@myagentroam/server 0.13.4 → 0.13.7

package/dist/quick-start/node-runtime.js

@@ -12,6 +12,7 @@ export async function startLocalNode(root, config, bootstrap, stopTimeoutMs = 45
     const path = join(data, 'node.json');
     await mkdir(data, { recursive: true, mode: 0o700 });
     await mkdir(workspace, { recursive: true, mode: 0o700 });
+    let created = false;
     try {
         await readFile(path, 'utf8');
     }
@@ -29,6 +30,7 @@ export async function startLocalNode(root, config, bootstrap, stopTimeoutMs = 45
                 registrationToken: token
             }, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
             await link(temporary, path);
+            created = true;
         }
         finally {
             await unlink(temporary).catch(() => { });
@@ -39,13 +41,29 @@ export async function startLocalNode(root, config, bootstrap, stopTimeoutMs = 45
         nodeConfig === null ||
         Array.isArray(nodeConfig) ||
         typeof nodeConfig['serverUrl'] !== 'string')
-        throw new Error('QUICK_START_NODE_CONFIG_INVALID');
+        throw Object.assign(new Error('QUICK_START_NODE_CONFIG_INVALID'), {
+            code: 'QUICK_START_NODE_CONFIG_INVALID'
+        });
     const record = nodeConfig;
+    const nonempty = (value) => typeof value === 'string' && value.trim().length > 0;
+    const hasIdentity = nonempty(record['nodeId']) && nonempty(record['credential']);
+    if (!hasIdentity && (record['nodeId'] !== undefined || record['credential'] !== undefined))
+        throw Object.assign(new Error('QUICK_START_NODE_CONFIG_INVALID'), {
+            code: 'QUICK_START_NODE_CONFIG_INVALID'
+        });
+    if (!hasIdentity && !nonempty(record['registrationToken']))
+        throw Object.assign(new Error('QUICK_START_NODE_CONFIG_INVALID'), {
+            code: 'QUICK_START_NODE_CONFIG_INVALID'
+        });
+    const token = !created && !hasIdentity
+        ? (await bootstrap.issue(record['registrationToken'])).token
+        : undefined;
     const serverUrl = `http://127.0.0.1:${config.serverPort}`;
-    if (record['serverUrl'] !== serverUrl) {
+    if (record['serverUrl'] !== serverUrl ||
+        (token !== undefined && token !== record['registrationToken'])) {
         const temporary = `${path}.${randomUUID()}.tmp`;
         try {
-            await writeFile(temporary, `${JSON.stringify({ ...record, serverUrl }, null, 2)}\n`, {
+            await writeFile(temporary, `${JSON.stringify({ ...record, serverUrl, ...(token === undefined ? {} : { registrationToken: token }) }, null, 2)}\n`, {
                 mode: 0o600,
                 flag: 'wx'
             });

package/dist/quick-start/run.js

@@ -128,8 +128,17 @@ export async function runQuickStart(args) {
                                 console.error(cliText('quickNodeUnavailable'));
                         }
                     }
-                    catch {
-                        console.error(cliText('quickNodeUnavailable'));
+                    catch (error) {
+                        if (error instanceof Error &&
+                            'code' in error &&
+                            error.code === 'QUICK_START_NODE_BOOTSTRAP_RECOVERY_REQUIRED')
+                            console.error(cliText('quickNodeBootstrapRecoveryRequired'));
+                        else if (error instanceof Error &&
+                            'code' in error &&
+                            error.code === 'QUICK_START_NODE_CONFIG_INVALID')
+                            console.error(cliText('quickNodeInstallFailed', { code: error.code }));
+                        else
+                            console.error(cliText('quickNodeUnavailable'));
                     }
                     if (mysqlExitedDuringNodeStartup)
                         throw new Error('QUICK_START_MYSQL_EXITED');

package/node_modules/@myagentroam/protocol/dist/index.d.ts

@@ -8706,6 +8706,7 @@ export declare const watchEventSchema: z.ZodUnion<[z.ZodObject<{
     type: z.ZodLiteral<"watch.session.snapshot">;
     workspaceId: z.ZodString;
     sessionId: z.ZodString;
+    historyReset: z.ZodOptional<z.ZodLiteral<true>>;
     revision: z.ZodNumber;
     snapshotSequence: z.ZodNumber;
     expiresAt: z.ZodNumber;
@@ -8722,6 +8723,7 @@ export declare const watchEventSchema: z.ZodUnion<[z.ZodObject<{
     watchId: string;
     snapshotSequence: number;
     payload?: unknown;
+    historyReset?: true | undefined;
 }, {
     type: "watch.session.snapshot";
     expiresAt: number;
@@ -8734,6 +8736,7 @@ export declare const watchEventSchema: z.ZodUnion<[z.ZodObject<{
     watchId: string;
     snapshotSequence: number;
     payload?: unknown;
+    historyReset?: true | undefined;
 }>, z.ZodObject<{
     workbenchConnectionId: z.ZodString;
     watchId: z.ZodString;
@@ -28338,6 +28341,7 @@ export declare const hostedConversationSnapshotSchema: z.ZodEffects<z.ZodObject<
         } | undefined;
     }>, "many">;
     historyNextCursor: z.ZodNullable<z.ZodString>;
+    historyVersion: z.ZodOptional<z.ZodString>;
     files: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         conversationId: z.ZodString;
@@ -29371,6 +29375,7 @@ export declare const hostedConversationSnapshotSchema: z.ZodEffects<z.ZodObject<
     };
     historyNextCursor: string | null;
     nodeAppVersion?: string | undefined;
+    historyVersion?: string | undefined;
 }, {
     files: {
         source: "SYSTEM" | "USER" | "AGENT";
@@ -30211,6 +30216,7 @@ export declare const hostedConversationSnapshotSchema: z.ZodEffects<z.ZodObject<
     };
     historyNextCursor: string | null;
     nodeAppVersion?: string | undefined;
+    historyVersion?: string | undefined;
 }>, {
     files: {
         source: "SYSTEM" | "USER" | "AGENT";
@@ -31051,6 +31057,7 @@ export declare const hostedConversationSnapshotSchema: z.ZodEffects<z.ZodObject<
     };
     historyNextCursor: string | null;
     nodeAppVersion?: string | undefined;
+    historyVersion?: string | undefined;
 }, {
     files: {
         source: "SYSTEM" | "USER" | "AGENT";
@@ -31891,6 +31898,7 @@ export declare const hostedConversationSnapshotSchema: z.ZodEffects<z.ZodObject<
     };
     historyNextCursor: string | null;
     nodeAppVersion?: string | undefined;
+    historyVersion?: string | undefined;
 }>;
 export type HostedConversationSnapshot = z.infer<typeof hostedConversationSnapshotSchema>;
 export declare const hostedConversationCreateInputSchema: z.ZodObject<{

package/node_modules/@myagentroam/protocol/dist/index.js

@@ -1551,6 +1551,7 @@ export const watchEventSchema = z.union([
         type: z.literal('watch.session.snapshot'),
         workspaceId: z.string().min(1).max(160),
         sessionId: z.string().min(1).max(512),
+        historyReset: z.literal(true).optional(),
         revision: z.number().int().nonnegative(),
         snapshotSequence: z.number().int().positive(),
         expiresAt: z.number().int().positive(),
@@ -2706,6 +2707,7 @@ export const hostedConversationSnapshotSchema = z
         .nullable(),
     turns: z.array(conversationTurnSchema),
     historyNextCursor: z.string().min(1).max(2048).nullable(),
+    historyVersion: z.string().min(1).max(160).optional(),
     files: z.array(conversationFileProjectionSchema),
     models: z.array(marAgentNodeModelSummarySchema),
     error: z

package/node_modules/@myagentroam/protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myagentroam/protocol",
-  "version": "0.13.4",
+  "version": "0.13.7",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/myagentroam/mar.git",

package/node_modules/@myagentroam/server-core/dist/mcp-service.js

@@ -29,7 +29,7 @@ export class McpService {
         const rows = await this.sourceRows(actorUserId);
         return Promise.all(rows.map(async (row) => {
             const source = sourceSummary(row);
-            const result = await this.authorization.authorize(actorUserId, 'SKILL_SOURCE_MANAGE', scopeContext(source.scope, source.ownerUserId ?? actorUserId, source.organizationId));
+            const result = await this.authorization.authorize(actorUserId, 'SKILL_SOURCE_MANAGE', scopeContext(source.scope, source.ownerUserId ?? actorUserId, source.organizationId, source.builtIn));
             return { ...source, manageable: result.allowed };
         }));
     }
@@ -327,7 +327,7 @@ export class McpService {
     }
     async assertManageRow(actorUserId, row) {
         const scope = String(row['scope']);
-        const result = await this.authorization.authorize(actorUserId, 'SKILL_SOURCE_MANAGE', scopeContext(scope, Number(row['owner_user_id']), Number(row['owner_organization_id'])));
+        const result = await this.authorization.authorize(actorUserId, 'SKILL_SOURCE_MANAGE', scopeContext(scope, Number(row['owner_user_id']), Number(row['owner_organization_id']), Boolean(row['built_in'])));
         if (!result.allowed)
             throw new Error('MCP_SOURCE_FORBIDDEN');
     }
@@ -436,7 +436,9 @@ function sourceSummary(row) {
         manageable: false
     };
 }
-function scopeContext(scope, userId, organizationId) {
+function scopeContext(scope, userId, organizationId, builtIn = false) {
+    if (scope === 'ENTERPRISE' && builtIn)
+        return { ownerType: 'SYSTEM' };
     if (scope === 'PERSONAL')
         return { ownerType: 'PERSONAL', ownerUserId: userId };
     if (scope === 'ORGANIZATION')

package/node_modules/@myagentroam/server-core/dist/mysql-node-identity.d.ts

@@ -24,6 +24,11 @@ export declare class MysqlNodeIdentityStorage {
         token: string;
         expiresAt: number;
     }>;
+    /** Recover only an unused personal token; never infer a lost registration result. */
+    recoverPersonalNodeRegistrationToken(token: string, userId: number, ttlMs: number): Promise<{
+        token: string;
+        expiresAt: number;
+    } | undefined>;
     registerNode(token: string, input: {
         readonly metadata: string;
     }, registeredAddress?: string): Promise<{

package/node_modules/@myagentroam/server-core/dist/mysql-node-identity.js

@@ -65,6 +65,37 @@ export class MysqlNodeIdentityStorage {
         }
         return { token, expiresAt };
     }
+    /** Recover only an unused personal token; never infer a lost registration result. */
+    async recoverPersonalNodeRegistrationToken(token, userId, ttlMs) {
+        const connection = await this.raw.getConnection();
+        try {
+            await connection.beginTransaction();
+            const [rows] = await connection.execute(`SELECT expires_at,display_name FROM node_registration_tokens
+         WHERE token_hash=? AND used_at IS NULL AND created_by_user_id=?
+         AND owner_type='PERSONAL' AND owner_user_id=? AND owner_organization_id IS NULL FOR UPDATE`, [sha256(token), userId, userId]);
+            const row = rows[0];
+            if (!row) {
+                await connection.rollback();
+                return undefined;
+            }
+            const expiresAt = Number(row['expires_at']);
+            const result = expiresAt > this.now()
+                ? { token, expiresAt }
+                : await this.createNodeRegistrationToken(userId, ttlMs, { ownerType: 'PERSONAL', ownerUserId: userId }, row['display_name'] == null ? null : String(row['display_name']), connection);
+            // Keep the expired, unusable row so a failed local file write can retry safely.
+            await connection.commit();
+            commitMysqlAudits(connection);
+            return result;
+        }
+        catch (error) {
+            discardMysqlAudits(connection);
+            await connection.rollback();
+            throw error;
+        }
+        finally {
+            connection.release();
+        }
+    }
     async registerNode(token, input, registeredAddress = 'unknown') {
         const connection = await this.raw.getConnection();
         try {

package/node_modules/@myagentroam/server-core/dist/skill-source-service.js

@@ -15,7 +15,7 @@ export class SkillSourceService {
         const rows = await this.sourceRows(actorUserId);
         return Promise.all(rows.map(async (row) => {
             const summary = sourceSummary(row);
-            const authorization = await this.authorization.authorize(actorUserId, 'SKILL_SOURCE_MANAGE', scopeContext(summary.scope, summary.ownerUserId ?? actorUserId, summary.organizationId));
+            const authorization = await this.authorization.authorize(actorUserId, 'SKILL_SOURCE_MANAGE', scopeContext(summary.scope, summary.ownerUserId ?? actorUserId, summary.organizationId, summary.builtIn));
             return { ...summary, manageable: authorization.allowed };
         }));
     }
@@ -166,12 +166,14 @@ export class SkillSourceService {
         const scope = row['scope'];
         if (scope !== 'ENTERPRISE' && scope !== 'ORGANIZATION' && scope !== 'PERSONAL')
             throw new Error('SKILL_SOURCE_INVALID');
-        const result = await this.authorization.authorize(actorUserId, 'SKILL_SOURCE_MANAGE', scopeContext(scope, Number(row['owner_user_id']), Number(row['owner_organization_id'])));
+        const result = await this.authorization.authorize(actorUserId, 'SKILL_SOURCE_MANAGE', scopeContext(scope, Number(row['owner_user_id']), Number(row['owner_organization_id']), Boolean(row['built_in'])));
         if (!result.allowed)
             throw new Error('SKILL_SOURCE_FORBIDDEN');
     }
 }
-function scopeContext(scope, actorUserId, organizationId) {
+function scopeContext(scope, actorUserId, organizationId, builtIn = false) {
+    if (scope === 'ENTERPRISE' && builtIn)
+        return { ownerType: 'SYSTEM' };
     if (scope === 'PERSONAL')
         return { ownerType: 'PERSONAL', ownerUserId: actorUserId };
     if (scope === 'ORGANIZATION') {

package/node_modules/@myagentroam/server-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myagentroam/server-core",
-  "version": "0.13.4",
+  "version": "0.13.7",
   "private": true,
   "type": "module",
   "files": [
@@ -638,7 +638,7 @@
   },
   "dependencies": {
     "@fastify/websocket": "^11.3.0",
-    "@myagentroam/protocol": "0.13.4",
+    "@myagentroam/protocol": "0.13.7",
     "fastify": "^5.1.0",
     "mysql2": "^3.23.4",
     "nodemailer": "^10.0.11",

package/node_modules/@myagentroam-enterprise/server-implementation/dist/cli-messages.en-US.d.ts

@@ -8,6 +8,7 @@ export declare const cliMessagesEnUS: {
     readonly quickNodeNotPrepared: "The Server Node dependency is unavailable. Check the npm installation or disable the local Node with --no-node.";
     readonly quickNodeInstallFailed: "The local Node operation failed ({code}). Check the Node logs and configuration.";
     readonly quickNodeOnline: "Local Node is online.";
+    readonly quickNodeBootstrapRecoveryRequired: "Local Node registration cannot be safely recovered (QUICK_START_NODE_BOOTSTRAP_RECOVERY_REQUIRED). The token was consumed or its state is unknown. No new Node was registered. Keep node-data/node.json and restore its existing identity from a backup or resolve the previous registration before registering again.";
     readonly quickNodeUnavailable: "Local Node is not online. Check the Node logs and configuration; registration is not retried automatically.";
     readonly quickNodeSupervisorExited: "Local Node Supervisor exited unexpectedly. The management page remains available; check the Node logs.";
     readonly quickSearchDisabled: "Local search is unavailable on this platform and has been disabled; an external search endpoint can be configured later.";

package/node_modules/@myagentroam-enterprise/server-implementation/dist/cli-messages.en-US.js

@@ -8,6 +8,7 @@ export const cliMessagesEnUS = {
     quickNodeNotPrepared: 'The Server Node dependency is unavailable. Check the npm installation or disable the local Node with --no-node.',
     quickNodeInstallFailed: 'The local Node operation failed ({code}). Check the Node logs and configuration.',
     quickNodeOnline: 'Local Node is online.',
+    quickNodeBootstrapRecoveryRequired: 'Local Node registration cannot be safely recovered (QUICK_START_NODE_BOOTSTRAP_RECOVERY_REQUIRED). The token was consumed or its state is unknown. No new Node was registered. Keep node-data/node.json and restore its existing identity from a backup or resolve the previous registration before registering again.',
     quickNodeUnavailable: 'Local Node is not online. Check the Node logs and configuration; registration is not retried automatically.',
     quickNodeSupervisorExited: 'Local Node Supervisor exited unexpectedly. The management page remains available; check the Node logs.',
     quickSearchDisabled: 'Local search is unavailable on this platform and has been disabled; an external search endpoint can be configured later.',

package/node_modules/@myagentroam-enterprise/server-implementation/dist/cli-messages.zh-CN.d.ts

@@ -8,6 +8,7 @@ export declare const cliMessagesZhCN: {
     readonly quickNodeNotPrepared: "Server 的 Node 依赖不可用，请检查 npm 安装或使用 --no-node 禁用本机 Node。";
     readonly quickNodeInstallFailed: "本机 Node 操作失败（{code}）。请检查 Node 日志与配置。";
     readonly quickNodeOnline: "本机 Node 已上线。";
+    readonly quickNodeBootstrapRecoveryRequired: "无法安全恢复本机 Node 注册（QUICK_START_NODE_BOOTSTRAP_RECOVERY_REQUIRED）：令牌已使用或状态不明，未重复登记。请保留 node-data/node.json，从备份恢复已有身份，或核对并处理上次登记后再注册。";
     readonly quickNodeUnavailable: "本机 Node 尚未上线。请检查 Node 日志与配置；注册不会自动重试。";
     readonly quickNodeSupervisorExited: "本机 Node Supervisor 意外退出。管理页面仍可访问，请检查 Node 日志。";
     readonly quickSearchDisabled: "此平台无法使用本地搜索，已禁用；之后可配置外部搜索地址。";

package/node_modules/@myagentroam-enterprise/server-implementation/dist/cli-messages.zh-CN.js

@@ -8,6 +8,7 @@ export const cliMessagesZhCN = {
     quickNodeNotPrepared: 'Server 的 Node 依赖不可用，请检查 npm 安装或使用 --no-node 禁用本机 Node。',
     quickNodeInstallFailed: '本机 Node 操作失败（{code}）。请检查 Node 日志与配置。',
     quickNodeOnline: '本机 Node 已上线。',
+    quickNodeBootstrapRecoveryRequired: '无法安全恢复本机 Node 注册（QUICK_START_NODE_BOOTSTRAP_RECOVERY_REQUIRED）：令牌已使用或状态不明，未重复登记。请保留 node-data/node.json，从备份恢复已有身份，或核对并处理上次登记后再注册。',
     quickNodeUnavailable: '本机 Node 尚未上线。请检查 Node 日志与配置；注册不会自动重试。',
     quickNodeSupervisorExited: '本机 Node Supervisor 意外退出。管理页面仍可访问，请检查 Node 日志。',
     quickSearchDisabled: '此平台无法使用本地搜索，已禁用；之后可配置外部搜索地址。',

package/node_modules/@myagentroam-enterprise/server-implementation/dist/composition/quick-start-node-bootstrap.d.ts

@@ -7,9 +7,13 @@ export declare function createQuickStartNodeBootstrap(input: {
         token: string;
         expiresAt: number;
     }>;
+    readonly recoverPersonalNodeRegistrationToken: (token: string, userId: number, ttlMs: number) => Promise<{
+        token: string;
+        expiresAt: number;
+    } | undefined>;
     readonly isNodeConnected: (nodeId: string) => boolean;
 }): {
-    issue(): Promise<{
+    issue(previousToken?: string): Promise<{
         token: string;
         expiresAt: number;
     }>;

package/node_modules/@myagentroam-enterprise/server-implementation/dist/composition/quick-start-node-bootstrap.js

@@ -2,7 +2,7 @@
 export function createQuickStartNodeBootstrap(input) {
     let attempted = false;
     return {
-        async issue() {
+        async issue(previousToken) {
             if (attempted)
                 throw new Error('QUICK_START_NODE_BOOTSTRAP_ALREADY_USED');
             attempted = true;
@@ -11,6 +11,14 @@ export function createQuickStartNodeBootstrap(input) {
                 throw new Error('QUICK_START_NODE_ADMIN_UNAVAILABLE');
             const ownership = { ownerType: 'PERSONAL', ownerUserId: userId };
             await input.assertOwnershipSelection(userId, ownership);
+            if (previousToken !== undefined) {
+                const recovered = await input.recoverPersonalNodeRegistrationToken(previousToken, userId, 600_000);
+                if (!recovered)
+                    throw Object.assign(new Error('QUICK_START_NODE_BOOTSTRAP_RECOVERY_REQUIRED'), {
+                        code: 'QUICK_START_NODE_BOOTSTRAP_RECOVERY_REQUIRED'
+                    });
+                return recovered;
+            }
             return input.createNodeRegistrationToken(userId, 600_000, ownership, 'Local Node');
         },
         online: input.isNodeConnected

package/node_modules/@myagentroam-enterprise/server-implementation/dist/composition/server-application.js

@@ -712,6 +712,7 @@ export async function composeServerApplication(options, storage, quickStart = fa
                         isPersonalAdmin: (userId) => authorization.isPersonalAdmin(userId),
                         assertOwnershipSelection: (userId, ownership) => resources.assertOwnershipSelection(userId, ownership),
                         createNodeRegistrationToken: (userId, ttlMs, ownership, name) => database.createNodeRegistrationToken(userId, ttlMs, ownership, name),
+                        recoverPersonalNodeRegistrationToken: (token, userId, ttlMs) => database.recoverPersonalNodeRegistrationToken(token, userId, ttlMs),
                         isNodeConnected: (nodeId) => nodeControl.isNodeConnected(nodeId) && !nodeControl.isNodeUpgradeOnly(nodeId)
                     })
                 }

package/node_modules/@myagentroam-enterprise/server-implementation/dist/license/management-gate.js

@@ -7,8 +7,7 @@ export function managementRequirement(method, route) {
         route.startsWith('/api/enterprise/users') ||
         route.startsWith('/api/organizations') ||
         route.startsWith('/api/resource-grants') ||
-        route.startsWith('/api/oauth-providers') ||
-        route.startsWith('/api/system-settings')) {
+        route.startsWith('/api/oauth-providers')) {
         return 'ENTERPRISE_WRITABLE';
     }
     if (route === '/api/node-registration-tokens' ||
@@ -19,6 +18,8 @@ export function managementRequirement(method, route) {
         route.startsWith('/api/workspaces/:workspaceId/mcps') ||
         route.startsWith('/api/nodes/:nodeId') ||
         route.startsWith('/api/environment-secrets') ||
+        route.startsWith('/api/system-settings') ||
+        route.startsWith('/api/skill-sources') ||
         route.startsWith('/api/mcp-sources') ||
         route.startsWith('/api/mcp-catalog')) {
         return 'WRITABLE';

package/node_modules/@myagentroam-enterprise/server-implementation/dist/mysql/server-database.d.ts

@@ -79,6 +79,10 @@ export declare class MysqlServerDatabase {
         token: string;
         expiresAt: number;
     }>;
+    recoverPersonalNodeRegistrationToken(token: string, userId: number, ttlMs: number): Promise<{
+        token: string;
+        expiresAt: number;
+    } | undefined>;
     registerNode(token: string, input: {
         readonly metadata: string;
     }, registeredAddress?: string): Promise<{

package/node_modules/@myagentroam-enterprise/server-implementation/dist/mysql/server-database.js

@@ -366,6 +366,9 @@ export class MysqlServerDatabase {
     createNodeRegistrationToken(userId, ttlMs = 10 * 60 * 1000, ownership = { ownerType: 'PERSONAL', ownerUserId: userId }, displayName = null, connection) {
         return this.nodeIdentities.createNodeRegistrationToken(userId, ttlMs, ownership, displayName, connection);
     }
+    recoverPersonalNodeRegistrationToken(token, userId, ttlMs) {
+        return this.nodeIdentities.recoverPersonalNodeRegistrationToken(token, userId, ttlMs);
+    }
     registerNode(token, input, registeredAddress = 'unknown') {
         return this.nodeIdentities.registerNode(token, input, registeredAddress);
     }

package/node_modules/@myagentroam-enterprise/server-implementation/dist/rbac/authorization-service.js

@@ -19,7 +19,13 @@ export class AuthorizationService {
                 context.ownerUserId === actorUserId &&
                 this.matrix.grants.get('MEMBER')?.get(permissionId)?.has('PERSONAL') === true;
             const system = context.ownerType === 'SYSTEM' &&
-                ['NODE_MANAGE', 'SKILL_SOURCE_MANAGE', 'LICENSE_READ', 'LICENSE_IMPORT'].includes(permissionId);
+                [
+                    'NODE_MANAGE',
+                    'SKILL_SOURCE_MANAGE',
+                    'SYSTEM_SETTINGS_MANAGE',
+                    'LICENSE_READ',
+                    'LICENSE_IMPORT'
+                ].includes(permissionId);
             return personal || system
                 ? { allowed: true }
                 : { allowed: false, reason: 'ENTERPRISE_LICENSE_REQUIRED' };

package/node_modules/@myagentroam-enterprise/server-implementation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myagentroam-enterprise/server-implementation",
-  "version": "0.13.4",
+  "version": "0.13.7",
   "private": true,
   "type": "module",
   "files": [
@@ -15,13 +15,13 @@
   },
   "dependencies": {
     "@fastify/websocket": "^11.3.0",
-    "@myagentroam/protocol": "0.13.4",
+    "@myagentroam/protocol": "0.13.7",
     "fastify": "^5.1.0",
     "mysql2": "^3.23.4",
     "undici": "7.29.0",
     "ws": "^8.21.3",
     "zod": "^3.24.1",
-    "@myagentroam/server-core": "0.13.4"
+    "@myagentroam/server-core": "0.13.7"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myagentroam/server",
-  "version": "0.13.4",
+  "version": "0.13.7",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/myagentroam/mar.git",
@@ -27,7 +27,7 @@
     "license": "tsx --conditions=development src/license.ts"
   },
   "dependencies": {
-    "@myagentroam/node": "0.13.4",
+    "@myagentroam/node": "0.13.7",
     "@fastify/ajv-compiler": "4.0.6",
     "@fastify/error": "4.2.0",
     "@fastify/fast-json-stringify-compiler": "5.1.0",
@@ -35,9 +35,9 @@
     "@fastify/merge-json-schemas": "0.2.1",
     "@fastify/proxy-addr": "5.1.0",
     "@fastify/websocket": "11.3.0",
-    "@myagentroam/protocol": "0.13.4",
-    "@myagentroam/server-core": "0.13.4",
-    "@myagentroam-enterprise/server-implementation": "0.13.4",
+    "@myagentroam/protocol": "0.13.7",
+    "@myagentroam/server-core": "0.13.7",
+    "@myagentroam-enterprise/server-implementation": "0.13.7",
     "@pinojs/redact": "0.4.0",
     "@types/node": "24.13.3",
     "abstract-logging": "2.0.1",
@@ -123,7 +123,7 @@
     "zod": "3.25.76"
   },
   "devDependencies": {
-    "@myagentroam/web-console": "@myagentroam/web-console@file:///tmp/mar-server-candidate-srJsSU/source/mar-web-console"
+    "@myagentroam/web-console": "@myagentroam/web-console@file:///var/tmp/mr13-5V856P/mar-server-candidate-nYjK39/source/mar-web-console"
   },
   "license": "LicenseRef-MAR-ESAL-1.0",
   "optionalDependencies": {},