@bevel-software/platform-core-backend 0.33.0 → 0.34.0

package/agent-guide/access-control.md

@@ -9,7 +9,7 @@ Access to any path — reading it as much as writing it — is governed by
   role to a group* below). Role names are
   case- and whitespace-insensitive (`Admin` = `admin` = `ADMIN`; `Product Team`
   = `product team`). The reserved names `deny` and `everyone` cannot be used, and neither can
-  names starting with `role/` or `plugin/` — those spellings are tokens in
+  names starting with `role/`, `group/` or `plugin/` — those spellings are tokens in
   access entries (below). One exception to the file's authority: the
   **deployment admin** — the address the server configuration sets as
   `ADMIN_EMAIL` — is **always an Admin**, whether or not `roles.yaml` lists
@@ -35,8 +35,11 @@ Access to any path — reading it as much as writing it — is governed by
   denials (the lowercase word `deny`, a space, then the principal).
   Capitalised forms like `Deny` are *not* triggers; they are treated as part
   of a name.
-- **Principals** are a role name from `roles.yaml`, a group name from
-  `groups.yaml`, a person as `Name <email>`, a plugin token (above), or
+- **Principals** are a role (`role/<Name>`, from `roles.yaml`), a group
+  (`group/<Name>`, from the active group source — `groups.yaml`, or
+  `synced-groups.yaml` when groups sync from an identity provider), a person
+  as `Name <email>`, a plugin
+  token (above), or
   **`everyone`** — the built-in org-wide principal: every signed-in person and
   their agents. `read: everyone` in a folder's BODY opens that folder to the
   whole organisation; it is how an organisation-wide skill or plugin is
@@ -46,8 +49,17 @@ Access to any path — reading it as much as writing it — is governed by
   to the plugin itself. A person's personal plugin
   (`{{pluginsDir}}/personal-<id>/`) grants its owner access and denies
   `everyone` outright, so opening a parent folder never opens it.
-  When a group and a role share a name, the bare name means the GROUP;
-  `role/<Name>` (for example `deny role/Reviewer`) always means the role.
+  **Write roles as `role/<Name>` and groups as `group/<Name>`** — for
+  example `read: group/Platform Team` or `deny role/Reviewer`; the Manage
+  access dialog writes them that way too. A bare name (`read: Reviewer`)
+  still works and means the ROLE when a role of that name exists, and the
+  group otherwise. So a group that shares a role's name is reached only as
+  `group/<Name>`: a bare `read: Admin` reaches the `Admin` role, never the
+  members of a group named `Admin` (unless `roles.yaml` itself lists that
+  group under the role). The same holds for a denial: a bare
+  `deny Admin` denies the role, so denying a same-named group needs
+  `deny group/Admin`. `role/<Name>` always means the role,
+  `group/<Name>` always the group.
 - **Keep an `access.md` body pure YAML**, with any explanation in `#` comments.
   A body that does not parse as YAML naming at least one verb is read in the
   older format instead, where the FRONTMATTER carried the folder's rules — so a
@@ -171,9 +183,8 @@ roles:
 - **With denials.** Group members hold the role's grants exactly as if they
   were listed by email. A denial of the role in an `access.md`
   (`deny role/Reviewer`) therefore removes the role's contribution for
-  everyone in the group, as it does for the emails. Write the `role/` form:
-  a bare `deny Reviewer` would deny a group named `Reviewer` instead, if one
-  exists. The nearest `access.md` that says
+  everyone in the group, as it does for the emails. To deny the group
+  instead, write `deny group/Platform Team`. The nearest `access.md` that says
   anything about the person decides: a person granted by name
   (`Name <email>`) in the SAME `access.md` as the denial keeps that access,
   because within one file a person's own entry beats a role entry. A grant by

package/agent-guide/html-views.md

@@ -28,11 +28,17 @@ than by a markdown document.
 
 ### `window.bevel`
 
-Core puts four members on it:
+Core puts five members on it:
 
 - `window.bevel.openNode(href)` — follow `href` as if the reader had clicked a
   link to it.
 - `window.bevel.navigate(href)` — the same function under a second name.
+- `window.bevel.branch` — the branch the page is viewed on, as a string: a
+  page that reads its data through the tools and links to what they name
+  does both there, so the same page shows a draft's data on the draft and the
+  released data on the default branch. `null` where the host has no branch
+  for the page (a page embedded on another site); read it as `window.bevel?.branch
+  ?? '<default branch>'` so the page still works there.
 - `window.bevel.tools` — the viewer's tools, or `null` where there are none
   (next section).
 - `window.bevel.requireTools()` — ask for the tools when the page cannot work
@@ -147,11 +153,214 @@ if (await window.bevel?.requireTools?.()) {
 }
 ```
 
+### Live data: a page that stays still while it loads
+
+A page that reads its data through `window.bevel.tools` waits on several
+calls before it has anything to show. Write it so the reader never sees the
+page change shape, never sees a half-loaded board as if it were the answer,
+and never loses the board they were reading:
+
+- **Render the final page shell in the markup, before any data.** Headings,
+  columns, panels and the controls are in the HTML itself, with their size
+  reserved in CSS (a grid, a `min-height` per region). The loading treatment —
+  placeholder rows, `aria-busy="true"` — sits **inside** the data regions.
+  Never start with one "Loading…" line that the script later swaps for the
+  whole page: that swap is a full-page layout change, and the first thing the
+  reader sees looks broken.
+- **Publish one consistent dataset at a time.** Collect every read into local
+  variables first; when ALL of them have succeeded, update every data region
+  from that one dataset in one synchronous step. Until then show no counts,
+  no cards and no empty columns: "0" or "None" is an answer only a finished
+  dataset may give.
+- **Refresh keeps the current board.** A refresh leaves the last published
+  dataset on screen, shows a small refreshing state (a status line, the
+  Refresh button disabled) and publishes the replacement only when it is
+  complete. Never return to the loading placeholders.
+- **A failed read fails the whole load, visibly.** If any read the page needs
+  rejects, publish nothing from that load: keep the shell (first load) or the
+  last good dataset (refresh), say what failed — the rejection carries the
+  tool's own message — and offer a Retry button that runs the same load
+  again. Never show the reads that did succeed as if they were the whole
+  board.
+- **Read in bounded parallel once the paths are known.** List first
+  (`list_files`, `grep`), then read the files it named with a small fixed
+  number of `callTool` reads in flight at a time — four is plenty — rather
+  than one after another or all at once. Read tools run at once with no
+  prompt.
+- **Load with `callTool`, not `callToolChain`.** A chain may write, so the app
+  asks the viewer before it runs: a page that loads through `callToolChain`
+  shows its reader a "wants to write" card for a read.
+- **The reads are the viewer's own.** Every call answers with exactly what
+  the person viewing the page may read: `list_files` and `grep` leave out
+  what they may not, and `read_file` of such a file rejects. Build the board
+  from what the calls return; never try to widen it (another identity, a
+  copied dataset) — the same page shows each reader their own board.
+- **Link to what the tools named by the path they answered.** A path a tool
+  answers (`read_file`'s `path`, a listing's `path`) starts with the checkout
+  folder, `{{kbDirName}}/Data/Tickets/A.md`, and knows nothing of where the
+  page sits. Link to it on the branch the page read it from, each segment of
+  the path encoded on its own — `'/workspace/' + encodeURIComponent(BRANCH)
+  + '/' + path.split('/').map(encodeURIComponent).join('/')` — so a card and
+  its data come from one branch and a name carrying `#`, `?` or `%` stays
+  in the path rather than ending the URL at it; a root-relative `'/' +
+  path.split('/').map(encodeURIComponent).join('/')` opens it on the branch
+  the page is viewed on instead (see *How a link resolves*). Never put the
+  checkout folder in front of a path a tool answered: it is already there.
+
+A complete page that follows these rules — plain HTML and one inline script,
+no build step and no framework:
+
+```html
+<!doctype html>
+<html>
+<head>
+<style>
+  body { font: 14px system-ui, sans-serif; margin: 16px; }
+  header { display: flex; align-items: center; gap: 12px; min-height: 40px; }
+  #status { color: #555; }
+  #status.error { color: #b00020; }
+  .board { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 12px; }
+  .column { min-height: 320px; border: 1px solid #ddd; border-radius: 6px; padding: 8px; }
+  .column ul { list-style: none; margin: 0; padding: 0; }
+  .column li { min-height: 20px; padding: 6px; margin-bottom: 6px; border-radius: 4px; background: #f4f4f4; }
+  .column li.placeholder { background: #ececec; }
+  .count { color: #777; font-weight: normal; }
+</style>
+</head>
+<body>
+<header>
+  <h1>Tickets</h1>
+  <button id="refresh" type="button" disabled>Refresh</button>
+  <span id="status" role="status">Loading…</span>
+  <button id="retry" type="button" hidden>Retry</button>
+</header>
+<main id="board" class="board" aria-busy="true">
+  <section class="column" data-status="todo"><h2>To do <span class="count"></span></h2><ul><li class="placeholder"></li><li class="placeholder"></li></ul></section>
+  <section class="column" data-status="doing"><h2>Doing <span class="count"></span></h2><ul><li class="placeholder"></li><li class="placeholder"></li></ul></section>
+  <section class="column" data-status="done"><h2>Done <span class="count"></span></h2><ul><li class="placeholder"></li><li class="placeholder"></li></ul></section>
+</main>
+<script>
+  // The branch the page is viewed on: its data and its links both come from
+  // there, so the page on a draft shows the draft's tickets. Outside the app
+  // (no bridge) it reads the default branch.
+  const BRANCH = window.bevel?.branch ?? 'main';
+  const FOLDER = 'Data/Tickets';
+  const READS_IN_FLIGHT = 4;
+  const tools = window.bevel?.tools;
+  const board = document.getElementById('board');
+  const statusLine = document.getElementById('status');
+  const refreshButton = document.getElementById('refresh');
+  const retryButton = document.getElementById('retry');
+  let published = false;
+
+  /** The text under `# <heading>` in a node's markdown, whatever its line endings. */
+  function field(markdown, heading) {
+    const lines = markdown.split(/\r?\n/);
+    const at = lines.indexOf('# ' + heading);
+    if (at < 0) return '';
+    const end = lines.findIndex((line, i) => i > at && line.startsWith('# '));
+    return lines.slice(at + 1, end < 0 ? undefined : end).join('\n').trim();
+  }
+
+  /**
+   * `fn` over `items`, at most `limit` at a time. After a failure no new item
+   * starts; it rejects with the first failure once the calls in flight have
+   * settled, so a Retry never overlaps the load that failed.
+   */
+  async function mapBounded(items, limit, fn) {
+    const results = new Array(items.length);
+    let next = 0;
+    let failure = null;
+    async function worker() {
+      while (!failure && next < items.length) {
+        const i = next++;
+        try {
+          results[i] = await fn(items[i]);
+        } catch (error) {
+          failure ??= { error };
+        }
+      }
+    }
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    if (failure) throw failure.error;
+    return results;
+  }
+
+  /** The whole dataset, or a rejection. Touches no element. */
+  async function readTickets() {
+    const listing = await tools.callTool('list_files', { body: { branch: BRANCH, path: FOLDER } });
+    const paths = listing.entries
+      .filter((entry) => entry.type === 'file' && entry.name.endsWith('.md'))
+      .map((entry) => `${FOLDER}/${entry.name}`);
+    return mapBounded(paths, READS_IN_FLIGHT, async (path) => {
+      const file = await tools.callTool('read_file', { body: { branch: BRANCH, path } });
+      // `file.path` is the path as the tool names it, checkout folder first.
+      return { path: file.path, name: field(file.content, 'Name') || path, status: field(file.content, 'Status').toLowerCase() };
+    });
+  }
+
+  /** Every data region from one dataset, in one synchronous step. */
+  function publish(tickets) {
+    for (const column of board.querySelectorAll('.column')) {
+      const mine = tickets.filter((ticket) => ticket.status === column.dataset.status);
+      column.querySelector('.count').textContent = `(${mine.length})`;
+      const items = mine.map((ticket) => {
+        const link = document.createElement('a');
+        // Each segment encoded on its own: a name with `#` in it stays a name.
+        link.href = '/workspace/' + encodeURIComponent(BRANCH) + '/' + ticket.path.split('/').map(encodeURIComponent).join('/');
+        link.textContent = ticket.name;
+        const item = document.createElement('li');
+        item.append(link);
+        return item;
+      });
+      if (items.length === 0) {
+        const none = document.createElement('li');
+        none.textContent = 'None';
+        items.push(none);
+      }
+      column.querySelector('ul').replaceChildren(...items);
+    }
+    published = true;
+  }
+
+  async function load() {
+    refreshButton.disabled = true;
+    retryButton.hidden = true;
+    board.setAttribute('aria-busy', 'true');
+    statusLine.className = '';
+    statusLine.textContent = published ? 'Refreshing…' : 'Loading…';
+    try {
+      publish(await readTickets());
+      statusLine.textContent = `Updated ${new Date().toLocaleTimeString()}`;
+    } catch (error) {
+      statusLine.className = 'error';
+      statusLine.textContent = (published ? 'Could not refresh; showing the last loaded board. ' : 'Could not load the tickets. ') + error.message;
+      retryButton.hidden = false;
+    } finally {
+      board.setAttribute('aria-busy', 'false');
+      refreshButton.disabled = false;
+    }
+  }
+
+  refreshButton.addEventListener('click', load);
+  retryButton.addEventListener('click', load);
+  if (tools) {
+    load();
+  } else {
+    board.setAttribute('aria-busy', 'false');
+    statusLine.textContent = 'Open this page in Bevel to load the tickets.';
+  }
+</script>
+</body>
+</html>
+```
+
 ### Links written in the markup
 
 An `<a href>` in the page keeps its address only when it is one of these:
 
 - a document of the knowledge base, `.md`, `.html` or `.htm`, with or without a heading — `../Knowledge/Alice.md#goal`, `Q3-Report.html`, `Notes.htm`
+- a root-relative path to such a document, from the checkout folder — `/{{kbDirName}}/Data/Tickets/A.md`
 - an absolute workspace URL — `/workspace/main/{{knowledgeBaseDir}}/Alice.md`
 - an external address — `https://example.com/docs`, `http://example.com`, `mailto:team@example.com`
 - a bare fragment, a place in this page — `#totals`, `#`
@@ -177,10 +386,22 @@ or `window.bevel.navigate(href)`:
   top" link. The page's own address does not change, so `hashchange` never
   fires: a page that routes by hash handles its own clicks.
 - **A relative path** resolves against the folder of the page's own file and
-  opens that file in the app: from `{{knowledgeBaseDir}}/Reports/Q3.html`,
-  `../Knowledge/Alice.md#goal` opens `{{knowledgeBaseDir}}/Knowledge/Alice.md`
-  at its `goal` heading.
-- **`/workspace/<branch>/<path>`** opens that file on that branch.
+  opens that file in the app, in a new tab, leaving the page where it is:
+  from `{{knowledgeBaseDir}}/Reports/Q3.html`, `../Knowledge/Alice.md#goal`
+  opens `{{knowledgeBaseDir}}/Knowledge/Alice.md` at its `goal` heading. A
+  path that names the page's own file with a fragment (`Q3.html#totals`
+  from `Q3.html`) scrolls the page, as `#totals` does.
+- **A root-relative path**, `/{{kbDirName}}/<path>`, opens that file on the
+  page's own branch, in a new tab, from a page in any folder. A path a tool
+  answered (`read_file`'s `path`, a listing's `path`) already starts with the
+  checkout folder, so it is linked as `'/' +
+  path.split('/').map(encodeURIComponent).join('/')` — each segment encoded
+  on its own, so a name carrying `#`, `?` or `%` stays a name — never with
+  the folder put in front of it again; a path the page composed itself,
+  without that prefix, gets `'/{{kbDirName}}/'` in front. A link the page's
+  script creates after load is kept as written.
+- **`/workspace/<branch>/<path>`** opens that file on that branch, in a new
+  tab.
 - **An external address** (`http:`, `https:`, `mailto:`) opens in a new tab.
   A call from a script may also open `tel:`, `sms:`, `geo:` and a
   protocol-relative `//host/path` address in a new tab, though a link
@@ -191,3 +412,8 @@ or `window.bevel.navigate(href)`:
 A click that a handler of the page has already cancelled with
 `event.preventDefault()` is left to that handler: the bridge neither scrolls
 nor opens anything for it.
+
+A click on a link with Ctrl, Cmd or Shift held, or with the middle button,
+opens its destination in a new tab, as a browser does with a link: a bare
+fragment opens the page's own file at that section in a new tab, and the
+page stays where it is.

package/agent-guide/tool-manuals.md

@@ -34,7 +34,7 @@ migration converts such files into `mcp.json` entries; do not write new ones.)
 ---
 id: my_tool
 write:
-  - Product Team
+  - group/Product Team
 owner:
   - Jane Doe <jane@x.com>
 type: http

package/dist/core/catalog-revision.d.ts

@@ -2,6 +2,7 @@ import express, { type RequestHandler } from 'express';
 import type { ISkillService, SkillSummary } from '../modules/skills/skills.contract.js';
 import type { IToolManualService } from '../modules/tool-manuals/tool-manuals.contract.js';
 import '../modules/tool-auth/tool-auth.middleware.js';
+import { type IAgentScopeResolver } from '../modules/agent-scope/index.js';
 /**
  * The revision of a caller's catalog: a hex digest over the two lists.
  *
@@ -27,7 +28,15 @@ export declare function catalogRevision(manuals: readonly string[], skills: read
 views?: readonly {
     uri: string;
     text: string;
-}[]): string;
+}[], 
+/**
+ * The connection's agent configuration — its path and the digest of its bytes, or
+ * why it cannot be used (`ConnectionScope.fingerprint`) — so an edit of
+ * the file is a new revision even when it changes nothing listed (a new
+ * skill entry that names nothing yet still moves it). Absent for
+ * Everything, whose revision is exactly what it was before agents existed.
+ */
+agent?: string | null): string;
 /**
  * `GET /agent/catalog-revision` — the caller's catalog fingerprint, plus the
  * two counts behind it so an operator reading a log can tell a shrinking
@@ -42,6 +51,8 @@ export declare function createCatalogRevisionRoutes(deps: {
     toolManuals: Pick<IToolManualService, 'catalogFingerprints'>;
     skills: Pick<ISkillService, 'listSkills'>;
     manualAuth: RequestHandler;
+    /** Resolves the scope of a connection made as an agent configuration (`modules/agent-scope`). */
+    agentScope?: Pick<IAgentScopeResolver, 'resolve'>;
     /** Connection-key/internal-token user id → email, for the per-caller ACL. */
     resolveUserEmail: (userId: string) => Promise<string | undefined>;
     /** The MCP App views served; absent on a deployment that serves none. */

package/dist/core/catalog-revision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-revision.d.ts","sourceRoot":"","sources":["../../src/core/catalog-revision.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,EAAE,EAAgB,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AAC3F,OAAO,8CAA8C,CAAC;AAqCtD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,MAAM,EAAE,SAAS,YAAY,EAAE;AAC/B;;;;GAIG;AACH,KAAK,GAAE,SAAS;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAO,GACnD,MAAM,CASR;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,WAAW,EAAE,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;IAC7D,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC1C,UAAU,EAAE,cAAc,CAAC;IAC3B,6EAA6E;IAC7E,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAClE,yEAAyE;IACzE,OAAO,CAAC,EAAE;QAAE,QAAQ,IAAI,OAAO,CAAC;YAAE,SAAS,EAAE,SAAS;gBAAE,GAAG,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CAC5F,GAAG,OAAO,CAAC,MAAM,CA4BjB"}
+{"version":3,"file":"catalog-revision.d.ts","sourceRoot":"","sources":["../../src/core/catalog-revision.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,EAAE,EAAgB,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AAC3F,OAAO,8CAA8C,CAAC;AACtD,OAAO,EAA0B,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAqCnG;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,MAAM,EAAE,SAAS,YAAY,EAAE;AAC/B;;;;GAIG;AACH,KAAK,GAAE,SAAS;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAO;AACpD;;;;;;GAMG;AACH,KAAK,GAAE,MAAM,GAAG,IAAW,GAC1B,MAAM,CAUR;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,WAAW,EAAE,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;IAC7D,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC1C,UAAU,EAAE,cAAc,CAAC;IAC3B,iGAAiG;IACjG,UAAU,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAClD,6EAA6E;IAC7E,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAClE,yEAAyE;IACzE,OAAO,CAAC,EAAE;QAAE,QAAQ,IAAI,OAAO,CAAC;YAAE,SAAS,EAAE,SAAS;gBAAE,GAAG,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CAC5F,GAAG,OAAO,CAAC,MAAM,CAsCjB"}

package/dist/core/catalog-revision.js

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import express from 'express';
 import { logger } from '../shared/logging.js';
 import '../modules/tool-auth/tool-auth.middleware.js'; // Express Request augmentation (req.toolAuth)
+import { resolveConnectionScope } from '../modules/agent-scope/index.js';
 const log = logger('catalog-revision');
 /**
  * A fingerprint of ONE caller's released catalog — every tool manual and every
@@ -56,13 +57,22 @@ export function catalogRevision(manuals, skills,
  * changes a view and nothing else must still move the revision, or a local
  * server already running keeps serving the view it read at startup.
  */
-views = []) {
+views = [], 
+/**
+ * The connection's agent configuration — its path and the digest of its bytes, or
+ * why it cannot be used (`ConnectionScope.fingerprint`) — so an edit of
+ * the file is a new revision even when it changes nothing listed (a new
+ * skill entry that names nothing yet still moves it). Absent for
+ * Everything, whose revision is exactly what it was before agents existed.
+ */
+agent = null) {
     const lines = [
         ...[...manuals].sort(),
         '\u0001', // separates the lists, so a line can never migrate between them
         ...skills.map(skillFingerprint).sort(),
         '\u0001',
         ...views.map((v) => `${v.uri}\u0000${createHash('sha256').update(v.text).digest('hex')}`).sort(),
+        ...(agent !== null ? ['\u0001', agent] : []),
     ];
     return createHash('sha256').update(lines.join('\n')).digest('hex').slice(0, 32);
 }
@@ -85,16 +95,26 @@ export function createCatalogRevisionRoutes(deps) {
             // No resolvable caller is an EMPTY catalog, not a failure: that is what
             // both list surfaces answer such a caller, so the fingerprint agrees
             // with them rather than inventing a third verdict.
+            // A connection made as an agent configuration is fingerprinted over what IT
+            // loads, plus the file itself; Everything asks exactly what it always did.
+            const scope = await resolveConnectionScope(deps.agentScope, email, req.toolAuth?.agentPath);
+            const connectors = scope.connectorFilter();
+            const within = scope.skillFilter();
             const [manuals, skills] = email
-                ? await Promise.all([deps.toolManuals.catalogFingerprints(email), deps.skills.listSkills(email)])
+                ? await Promise.all([
+                    connectors ? deps.toolManuals.catalogFingerprints(email, connectors) : deps.toolManuals.catalogFingerprints(email),
+                    within ? deps.skills.listSkills(email, { within }) : deps.skills.listSkills(email),
+                ])
                 : [[], []];
             // A manifest that cannot be read counts as no views, which is also what
             // the MCP endpoint serves in that state.
             const views = deps.mcpApps ? ((await deps.mcpApps.manifest().catch(() => null))?.resources ?? []) : [];
+            const connection = scope.toWire();
             res.json({
-                revision: catalogRevision(manuals, skills, views),
+                revision: catalogRevision(manuals, skills, views, scope.fingerprint()),
                 tools: manuals.length,
                 skills: skills.length,
+                ...(connection ? { connection } : {}),
             });
         }
         catch (err) {

package/dist/core/catalog-revision.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-revision.js","sourceRoot":"","sources":["../../src/core/catalog-revision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,OAA8C,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG9C,OAAO,8CAA8C,CAAC,CAAC,8CAA8C;AAErG,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,CAAe;IACvC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA0B,EAC1B,MAA+B;AAC/B;;;;GAIG;AACH,QAAkD,EAAE;IAEpD,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;QACtB,QAAQ,EAAE,gEAAgE;QAC1E,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE;QACtC,QAAQ;QACR,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;KACjG,CAAC;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAQ3C;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAG,EAAE,EAAE;QACjF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9F,wEAAwE;YACxE,qEAAqE;YACrE,mDAAmD;YACnD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK;gBAC7B,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;gBACjG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACb,wEAAwE;YACxE,yCAAyC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;gBACjD,KAAK,EAAE,OAAO,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"catalog-revision.js","sourceRoot":"","sources":["../../src/core/catalog-revision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,OAA8C,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG9C,OAAO,8CAA8C,CAAC,CAAC,8CAA8C;AACrG,OAAO,EAAE,sBAAsB,EAA4B,MAAM,iCAAiC,CAAC;AAEnG,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,CAAe;IACvC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA0B,EAC1B,MAA+B;AAC/B;;;;GAIG;AACH,QAAkD,EAAE;AACpD;;;;;;GAMG;AACH,QAAuB,IAAI;IAE3B,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;QACtB,QAAQ,EAAE,gEAAgE;QAC1E,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE;QACtC,QAAQ;QACR,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;QAChG,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAU3C;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAG,EAAE,EAAE;QACjF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9F,wEAAwE;YACxE,qEAAqE;YACrE,mDAAmD;YACnD,4EAA4E;YAC5E,2EAA2E;YAC3E,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC5F,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK;gBAC7B,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;oBAChB,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC;oBAClH,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;iBACnF,CAAC;gBACJ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACb,wEAAwE;YACxE,yCAAyC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtE,KAAK,EAAE,OAAO,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/core-ports.d.ts

@@ -7,7 +7,33 @@ import type { IAccountAdmission } from '../modules/auth/account-admission.js';
 import type { IWriteAccess } from '../modules/write-access/write-access.js';
 import type { OnServerStart } from '../modules/workspace/startup/on-server-start.js';
 import type { AgentGuideHook } from '../modules/agent-guide/agent-guide.js';
+import type { IAgentScopeResolver } from '../modules/agent-scope/index.js';
 import type { EmbedNodeIdResolver } from '../modules/embed/embed.interface.js';
+import type { IWorkspaceService } from '@bevel-software/platform-shared';
+import type { IAccessControl } from '../modules/access/index.js';
+import type { KbContext } from '../shared/kb-context.js';
+import type { ITreeWalker } from '../shared/fs.contract.js';
+import type { IPluginLinkIndex } from '../modules/plugins/index.js';
+/**
+ * The core services a distribution's agent-scope resolver reads through,
+ * handed to `CorePorts.agentScope` when core makes it: the clones of the
+ * branches, the person's read gate, the branch model and knowledge-base
+ * layout, the disk walk that finds its configurations, and the plugin link
+ * index that says which plugins a `plugins:`-style entry stands for.
+ *
+ * Each is the service's CONTRACT, not its class: a resolver written against
+ * these runs on any implementation of them — core's own services in a
+ * deployment, a stand-in in a distribution's tests — and a resolver that
+ * needs more than a contract offers asks for the contract to grow, not for
+ * the class.
+ */
+export interface AgentScopeCollaborators {
+    workspaceService: IWorkspaceService;
+    accessControl: IAccessControl;
+    kb: KbContext;
+    disk: ITreeWalker;
+    pluginLinkIndex: IPluginLinkIndex;
+}
 /**
  * Every seam the enterprise overlay can fill in the CORE composition
  * (`createCoreServices`). All fields are optional; each has a safe core-only
@@ -108,6 +134,21 @@ export interface CorePorts {
      * `modules/agent-guide`.
      */
     agentGuide?: AgentGuideHook;
+    /**
+     * THIS distribution's agent configurations: what "Connect as" offers beside
+     * Everything, and what a connection made as one of them loads (see
+     * `modules/agent-scope`). Core owns the mechanism and no configuration —
+     * the file kind, where it lives and what its definition says are the
+     * distribution's, as the file kinds registered for access verbs are. A
+     * factory, since a resolver reads through core services that exist only
+     * once core is built: called ONCE, during construction, with those
+     * services (`AgentScopeCollaborators`), and its answer is the one resolver
+     * every surface consults from then on — the tool contexts, which capture it
+     * at construction, as much as the routes the server mounts later. Core
+     * default: `noAgentConfigurations()` — nothing is offered, and a connection
+     * recorded as some path loads nothing, never Everything.
+     */
+    agentScope?: (core: AgentScopeCollaborators) => IAgentScopeResolver;
     /**
      * Mirror this composition's branch model and knowledge-base layout onto the
      * shared package's PROCESS-WIDE live bindings (`DEFAULT_BRANCH`,

package/dist/core/core-ports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-ports.d.ts","sourceRoot":"","sources":["../../src/core/core-ports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;OAIG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACrC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC5C;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,mBAI/B,CAAC"}
+{"version":3,"file":"core-ports.d.ts","sourceRoot":"","sources":["../../src/core/core-ports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,aAAa,EAAE,cAAc,CAAC;IAC9B,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,EAAE,gBAAgB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;OAIG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACrC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC5C;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,mBAAmB,CAAC;IACpE;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,mBAI/B,CAAC"}

package/dist/core/core-ports.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-ports.js","sourceRoot":"","sources":["../../src/core/core-ports.ts"],"names":[],"mappings":"AAwJA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB;IACpD,KAAK,CAAC,GAAG;QACP,yCAAyC;IAC3C,CAAC;CACF,CAAC"}
+{"version":3,"file":"core-ports.js","sourceRoot":"","sources":["../../src/core/core-ports.ts"],"names":[],"mappings":"AAkMA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB;IACpD,KAAK,CAAC,GAAG;QACP,yCAAyC;IAC3C,CAAC;CACF,CAAC"}

package/dist/core/create-core-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-core-server.d.ts","sourceRoot":"","sources":["../../src/core/create-core-server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAiDtD,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAmCvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAO9D,KAAK,UAAU,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAChD,kEAAkE;IAClE,eAAe,EAAE,eAAe,CAAC;IACjC,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;OAYG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,mFAAmF;IACnF,OAAO,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACpD;;;;OAIG;IACH,KAAK,CAAC,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,SAAS,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACtD,2EAA2E;IAC3E,MAAM,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;CACpD;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,YAAY,EAClB,GAAG,GAAE,gBAAqB,EAC1B,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,IAAI,CAAC,EAAE,OAAO,CAAC;CACX,GACL,OAAO,CAAC,UAAU,CAAC,CA8wBrB"}
+{"version":3,"file":"create-core-server.d.ts","sourceRoot":"","sources":["../../src/core/create-core-server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAkDtD,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAmCvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAO9D,KAAK,UAAU,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAChD,kEAAkE;IAClE,eAAe,EAAE,eAAe,CAAC;IACjC,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;OAYG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,mFAAmF;IACnF,OAAO,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACpD;;;;OAIG;IACH,KAAK,CAAC,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,SAAS,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACtD,2EAA2E;IAC3E,MAAM,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;CACpD;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,YAAY,EAClB,GAAG,GAAE,gBAAqB,EAC1B,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,IAAI,CAAC,EAAE,OAAO,CAAC;CACX,GACL,OAAO,CAAC,UAAU,CAAC,CA0xBrB"}

package/dist/core/create-core-server.js

@@ -2,6 +2,7 @@ import express from 'express';
 import cors from 'cors';
 import path from 'node:path';
 import { createAuthRoutes } from '../modules/auth/auth.routes.js';
+import { authCookieSecure } from '../modules/auth/auth.middleware.js';
 import { createWorkspaceRoutes } from '../modules/workspace/workspace.routes.js';
 import { createAgentUploadRoutes, isAgentUploadRawBodyPath, } from '../modules/workspace/agent-upload.routes.js';
 import { createAgentDownloadRoutes } from '../modules/workspace/agent-download.routes.js';
@@ -228,7 +229,10 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     if (opts.boot ?? true)
         await startCore(core, ext);
     // Auth routes (unprotected — login endpoint must be accessible)
-    app.use('/api', createAuthRoutes(core.authService, core.authMiddleware, core.authProviders, core.config.loginPasswordEnabled));
+    app.use('/api', createAuthRoutes(core.authService, core.authMiddleware, core.authProviders, core.config.loginPasswordEnabled, 
+    // The cookie's Secure flag follows the scheme the deployment is reached
+    // on, as the SSO providers' does: one rule for every sign-in path.
+    { cookieSecure: authCookieSecure(core.config.publicBackendUrl) }));
     // MCP routes must mount BEFORE every `app.use('/api', authMiddleware, …)`
     // below: Express 5 fires the outer JWT middleware before deciding whether
     // its router has a matching route, so a request to `POST /api/mcp` carrying
@@ -237,7 +241,7 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     app.use('/api', createMcpRoutes(core.mcpService, core.externalApiKeyService, core.mcpAuthMiddleware, core.authMiddleware, core.usageMeter, 
     // The local-token exchange: verifies an MCP OAuth access token and mints
     // the loopback internal token the local MCP server uses for its REST reads.
-    core.internalTokenService, core.mcpOAuthProvider, core.mcpResourceMetadataUrl));
+    core.internalTokenService, core.mcpOAuthProvider, core.mcpResourceMetadataUrl, core.agentScopeService));
     // Remote sync — `POST /api/sync`, called by a git host's webhook or a
     // pipeline with the deployment's sync secret (or by an admin's session).
     // Same reason as MCP for mounting here: a non-JWT bearer must not meet a
@@ -273,6 +277,7 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
         toolManualService: core.toolManualService,
         accessControl: core.accessControl,
         connectionProbe: core.connectionProbeService,
+        agents: core.agentScopeService,
         stateSecret: core.config.jwtSecret,
         publicBackendUrl: core.config.publicBackendUrl,
         publicFrontendUrl: core.config.publicFrontendUrl,
@@ -394,7 +399,7 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     // What MCP clients are told about each platform tool's effect: read by the
     // agent manual (the hosted endpoint) and by `/agent/tool-hints` (hexis-mcp).
     const { readOnlyHints } = core;
-    toolsRouter.use(createManualRoutes(core.toolRegistry, core.manualAuthMiddleware, async (userId) => (await core.authService.getUserById(userId))?.email, readOnlyHints));
+    toolsRouter.use(createManualRoutes(core.toolRegistry, core.manualAuthMiddleware, async (userId) => (await core.authService.getUserById(userId))?.email, readOnlyHints, core.agentScopeService));
     toolsRouter.use(createToolHintsAgentRoutes(readOnlyHints, core.manualAuthMiddleware));
     // The aggregated manual list (KB + the caller's accessible `.tool`s) + inline
     // `.tool` sub-manuals. Mounted on the tools router so they share `manualAuth`
@@ -405,7 +410,7 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
         kb: core.kb,
         disk: core.disk,
         pluginIndex: core.pluginIndexService,
-    }));
+    }, core.agentScopeService));
     // What every connected agent is told at session start, as the hosted proxy
     // composes it: read by the local `hexis-mcp` bridge at startup and by the
     // External agent access card. Same `manualAuth`, same router, as `all-tools`.
@@ -419,6 +424,7 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
         skills: core.skillService,
         manualAuth: core.manualAuthMiddleware,
         resolveUserEmail: async (userId) => (await core.authService.getUserById(userId))?.email,
+        agentScope: core.agentScopeService,
         // The views move the revision too: a release that changes a view and no
         // manual would otherwise leave a running local server on the old one.
         mcpApps: core.mcpAppService,
@@ -428,7 +434,7 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     // declaring knowledge-base file server-side, so the file is the allowlist and
     // the caller cannot widen it. Same `manualAuth` as the rest of the agent
     // surface.
-    toolsRouter.use(createDeclaredVariableRoutes(core.toolManualService, core.secretsVaultService, core.manualAuthMiddleware, async (userId) => (await core.authService.getUserById(userId))?.email));
+    toolsRouter.use(createDeclaredVariableRoutes(core.toolManualService, core.secretsVaultService, core.manualAuthMiddleware, async (userId) => (await core.authService.getUserById(userId))?.email, core.agentScopeService));
     app.use('/api', toolsRouter);
     // The same guard on the PARSED body, for the WHOLE `/workspace/:id` prefix
     // and ahead of EVERY router under it — the file routes, the review, workflow
@@ -459,7 +465,7 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
         toolAuth: core.toolAuthMiddleware,
         isToolCredential: (token) => core.internalTokenService.looksLikeInternalToken(token) ||
             core.externalApiKeyService.looksLikeExternalApiKey(token),
-    }), createPluginCreationRoutes(core.pluginProvisionService, async (req) => (req.userId ? ((await core.authService.getUserById(req.userId)) ?? null) : null)));
+    }), createPluginCreationRoutes(core.pluginProvisionService, async (req) => (req.userId ? ((await core.authService.getUserById(req.userId)) ?? null) : null), core.agentScopeService));
     // Protected routes
     // The same guard again, now BEHIND the JWT check, so an authenticated
     // request also gets the resolved form judged — a link in the repository that
@@ -490,7 +496,7 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
     }));
     app.use('/api', createEventsRoutes(core.eventBus, core.authMiddleware, eventDelivery));
     app.use('/api', core.authMiddleware, createDiffRoutes(core.diffService, core.authService, core.workflowService, core.accessControl, core.kbDirName));
-    app.use('/api', core.authMiddleware, createAccessRoutes(core.accessControl, core.workspaceService, core.authService, core.authService, core.workflowService, core.eventBus, core.db, core.kb, [core.config.adminEmail]));
+    app.use('/api', core.authMiddleware, createAccessRoutes(core.accessControl, core.workspaceService, core.authService, core.authService, core.workflowService, core.eventBus, core.db, core.kb, core.disk, [core.config.adminEmail]));
     // Asking for Can edit or Owner on an item from its Manage access dialog, and
     // the editors' Accept / Decline. Mounted beside the access routes it shares
     // its gate with: the request is refused by the same canWrite it would
@@ -617,6 +623,7 @@ export async function createCoreServer(core, ext = {}, opts = {}) {
             clientNameFor: (st) => core.githubFacade.clientNameFor(st),
             completeConsent: (userId, st) => core.githubFacade.completeConsent(userId, st),
         },
+        agents: core.agentScopeService,
     }));
     // What an Owner pastes into Claude's admin settings to register this
     // deployment as a GitHub Enterprise Server — admins only — plus whether it