@twinsearth/w2m-dsh-plugin 2.2.3 → 2.2.5

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "2.2.3"
+    "version": "2.2.5"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "2.2.3",
+      "version": "2.2.5",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "2.2.3"
+  "version": "2.2.5"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -4,9 +4,38 @@ All notable changes to this project are documented here.
 
 ## [Unreleased]
 
+## [2.2.5] - 2026-11-12
+
+- DSH 0.2.2-rc.2 compatibility, measured rather than assumed: the packed artifact mounts and boots in
+  the rc.2 runtime (`@deepseek-ai/dsh@0.2.2-rc.2`) with every host entry active, all `w2m_*` tools
+  registered, the browser half composed into `__DSH_BOOT__` and activated, the real page booting in a
+  browser, and the Node-execution menu opening and taking temporary execution from the composer.
+- The compatibility gate now pins that host: `DSH_HOST_VERSION` moves from `0.2.0-rc.2` to
+  `0.2.2-rc.2`, with the Cordis versions that release carries (`@deepseek-ai/cordis@4.1.0`,
+  `@deepseek-ai/cordis-plugin-loader@1.1.0`) and the pnpm the runtime bundles (`11.28.5`). The gate is
+  what turns "the host moved" into a measurement instead of a surprise.
+- `package.json#engines.dsh` is declared for the first time: `>=0.2.0 <0.3.0`. The requirement is read
+  before any plugin code loads, so a host outside the line is refused with a named requirement instead
+  of failing later. Prereleases participate in the range (DSH evaluates it with `includePrerelease`),
+  which is why `0.2.2-rc.2` and `0.2.2-rc.1` both satisfy it; declaring `engines.dsh` also means the
+  old `@deepseek-ai/dsh-*` peer fallback no longer decides compatibility for this package.
+- Reviewed the two rc.2 changes an extension could depend on, and neither needs this package to move:
+  tool failures now carry structured identity (`ToolGuardDenial.info`, `ToolContextUnavailableError`,
+  approval and context error codes) but this package registers no `tools` guards and already returns a
+  named refusal reason, so the change is additive from here; and plugins can register MCP servers for
+  their own lifetime through `ctx.mcpManager`, which this package deliberately does **not** do — its
+  bundled `w2m-mcp` server mirrors the same `w2m_*` tools for codex/Claude hosts, so mounting it inside
+  DSH would register every tool twice.
 - `w2m_intent`: structured intents mapped onto allow-listed commands; unknown actions, parameters and types
   are refused by name (the fleet does not invent commands).
 
+## [2.2.4] - 2026-11-05
+
+- Fixes the remote desktop `HTTP 404`: a default desktop profile leaves `stateDir` empty, and
+  the remote-view route registration returned not-mounted in that case. The host now resolves
+  the same `~/.dsh/xclient` directory the agent uses, so `/api/w2m/remote/config|start|frame|stop`
+  are mounted and the settings toggle works without configuring `stateDir` by hand.
+- Remote-view route coverage now includes the default-stateDir mount path.
 ## [2.2.3] - 2026-11-05
 
 - Remote desktop (view-only) now reaches 1 frame per second in a fleet. A machine opts in by

package/README.md

@@ -93,7 +93,7 @@ w2m-mcp --help
 # 复制进你自己的 codex/mcp-servers.toml
 [mcp_servers.w2m]
 command = "npx"
-args = ["-y", "@twinsearth/w2m-dsh-plugin@2.2.3", "w2m-mcp"]
+args = ["-y", "@twinsearth/w2m-dsh-plugin@2.2.5", "w2m-mcp"]
 ```
 
 ### 5. 验证过的 release tarball（离线）

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@2.2.3", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@2.2.5", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/acceptance/2.2.4/RELEASE-2240.json

@@ -0,0 +1,32 @@
+{
+  "version": "2.2.4",
+  "case": "RELEASE-2240",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-11-05T15:10:00.000Z",
+  "executor": "lead",
+  "task_id": "pre-release-2240",
+  "requirement": "v2.2.4: remote-view host routes mount on a default desktop profile whose stateDir is unset, so the settings toggle and /api/w2m/remote/{config,start,frame,stop} no longer return HTTP 404",
+  "commands": [
+    ["node", "--test", "--test-force-exit", "test/remote-view-route.test.mjs", "test/view-consent.test.mjs", "test/view-frame-channel.test.mjs", "test/relay-target.test.mjs", "test/client-bundle.test.mjs"],
+    ["node", "scripts/check-entrypoints.mjs"],
+    ["node", "--test", "--test-force-exit", "test/loader-entry.test.mjs"]
+  ],
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "remote_view": "test/remote-view-route.test.mjs 4/4: default-stateDir mount, P2P session, P2P refusal, and relay refresh",
+      "consent": "test/view-consent.test.mjs 4/4",
+      "p2p": "test/view-frame-channel.test.mjs 4/4",
+      "relay": "test/relay-target.test.mjs 3/3",
+      "client": "test/client-bundle.test.mjs 36/36",
+      "entrypoints": "node scripts/check-entrypoints.mjs: all entry points PASS",
+      "loader": "test/loader-entry.test.mjs 10/10 against the packed 2.2.4 artifact in the real DSH 0.2.2-rc.1 Loader and Edge page",
+      "root_cause": "registerRemoteViewRoutes returned { mounted: false, reason: 'stateDir is not configured' } when cfg.stateDir was empty; no /api/w2m/remote/* route existed",
+      "fix": "resolveStateDir(null, '') resolves ~/.dsh/xclient, matching the agent's default state directory",
+      "scope": "code and tests only; no profile was edited by the tests; npm publish is separate"
+    }
+  }
+}

package/docs/acceptance/2.2.5/RELEASE-2250.json

@@ -0,0 +1,34 @@
+{
+  "version": "2.2.5",
+  "case": "RELEASE-2250",
+  "kind": "positive",
+  "machines": ["b53a37f4-1464-4512-9259-33a7df091e3e"],
+  "executed_at": "2026-11-12T12:43:04Z",
+  "executor": "lead",
+  "task_id": "pre-release-2250",
+  "requirement": "v2.2.5: the packed artifact mounts and boots in DSH 0.2.2-rc.2 (host entries active, all w2m_* tools registered, browser half composed and activated, real page boots, composer menus usable), and package.json#engines.dsh declares the supported host range before any plugin code loads",
+  "commands": [
+    ["node", "scripts/pack.mjs"],
+    ["node", "test/helpers/dsh-loader-driver.mjs", "<harnessRoot>", "<dshHome>", "w2mrc2", "[\"--port\",\"0\",\"--no-open\"]", "<overlay>"],
+    ["node", "--test", "--test-force-exit", "test/loader-entry.test.mjs"],
+    ["node", "--test", "--test-force-exit", "test/installed-version.test.mjs", "test/evidence.test.mjs", "test/claims.test.mjs", "test/agent-plugins.test.mjs"],
+    ["node", "scripts/preflight.mjs"]
+  ],
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "host": "DSH 0.2.2-rc.2 (@deepseek-ai/dsh@0.2.2-rc.2 installed from npm; cordis 4.1.0, cordis-plugin-loader 1.1.0, cordis-plugin-group 1.1.0 resolved by that tree)",
+      "loader": "drive the packed 2.2.5 artifact through the real Loader in a web profile: 177 entries active, 0 failed fibers, the w2m row active, 23 tools registered through the tools service projection",
+      "client_host_half": "the real clientModules registry accepted the package's dsh.client declaration and composed a boot-graph row for @twinsearth/w2m-dsh-plugin from the shipped lib/client.js",
+      "client_activation": "the real client module system plus a real Cordis fiber activated the entry (state active, no error) and it took 16 composer/sidebar/settings seats",
+      "client_page": "the profile's Web app booted in headless Edge against the real server: the package stylesheet arrived, the boot overlay was dismissed, and no entry reported a boot failure",
+      "composer_control": "the Node-execution menu opened from the composer with three options, and selecting temporary execution updated the control to 'Node-execution: temporary 24h, 24h left' with data-on=true and no error note",
+      "routes": "w2m_status reports target_selection.attached=true and the live connection registry holds 25 fetch routes, including /api/w2m/target, /api/w2m/capability and the four /api/w2m/remote/* routes",
+      "engines_dsh": "package.json#engines.dsh is '>=0.2.0 <0.3.0'; DSH evaluates it with includePrerelease, so 0.2.2-rc.1 and 0.2.2-rc.2 both satisfy it, and the packed tarball installed into the rc.2 profile without a compatibility refusal",
+      "compat_gate": "compat.yml pins DSH_HOST_VERSION 0.2.2-rc.2 with cordis 4.1.0 / cordis-plugin-loader 1.1.0 / pnpm 11.28.5; the pin is the release gate's measurement of this host",
+      "not_adopted": "rc.2 lets a plugin register MCP servers through ctx.mcpManager; this package does not, because its bundled w2m-mcp server mirrors the same w2m_* tools for codex and Claude hosts, so mounting it inside DSH would register every tool twice",
+      "artifact": "scripts/pack.mjs packs dist/twinsearth-w2m-dsh-plugin-2.2.5.tgz deterministically from this tree; the published sha256 is the one release.yml writes into dist/SHA256SUMS beside the tarball, so the artifact digest is not restated here -- a record that named its own tarball's hash would be inside the tarball it describes",
+      "scope": "code, tests, manifests and docs; the probe profile and the rc.2 runtime live under a temporary directory, and publishing is a separate workflow run"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {
@@ -58,7 +58,8 @@
     "locale"
   ],
   "engines": {
-    "node": ">=20.19.0"
+    "node": ">=20.19.0",
+    "dsh": ">=0.2.0 <0.3.0"
   },
   "license": "MIT",
   "scripts": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/remote-view-route.mjs

@@ -12,6 +12,7 @@ import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { captureHostScreen } from './capture-route.mjs';
 import { createViewSide, openViewFrame } from '../agent/view/session-key.mjs';
+import { resolveStateDir } from '../util/cli.mjs';
 
 export const REMOTE_CONFIG_PATH = '/api/w2m/remote/config';
 export const REMOTE_FRAME_PATH = '/api/w2m/remote/frame';
@@ -43,8 +44,13 @@ function payloadJson(payload) {
 export function registerRemoteViewRoutes(ctx, deps = {}) {
   const status = { mounted: false, reason: 'the host has no Connection service', configPath: null };
   if (typeof ctx?.inject !== 'function') return status;
-  if (typeof deps.stateDir !== 'string' || deps.stateDir === '') { status.reason = 'stateDir is not configured'; return status; }
-  const file = join(deps.stateDir, 'remote-view.json');
+  // stateDir is unset on a default desktop profile. That must not silently remove the
+  // remote-view routes: the settings toggle and every /api/w2m/remote/* call would 404.
+  // Resolve the same default the agent uses so consent lives beside device.json.
+  const stateDir = typeof deps.stateDir === 'string' && deps.stateDir !== ''
+    ? deps.stateDir
+    : resolveStateDir(null, '');
+  const file = join(stateDir, 'remote-view.json');
   const capture = deps.capture ?? captureHostScreen;
   const platform = deps.platform ?? process.platform;
   const p2p = deps.p2p ?? null;

package/src/plugin/tools.mjs

@@ -296,7 +296,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '2.2.3';
+const PLUGIN_VERSION = '2.2.5';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;