@twinsearth/w2m-dsh-plugin 2.1.10 → 2.2.0

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "2.1.10"
+    "version": "2.2.0"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "2.1.10",
+      "version": "2.2.0",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "2.1.10"
+  "version": "2.2.0"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "2.1.10",
+  "version": "2.2.0",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,18 @@ All notable changes to this project are documented here.
 - `w2m_intent`: structured intents mapped onto allow-listed commands; unknown actions, parameters and types
   are refused by name (the fleet does not invent commands).
 
+## [2.2.0] - 2026-11-01
+
+- Fleet binding policy: `fleetKeyPolicy: account` is the new default. A configured `fleetKey` is a fallback while the signed-in account is authoritative, so switching DeepSeek accounts moves the machine without editing every profile. Set `fleetKeyPolicy: config` to keep the old explicit-pin behaviour.
+- `w2m_status` now reads `device.json` through the `DSH_HOME/xclient` fallback when `stateDir` is unset; it no longer reports `paired: false` / `FLEET_UNPAIRED` on a working machine. The reported fleet is compared against the key the stack actually resolved.
+- Includes the v2.1.10 `spawnSync.status` capture fix and the v2.1.11 profile-refresh fix for a switched account.
+- Breaking: an explicit `fleetKey` no longer pins the fleet by default; add `fleetKeyPolicy: config` to opt out.
+
+## [2.1.11] - 2026-11-01
+
+- Account switch: refresh the account profile when `getDeviceIdentity()` has no userId. After a DeepSeek account switch the host clears its cached profile, so the identity read returns no userId until someone calls `getProfile()`; the plugin then derived no new fleet key and kept the previous account's token. It now fetches the profile once, derives the new key, detects the fleet mismatch and re-pairs. This is the remaining half of the v2.1.10 account-switch fix.
+- Tests: a stale-profile service yields the switched account's fleet key in test/chatops-account.test.mjs.
+
 ## [2.1.10] - 2026-11-01
 
 - Fleet binding: a DeepSeek account switch now re-pairs the machine instead of leaving it in the previous account's fleet. Startup compares the relay's fleet_id with the fleet id derived from the signed-in account, and a 60s watcher covers a switch without a process restart. A stored token is only valid for the account that minted it; it is no longer treated as proof of the current account.

package/README.md

@@ -92,7 +92,7 @@ w2m-mcp --help
 # 复制进你自己的 codex/mcp-servers.toml
 [mcp_servers.w2m]
 command = "npx"
-args = ["-y", "@twinsearth/w2m-dsh-plugin@2.1.10", "w2m-mcp"]
+args = ["-y", "@twinsearth/w2m-dsh-plugin@2.2.0", "w2m-mcp"]
 ```
 
 ### 5. 验证过的 release tarball（离线）

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@2.1.10", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@2.2.0", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/acceptance/2.1.11/ACCOUNT-SWITCH-PROFILE-21110.json

@@ -0,0 +1,20 @@
+{
+  "version": "2.1.11",
+  "case": "ACCOUNT-SWITCH-PROFILE-21110",
+  "kind": "positive",
+  "machines": [
+    "1bef9935-8c13-4dd9-9043-4e025320723f"
+  ],
+  "executed_at": "2026-10-31T19:11:34.238Z",
+  "executor": "lead",
+  "task_id": "account-switch-profile-21110-1793473894239",
+  "requirement": "After a DeepSeek account switch the plugin must refresh the cleared profile, derive the new fleet key and re-pair instead of keeping the previous fleet token",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "refresh": "identify() calls getProfile when getDeviceIdentity has no userId",
+      "key": "the switched account yields a different fleetKey",
+      "rebind": "the v2.1.10 fleet mismatch check then re-pairs"
+    }
+  }
+}

package/docs/acceptance/2.2.0/ACCOUNT-SWITCH-POLICY-2200.json

@@ -0,0 +1,21 @@
+{
+  "version": "2.2.0",
+  "case": "ACCOUNT-SWITCH-POLICY-2200",
+  "kind": "positive",
+  "machines": [
+    "1bef9935-8c13-4dd9-9043-4e025320723f"
+  ],
+  "executed_at": "2026-10-31T20:06:14.655Z",
+  "executor": "lead",
+  "task_id": "account-switch-policy-2200-1793477174656",
+  "requirement": "A DeepSeek account switch must move a machine without per-machine fleetKey edits, while w2m_status must use the same device identity fallback as the other tools",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "policy": "fleetKeyPolicy defaults account; configured key is fallback; config opts out",
+      "status": "w2m_status reads DSH_HOME/xclient device.json when stateDir is unset",
+      "select": "selectFleetKey account/config/no-account tests pass",
+      "account": "profile refresh and fleet mismatch re-pair from 2.1.11"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "2.1.10",
+  "version": "2.2.0",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "2.1.10",
+  "version": "2.2.0",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/chatops/account.mjs

@@ -300,6 +300,23 @@ export function createAccountIdentity(options = {}) {
     let identity;
     try {
       identity = await service.getDeviceIdentity();
+      /**
+       * A switched account is invisible until the profile is fetched.
+       *
+       * `getDeviceIdentity()` reads `getPlatformSession().userId`, and that is only populated
+       * from a profile already cached for the current grant. After credentials/record-updated
+       * the old profile is discarded and the session's userId is null until someone calls
+       * `getProfile()`. A machine that was paired before the switch therefore derived no new
+       * fleet key and kept its old token -- the reported "still in the previous account's
+       * fleet" state. Fetch the profile once when the identity is missing; the second read then
+       * sees the new account.
+       */
+      if ((identity?.userId == null) && typeof service.getProfile === 'function') {
+        try {
+          await service.getProfile();
+          identity = await service.getDeviceIdentity();
+        } catch { /* keep the signed-out answer if the profile cannot be read */ }
+      }
     } catch (error) {
       return { ok: false, reason: 'identity_read_failed', detail: error instanceof Error ? error.message : String(error) };
     }

package/src/plugin/fleet-binding.mjs

@@ -39,6 +39,31 @@ export function shouldRejoin({ token, fleetId, fleetKey, expectedFleetId = null
   return typeof expectedFleetId === 'string' && expectedFleetId !== '' && fleetId !== expectedFleetId;
 }
 
+/**
+ * Choose the key a start actually binds with.
+ *
+ * `fleetKeyPolicy: 'account'` (the default) makes the signed-in account authoritative: an explicit
+ * `fleetKey` is a **fallback** for when the account cannot be read, not a pin that survives an
+ * account switch. `'config'` restores the old operator-pin behaviour for fleets that deliberately
+ * outlive the signed-in account.
+ *
+ * The distinction exists because a key in the profile has no provenance: it may have been placed
+ * there by an earlier setup for the *previous* account, or by an operator who means to pin the fleet.
+ * The policy is the machine-readable statement of which one it is; without it, auto-switching would
+ * silently override a deliberate pin.
+ *
+ * @param {{configured?: string|null, account?: string|null, policy?: string}} input
+ * @returns {{fleetKey: string|null, source: 'account'|'config'|null}}
+ */
+export function selectFleetKey({ configured = null, account = null, policy = 'account' } = {}) {
+  const hasConfig = typeof configured === 'string' && configured.trim() !== '';
+  const hasAccount = typeof account === 'string' && account.trim() !== '';
+  if (policy === 'config' && hasConfig) return { fleetKey: configured, source: 'config' };
+  if (hasAccount) return { fleetKey: account, source: 'account' };
+  if (hasConfig) return { fleetKey: configured, source: 'config' };
+  return { fleetKey: null, source: null };
+}
+
 /**
  * Read this machine's relay record and classify its fleet binding.
  *

package/src/plugin/tools.mjs

@@ -1,5 +1,5 @@
 import { FAILOVER_DEFAULTS, createRelayFailover, relayPool } from './relay-failover.mjs';
-import { diagnoseFleetBinding, shouldRejoin } from './fleet-binding.mjs';
+import { diagnoseFleetBinding, shouldRejoin, selectFleetKey } from './fleet-binding.mjs';
 import { DEFAULT_BOOTSTRAP_URL, DEFAULT_BOOTSTRAP_OPERATOR_KEY_PEM } from './bootstrap.mjs';
 /**
  * DSH: Windows2MacO - the DSH Cordis plugin.
@@ -293,7 +293,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '2.1.10';
+const PLUGIN_VERSION = '2.2.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -799,6 +799,17 @@ function readConfig(config = {}) {
         : (typeof process.env.W2M_FLEET_KEY === 'string' && process.env.W2M_FLEET_KEY.trim() !== ''
           ? process.env.W2M_FLEET_KEY.trim()
           : null),
+    /**
+     * v2.2.0: which key wins when a configured key and the signed-in account disagree.
+     *
+     * `'account'` (default) follows the account and treats the configured key as a fallback, so an
+     * account switch moves the machine without editing every profile. `'config'` is the explicit
+     * operator pin and keeps the old behaviour. The old silent "config always wins" made an account
+     * switch look like a binding bug on every machine that had ever stored a key.
+     */
+    fleetKeyPolicy: (config.fleetKeyPolicy === 'config' || process.env.W2M_FLEET_KEY_POLICY === 'config')
+      ? 'config'
+      : 'account',
     // From the merged layers, not from `config` alone: this is the value the fleet shares.
     allowedCommands: shared.values.allowedCommands
       .filter((entry) => typeof entry === 'string')
@@ -4904,7 +4915,18 @@ const result = await request({
       // Read, not required: this tool exists to describe a half-configured machine, so an absent or
       // unpaired device.json is part of the answer rather than a reason to refuse. `/healthz` needs
       // no bearer token, so nothing here depends on the token being present.
-      const device = await readDevice(cfg);
+      /**
+       * v2.2.0: use the same identity path every other tool uses.
+       *
+       * `readDevice(cfg)` returns an empty identity when `stateDir` is unset, while dispatch and
+       * history fall back to `DSH_HOME/xclient/device.json`. `w2m_status` was the only reader that
+       * skipped that fallback, so a working machine reported `paired: false` / `FLEET_UNPAIRED`
+       * and sent the reader to fix a pairing that was already fine.
+       */
+      const statusDeviceFile = devicePathFor(cfg);
+      const device = statusDeviceFile === null
+        ? await readDevice(cfg)
+        : await readDevice({ stateDir: path.dirname(statusDeviceFile) });
 
       // A cheap reachability probe of a documented endpoint. Without a configured URL there is
       // nothing to probe, and that is reported rather than guessed at.
@@ -5038,7 +5060,7 @@ const result = await request({
         relayUrl: cfg.rabbitUrl,
         token: device.device_token,
         machineId: device.machine_id,
-        fleetKey: cfg.fleetKey,
+        fleetKey: statusFleetKey,
         expectedFleetId,
       });
 
@@ -5078,6 +5100,7 @@ const result = await request({
             allowedCommands: cfg.allowedCommands,
             pairingCode_configured: cfg.pairingCode !== null,
             fleetKey_configured: cfg.fleetKey !== null,
+            fleetKey_policy: cfg.fleetKeyPolicy,
             p2pMode: cfg.p2pMode,
             // The resolved list, shared server first, exactly as the node will query it.
             stunServers: cfg.stunServers,
@@ -7962,10 +7985,24 @@ async function startLocalStack(ctx, cfg) {
      */
     async function deriveFleetKeyOnce(attempts = FAST_DERIVE_ATTEMPTS) {
       const configured = fleetKeyFromConfig;
-      if (configured !== null) return { fleetKey: configured, fleetKeySource: 'config', last: null };
+      /**
+       * v2.2.0: the configured key is a **fallback** unless the operator pins it.
+       *
+       * Before this, a key in the profile returned immediately and the account was never read.
+       * That is why a machine with an old key stayed in the previous account's fleet even after
+       * v2.1.10/v2.1.11 taught the binding code to compare and re-pair: it never got a new key to
+       * compare with. The default policy now reads the account first; `fleetKeyPolicy: 'config'`
+       * restores the explicit pin for fleets that outlive the signed-in account.
+       */
+      if (cfg.fleetKeyPolicy === 'config' && configured !== null) {
+        return { fleetKey: configured, fleetKeySource: 'config', last: null };
+      }
 
+      // A configured key is a usable fallback, so do not spend the full retry budget before
+      // using it. One account read is enough at mount; the watcher retries if the profile is cold.
+      const effectiveAttempts = configured !== null ? 1 : attempts;
       let last = null;
-      for (let attempt = 1; attempt <= attempts; attempt += 1) {
+      for (let attempt = 1; attempt <= effectiveAttempts; attempt += 1) {
         try {
           const { createAccountIdentity } = await import('../chatops/account.mjs');
           last = await createAccountIdentity({ ctx, platform: process.platform }).resolve();
@@ -7982,20 +8019,28 @@ async function startLocalStack(ctx, cfg) {
          */
         const derived = last && typeof last.fleetKey === 'string' && last.fleetKey !== '' ? last.fleetKey : null;
         if (derived !== null) {
+          if (configured !== null && configured !== derived) {
+            ctx.logger?.warn?.('w2m: the signed-in account derives a different fleet than the configured fleetKey; following the account (set fleetKeyPolicy: config to pin the configured key)');
+          }
           ctx.logger?.info?.(
             `w2m: fleet key derived from the signed-in account on attempt ${attempt} (fleet ${last.accountCode})`
             + (last.ok === true ? '' : `; no serial number: ${last.reason ?? 'unknown reason'}`),
           );
           return { fleetKey: derived, fleetKeySource: 'account', last };
         }
-        if (attempt < attempts) {
+        if (attempt < effectiveAttempts) {
           const waitMs = Math.min(2000 * 2 ** (attempt - 1), 30000);
           ctx.logger?.info?.(`w2m: no fleet key yet (${describeIdentityFailure(last)}); retrying in ${waitMs}ms`);
           await new Promise((resolve) => { setTimeout(resolve, waitMs); });
         }
       }
+      // Account unavailable: the configured key, if any, is the documented fallback.
+      const fallback = selectFleetKey({ configured, account: null, policy: cfg.fleetKeyPolicy });
+      if (fallback.fleetKey !== null) {
+        ctx.logger?.warn?.('w2m: the signed-in account produced no fleet key; falling back to the configured fleetKey (mark it fleetKeyPolicy: config to make that choice explicit)');
+      }
       // Not fatal: the caller may pair by code, and a later attempt may still succeed.
-      return { fleetKey: null, fleetKeySource: null, last };
+      return { fleetKey: fallback.fleetKey, fleetKeySource: fallback.source, last };
     }
 
     let { fleetKey, fleetKeySource } = await deriveFleetKeyOnce();
@@ -8308,7 +8353,7 @@ async function startLocalStack(ctx, cfg) {
     let accountWatch = null;
     let accountWatchBusy = false;
     async function recheckAccountBinding() {
-      if (accountWatchBusy || fleetKeyFromConfig !== null) return;
+      if (accountWatchBusy || cfg.fleetKeyPolicy === 'config') return;
       accountWatchBusy = true;
       try {
         const { createAccountIdentity } = await import('../chatops/account.mjs');