@twinsearth/w2m-dsh-plugin 2.1.9 → 2.1.10

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "2.1.9"
+    "version": "2.1.10"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "2.1.9",
+      "version": "2.1.10",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "2.1.9"
+  "version": "2.1.10"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "2.1.9",
+  "version": "2.1.10",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,13 @@ All notable changes to this project are documented here.
 - `w2m_intent`: structured intents mapped onto allow-listed commands; unknown actions, parameters and types
   are refused by name (the fleet does not invent commands).
 
+## [2.1.10] - 2026-11-01
+
+- Fleet binding: a DeepSeek account switch now re-pairs the machine instead of leaving it in the previous account's fleet. Startup compares the relay's fleet_id with the fleet id derived from the signed-in account, and a 60s watcher covers a switch without a process restart. A stored token is only valid for the account that minted it; it is no longer treated as proof of the current account.
+- Fleet binding diagnostics: FLEET_MISMATCH names a binding to a different account's fleet; FLEET_UNBOUND keeps the existing re-admit rule.
+- Remote view capture: read the `spawnSync` exit code from `status`, not the execFile-shaped `code`. `code` is `undefined` for `spawnSync`, so every successful screen capture was reported as CAPTURE_DENIED and the relay view target could never publish a frame. S2 used `status`, which is why its probe passed while the agent path failed.
+- Tests: mismatch and unbound re-admit cases in test/fleet-binding.test.mjs; a capture test pins the `status` contract and would fail on the old `code` read.
+
 ## [2.1.9] - 2026-10-31
 
 - Plugin identity: exported locale/zh.json + locale/en.json meta.title/meta.description. DSH reads these without activating the plugin, so the manager list and detail page render the custom name and copy.

package/README.md

@@ -92,7 +92,7 @@ w2m-mcp --help
 # 复制进你自己的 codex/mcp-servers.toml
 [mcp_servers.w2m]
 command = "npx"
-args = ["-y", "@twinsearth/w2m-dsh-plugin@2.1.9", "w2m-mcp"]
+args = ["-y", "@twinsearth/w2m-dsh-plugin@2.1.10", "w2m-mcp"]
 ```
 
 ### 5. 验证过的 release tarball（离线）

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@2.1.9", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@2.1.10", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/acceptance/2.1.10/ACCOUNT-SWITCH-21100.json

@@ -0,0 +1,20 @@
+{
+  "version": "2.1.10",
+  "case": "ACCOUNT-SWITCH-21100",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-31T18:03:23.303Z",
+  "executor": "lead",
+  "task_id": "account-switch-21100-1793469803304",
+  "requirement": "Switching the signed-in DeepSeek account must move the machine to that account fleet, not leave it heartbeating in the previous fleet",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "mismatch": "FLEET_MISMATCH names a relay fleet_id that differs from the account-derived fleet_id",
+      "rejoin": "shouldRejoin re-admits on null and on mismatch, and not when the ids agree",
+      "watch": "a 60s account check re-derives the fleet key and re-pairs after a switch"
+    }
+  }
+}

package/docs/acceptance/2.1.10/REMOTE-VIEW-CAPTURE-21100.json

@@ -0,0 +1,20 @@
+{
+  "version": "2.1.10",
+  "case": "REMOTE-VIEW-CAPTURE-21100",
+  "kind": "positive",
+  "machines": [
+    "b1b19d49-20f1-4cdc-986e-f5630a5cd6f2"
+  ],
+  "executed_at": "2026-10-31T18:11:48.141Z",
+  "executor": "lead",
+  "task_id": "remote-view-capture-21100-1793470308142",
+  "requirement": "The relay view target must read spawnSync.status so a successful screen capture is published instead of CAPTURE_DENIED",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "status": "captureScreen reads result.status on darwin and win32",
+      "regression": "a runner returning {status:0,code:1} still captures",
+      "probe": "remote-s2-capture exit 162 on macmini"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "2.1.9",
+  "version": "2.1.10",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "2.1.9",
+  "version": "2.1.10",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/agent/view/capture.mjs

@@ -74,7 +74,9 @@ export function captureScreen(options = {}) {
     let height = null;
     if (platform === 'win32') {
       const result = run(['powershell.exe', '-NoProfile', '-NonInteractive', '-STA', '-ExecutionPolicy', 'Bypass', '-Command', windowsCaptureScript(maxBytes)], { timeoutMs: 20000 });
-      if (result.code !== 0) return { ok: false, code: VIEW_CAPTURE_CODE.DENIED, error: `PowerShell capture failed (exit ${result.code ?? 'null'}${result.signal ? ', signal ' + result.signal : ''}${result.error?.message ? ', ' + result.error.message : ''})`, capture_ms: Date.now() - started };
+      // `spawnSync` reports the exit code as `status`; `code` is the execFile-shaped field
+      // and is undefined here, which made every successful capture look like a denial.
+      if (result.status !== 0) return { ok: false, code: VIEW_CAPTURE_CODE.DENIED, error: `PowerShell capture failed (exit ${result.status ?? 'null'}${result.signal ? ', signal ' + result.signal : ''}${result.error?.message ? ', ' + result.error.message : ''})`, capture_ms: Date.now() - started };
       base64 = String(result.stdout ?? '').trim().split(/\r?\n/).filter(Boolean).pop() ?? '';
       if (!/^[A-Za-z0-9+/=]{100,}$/.test(base64)) return { ok: false, code: VIEW_CAPTURE_CODE.FAILED, error: 'PowerShell returned no JPEG', capture_ms: Date.now() - started };
     } else if (platform === 'darwin') {
@@ -82,7 +84,9 @@ export function captureScreen(options = {}) {
       const file = join(dir, 'frame.jpg');
       try {
         const result = run(['/usr/sbin/screencapture', '-x', '-t', 'jpg', file], { timeoutMs: 15000 });
-        if (result.code !== 0) return { ok: false, code: VIEW_CAPTURE_CODE.DENIED, error: `screencapture failed (exit ${result.code})`, capture_ms: Date.now() - started };
+        // Same `spawnSync` contract: `status`, never `code`. S2 used the right field, which is
+        // why the probe succeeded while the relay view target reported CAPTURE_DENIED.
+        if (result.status !== 0) return { ok: false, code: VIEW_CAPTURE_CODE.DENIED, error: `screencapture failed (exit ${result.status})`, capture_ms: Date.now() - started };
         const data = readFileSync(file);
         base64 = data.toString('base64');
         const sips = run(['sips', '-g', 'pixelWidth', '-g', 'pixelHeight', file], { timeoutMs: 5000 });

package/src/plugin/fleet-binding.mjs

@@ -13,6 +13,7 @@
 export const FLEET_BINDING_CODE = Object.freeze({
   BOUND: 'FLEET_BOUND',
   UNBOUND: 'FLEET_UNBOUND',
+  MISMATCH: 'FLEET_MISMATCH',
   UNPAIRED: 'FLEET_UNPAIRED',
   TOKEN_REJECTED: 'FLEET_TOKEN_REJECTED',
   UNKNOWN: 'FLEET_UNKNOWN',
@@ -20,12 +21,22 @@ export const FLEET_BINDING_CODE = Object.freeze({
 
 /**
  * Should a start-up re-admit even though a token exists?
- * Only when the token is valid, the machine has no fleet, and a key is available to bind it.
+ *
+ * Two states need it: the machine has no fleet (a token issued before fleet binding, or a
+ * run where the pairing code carried none), or the fleet it is in is **not the fleet the
+ * current account derives**. The second is the account-switch defect: a stored token stays
+ * valid for the account that minted it, so after a different DeepSeek account signs in the
+ * machine keeps heartbeating into the old account's fleet unless its binding is compared
+ * with the key the new account derives.
+ *
+ * An absent expected fleet id means the caller could not derive one; equality cannot be
+ * tested then, so only the unbound state re-admits.
  */
-export function shouldRejoin({ token, fleetId, fleetKey }) {
-  return typeof token === 'string' && token !== ''
-    && (fleetId === null || fleetId === undefined || fleetId === '')
-    && typeof fleetKey === 'string' && fleetKey.trim() !== '';
+export function shouldRejoin({ token, fleetId, fleetKey, expectedFleetId = null }) {
+  if (typeof token !== 'string' || token === '') return false;
+  if (typeof fleetKey !== 'string' || fleetKey.trim() === '') return false;
+  if (fleetId === null || fleetId === undefined || fleetId === '') return true;
+  return typeof expectedFleetId === 'string' && expectedFleetId !== '' && fleetId !== expectedFleetId;
 }
 
 /**
@@ -35,14 +46,16 @@ export function shouldRejoin({ token, fleetId, fleetKey }) {
  *          fleetKey: string|null, fetchImpl?: Function, timeoutMs?: number}} input
  * @returns {Promise<object>} a bounded, token-free status block
  */
-export async function diagnoseFleetBinding({ relayUrl, token, machineId, fleetKey = null, fetchImpl = fetch, timeoutMs = 2500 }) {
+export async function diagnoseFleetBinding({ relayUrl, token, machineId, fleetKey = null, expectedFleetId = null, fetchImpl = fetch, timeoutMs = 2500 }) {
   const checkedAt = new Date().toISOString();
   const fleetKeyConfigured = typeof fleetKey === 'string' && fleetKey.trim() !== '';
+  const expected = typeof expectedFleetId === 'string' && expectedFleetId !== '' ? expectedFleetId : null;
   const base = {
     ok: true,
     state: 'unknown',
     code: FLEET_BINDING_CODE.UNKNOWN,
     fleet_id: null,
+    expected_fleet_id: expected,
     token_present: typeof token === 'string' && token !== '',
     fleet_key_configured: fleetKeyConfigured,
     machine_id: machineId,
@@ -93,6 +106,16 @@ export async function diagnoseFleetBinding({ relayUrl, token, machineId, fleetKe
           : 'set fleetKey / W2M_FLEET_KEY, then restart the agent so the machine can join its fleet',
       };
     }
+    if (expected !== null && fleetId !== expected) {
+      return {
+        ...base,
+        state: 'mismatch',
+        code: FLEET_BINDING_CODE.MISMATCH,
+        fleet_id: fleetId,
+        detail: 'the relay records this machine in a different fleet than the signed-in account derives',
+        remedy: 're-admit this machine with the account-derived fleet key; the old token must not keep it in the previous fleet',
+      };
+    }
     return { ...base, state: 'bound', code: FLEET_BINDING_CODE.BOUND, fleet_id: fleetId };
   } catch (error) {
     return {

package/src/plugin/tools.mjs

@@ -293,7 +293,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '2.1.9';
+const PLUGIN_VERSION = '2.1.10';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -744,7 +744,7 @@ function readConfig(config = {}) {
   // silent default when a value *is* supplied.
   const p2p = resolveP2PMode(config);
   const p2pMode = p2p.mode;
-  const p2pPortResult = normalizeP2PPort(config.p2pPort);
+  const p2pPortResult = normalizeP2PPort(config.p2pPort);
   const p2pPublicPortResult = normalizeP2PPort(config.p2pPublicPort);
   const stun = resolveStunServers(config);
   const stunList = stun.servers;
@@ -934,7 +934,7 @@ function readConfig(config = {}) {
       : (typeof process.env.W2M_BOOTSTRAP_OPERATOR_KEY === 'string' && process.env.W2M_BOOTSTRAP_OPERATOR_KEY.trim() !== '' ? process.env.W2M_BOOTSTRAP_OPERATOR_KEY : DEFAULT_BOOTSTRAP_OPERATOR_KEY_PEM),
     p2pMode,
     p2pPort: p2pPortResult.ok ? p2pPortResult.port : null,
-    p2pPortError: p2pPortResult.ok ? null : `P2P_PORT_INVALID: ${p2pPortResult.reason}`,
+    p2pPortError: p2pPortResult.ok ? null : `P2P_PORT_INVALID: ${p2pPortResult.reason}`,
     p2pPublicPort: p2pPublicPortResult.ok ? p2pPublicPortResult.port : null,
     stunServers: stunList,
   };
@@ -2037,7 +2037,7 @@ async function initP2P(ctx, cfg, runtime, block) {
     getJson: transport.getJson,
     stunServers: cfg.stunServers,
     log: (line) => ctx?.logger?.info?.(`w2m ${line}`),
-    ...(Number.isInteger(cfg.p2pPort) ? { bindPort: cfg.p2pPort } : {}),
+    ...(Number.isInteger(cfg.p2pPort) ? { bindPort: cfg.p2pPort } : {}),
     ...(Number.isInteger(cfg.p2pPublicPort) ? { publicPort: cfg.p2pPublicPort } : {}),
     ...(keyLoad.key === null ? {} : { deviceKey: keyLoad.key }),
     ...block,
@@ -5021,11 +5021,25 @@ const result = await request({
       };
       })();
 
+      /**
+       * Compare against the key the stack actually resolved, not just `cfg.fleetKey`.
+       * A machine joined by account has no configured key, and that is exactly the case
+       * where a switched account used to look "bound" because only `fleet_id=null` was
+       * treated as wrong.
+       */
+      let expectedFleetId = null;
+      const statusFleetKey = resolvedFleetKey.value ?? cfg.fleetKey;
+      try {
+        const { planJoin } = await import('../chatops/fleet-join.mjs');
+        const plan = planJoin({ fleetKeyEncoded: statusFleetKey });
+        if (plan.ok === true) expectedFleetId = plan.fleetId;
+      } catch { /* malformed key: report without an expectation */ }
       const fleetBinding = await diagnoseFleetBinding({
         relayUrl: cfg.rabbitUrl,
         token: device.device_token,
         machineId: device.machine_id,
         fleetKey: cfg.fleetKey,
+        expectedFleetId,
       });
 
       return JSON.stringify(
@@ -8062,16 +8076,38 @@ async function startLocalStack(ctx, cfg) {
             if (identityOptions.identity !== undefined && identityOptions.identity !== null) identityOptions.identity.device_token = null;
             ctx.logger?.warn?.('w2m: stored device token was rejected by ' + relayForToken + ' (HTTP ' + probe.status + '); pairing again with the fleet key');
           }
-          if (alreadyPaired && fleetKeyFromConfig !== null) {
+          /**
+           * Compare the relay's binding with the fleet the **current** key derives.
+           *
+           * The old check ran only for a configured `fleetKey`, so the account-derived key
+           * (the normal case) was never compared. That is the account-switch defect: the
+           * stored token stays valid for the account that minted it, and the machine keeps
+           * heartbeating into the previous account's fleet. `fleetId=null` was the only
+           * rejoin trigger, so a non-null mismatch looked perfectly healthy.
+           */
+          const effectiveFleetKey = fleetKey ?? fleetKeyFromConfig;
+          if (alreadyPaired && effectiveFleetKey !== null) {
+            let expectedFleetId = null;
+            try {
+              const { planJoin } = await import('../chatops/fleet-join.mjs');
+              const plan = planJoin({ fleetKeyEncoded: effectiveFleetKey });
+              if (plan.ok === true) expectedFleetId = plan.fleetId;
+            } catch { /* malformed key: binding cannot be compared, keep the token */ }
             const binding = await diagnoseFleetBinding({
               relayUrl: relayForToken,
               token: existingToken,
               machineId: loaded.identity.machine_id,
-              fleetKey: fleetKeyFromConfig,
+              fleetKey: effectiveFleetKey,
+              expectedFleetId,
             });
-            if (shouldRejoin({ token: existingToken, fleetId: binding.fleet_id, fleetKey: fleetKeyFromConfig })) {
+            if (shouldRejoin({ token: existingToken, fleetId: binding.fleet_id, fleetKey: effectiveFleetKey, expectedFleetId })) {
               alreadyPaired = false;
-              ctx.logger?.warn?.('w2m: FLEET_UNBOUND (token valid, fleet_id=null); re-admitting with the configured fleet key');
+              loaded.identity.device_token = null;
+              if (identityOptions.identity !== undefined && identityOptions.identity !== null) identityOptions.identity.device_token = null;
+              ctx.logger?.warn?.(
+                `w2m: fleet binding changed (relay=${binding.fleet_id ?? 'none'}, account=${expectedFleetId ?? 'unknown'}); `
+                + `re-admitting with the ${fleetKeySource === 'config' ? 'configured' : 'account-derived'} fleet key`,
+              );
             }
           }
         } catch { /* network error: keep the token, do not force a re-pair */ }
@@ -8254,6 +8290,55 @@ async function startLocalStack(ctx, cfg) {
      */
     ensureFleetJoin = () => joinFleet();
 
+    /**
+     * Watch for an account switch while the process stays alive.
+     *
+     * The mount check repairs a switch that happened before start-up. This one covers the same
+     * event without a restart: a different DeepSeek account signs in, the account service starts
+     * returning a different user id, and the derived fleet key changes. The stored token is still
+     * valid for the *previous* account, so without this the machine keeps heartbeating into the
+     * old fleet -- the reported symptom. Re-pairing rotates the token and moves the machine.
+     *
+     * The account service is read on an interval rather than per request: it can touch the host's
+     * profile store, and a switch is a human-paced event, not a per-dispatch one. An operator-set
+     * `fleetKey` is not watched -- that is an explicit decision and must not be overwritten by
+     * whichever account happens to be signed in.
+     */
+    const ACCOUNT_WATCH_MS = 60_000;
+    let accountWatch = null;
+    let accountWatchBusy = false;
+    async function recheckAccountBinding() {
+      if (accountWatchBusy || fleetKeyFromConfig !== null) return;
+      accountWatchBusy = true;
+      try {
+        const { createAccountIdentity } = await import('../chatops/account.mjs');
+        const identity = await createAccountIdentity({ ctx, platform: process.platform }).resolve();
+        const next = typeof identity?.fleetKey === 'string' && identity.fleetKey !== '' ? identity.fleetKey : null;
+        if (next === null || next === fleetKey) return;
+        ctx.logger?.warn?.('w2m: the signed-in account changed; leaving the previous fleet and re-pairing with the new account fleet key');
+        fleetKey = next;
+        fleetKeySource = 'account';
+        resolvedFleetKey.value = next;
+        resolvedFleetKey.source = 'account';
+        resolvedFleetKey.at = Date.now();
+        alreadyPaired = false;
+        joinSucceeded = false;
+        joinPromise = null;
+        joinLastError = null;
+        joinLastWasKeyless = false;
+        loaded.identity.device_token = null;
+        if (identityOptions.identity !== undefined && identityOptions.identity !== null) identityOptions.identity.device_token = null;
+        const outcome = await joinFleet();
+        if (outcome.paired !== true) scheduleJoinRetry();
+      } catch (error) {
+        ctx.logger?.warn?.('w2m: account re-check failed: ' + (error instanceof Error ? error.message : String(error)));
+      } finally {
+        accountWatchBusy = false;
+      }
+    }
+    accountWatch = setInterval(() => { void recheckAccountBinding(); }, ACCOUNT_WATCH_MS);
+    accountWatch.unref?.();
+
     if (alreadyPaired) {
       joinSucceeded = true;
       joinPromise = Promise.resolve({ paired: true, by: 'existing token' });
@@ -8362,6 +8447,10 @@ async function startLocalStack(ctx, cfg) {
 
   return async () => {
     clearJoinRetry();
+    if (accountWatch !== null) {
+      clearInterval(accountWatch);
+      accountWatch = null;
+    }
     ensureFleetJoin = null;
     inProcessAgentStatus = null;
     await agent.stop();