@syengup/friday-channel-next 0.1.36 → 0.1.38

package/src/http/handlers/history-set-title.test.ts

@@ -42,7 +42,8 @@ function setForward(store: Record<string, unknown>, withWriter = true): void {
     runtime: {
       agent: {
         session: {
-          resolveStorePath: (_s?: string, opts?: { agentId?: string }) => `/store/${opts?.agentId ?? "main"}.json`,
+          resolveStorePath: (_s?: string, opts?: { agentId?: string }) =>
+            `/store/${opts?.agentId ?? "main"}.json`,
           loadSessionStore: () => store,
           ...(withWriter
             ? {
@@ -61,7 +62,9 @@ function setForward(store: Record<string, unknown>, withWriter = true): void {
 }
 
 describe("handleHistorySetTitle", () => {
-  beforeEach(() => setFridayNextRuntime({ config: { loadConfig: () => CFG }, logger: {} } as never));
+  beforeEach(() =>
+    setFridayNextRuntime({ config: { loadConfig: () => CFG }, logger: {} } as never),
+  );
   afterEach(() => resetFridayAgentForwardRuntimeForTest());
 
   it("rejects GET with 405", async () => {
@@ -102,14 +105,20 @@ describe("handleHistorySetTitle", () => {
   it("404s when the session is unknown", async () => {
     setForward({});
     const res = new MockRes();
-    await handleHistorySetTitle(makeReq({ sessionKey: "agent:main:nope", title: "x" }, AUTH), res as any);
+    await handleHistorySetTitle(
+      makeReq({ sessionKey: "agent:main:nope", title: "x" }, AUTH),
+      res as any,
+    );
     expect(res.statusCode).toBe(404);
   });
 
   it("503s when the store writer is unavailable", async () => {
     setForward({ "agent:main:main": { sessionId: "s" } }, false);
     const res = new MockRes();
-    await handleHistorySetTitle(makeReq({ sessionKey: "agent:main:main", title: "x" }, AUTH), res as any);
+    await handleHistorySetTitle(
+      makeReq({ sessionKey: "agent:main:main", title: "x" }, AUTH),
+      res as any,
+    );
     expect(res.statusCode).toBe(503);
   });
-})
+});

package/src/http/handlers/link-preview.test.ts

@@ -11,7 +11,10 @@ vi.mock("node:dns/promises", () => ({
 
 import dns from "node:dns/promises";
 import { handleLinkPreview } from "./link-preview.js";
-import { resetLinkPreviewCacheForTest, type LinkPreviewPayload } from "../../link-preview/preview-service.js";
+import {
+  resetLinkPreviewCacheForTest,
+  type LinkPreviewPayload,
+} from "../../link-preview/preview-service.js";
 import { setAttachmentsDirForTest } from "./files.js";
 import { clearFridayNextRuntime, setFridayNextRuntime } from "../../runtime.js";
 
@@ -33,7 +36,10 @@ class MockRes extends EventEmitter {
 function makeReq(query: string | null, token: string | null = "tok"): IncomingMessage {
   return {
     method: "GET",
-    url: query == null ? "/friday-next/link-preview" : `/friday-next/link-preview?url=${encodeURIComponent(query)}`,
+    url:
+      query == null
+        ? "/friday-next/link-preview"
+        : `/friday-next/link-preview?url=${encodeURIComponent(query)}`,
     headers: token ? { authorization: `Bearer ${token}` } : {},
   } as unknown as IncomingMessage;
 }
@@ -76,7 +82,10 @@ afterEach(() => {
 describe("handleLinkPreview", () => {
   it("405 on non-GET", async () => {
     const res = new MockRes();
-    await handleLinkPreview({ method: "POST", url: "/friday-next/link-preview", headers: {} } as never, res as never);
+    await handleLinkPreview(
+      { method: "POST", url: "/friday-next/link-preview", headers: {} } as never,
+      res as never,
+    );
     expect(res.statusCode).toBe(405);
   });
 
@@ -105,7 +114,10 @@ describe("handleLinkPreview", () => {
         if (url.includes("cover.png")) {
           return new Response(PNG_BYTES, { status: 200, headers: { "content-type": "image/png" } });
         }
-        return new Response(PAGE_HTML, { status: 200, headers: { "content-type": "text/html; charset=utf-8" } });
+        return new Response(PAGE_HTML, {
+          status: 200,
+          headers: { "content-type": "text/html; charset=utf-8" },
+        });
       }),
     );
     const res = await invoke(makeReq("https://example.com/article"));
@@ -142,7 +154,9 @@ describe("handleLinkPreview", () => {
     const html = `<meta property="og:title" content="T">`;
     vi.stubGlobal(
       "fetch",
-      vi.fn(async () => new Response(html, { status: 200, headers: { "content-type": "text/html" } })),
+      vi.fn(
+        async () => new Response(html, { status: 200, headers: { "content-type": "text/html" } }),
+      ),
     );
     const res = await invoke(makeReq("https://example.com/x"));
     expect(JSON.parse(res.body).preview.siteName).toBe("example.com");
@@ -152,7 +166,13 @@ describe("handleLinkPreview", () => {
     // 可达但无 OG/title → 退到 hostname 卡片(不再折叠)。
     vi.stubGlobal(
       "fetch",
-      vi.fn(async () => new Response("<html><body>plain</body></html>", { status: 200, headers: { "content-type": "text/html" } })),
+      vi.fn(
+        async () =>
+          new Response("<html><body>plain</body></html>", {
+            status: 200,
+            headers: { "content-type": "text/html" },
+          }),
+      ),
     );
     const res = await invoke(makeReq("https://example.com/bare"));
     expect(res.statusCode).toBe(200);
@@ -166,9 +186,15 @@ describe("handleLinkPreview", () => {
       vi.fn(async (input: URL | string) => {
         const url = String(input);
         if (url.includes("favicon")) {
-          return new Response(ICO_BYTES, { status: 200, headers: { "content-type": "image/x-icon" } });
+          return new Response(ICO_BYTES, {
+            status: 200,
+            headers: { "content-type": "image/x-icon" },
+          });
         }
-        return new Response(`<meta property="og:title" content="Titled">`, { status: 200, headers: { "content-type": "text/html" } });
+        return new Response(`<meta property="og:title" content="Titled">`, {
+          status: 200,
+          headers: { "content-type": "text/html" },
+        });
       }),
     );
     const res = await invoke(makeReq("https://example.com/p"));
@@ -185,7 +211,10 @@ describe("handleLinkPreview", () => {
       vi.fn(async (input: URL | string) => {
         const url = String(input);
         if (url.endsWith("/favicon.ico")) {
-          return new Response(ICO_BYTES, { status: 200, headers: { "content-type": "image/vnd.microsoft.icon" } });
+          return new Response(ICO_BYTES, {
+            status: 200,
+            headers: { "content-type": "image/vnd.microsoft.icon" },
+          });
         }
         return new Response("blocked", { status: 403, headers: { "content-type": "text/html" } }); // page blocks bots
       }),
@@ -199,29 +228,41 @@ describe("handleLinkPreview", () => {
   });
 
   it("502 fetch_failed for a dead domain (page and favicon both fail)", async () => {
-    vi.stubGlobal("fetch", vi.fn(async () => new Response("nope", { status: 404 })));
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response("nope", { status: 404 })),
+    );
     const res = await invoke(makeReq("https://dead.example.com/x"));
     expect(res.statusCode).toBe(502);
     expect(JSON.parse(res.body).error).toBe("fetch_failed");
   });
 
   it("502 fetch_failed on non-2xx and non-HTML responses", async () => {
-    vi.stubGlobal("fetch", vi.fn(async () => new Response("nope", { status: 500 })));
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response("nope", { status: 500 })),
+    );
     expect((await invoke(makeReq("https://example.com/down"))).statusCode).toBe(502);
 
     resetLinkPreviewCacheForTest();
     vi.stubGlobal(
       "fetch",
-      vi.fn(async () => new Response("{}", { status: 200, headers: { "content-type": "application/json" } })),
+      vi.fn(
+        async () =>
+          new Response("{}", { status: 200, headers: { "content-type": "application/json" } }),
+      ),
     );
     expect((await invoke(makeReq("https://example.com/api"))).statusCode).toBe(502);
   });
 
   it("serves the second request from cache without refetching", async () => {
-    const fetchMock = vi.fn(async () => new Response(`<meta property="og:title" content="Cached">`, {
-      status: 200,
-      headers: { "content-type": "text/html" },
-    }));
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(`<meta property="og:title" content="Cached">`, {
+          status: 200,
+          headers: { "content-type": "text/html" },
+        }),
+    );
     vi.stubGlobal("fetch", fetchMock);
     await invoke(makeReq("https://example.com/cached"));
     const afterFirst = fetchMock.mock.calls.length;

package/src/http/handlers/link-preview.ts

@@ -17,7 +17,10 @@ const ERROR_STATUS: Record<LinkPreviewError, number> = {
   fetch_failed: 502,
 };
 
-export async function handleLinkPreview(req: IncomingMessage, res: ServerResponse): Promise<boolean> {
+export async function handleLinkPreview(
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<boolean> {
   if (req.method !== "GET") {
     res.statusCode = 405;
     res.setHeader("Content-Type", "application/json");

package/src/http/handlers/messages.test.ts

@@ -35,9 +35,9 @@ describe("composeBodyWithMediaRefs", () => {
   });
 
   it("omits the leading blank line when text is empty (attachment-only)", () => {
-    expect(composeBodyWithMediaRefs("", ["[media attached: file:///a]", "[media attached: file:///b]"])).toBe(
-      "[media attached: file:///a]\n[media attached: file:///b]",
-    );
+    expect(
+      composeBodyWithMediaRefs("", ["[media attached: file:///a]", "[media attached: file:///b]"]),
+    ).toBe("[media attached: file:///a]\n[media attached: file:///b]");
   });
 });
 
@@ -152,7 +152,9 @@ describe("handleMessages dispatch context (owner fields)", () => {
     const dispatchCalled = new Promise<void>((resolve) => {
       __setMockFridayDispatchForTests(async (args: unknown) => {
         const a = args as {
-          dispatcherOptions?: { deliver?: (payload: unknown, info: { kind: string }) => Promise<void> };
+          dispatcherOptions?: {
+            deliver?: (payload: unknown, info: { kind: string }) => Promise<void>;
+          };
         };
         if (a.dispatcherOptions?.deliver) {
           await a.dispatcherOptions.deliver(
@@ -169,10 +171,12 @@ describe("handleMessages dispatch context (owner fields)", () => {
     req.headers = { authorization: "Bearer tok" };
     const res = new MockRes() as unknown as ServerResponse;
     let observedPayload: Record<string, unknown> | null = null;
-    const broadcastSpy = vi.spyOn(sseEmitter, "broadcastToRun").mockImplementation((_: string, evt: unknown) => {
-      const data = (evt as { data?: { payload?: Record<string, unknown> } })?.data;
-      if (data?.payload) observedPayload = data.payload;
-    });
+    const broadcastSpy = vi
+      .spyOn(sseEmitter, "broadcastToRun")
+      .mockImplementation((_: string, evt: unknown) => {
+        const data = (evt as { data?: { payload?: Record<string, unknown> } })?.data;
+        if (data?.payload) observedPayload = data.payload;
+      });
 
     const p = handleMessages(req, res);
     req.end(

package/src/http/handlers/messages.ts

@@ -48,6 +48,7 @@ import {
   resolveMediaUrl,
 } from "./files.js";
 import { runFridayDispatch } from "../../agent/dispatch-bridge.js";
+import { ensureSubagentSpawnScope } from "../../agent/operator-scope.js";
 import { saveInboundMediaBuffer } from "../../agent/media-bridge.js";
 import {
   contextTokensFromUsageRecord,
@@ -77,7 +78,10 @@ const log = (
   logger[level](`[${action}] deviceId=${deviceId}${runPart}${detailPart}`);
 };
 
-function collectReplyPayloadMediaUrls(pl: { mediaUrls?: string[]; mediaUrl?: string | null }): string[] {
+function collectReplyPayloadMediaUrls(pl: {
+  mediaUrls?: string[];
+  mediaUrl?: string | null;
+}): string[] {
   const fromArr = Array.isArray(pl.mediaUrls)
     ? pl.mediaUrls.filter((u): u is string => typeof u === "string" && u.trim().length > 0)
     : [];
@@ -159,7 +163,12 @@ export function isCanvasSnapshotMediaPath(url: unknown): boolean {
 export function translateDeliverPayload(
   pl: FridayReplyPayload,
   kind: string,
-  meta?: { modelName?: string; totalTokens?: number; contextTokensUsed?: number; contextWindowMax?: number },
+  meta?: {
+    modelName?: string;
+    totalTokens?: number;
+    contextTokensUsed?: number;
+    contextWindowMax?: number;
+  },
 ): Record<string, unknown> {
   // Strip canvas-snapshot tool-result images before any media resolution (paths here are still the
   // original `/tmp/openclaw/openclaw-canvas-snapshot-*.jpg` temp paths, not yet copied to friday files).
@@ -210,7 +219,11 @@ export function translateDeliverPayload(
   if (typeof meta?.modelName === "string" && meta.modelName.trim()) {
     nextFridayNext.modelName = meta.modelName.trim();
   }
-  if (typeof meta?.totalTokens === "number" && Number.isFinite(meta.totalTokens) && meta.totalTokens > 0) {
+  if (
+    typeof meta?.totalTokens === "number" &&
+    Number.isFinite(meta.totalTokens) &&
+    meta.totalTokens > 0
+  ) {
     nextFridayNext.totalTokens = Math.floor(meta.totalTokens);
   }
   if (
@@ -260,8 +273,10 @@ function scheduleLateFinalMetaPatch(runId: string, attempts = 6): void {
             sessionKey: route.sessionKey,
             modelName: meta.modelName ?? null,
             totalTokens: typeof meta.totalTokens === "number" ? meta.totalTokens : null,
-            contextTokensUsed: typeof meta.contextTokensUsed === "number" ? meta.contextTokensUsed : null,
-            contextWindowMax: typeof meta.contextWindowMax === "number" ? meta.contextWindowMax : null,
+            contextTokensUsed:
+              typeof meta.contextTokensUsed === "number" ? meta.contextTokensUsed : null,
+            contextWindowMax:
+              typeof meta.contextWindowMax === "number" ? meta.contextWindowMax : null,
             ts: Date.now(),
           },
         },
@@ -298,11 +313,17 @@ function pickMetadataFromMessageLike(message: unknown): {
       ? usage.totalTokens
       : undefined) ??
     (typeof usage?.total === "number" && Number.isFinite(usage.total) ? usage.total : undefined) ??
-    (typeof usage?.total_tokens === "number" && Number.isFinite(usage.total_tokens) ? usage.total_tokens : undefined);
+    (typeof usage?.total_tokens === "number" && Number.isFinite(usage.total_tokens)
+      ? usage.total_tokens
+      : undefined);
   const totalFromMessage =
-    (typeof m.totalTokens === "number" && Number.isFinite(m.totalTokens) ? m.totalTokens : undefined) ??
-    (typeof m.total_tokens === "number" && Number.isFinite(m.total_tokens) ? m.total_tokens : undefined);
-  const totalTokens = Math.floor((totalFromUsage ?? totalFromMessage ?? 0));
+    (typeof m.totalTokens === "number" && Number.isFinite(m.totalTokens)
+      ? m.totalTokens
+      : undefined) ??
+    (typeof m.total_tokens === "number" && Number.isFinite(m.total_tokens)
+      ? m.total_tokens
+      : undefined);
+  const totalTokens = Math.floor(totalFromUsage ?? totalFromMessage ?? 0);
 
   let contextTokensUsed: number | undefined;
   if (usage) {
@@ -313,8 +334,12 @@ function pickMetadataFromMessageLike(message: unknown): {
   }
 
   const ctxMaxRaw =
-    (typeof m.contextWindow === "number" && Number.isFinite(m.contextWindow) ? m.contextWindow : undefined) ??
-    (typeof m.maxContextTokens === "number" && Number.isFinite(m.maxContextTokens) ? m.maxContextTokens : undefined);
+    (typeof m.contextWindow === "number" && Number.isFinite(m.contextWindow)
+      ? m.contextWindow
+      : undefined) ??
+    (typeof m.maxContextTokens === "number" && Number.isFinite(m.maxContextTokens)
+      ? m.maxContextTokens
+      : undefined);
   const contextWindowMax =
     typeof ctxMaxRaw === "number" && ctxMaxRaw > 0 ? Math.floor(ctxMaxRaw) : undefined;
 
@@ -336,9 +361,16 @@ async function resolveRunMetadataFromRuntimeSession(
   contextTokensUsed?: number;
   contextWindowMax?: number;
 } | null> {
-  const sessionApi = (runtime as unknown as {
-    subagent?: { getSessionMessages?: (params: { sessionKey: string; limit?: number }) => Promise<{ messages?: unknown[] }> };
-  }).subagent;
+  const sessionApi = (
+    runtime as unknown as {
+      subagent?: {
+        getSessionMessages?: (params: {
+          sessionKey: string;
+          limit?: number;
+        }) => Promise<{ messages?: unknown[] }>;
+      };
+    }
+  ).subagent;
   if (!sessionApi?.getSessionMessages) return null;
   try {
     const response = await sessionApi.getSessionMessages({ sessionKey, limit: 80 });
@@ -373,7 +405,10 @@ export function composeBodyWithMediaRefs(text: string, mediaRefs: string[]): str
   return trimmed ? `${trimmed}\n\n${mediaRefs.join("\n")}` : mediaRefs.join("\n");
 }
 
-async function buildBodyForAgentWithAttachments(text: string, attachmentIds: string[]): Promise<string> {
+async function buildBodyForAgentWithAttachments(
+  text: string,
+  attachmentIds: string[],
+): Promise<string> {
   if (attachmentIds.length === 0) return text.trim();
 
   const mediaRefs: string[] = [];
@@ -539,7 +574,10 @@ export async function handleMessages(req: IncomingMessage, res: ServerResponse):
         dispatcherOptions: {
           deliver: async (pl: any, info: any) => {
             let meta = getRunMetadata(runId);
-            if (info.kind.toLowerCase() === "final" && !(meta?.modelName || typeof meta?.totalTokens === "number")) {
+            if (
+              info.kind.toLowerCase() === "final" &&
+              !(meta?.modelName || typeof meta?.totalTokens === "number")
+            ) {
               const resolved = await resolveRunMetadataFromRuntimeSession(runtime, baseSessionKey);
               if (resolved) {
                 setRunMetadata(runId, resolved);
@@ -602,10 +640,11 @@ export async function handleMessages(req: IncomingMessage, res: ServerResponse):
           // OpenClaw `pi-embedded-subscribe` gates `streamReasoning` on `typeof onReasoningStream === "function"`.
           // Without this, `emitReasoningStream` never runs and Friday SSE never sees `stream: "thinking"`.
           onReasoningStream: async (pl: unknown) => {
-            const text =
+            const rawText =
               typeof pl === "object" && pl !== null && "text" in pl
-                ? String((pl as { text?: unknown }).text ?? "")
-                : "";
+                ? (pl as { text?: unknown }).text
+                : undefined;
+            const text = typeof rawText === "string" ? rawText : "";
             log("REASONING_STREAM", normalizedDeviceId, runId, `textLen=${text.length}`);
           },
           onReasoningEnd: async () => {
@@ -636,6 +675,15 @@ export async function handleMessages(req: IncomingMessage, res: ServerResponse):
     }
   };
 
+  // Elevate the route's (empty) operator scope so the dispatched agent can spawn
+  // subagents. Must run here, synchronously inside the route's AsyncLocalStorage
+  // context, so the live scope object the subagent spawn later reads carries
+  // operator.write. See agent/operator-scope.ts.
+  const elevatedScopes = ensureSubagentSpawnScope();
+  if (elevatedScopes.length > 0) {
+    log("SCOPE_ELEVATED", normalizedDeviceId, runId, elevatedScopes.join(","));
+  }
+
   runAgent().catch((err) => {
     log("RUN_ERROR", normalizedDeviceId, runId, String(err), "error");
     sseEmitter.untrackRun(runId);

package/src/http/handlers/models-list.ts

@@ -44,7 +44,7 @@ function resolveConfiguredModels(): ResolvedModels {
       seen.add(modelKey);
       entries.push({
         id: modelKey,
-        name: typeof info?.alias === "string" ? info.alias : meta?.name ?? split.modelId,
+        name: typeof info?.alias === "string" ? info.alias : (meta?.name ?? split.modelId),
         provider: split.provider,
         reasoning: meta?.reasoning,
         contextWindow: meta?.contextWindow,
@@ -104,13 +104,19 @@ function resolveConfiguredModels(): ResolvedModels {
   return { models: entries, defaultModel };
 }
 
-function buildProviderModelMeta(cfg: Record<string, unknown>): Map<string, {
-  name?: string;
-  reasoning?: boolean;
-  contextWindow?: number;
-  maxTokens?: number;
-}> {
-  const meta = new Map<string, { name?: string; reasoning?: boolean; contextWindow?: number; maxTokens?: number }>();
+function buildProviderModelMeta(cfg: Record<string, unknown>): Map<
+  string,
+  {
+    name?: string;
+    reasoning?: boolean;
+    contextWindow?: number;
+    maxTokens?: number;
+  }
+> {
+  const meta = new Map<
+    string,
+    { name?: string; reasoning?: boolean; contextWindow?: number; maxTokens?: number }
+  >();
   const models = cfg?.models as Record<string, unknown> | undefined;
   const providers = models?.providers as Record<string, unknown> | undefined;
   if (providers) {

package/src/http/handlers/nodes-approve.test.ts

@@ -24,8 +24,14 @@ class MockRes extends EventEmitter {
   }
 }
 
-function mockReq(method: string, headers: Record<string, string> = {}): PassThrough & { method: string; headers: Record<string, string> } {
-  const stream = new PassThrough() as unknown as PassThrough & { method: string; headers: Record<string, string> };
+function mockReq(
+  method: string,
+  headers: Record<string, string> = {},
+): PassThrough & { method: string; headers: Record<string, string> } {
+  const stream = new PassThrough() as unknown as PassThrough & {
+    method: string;
+    headers: Record<string, string>;
+  };
   stream.method = method;
   stream.headers = headers;
   return stream;
@@ -92,7 +98,10 @@ describe("handleNodesApprove", () => {
   });
 
   it("returns 404 when listNodePairing returns data without matching node", async () => {
-    mockList.mockResolvedValueOnce({ pending: [{ requestId: "x", nodeId: "UNMATCHED" }], paired: [] });
+    mockList.mockResolvedValueOnce({
+      pending: [{ requestId: "x", nodeId: "UNMATCHED" }],
+      paired: [],
+    });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -135,7 +144,9 @@ describe("handleNodesApprove", () => {
   it("returns 200 with alreadyApproved when node in paired with caps", async () => {
     mockList.mockResolvedValueOnce({
       pending: [],
-      paired: [{ nodeId: NODE_ID, approvedAtMs: 100, caps: ["canvas"], commands: ["canvas.present"] }],
+      paired: [
+        { nodeId: NODE_ID, approvedAtMs: 100, caps: ["canvas"], commands: ["canvas.present"] },
+      ],
     });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });

package/src/http/handlers/nodes-approve.ts

@@ -14,15 +14,6 @@ interface PairedNodeEntry {
   caps?: string[];
   commands?: string[];
 }
-interface NodePairingList {
-  pending: PendingNodeEntry[];
-  paired: PairedNodeEntry[];
-}
-type ApproveNodePairingResult =
-  | { requestId: string; node: PairedNodeEntry }
-  | { status: "forbidden"; missingScope: string }
-  | null;
-
 export async function handleNodesApprove(
   req: IncomingMessage,
   res: ServerResponse,
@@ -62,7 +53,7 @@ export async function handleNodesApprove(
 
   const normalizedNodeId = rawNodeId.trim().toUpperCase();
 
-let listData, listNodePairing, approveNodePairing;
+  let listData, listNodePairing, approveNodePairing;
   try {
     ({ listNodePairing, approveNodePairing } = await loadNodePairingModule());
   } catch (err) {
@@ -91,12 +82,7 @@ let listData, listNodePairing, approveNodePairing;
     const requestId = pendingMatch.requestId;
     log.info(`approving nodeId=${normalizedNodeId} requestId=${requestId}`);
 
-    const callerScopes = [
-      "operator.admin",
-      "operator.pairing",
-      "operator.read",
-      "operator.write",
-    ];
+    const callerScopes = ["operator.admin", "operator.pairing", "operator.read", "operator.write"];
 
     let approved;
     try {
@@ -105,10 +91,12 @@ let listData, listNodePairing, approveNodePairing;
       log.error(`approveNodePairing failed: ${err instanceof Error ? err.message : String(err)}`);
       res.statusCode = 502;
       res.setHeader("Content-Type", "application/json");
-      res.end(JSON.stringify({
-        error: "Node approval failed",
-        detail: err instanceof Error ? err.message : "Unknown error",
-      }));
+      res.end(
+        JSON.stringify({
+          error: "Node approval failed",
+          detail: err instanceof Error ? err.message : "Unknown error",
+        }),
+      );
       return true;
     }
 
@@ -122,18 +110,22 @@ let listData, listNodePairing, approveNodePairing;
     if ("status" in approved && approved.status === "forbidden") {
       res.statusCode = 403;
       res.setHeader("Content-Type", "application/json");
-      res.end(JSON.stringify({ error: `Node approval forbidden: ${(approved as any).missingScope ?? "unknown"}` }));
+      res.end(
+        JSON.stringify({ error: `Node approval forbidden: ${approved.missingScope ?? "unknown"}` }),
+      );
       return true;
     }
 
     res.statusCode = 200;
     res.setHeader("Content-Type", "application/json");
-    res.end(JSON.stringify({
-      ok: true,
-      nodeId: normalizedNodeId,
-      requestId: (approved as any).requestId,
-      approvedAtMs: (approved as any).node?.approvedAtMs,
-    }));
+    res.end(
+      JSON.stringify({
+        ok: true,
+        nodeId: normalizedNodeId,
+        requestId: approved.requestId,
+        approvedAtMs: approved.node?.approvedAtMs,
+      }),
+    );
     return true;
   }
 
@@ -147,26 +139,32 @@ let listData, listNodePairing, approveNodePairing;
     const caps = pairedMatch.caps ?? [];
     const commands = pairedMatch.commands ?? [];
     if (caps.length > 0 || commands.length > 0) {
-      log.info(`nodeId=${normalizedNodeId} already paired with caps=${caps.length} commands=${commands.length}`);
+      log.info(
+        `nodeId=${normalizedNodeId} already paired with caps=${caps.length} commands=${commands.length}`,
+      );
       res.statusCode = 200;
       res.setHeader("Content-Type", "application/json");
-      res.end(JSON.stringify({
-        ok: true,
-        nodeId: normalizedNodeId,
-        alreadyApproved: true,
-        approvedAtMs: pairedMatch.approvedAtMs,
-        caps,
-        commands,
-      }));
+      res.end(
+        JSON.stringify({
+          ok: true,
+          nodeId: normalizedNodeId,
+          alreadyApproved: true,
+          approvedAtMs: pairedMatch.approvedAtMs,
+          caps,
+          commands,
+        }),
+      );
       return true;
     }
   }
 
   res.statusCode = 404;
   res.setHeader("Content-Type", "application/json");
-  res.end(JSON.stringify({
-    error: "No pending node found for this nodeId",
-    nodeId: normalizedNodeId,
-  }));
+  res.end(
+    JSON.stringify({
+      error: "No pending node found for this nodeId",
+      nodeId: normalizedNodeId,
+    }),
+  );
   return true;
 }

package/src/http/handlers/plugin-info.ts

@@ -1,11 +1,7 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { extractBearerToken } from "../middleware/auth.js";
 import { PLUGIN_VERSION } from "../../version.js";
-import {
-  fetchLatestVersion,
-  getInstallSource,
-  semverGreater,
-} from "../../plugin-install-info.js";
+import { fetchLatestVersion, getInstallSource, semverGreater } from "../../plugin-install-info.js";
 
 export interface PluginInfoResult {
   currentVersion: string;
@@ -17,7 +13,10 @@ export interface PluginInfoResult {
   upgradable: boolean;
 }
 
-export async function handlePluginInfo(req: IncomingMessage, res: ServerResponse): Promise<boolean> {
+export async function handlePluginInfo(
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<boolean> {
   if (req.method !== "GET") {
     res.statusCode = 405;
     res.setHeader("Content-Type", "application/json");

package/src/http/handlers/plugin-upgrade.ts

@@ -18,7 +18,10 @@ const RESTART_DELAY_MS = 500;
  * eligible — dev (load.paths / source==="path") installs return 409 to protect
  * the dev environment from duplicate npm installs.
  */
-export async function handlePluginUpgrade(req: IncomingMessage, res: ServerResponse): Promise<boolean> {
+export async function handlePluginUpgrade(
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<boolean> {
   if (req.method !== "POST") {
     res.statusCode = 405;
     res.setHeader("Content-Type", "application/json");