@fungi.computer/oyster 0.6.0 → 0.7.0

package/dist/agents.js

@@ -1,16 +1,7 @@
-/**
- * Agents for Apps on a standalone Oyster: one adapter shape and the routes
- * the App page calls. Apps reach agents through Agar's `agent.list`,
- * `agent.manage`, `agent.read` and `agent.send` contracts, so an App written
- * for the Hub (Grove) runs unchanged. Each agent's own transport is
- * Shiitake's HTTP routes (`/sessions…`, `/acp`) and Knapsack's Session browser
- * transport (`/browser/…`), served by the adapter behind the same App grants.
- */
-import { Hono } from "hono";
-import { keyAgentAccess } from "./keys.js";
+import { agent, agents as agentCollection, owner, routes, } from "./authorization.js";
 import * as Schema from "effect/Schema";
 import { z } from "zod";
-import { oysterPrincipalIsOwner, } from "./host.js";
+import {} from "./host.js";
 import { agentAvatarSchema } from "./agent-avatars.js";
 import { computerTargetParam } from "./computer-target.js";
 import { agentAvatar, agentList, agentManage, agentRename, agentSessionRead, agentSessionWrite, agentToolPolicy, } from "@fungi.computer/agar/agents";
@@ -46,6 +37,13 @@ const visitSchema = Schema.Struct({
     sessionId: Schema.String,
 });
 const agentIdPattern = /^[a-z0-9_-]{1,64}$/u;
+/** Explicit owner-addressed settings remain reachable after list hides an archive. */
+async function knownAgent(agents, agentId) {
+    if (!agentIdPattern.test(agentId))
+        return false;
+    return ((await agents.list()).some((agent) => agent.agentId === agentId) ||
+        (await agents.list({ archived: true })).some((agent) => agent.agentId === agentId));
+}
 /** How often an open inbox stream re-reads the revision. */
 const inboxPollMs = 2_000;
 const maxAgentRequestBytes = 512 * 1024;
@@ -53,9 +51,8 @@ function refusal(status, error) {
     return Response.json({ error }, { status });
 }
 /** Agent adapters admitted against each App's declared capabilities. */
-export function agentCapabilities(agents, liveKey) {
-    const routes = createAgentRoutes(agents, liveKey);
-    const shared = { base: "/", routes };
+export function agentCapabilities(agents) {
+    const shared = { base: "/", routes: createAgentRoutes(agents) };
     return [
         {
             ...shared,
@@ -136,45 +133,22 @@ export function agentCapabilities(agents, liveKey) {
         },
     ];
 }
-function createAgentRoutes(agents, liveKey) {
-    const routes = new Hono();
-    // Every Agent and Session lookup shares this live principal-scoped door.
-    const access = async (principal, agentId) => {
-        if (oysterPrincipalIsOwner(principal))
-            return true;
-        if (principal.actor.kind !== "team-key")
-            return false;
-        const key = await liveKey(principal.actor.keyId);
-        return key !== null && keyAgentAccess(key, agentId);
-    };
-    routes.use("/agents/:agentId/*", async (context, next) => {
-        if (!(await access(context.env.principal, context.req.param("agentId"))))
-            return refusal(403, "Agent access denied");
-        await next();
-        return undefined;
-    });
-    routes.use("/agent-policies/:agentId", async (context, next) => {
-        if (!(await access(context.env.principal, context.req.param("agentId"))))
-            return refusal(403, "Agent access denied");
-        await next();
-        return undefined;
-    });
-    routes.get("/agents", async (context) => {
-        const listed = await agents.list();
-        const actor = context.env.principal.actor;
-        if (oysterPrincipalIsOwner(context.env.principal))
-            return Response.json(listed);
-        if (actor.kind !== "team-key")
-            return Response.json([]);
-        const key = await liveKey(actor.keyId);
-        return Response.json(key === null
-            ? []
-            : listed.filter((agent) => keyAgentAccess(key, agent.agentId)));
-    });
-    routes.post("/agents", async (context) => {
-        const { principal } = context.env;
-        if (!oysterPrincipalIsOwner(principal))
-            return refusal(403, "Only the owner creates agents");
+function createAgentRoutes(agents) {
+    return (routes()
+        .get("/agents", agentCollection(), async (context, { reaches }) => {
+        const selected = context.req.query("archived");
+        if (selected !== undefined &&
+            selected !== "true" &&
+            selected !== "false")
+            return refusal(400, "Choose a valid archive view");
+        const listed = await agents.list({ archived: selected === "true" });
+        const reached = [];
+        for (const item of listed)
+            if (await reaches(item.agentId))
+                reached.push(item);
+        return Response.json(reached);
+    })
+        .post("/agents", owner("direct-or-app"), async (context, { principal }) => {
         const body = Schema.decodeUnknownOption(createSchema)(await context.req.json());
         if (body._tag === "None")
             return refusal(400, "Name the agent");
@@ -186,11 +160,8 @@ function createAgentRoutes(agents, liveKey) {
         // The owner's own authenticated request creates this Agent; its App tools
         // are approved the same way direct owner approval is, with no second path.
         return Response.json(await agents.create(body.value.name, body.value.requestId, principal, "owner-direct", avatar?.data));
-    });
-    routes.put("/agent-names/:agentId", async (context) => {
-        const { principal } = context.env;
-        if (!oysterPrincipalIsOwner(principal))
-            return refusal(403, "Only the owner renames agents");
+    })
+        .put("/agent-names/:agentId", owner("direct-or-app"), async (context, { principal }) => {
         const agentId = context.req.param("agentId");
         if (!agentIdPattern.test(agentId))
             return refusal(404, "No such agent");
@@ -205,11 +176,8 @@ function createAgentRoutes(agents, liveKey) {
                     ? 409
                     : 403, result.error);
         return Response.json(result);
-    });
-    routes.put("/agent-avatars/:agentId", async (context) => {
-        const { principal } = context.env;
-        if (!oysterPrincipalIsOwner(principal))
-            return refusal(403, "Only the owner changes avatars");
+    })
+        .put("/agent-avatars/:agentId", owner("direct-or-app"), async (context, { principal }) => {
         const agentId = context.req.param("agentId");
         if (!agentIdPattern.test(agentId))
             return refusal(404, "No such agent");
@@ -220,19 +188,19 @@ function createAgentRoutes(agents, liveKey) {
         if ("error" in result)
             return refusal(result.error === "not_found" ? 404 : 403, result.error);
         return Response.json(result);
-    });
-    routes.get("/agent-policies/:agentId", async (context) => {
-        const agentId = context.req.param("agentId");
+    })
+        .get("/agent-policies/:agentId", agent(), async (_context, { agentId }) => {
         if (!agentIdPattern.test(agentId))
             return refusal(404, "No such agent");
         const status = await agents.policyStatus(agentId);
         return status === null
             ? refusal(404, "No such agent")
             : Response.json(status);
-    });
-    routes.put("/agent-policies/:agentId", async (context) => approvePolicy(agents, context.env.principal, "owner-direct", context.req.param("agentId"), await context.req.text()));
-    routes.all("/agents/:agentId/*", async (context) => {
-        const agentId = context.req.param("agentId");
+    })
+        .put("/agent-policies/:agentId", owner("direct-or-app"), async (context, { principal }) => approvePolicy(agents, principal, "owner-direct", context.req.param("agentId"), await context.req.text()))
+        .post("/agents/:agentId/archive", owner("direct-or-app"), (context, { principal }) => changeArchive(agents, context.req.param("agentId"), true, principal))
+        .post("/agents/:agentId/unarchive", owner("direct-or-app"), (context, { principal }) => changeArchive(agents, context.req.param("agentId"), false, principal))
+        .all("/agents/:agentId/*", agent(), async (context, { agentId }) => {
         if (!agentIdPattern.test(agentId))
             return refusal(404, "No such agent");
         const incoming = context.req.raw;
@@ -252,49 +220,40 @@ function createAgentRoutes(agents, liveKey) {
         target.searchParams.delete(computerTargetParam);
         const response = await agents.fetch(agentId, new Request(target, incoming));
         return response ?? refusal(404, "No such agent");
-    });
-    routes.get("/member/inbox", async (context) => {
+    })
+        .get("/member/inbox", agentCollection(), async (_context, { authority, reaches }) => {
         const inbox = await agents.inbox();
-        const principal = context.env.principal;
-        if (oysterPrincipalIsOwner(principal))
+        if (authority.kind === "owner")
             return Response.json({
                 items: inbox.items,
                 next: null,
                 cursor: inbox.revision,
             });
-        if (principal.actor.kind !== "team-key")
-            return refusal(403, "Agent access denied");
-        const key = await liveKey(principal.actor.keyId);
+        const items = [];
+        for (const item of inbox.items)
+            if ("agentId" in item && (await reaches(item.agentId)))
+                items.push(item);
         return Response.json({
-            items: key === null
-                ? []
-                : inbox.items.filter((item) => "agentId" in item && keyAgentAccess(key, item.agentId)),
+            items,
             next: null,
             // The global revision changes for ungranted Agents too. Key feeds have
             // no scoped event stream, so expose neither that revision nor its events.
             cursor: 0,
         });
-    });
-    routes.get("/member/inbox/notices", (context) => oysterPrincipalIsOwner(context.env.principal)
-        ? Response.json({ items: [], next: null })
-        : refusal(403, "Agent access denied"));
-    routes.post("/member/inbox/visits", async (context) => {
+    })
+        .get("/member/inbox/notices", owner("direct-or-app"), () => Response.json({ items: [], next: null }))
+        .post("/member/inbox/visits", agent(async (facts) => (await facts.body(visitSchema))?.agentId ?? null), async (context, { agentId }) => {
         const body = Schema.decodeUnknownOption(visitSchema)(await context.req.json());
         if (body._tag === "None")
             return refusal(400, "Invalid visit");
-        if (!(await access(context.env.principal, body.value.agentId)))
-            return refusal(403, "Agent access denied");
-        return (await agents.visit(body.value.agentId, body.value.sessionId))
+        return (await agents.visit(agentId, body.value.sessionId))
             ? new Response(null, { status: 204 })
             : refusal(404, "No such Session");
-    });
-    // The feed is small (one person's agents), so a change is announced as a
-    // `reset` and the client re-reads the whole inbox.
-    routes.get("/member/inbox/events", (context) => {
-        // The unscoped revision also changes for other Agents. Do not expose it
-        // until a principal-scoped revision exists.
-        if (!oysterPrincipalIsOwner(context.env.principal))
-            return refusal(403, "Agent access denied");
+    })
+        // The feed is small (one person's agents), so a change is announced as a
+        // `reset` and the client re-reads the whole inbox. The unscoped revision
+        // also changes for other Agents, so only the owner reads it.
+        .get("/member/inbox/events", owner("direct-or-app"), (context) => {
         const after = Number(context.req.query("after") ?? "0");
         const signal = context.req.raw.signal;
         const encoder = new TextEncoder();
@@ -321,20 +280,33 @@ function createAgentRoutes(agents, liveKey) {
                 "Cache-Control": "no-store",
             },
         });
-    });
-    return routes;
+    }));
+}
+/** Owner-only archive transition; creator Agents use their own control tool. */
+async function changeArchive(agents, agentId, archived, principal) {
+    if (!agentIdPattern.test(agentId))
+        return refusal(404, "No such agent");
+    const result = await agents.setArchived(agentId, archived, principal);
+    if ("error" in result)
+        return Response.json(result, {
+            status: result.error === "not_found"
+                ? 404
+                : result.error === "not_granted"
+                    ? 403
+                    : result.archived !== undefined
+                        ? 503
+                        : 409,
+        });
+    return Response.json(result);
 }
 async function approvePolicy(agents, principal, actor, agentId, body) {
-    if (!oysterPrincipalIsOwner(principal))
-        return refusal(403, "Only the owner approves Agent tools");
     const input = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Struct({
         level: Schema.Literals(["read", "write"]),
         expectedRevision: Schema.NullOr(Schema.NonEmptyString),
     })), { onExcessProperty: "error" })(body);
     if (input._tag === "None")
         return refusal(400, "Choose read or write tools");
-    if (!agentIdPattern.test(agentId) ||
-        !(await agents.list()).some((agent) => agent.agentId === agentId))
+    if (!(await knownAgent(agents, agentId)))
         return refusal(404, "No such agent");
     const result = await agents.approveAppToolPolicy(agentId, principal, input.value.level, input.value.expectedRevision, actor);
     const failureStatuses = {
@@ -348,11 +320,8 @@ async function approvePolicy(agents, principal, actor, agentId, body) {
 }
 /** Host-owned direct approval under the admitted owner; never an App capability. */
 export function agentApprovalRoutes(agents) {
-    return new Hono()
-        .get("/api/agent-models/:agentId", async (context) => {
-        if (context.req.raw.headers.has("X-Oyster-Installation") ||
-            !oysterPrincipalIsOwner(context.get("principal")))
-            return refusal(403, "Owner only");
+    return routes()
+        .get("/api/agent-models/:agentId", owner("direct"), async (context) => {
         const agentId = context.req.param("agentId");
         if (!agentIdPattern.test(agentId))
             return refusal(404, "No such agent");
@@ -361,17 +330,14 @@ export function agentApprovalRoutes(agents) {
             ? refusal(404, "No such agent")
             : Response.json(choice);
     })
-        .put("/api/agent-models/:agentId", async (context) => {
-        if (context.req.raw.headers.has("X-Oyster-Installation") ||
-            !oysterPrincipalIsOwner(context.get("principal")))
-            return refusal(403, "Owner only");
+        .put("/api/agent-models/:agentId", owner("direct"), async (context, { principal }) => {
         const agentId = context.req.param("agentId");
         if (!agentIdPattern.test(agentId))
             return refusal(404, "No such agent");
         const input = agents.decodeModelChoice(await context.req.text());
         if (input === null)
             return refusal(400, "Invalid model choice");
-        const choice = await agents.setModelChoice(agentId, input, context.get("principal"));
+        const choice = await agents.setModelChoice(agentId, input, principal);
         if ("error" in choice && choice.error === "invalid_model_choice")
             return refusal(400, "Invalid model choice");
         return "error" in choice
@@ -382,21 +348,15 @@ export function agentApprovalRoutes(agents) {
                     : 409, choice.error)
             : Response.json(choice);
     })
-        .get("/api/agent-policies/:agentId", async (context) => {
-        if (context.req.raw.headers.has("X-Oyster-Installation"))
-            return refusal(403, "Owner direct only");
-        if (!oysterPrincipalIsOwner(context.get("principal")))
-            return refusal(403, "Owner only");
+        .get("/api/agent-policies/:agentId", owner("direct"), async (context) => {
         const agentId = context.req.param("agentId");
-        if (!(await agents.list()).some((agent) => agent.agentId === agentId))
+        if (!(await knownAgent(agents, agentId)))
             return refusal(404, "No such agent");
         return Response.json({
             expectedRevision: await agents.policyRevision(agentId),
         });
     })
-        .put("/api/agent-policies/:agentId", async (context) => context.req.raw.headers.has("X-Oyster-Installation")
-        ? refusal(403, "Missing admitted Agent installation")
-        : approvePolicy(agents, context.get("principal"), "owner-direct", context.req.param("agentId"), await context.req.text()));
+        .put("/api/agent-policies/:agentId", owner("direct"), async (context, { principal }) => approvePolicy(agents, principal, "owner-direct", context.req.param("agentId"), await context.req.text()));
 }
 const serverIdPattern = /^[a-z0-9_-]{1,64}$/u;
 const mcpRefusalStatus = { not_found: 404, duplicate_name: 409, limit: 409 };
@@ -405,28 +365,18 @@ const mcpRefusalStatus = { not_found: 404, duplicate_name: 409, limit: 409 };
  * capability. Bearer tokens go in and never come back out.
  */
 export function agentMcpServerRoutes(agents) {
-    const routes = new Hono();
-    const ownerOnly = async (context, next) => {
-        if (context.req.raw.headers.has("X-Oyster-Installation"))
-            return refusal(403, "Owner direct only");
-        if (!oysterPrincipalIsOwner(context.get("principal")))
-            return refusal(403, "Only the owner connects MCP servers");
-        await next();
-        return undefined;
-    };
-    routes.use("/api/agent-mcp-servers", ownerOnly);
-    routes.use("/api/agent-mcp-servers/*", ownerOnly);
-    // One owner read for the settings panel: every Agent with its servers.
-    routes.get("/api/agent-mcp-servers", async () => {
+    return (routes()
+        // One owner read for the settings panel: every Agent with its servers.
+        .get("/api/agent-mcp-servers", owner("direct"), async () => {
         const listed = await agents.list();
-        const rows = await Promise.all(listed.map(async (agent) => ({
-            agentId: agent.agentId,
-            name: agent.name,
-            servers: (await agents.mcpServers(agent.agentId)) ?? [],
+        const rows = await Promise.all(listed.map(async (item) => ({
+            agentId: item.agentId,
+            name: item.name,
+            servers: (await agents.mcpServers(item.agentId)) ?? [],
         })));
         return Response.json({ agents: rows });
-    });
-    routes.post("/api/agent-mcp-servers/:agentId", async (context) => {
+    })
+        .post("/api/agent-mcp-servers/:agentId", owner("direct"), async (context) => {
         if (!agentIdPattern.test(context.req.param("agentId")))
             return refusal(404, "No such agent");
         const length = Number(context.req.header("content-length") ?? "0");
@@ -439,8 +389,8 @@ export function agentMcpServerRoutes(agents) {
         return "error" in added
             ? refusal(mcpRefusalStatus[added.error], added.error)
             : Response.json(added, { status: 201 });
-    });
-    routes.delete("/api/agent-mcp-servers/:agentId/:serverId", async (context) => {
+    })
+        .delete("/api/agent-mcp-servers/:agentId/:serverId", owner("direct"), async (context) => {
         const serverId = context.req.param("serverId");
         if (!agentIdPattern.test(context.req.param("agentId")) ||
             !serverIdPattern.test(serverId))
@@ -448,6 +398,5 @@ export function agentMcpServerRoutes(agents) {
         return (await agents.removeMcpServer(context.req.param("agentId"), serverId))
             ? new Response(null, { status: 204 })
             : refusal(404, "No such server");
-    });
-    return routes;
+    }));
 }

package/dist/app-builds.d.ts

@@ -18,6 +18,7 @@
  */
 import * as Schema from "effect/Schema";
 import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+import { type BuildJobLog } from "./build/job-log.js";
 import { type Release } from "@fungi.computer/puffball";
 import { type AppPublisherCoreConfigInput } from "./build/effect.js";
 import { type TeamAppCandidateManifest } from "./build/submission-contract.js";
@@ -144,10 +145,12 @@ export type OysterBuildComputer = Readonly<{
         command: string;
         timeoutMs: number;
     }): Promise<Readonly<{
-        output?: Readonly<{
+        output: Readonly<{
             exitCode: number | null;
             stderr?: string;
         }> | null;
+        /** Raw combined events captured before the Computer reply's stream bounds. */
+        log: BuildJobLog;
     }>>;
 }>;
 export type OysterAppBuildOptions = Readonly<{
@@ -208,6 +211,8 @@ export declare function createOysterAppBuilds(options: OysterAppBuildOptions): R
         run: () => Promise<OysterBuildView>;
     }>>;
     read(jobId: string): OysterBuildView | null;
+    /** Full raw output; the host applies the same principal guard as `read`. */
+    readLog(jobId: string): Promise<BuildJobLog | null>;
     /** Discover the current source's latest job from the caller's Git owner,
      * never a job id remembered in a browser or another installation's repo. */
     latestRepositoryBuild(installationId: string, repository: string): OysterBuildView | null;
@@ -280,4 +285,4 @@ export declare function createOysterAppBuilds(options: OysterAppBuildOptions): R
     submitCandidate(jobId: string, manifest: TeamAppCandidateManifest, grant: string, credentialId: string): Promise<Response>;
 }>;
 export type OysterAppBuilds = ReturnType<typeof createOysterAppBuilds>;
-export {};
+export { buildJobLogMaxBytes, type BuildJobLog } from "./build/job-log.js";

package/dist/app-builds.js

@@ -20,6 +20,7 @@ import * as Schema from "effect/Schema";
 import * as Data from "effect/Data";
 import * as Option from "effect/Option";
 import { candidateFailureDiagnostic } from "./build/candidate-diagnostic.js";
+import { buildJobDiagnostic, buildJobLogSchema, } from "./build/job-log.js";
 import { parseArtifactRef, parseReleaseId, } from "@fungi.computer/puffball";
 import { appIdSchema, releaseSchema, sha256DigestSchema, sourceRevisionSchema, } from "@fungi.computer/puffball/effect";
 import { capturedPinnedRecipeSchema, normalizeAppPublisherRecipe, digestPinnedRecipe, fitsPinnedRecipe, pinnedRecipeObjectBound, } from "./build/effect.js";
@@ -235,8 +236,9 @@ export function createOysterAppBuilds(options) {
         detail: job.detail,
     });
     const settle = (jobId, status, detail) => {
+        const diagnostic = detail === null ? null : buildJobDiagnostic(jobId, detail);
         owner.sql.exec(`UPDATE oyster_build_jobs SET installation=CASE WHEN ?='succeeded' THEN installation ELSE ${failedInstallation} END,
-        status=?, detail=?, expires_at=MIN(expires_at, ?) WHERE job_id=? AND status='running'`, status, detail, status, detail, now(), jobId);
+        status=?, detail=?, expires_at=MIN(expires_at, ?) WHERE job_id=? AND status='running'`, status, diagnostic, status, diagnostic, now(), jobId);
     };
     const required = (jobId) => {
         const job = readJob(jobId);
@@ -244,6 +246,10 @@ export function createOysterAppBuilds(options) {
             throw new Error("Unknown build job");
         return job;
     };
+    // A job-scoped immutable object in the same artifact store as its build.
+    // It is read only through the owner build door, never exposed as a Release.
+    const logRef = (jobId) => parseArtifactRef(`artifact:build-log-${jobId}`);
+    const logCodec = Schema.fromJsonString(buildJobLogSchema);
     const publisher = createTeamBuildPublisher({
         teamId: options.tenantId,
         now,
@@ -284,7 +290,8 @@ export function createOysterAppBuilds(options) {
                     command: input.command,
                     timeoutMs: input.timeoutMs,
                 });
-                if (result.output === undefined || result.output === null)
+                await options.artifacts.put(logRef(input.jobId), new TextEncoder().encode(Schema.encodeUnknownSync(logCodec)(result.log)));
+                if (result.output === null)
                     throw new BuildOutcomeUnknown();
                 return result;
             },
@@ -458,6 +465,15 @@ export function createOysterAppBuilds(options) {
             const job = readJob(jobId);
             return job === null ? null : view(job);
         },
+        /** Full raw output; the host applies the same principal guard as `read`. */
+        async readLog(jobId) {
+            if (readJob(jobId) === null)
+                return null;
+            const bytes = await options.artifacts.get(logRef(jobId));
+            return bytes === null
+                ? null
+                : Schema.decodeUnknownSync(logCodec)(new TextDecoder().decode(bytes));
+        },
         /** Discover the current source's latest job from the caller's Git owner,
          * never a job id remembered in a browser or another installation's repo. */
         latestRepositoryBuild(installationId, repository) {
@@ -660,3 +676,4 @@ export function createOysterAppBuilds(options) {
         },
     });
 }
+export { buildJobLogMaxBytes } from "./build/job-log.js";

package/dist/approval-capability.d.ts

@@ -1,5 +1,5 @@
 import { type Approvals } from "@fungi.computer/approvals";
 import type { HostActor } from "@fungi.computer/puffball/app";
 import type { OysterCapability } from "./host.js";
-/** Ordinary capability routes; the outer App gate supplies identity and consent. */
+/** Ordinary capability routes; the outer App gate supplies consent, and only members answer. */
 export declare function approvalCapability(control: (actor: HostActor) => Approvals): OysterCapability;

package/dist/approval-capability.js

@@ -1,19 +1,19 @@
-import { Hono } from "hono";
+import { member, routes as routesFor } from "./authorization.js";
 import { bodyLimit } from "hono/body-limit";
 import { causeClass } from "./cause-class.js";
 import * as Schema from "effect/Schema";
 import { ApprovalListInputSchema, ApprovalGetInputSchema, ApprovalAnswerInputSchema, AutoApproveInputSchema, } from "@fungi.computer/approvals";
-/** Ordinary capability routes; the outer App gate supplies identity and consent. */
+/** Ordinary capability routes; the outer App gate supplies consent, and only members answer. */
 export function approvalCapability(control) {
-    const routes = new Hono();
-    routes.use("*", bodyLimit({ maxSize: 4096 }));
-    routes.use("*", async (context, next) => {
-        if (context.env.principal.actor.kind !== "member")
-            return context.json({ kind: "refused", reason: "not-eligible" }, 403);
-        await next();
-        return undefined;
-    });
-    routes.onError((cause, context) => {
+    const strict = { onExcessProperty: "error" };
+    const eligible = member(() => Response.json({ kind: "refused", reason: "not-eligible" }, { status: 403 }));
+    const options = { middleware: [bodyLimit({ maxSize: 4096 })] };
+    const routes = routesFor()
+        .post("/list", eligible, async (c, { principal }) => c.json(await control(principal.actor).list(Schema.decodeUnknownSync(ApprovalListInputSchema, strict)(await c.req.json()))), options)
+        .post("/get", eligible, async (c, { principal }) => c.json(await control(principal.actor).get(Schema.decodeUnknownSync(ApprovalGetInputSchema, strict)(await c.req.json()))), options)
+        .post("/answer", eligible, async (c, { principal }) => c.json(await control(principal.actor).answer(Schema.decodeUnknownSync(ApprovalAnswerInputSchema, strict)(await c.req.json()))), options)
+        .post("/set-auto-approve", eligible, async (c, { principal }) => c.json(await control(principal.actor).setAutoApprove(Schema.decodeUnknownSync(AutoApproveInputSchema, strict)(await c.req.json()))), options)
+        .onError((cause, context) => {
         if (cause instanceof SyntaxError || cause instanceof Schema.SchemaError)
             return context.json({ error: "Invalid approval request" }, 400);
         console.warn("Native approval control failed", {
@@ -21,11 +21,6 @@ export function approvalCapability(control) {
         });
         return context.json({ error: "Approval home unavailable" }, 503);
     });
-    const strict = { onExcessProperty: "error" };
-    routes.post("/list", async (c) => c.json(await control(c.env.principal.actor).list(Schema.decodeUnknownSync(ApprovalListInputSchema, strict)(await c.req.json()))));
-    routes.post("/get", async (c) => c.json(await control(c.env.principal.actor).get(Schema.decodeUnknownSync(ApprovalGetInputSchema, strict)(await c.req.json()))));
-    routes.post("/answer", async (c) => c.json(await control(c.env.principal.actor).answer(Schema.decodeUnknownSync(ApprovalAnswerInputSchema, strict)(await c.req.json()))));
-    routes.post("/set-auto-approve", async (c) => c.json(await control(c.env.principal.actor).setAutoApprove(Schema.decodeUnknownSync(AutoApproveInputSchema, strict)(await c.req.json()))));
     return {
         id: "approvals",
         version: 1,

package/dist/approval-home.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { ApprovalLedger, type Approvals, type PendingApproval, type ApprovalApplyResult } from "@fungi.computer/approvals";
 import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
-import { type OysterHost } from "./host.js";
+import type { OysterHost } from "./host.js";
 import type { HostActor } from "@fungi.computer/puffball/app";
 import type { TenantScope } from "./tenant.js";
 declare const callSchema: z.ZodObject<{
@@ -32,6 +32,7 @@ export type OysterApprovalCall = z.output<typeof callSchema>;
 export declare class OysterApprovalHome {
     private readonly host;
     readonly ledger: ApprovalLedger;
+    private surfaces;
     constructor(host: Readonly<{
         owner: WatchdogSqliteOwner;
         scope: TenantScope;

package/dist/approval-home.js

@@ -3,9 +3,8 @@ import * as Schema from "effect/Schema";
 import { hostActorSchema } from "@fungi.computer/puffball/app-method-runtime";
 import { ApprovalLedger, } from "@fungi.computer/approvals";
 import { invokeModuleOperation } from "@fungi.computer/mycelium/remote";
-import { oysterPrincipalIsOwner } from "./host.js";
+import { keyAppAccess, oysterPrincipalIsOwner } from "./authorization.js";
 import { sha256 } from "./release.js";
-import { keyAppAccess } from "./keys.js";
 const identity = z.string().min(1).max(256);
 const targetSchema = z.strictObject({
     actor: hostActorSchema,
@@ -25,6 +24,9 @@ const intentRow = Schema.decodeUnknownSync(Schema.Struct({ target_json: Schema.S
 export class OysterApprovalHome {
     host;
     ledger;
+    // The home's artifact store and capability configuration are fixed, unlike
+    // the authority read fresh from current() for every recheck and dispatch.
+    surfaces;
     constructor(host) {
         this.host = host;
         host.owner.sql.exec("CREATE TABLE IF NOT EXISTS oyster_approval_targets (record_id TEXT PRIMARY KEY, target_json TEXT NOT NULL) STRICT");
@@ -180,7 +182,7 @@ export class OysterApprovalHome {
                 byInstallation: new Map([[target.installationId, policy]]),
             };
         }
-        const snapshot = await oysterAppSnapshot(host, appSurfaceCache(host), principal, [installation], access, target.sessionId ?? undefined);
+        const snapshot = await oysterAppSnapshot(host, (this.surfaces ??= appSurfaceCache(host)), principal, [installation], access, target.sessionId, "direct");
         const module = snapshot.modules[record.module];
         const fence = snapshot.fences[record.module];
         const effect = snapshot.effects[record.module]?.[record.operation];

package/dist/apps/catalog.js

@@ -34,7 +34,7 @@ export const permissionCatalog = {
     "apps.call": entry("apps", "Call declared App methods", "call the listed methods in other Apps as you. Renamed target methods need approval again.", "run", "install"),
     "app.storage": entry("data", "Store App data", "save its App data.", "write", "install"),
     "app.events.emit": entry("workflows", "Send events", "tell your Workflows when something happens.", "sendPrompts", "ask"),
-    "team.workbenchHost": entry("shell", "Arrange the workbench", "arrange Apps on your workbench.", "list", "ask", null, "The shell runs with full access to your Team and every App inside it. Only pick a shell you trust."),
+    "team.workbenchHost": entry("shell", "Shell", "Full access to your Team and every App", "list", "ask", null, "Only pick a shell you trust."),
     "marketplace.browse": entry("bazaar", "Browse the marketplace", "browse Apps in the marketplace.", "browseBazaar", "install"),
     "marketplace.purchase": entry("bazaar", "Purchase from the marketplace", "purchase Apps from the marketplace.", "buyApps", "install"),
     "workflow.run": entry("workflows", "Run Workflows", "start Workflows.", "run", "install"),

package/dist/apps/gate.d.ts

@@ -4,9 +4,7 @@ import { type AppToolAccess } from "./tools.js";
 import { type ResourceRef, type DeclaredOperations, type Installation, type ApprovedGrant } from "./installation.js";
 /** Attested by the host, never authenticated by decoding request JSON. */
 export type HostPrincipal = Readonly<{
-    actor: HostActor | Readonly<{
-        kind: "visitor";
-    }>;
+    actor: HostActor;
     role: "owner" | "member" | null;
 }>;
 /** Requests select existing SDK methods, opaque backend calls and derived operation identities. */
@@ -54,7 +52,7 @@ export type GateRequest = z.output<typeof gateRequestSchema>;
 /** Immutable values the host already read; resource/grantor freshness remains host-owned. */
 export type GateFacts = Readonly<{
     principal: HostPrincipal;
-    installation: Readonly<Pick<Installation, "status" | "visibility" | "instanceId" | "authority"> & {
+    installation: Readonly<Pick<Installation, "status" | "instanceId" | "authority"> & {
         artifactDigest: string;
     }>;
     declaration: AppDeclaration;
@@ -87,7 +85,6 @@ export declare const gateRefusalSchema: z.ZodLazy<z.ZodObject<{
         approval_required: "approval_required";
         requires_not_granted: "requires_not_granted";
         invalid_input: "invalid_input";
-        visitor_read_only: "visitor_read_only";
     }>;
 }, z.core.$strict>>;
 /** Either an admitted scoped ceiling or one closed refusal code. */
@@ -100,13 +97,13 @@ export type GateDecision = Readonly<{
 export declare function grantsFor(installation: Pick<GateFacts["installation"], "status" | "authority" | "artifactDigest">, declaration: AppDeclaration, snapshot: DeclaredOperations, capability: ApprovedGrant["capability"], resource?: ResourceRef | "any"): ApprovedGrant | null;
 /** Approved binding operations from an already verified declaration. Hosts still pin
  * the selection/version/artifact and compare running frame grants as a subset. */
-export declare function approvedBindingGrants(installation: Pick<GateFacts["installation"], "status" | "authority">, declaration: AppDeclaration): InvocationGrants;
+export declare function approvedBindingGrants(installation: Pick<GateFacts["installation"], "status" | "authority">, declaration: AppDeclaration, resource?: ResourceRef | "any"): InvocationGrants;
 /** Narrow captured binding operations to the method's verified requirements and effect.
  * The captured set is the ceiling; this never adds an operation or resource authority. */
 export declare function scopedBindings(captured: InvocationGrants, method?: AppMethodDeclaration, ceiling?: "read" | "write"): InvocationGrants;
 /** Principal ceiling for invocation and metadata capture. Captures must pass this
  * to scopedBindings; its default write ceiling does not encode caller access. */
-export declare function appInvocationCeiling(facts: Pick<GateFacts, "principal" | "access">): "read" | "write";
+export declare function appInvocationCeiling(facts: Pick<GateFacts, "access">): "read" | "write";
 /** Permission metadata only: this is neither an invocation grant nor input admission. */
 export type AppMethodMetadataDecision = Readonly<{
     kind: "admitted";