set()) => {
+  if (value === null || typeof value !== 'object') return false;
+  if (seen.has(value)) return false;
+  seen.add(value);
+  if (Array.isArray(value)) return value.some((entry) => hasForbidden(entry, seen));
+  return Object.entries(value).some(([key, child]) => FORBIDDEN.test(key) || hasForbidden(child, seen));
+};
+
+function readDispatchRecord(stateDir, planSha) {
+  if (typeof stateDir !== 'string' || stateDir === '' || typeof planSha !== 'string' || !/^[0-9a-f]{64}$/.test(planSha)) return { ok: false, code: 'NOT_DISPATCHED' };
+  const path = join(stateDir, 'joint-dev', 'dispatches', planSha + '.json');
+  if (!existsSync(path)) return { ok: false, code: 'NOT_DISPATCHED' };
+  try {
+    const record = JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''));
+    if (record?.plan_sha256 !== planSha || !Array.isArray(record.tasks)) return { ok: false, code: 'DISPATCH_RECORD_INVALID' };
+    return { ok: true, record };
+  } catch {
+    return { ok: false, code: 'DISPATCH_RECORD_UNREADABLE' };
+  }
+}
+
+/**
+ * @param {{stateDir: string, planSha: string, relayUrl: string, deviceToken: string,
+ *          fetchImpl?: Function, timeoutMs?: number, taskIds?: Map<string,string>}} input
+ */
+export async function planProgress(input) {
+  const record = readDispatchRecord(input?.stateDir, input?.planSha);
+  if (record.ok !== true) return { ok: false, code: record.code };
+  const fetchImpl = typeof input?.fetchImpl === 'function' ? input.fetchImpl : globalThis.fetch;
+  const timeoutMs = Number.isInteger(input?.timeoutMs) ? input.timeoutMs : 15_000;
+  const base = typeof input?.relayUrl === 'string' ? input.relayUrl.replace(/\/$/, '') : '';
+  if (base === '') return { ok: false, code: 'RELAY_URL_REQUIRED' };
+  const token = typeof input?.deviceToken === 'string' ? input.deviceToken : '';
+  if (token === '') return { ok: false, code: 'DEVICE_TOKEN_REQUIRED' };
+  const steps = [];
+  for (const task of record.record.tasks) {
+    const taskId = String(task?.task_id ?? '');
+    const stepId = String(task?.step_id ?? '');
+    if (taskId === '') continue;
+    let response = null;
+    try {
+      const signal = typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function' ? AbortSignal.timeout(timeoutMs) : undefined;
+      response = await fetchImpl(base + '/v1/tasks/' + encodeURIComponent(taskId), { headers: { authorization: 'Bearer ' + token, accept: 'application/json' }, signal });
+    } catch {
+      steps.push({ step_id: stepId, task_id: taskId, state: 'unreadable', code: 'TASK_UNREADABLE' });
+      continue;
+    }
+    if (response.ok !== true) {
+      steps.push({ step_id: stepId, task_id: taskId, state: 'unavailable', code: response.status === 404 ? 'TASK_NOT_FOUND' : 'TASK_UNREADABLE', http_status: response.status });
+      continue;
+    }
+    let body = null;
+    try { body = await response.json(); } catch { body = null; }
+    if (body === null || typeof body !== 'object') {
+      steps.push({ step_id: stepId, task_id: taskId, state: 'unavailable', code: 'TASK_UNREADABLE' });
+      continue;
+    }
+    const progress = body.progress ?? body.task?.progress ?? null;
+    const row = {
+      step_id: stepId,
+      task_id: taskId,
+      status: body.task?.status ?? body.status ?? null,
+      progress: progress === null ? null : sanitize(progress),
+      leases: Array.isArray(body.leases) ? body.leases.map((lease) => ({ machine_id: lease?.machine_id ?? null, state: lease?.state ?? null })) : [],
+    };
+    if (progress === null) { row.progress_state = 'unavailable'; row.code = 'PROGRESS_UNSUPPORTED'; }
+    if (hasForbidden(body)) row.leak_fields_stripped = true;
+    steps.push(row);
+  }
+  const unavailable = steps.filter((step) => step.progress_state === 'unavailable').length;
+  return {
+    ok: true,
+    plan_sha256: record.record.plan_sha256,
+    approval_sha256: record.record.approval_sha256 ?? null,
+    dispatched_at: record.record.dispatched_at ?? null,
+    progress_state: steps.length > 0 && unavailable === steps.length ? 'unavailable' : 'partial',
+    code: steps.length > 0 && unavailable === steps.length ? 'PROGRESS_UNSUPPORTED' : null,
+    steps,
+  };
+}

package/src/plugin/joint-dev/relay-dispatch.mjs

@@ -12,6 +12,8 @@
  *     returns are checked: a lease on a machine that was not pinned cancels the task and fails.
  */
 import { createHash } from 'node:crypto';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 
 import { appendAudit } from './audit-file.mjs';
 import { inspectControlMessage } from './redline.mjs';
@@ -42,8 +44,13 @@ function orderSteps(steps) {
 }
 
 function writeAudit(file, event) {
-  if (typeof file !== 'string' || file === '') return;
-  try { appendAudit(file, event); } catch { /* an audit write must not change the dispatch outcome */ }
+  // No audit file requested (library callers): nothing to write, and that is not a failure.
+  if (typeof file !== 'string' || file === '') return { ok: true, skipped: true };
+  try {
+    return appendAudit(file, event);
+  } catch (error) {
+    return { ok: false, code: 'AUDIT_WRITE_FAILED', detail: error instanceof Error ? error.message : String(error) };
+  }
 }
 
 /**
@@ -74,35 +81,52 @@ export async function dispatchPlanToRelay(input) {
   const headers = { authorization: `Bearer ${token}`, 'content-type': 'application/json', accept: 'application/json' };
   const auditFile = typeof input?.auditFile === 'string' ? input.auditFile : '';
 
-  // R3: when a device token is supplied, every target machine must advertise the same plugin version.
-  if (typeof input?.deviceToken === 'string' && input.deviceToken !== '') {
-    const expected = typeof input?.expectedVersion === 'string' ? input.expectedVersion : null;
-    if (expected !== null) {
-      let fleet;
+  // D2 (B5): the version gate is observable and defaults to warn. It becomes a refusal only when the
+  // caller explicitly asks for enforce; a mixed-version fleet is reported, not silently assumed clean.
+  const versionGate = input?.versionGate === 'off' || input?.versionGate === 'enforce' ? input.versionGate : 'warn';
+  const warnings = [];
+  const expectedVersion = typeof input?.expectedVersion === 'string' && input.expectedVersion !== '' ? input.expectedVersion : null;
+  if (expectedVersion !== null && !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(expectedVersion)) {
+    return { ok: false, code: 'VERSION_UNPARSED', detail: { expected: expectedVersion } };
+  }
+  if (versionGate !== 'off' && expectedVersion !== null) {
+    const deviceToken = typeof input?.deviceToken === 'string' && input.deviceToken !== '' ? input.deviceToken : '';
+    let fleet = null;
+    if (deviceToken !== '') {
       try {
-        const response = await fetchImpl(`${rabbitUrl}/v1/devices`, { headers: { authorization: `Bearer ${input.deviceToken}`, accept: 'application/json' }, signal: signalOf() });
+        const response = await fetchImpl(`${rabbitUrl}/v1/devices`, { headers: { authorization: `Bearer ${deviceToken}`, accept: 'application/json' }, signal: signalOf() });
         fleet = response.ok === true ? await response.json() : null;
       } catch { fleet = null; }
-      if (fleet === null || !Array.isArray(fleet.devices)) return { ok: false, code: 'VERSION_UNVERIFIABLE', detail: { reason: 'the relay device list could not be read' } };
+    }
+    if (fleet === null || !Array.isArray(fleet.devices)) {
+      if (versionGate === 'enforce') return { ok: false, code: 'VERSION_UNVERIFIABLE', detail: { reason: 'the relay device list could not be read', expected: expectedVersion } };
+      warnings.push({ code: 'VERSION_UNVERIFIABLE', detail: 'the relay device list could not be read' });
+    } else {
       const byId = new Map(fleet.devices.map((device) => [device.machine_id, device]));
       const skew = ordered.steps
         .map((step) => ({ machine_id: step.machine_id, version: byId.get(step.machine_id)?.caps?.plugin_version ?? null }))
-        .filter((row) => row.version !== expected);
-      if (skew.length > 0) return { ok: false, code: 'VERSION_SKEW', detail: { expected, machines: skew } };
+        .filter((row) => row.version !== expectedVersion);
+      if (skew.length > 0) {
+        if (versionGate === 'enforce') return { ok: false, code: 'VERSION_SKEW', detail: { expected: expectedVersion, machines: skew } };
+        warnings.push({ code: 'VERSION_SKEW', detail: { expected: expectedVersion, machines: skew } });
+      }
     }
   }
 
   const capabilities = await readRelayCapabilities({ rabbitUrl, fetchImpl, timeoutMs });
   if (capabilities.ok !== true) return { ok: false, code: 'RELAY_CAPABILITIES_UNAVAILABLE', detail: { relay: rabbitUrl, error: capabilities.error ?? null } };
-  if (capabilities.signing_required === true) return { ok: false, code: 'RELAY_SIGNING_REQUIRED', detail: { relay: rabbitUrl } };
-  if (capabilities.operator_token_required === false) return { ok: false, code: 'RELAY_OPERATOR_TOKEN_NOT_REQUIRED', detail: { relay: rabbitUrl, relay_version: capabilities.relay_version ?? null } };
   const negotiation = negotiateFeatures(capabilities);
   if (negotiation.ok !== true) {
     return { ok: false, code: negotiation.code ?? 'RELAY_CAPABILITIES_MISSING', detail: { missing: negotiation.missing ?? null, relay: rabbitUrl } };
   }
+  if (capabilities.signing_required !== false) {
+    return { ok: false, code: capabilities.signing_required === true ? 'RELAY_SIGNING_REQUIRED' : 'SIGNING_UNVERIFIABLE', detail: { relay: rabbitUrl, signing_required: capabilities.signing_required } };
+  }
+  if (capabilities.operator_token_required !== true) return { ok: false, code: capabilities.operator_token_required === false ? 'RELAY_OPERATOR_TOKEN_NOT_REQUIRED' : 'OPERATOR_TOKEN_UNVERIFIED', detail: { relay: rabbitUrl, relay_version: capabilities.relay_version ?? null } };
 
   const dispatched = new Map(); // step_id -> task_id
   const tasks = [];
+  const dispatchDir = typeof input?.dispatchDir === 'string' && input.dispatchDir !== '' ? input.dispatchDir : null;
   for (const step of ordered.steps) {
     const taskId = taskIdOf(plan.plan_sha256, step.step_id);
     const dependsOn = (step.depends_on ?? []).map((dep) => dispatched.get(dep)).filter((id) => typeof id === 'string');
@@ -113,6 +137,7 @@ export async function dispatchPlanToRelay(input) {
       executor_machine_id: step.machine_id,
       command_argv: step.command_argv,
       command_hash: step.command_hash,
+      cwd_rel: typeof step.cwd_rel === 'string' && step.cwd_rel !== '' ? step.cwd_rel : '.',
       base_commit: plan.base_commit,
       plan_sha256: plan.plan_sha256,
       approval_sha256: approval.approval_sha256,
@@ -120,16 +145,19 @@ export async function dispatchPlanToRelay(input) {
       ...(dependsOn.length > 0 ? { depends_on: dependsOn } : {}),
       ...(Array.isArray(step.write_scope) && step.write_scope.length > 0 ? { write: true, write_scope: step.write_scope } : {}),
       ...(step.timeout_ms === undefined ? {} : { timeout_ms: step.timeout_ms }),
-      ...(input?.includeOffline === false ? {} : { include_offline: true }),
+      ...(input?.includeOffline === true ? { include_offline: true } : {}),
     };
     const check = inspectControlMessage({ v: 1, type: 'joint.dispatch', body });
     if (check.ok !== true) {
       writeAudit(auditFile, { event: 'joint.dispatch.refused', plan_sha256: plan.plan_sha256, step_id: step.step_id, reason_code: check.code ?? 'CONTROL_REFUSED' });
       return { ok: false, code: check.code ?? 'CONTROL_REFUSED', detail: check.detail ?? null, partial: tasks.length > 0, tasks };
     }
+    const controlText = JSON.stringify(body);
+    const audited = writeAudit(auditFile, { event: 'joint.dispatch.sending', plan_sha256: plan.plan_sha256, step_id: step.step_id, task_id: taskId, machine_id: step.machine_id, control_bytes: Buffer.byteLength(controlText), control_sha256: sha256(controlText) });
+    if (audited.ok !== true) return { ok: false, code: 'AUDIT_UNAVAILABLE', detail: audited, partial: tasks.length > 0, tasks };
     let response;
     try {
-      response = await fetchImpl(`${rabbitUrl}/v1/task`, { method: 'POST', headers, body: JSON.stringify(body), signal: signalOf() });
+      response = await fetchImpl(`${rabbitUrl}/v1/task`, { method: 'POST', headers, body: controlText, signal: signalOf() });
     } catch (error) {
       writeAudit(auditFile, { event: 'joint.dispatch.failed', plan_sha256: plan.plan_sha256, step_id: step.step_id, task_id: taskId, reason_code: 'RELAY_UNREACHABLE' });
       return { ok: false, code: 'RELAY_UNREACHABLE', detail: error instanceof Error ? error.message : String(error), partial: tasks.length > 0, tasks };
@@ -142,12 +170,7 @@ export async function dispatchPlanToRelay(input) {
         const read = await fetchImpl(`${rabbitUrl}/v1/tasks/${encodeURIComponent(taskId)}`, { headers, signal: signalOf() });
         existing = read.ok === true ? await read.json() : null;
       } catch { existing = null; }
-      if (existing === null) {
-        writeAudit(auditFile, { event: 'joint.dispatch.already', plan_sha256: plan.plan_sha256, step_id: step.step_id, task_id: taskId });
-        dispatched.set(step.step_id, taskId);
-        tasks.push({ step_id: step.step_id, task_id: taskId, already: true, leases: [] });
-        continue;
-      }
+      if (existing === null) return { ok: false, code: 'TASK_EXISTS_UNVERIFIED', detail: { step_id: step.step_id, task_id: taskId }, partial: tasks.length > 0, tasks };
       const existingLeases = Array.isArray(existing?.leases) ? existing.leases : [];
       const mine = existingLeases.filter((lease) => lease?.machine_id === step.machine_id);
       if (existingLeases.length > 0 && mine.length === 0) return { ok: false, code: 'TASK_EXISTS_FOREIGN', detail: { step_id: step.step_id, task_id: taskId }, partial: tasks.length > 0, tasks };
@@ -196,5 +219,12 @@ export async function dispatchPlanToRelay(input) {
       leases: leases.map((lease) => ({ machine_id: lease?.machine_id ?? null, state: lease?.state ?? null })),
     });
   }
-  return { ok: true, relay_version: capabilities.relay_version ?? null, features: capabilities.features ?? null, tasks };
+  if (dispatchDir !== null) {
+    try {
+      mkdirSync(dispatchDir, { recursive: true, mode: 0o700 });
+      const file = join(dispatchDir, plan.plan_sha256 + '.json');
+      writeFileSync(file, JSON.stringify({ v: 1, plan_sha256: plan.plan_sha256, approval_sha256: approval.approval_sha256, dispatched_at: new Date().toISOString(), tasks: tasks.map((task) => ({ step_id: task.step_id, task_id: task.task_id, machine_id: task.leases?.[0]?.machine_id ?? null, already: task.already === true })) }, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+    } catch { /* the progress view is best effort; dispatch itself already happened */ }
+  }
+  return { ok: true, relay_version: capabilities.relay_version ?? null, features: capabilities.features ?? null, version_gate: versionGate, ...(warnings.length > 0 ? { warnings } : {}), tasks };
 }

package/src/plugin/project-stream-route.mjs

@@ -0,0 +1,58 @@
+/**
+ * `/api/w2m/project-stream` (A6): authenticated SSE proxy for the read-only project panel.
+ *
+ * The browser cannot set an Authorization header on EventSource, and the device token must not be
+ * exposed to client code. This route takes the project id and cursor from the local user, attaches
+ * the device token server-side and streams the relay's frames through unchanged (including the
+ * PROJECT_REPLAY_TRUNCATED notice).
+ */
+export const PROJECT_STREAM_ROUTE_PATH = '/api/w2m/project-stream';
+const NO_STORE = { 'cache-control': 'no-store' };
+
+/**
+ * @param {object} ctx Cordis context
+ * @param {{relayUrl?: () => string|null, deviceToken?: () => Promise<string|null>|string|null}} [deps]
+ */
+export function registerProjectStreamRoute(ctx, deps = {}) {
+  const status = { mounted: false, reason: 'the host has no Connection service' };
+  if (typeof ctx?.inject !== 'function') return status;
+  ctx.inject(['connection'], (webCtx) => {
+    const registry = webCtx?.connection?.fetch;
+    if (registry === undefined || typeof registry.register !== 'function') {
+      status.reason = 'the connection service carries no fetch registry';
+      return;
+    }
+    registry.register({
+      path: PROJECT_STREAM_ROUTE_PATH,
+      methods: ['GET'],
+      fetch: async (request) => {
+        const url = new URL(request.url ?? 'http://local.invalid/api/w2m/project-stream');
+        const projectId = url.searchParams.get('project_id') ?? '';
+        if (!/^[A-Za-z0-9._-]{1,80}$/.test(projectId)) {
+          return Response.json({ ok: false, code: 'PROJECT_ID_INVALID' }, { status: 400, headers: NO_STORE });
+        }
+        const sinceRaw = url.searchParams.get('since_seq') ?? '0';
+        if (!/^[0-9]+$/.test(sinceRaw)) return Response.json({ ok: false, code: 'PROJECT_CURSOR_INVALID' }, { status: 400, headers: NO_STORE });
+        const relayUrl = typeof deps?.relayUrl === 'function' ? deps.relayUrl() : null;
+        if (typeof relayUrl !== 'string' || relayUrl === '') return Response.json({ ok: false, code: 'RELAY_URL_REQUIRED' }, { status: 503, headers: NO_STORE });
+        const token = typeof deps?.deviceToken === 'function' ? await deps.deviceToken() : null;
+        if (typeof token !== 'string' || token === '') return Response.json({ ok: false, code: 'DEVICE_TOKEN_REQUIRED' }, { status: 503, headers: NO_STORE });
+        const target = relayUrl.replace(/\/$/, '') + '/v1/projects/' + encodeURIComponent(projectId) + '/stream?since_seq=' + sinceRaw;
+        let upstream = null;
+        try {
+          upstream = await fetch(target, { headers: { authorization: 'Bearer ' + token, accept: 'text/event-stream' }, signal: request.signal });
+        } catch {
+          return Response.json({ ok: false, code: 'PROJECT_STREAM_UNAVAILABLE' }, { status: 502, headers: NO_STORE });
+        }
+        if (upstream.ok !== true || upstream.body === null) return Response.json({ ok: false, code: 'PROJECT_STREAM_REFUSED', http_status: upstream.status }, { status: 502, headers: NO_STORE });
+        return new Response(upstream.body, {
+          status: 200,
+          headers: { 'content-type': 'text/event-stream', 'cache-control': 'no-store', connection: 'keep-alive' },
+        });
+      },
+    });
+    status.mounted = true;
+    status.reason = null;
+  });
+  return status;
+}

package/src/plugin/tools-joint.mjs

@@ -11,7 +11,7 @@ import { loadOperatorKey } from './operator-key.mjs';
 
 const json = (value) => JSON.stringify(value, null, 2);
 
-export function registerJointTools(ctx, { defineTool, stateDir, machineName, output }) {
+export function registerJointTools(ctx, { defineTool, stateDir, machineName, output, progress }) {
   const requireStateDir = () => {
     if (typeof stateDir === 'string' && stateDir !== '') return stateDir;
     return null;
@@ -69,12 +69,17 @@ export function registerJointTools(ctx, { defineTool, stateDir, machineName, out
       'returns argv, output or file bytes, and it cannot approve or dispatch.',
     parameters: {
       plan_sha256: { type: 'string', description: 'the 64-hex plan id' },
+      action: { type: 'string', enum: ['status', 'progress'], description: 'status (default) or progress (relay projection; PROGRESS_UNSUPPORTED on an old relay)' },
     },
     output: output ?? { type: 'json' },
     async execute(args) {
       const dir = requireStateDir();
       if (dir === null) return json({ ok: false, code: 'JOINT_STATE_UNAVAILABLE' });
       const planSha = String(args?.plan_sha256 ?? '');
+      if ((args?.action ?? 'status') === 'progress') {
+        if (typeof progress !== 'function') return json({ ok: false, code: 'PROGRESS_UNAVAILABLE' });
+        return json(await progress({ planSha }));
+      }
       const plan = loadPlan({ stateDir: dir, planSha });
       if (plan.ok !== true) return json(plan);
       const key = loadOperatorKey();