@twinsearth/w2m-dsh-plugin 1.5.5 → 1.6.1

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.5.5"
+    "version": "1.6.1"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.5.5",
+      "version": "1.6.1",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.5.5"
+  "version": "1.6.1"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.5.5",
+  "version": "1.6.1",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,33 @@
 
 All notable changes to this project are documented here.
 
+## [1.6.1] — 2026-10-24
+
+**Node 执行开关改为「仅人工 UI 手动、进程内存态」：文件/远程/自动化一律无法授权。**
+
+本次实机验证暴露了一个必须修掉的现实：grant 任务可以远程写 `~/.w2m/exec-capability.json`，
+从而远程把机器变成可执行任意 Node 代码——与"最高权限只允许人工手动选中"直接冲突。
+
+- 能力状态改为**进程内存**唯一权威：`readExecCapability` 不再读磁盘；旧文件（含 permanent）被忽略；
+  只有 host 路由 `/api/w2m/capability`（composer 人工点击）能写。
+- **不随重启保留**：进程退出即回到 denied（"永久"= 本次进程生命周期）；
+  `describe` 明确返回 `survives_restart: false`、`manual_only: true`、`file_ignored: true`。
+- 三态语义不变：denied / temporary（默认 24h，上限 7 天，过期即失效）/ permanent（本进程内）。
+- 测试重写：`test/exec-capability.test.mjs` 6/6（含"磁盘写 permanent 仍 denied""路由是唯一 setter"
+  "重启即撤销"）；agent.test 161 项通过（PATH 环境问题已在本机修复，非代码缺陷）。
+- 修复 allow-list 解释器身份回归：当 argv[0] 是 **运行 agent 的同一个 node（process.execPath）** 时，
+  bare 条目 `node` 应放行（此前机器 PATH 里 node 指向别的程序时会误拒，实测 12 个 e2e 失败）。
+- 证据 `docs/acceptance/1.6.1/MANUAL-ONLY-CAPABILITY.json`（fleet task `01M5ANYMVLDYWBH`）。
+## [1.6.0] — 2026-10-24
+
+**一台 relay 承载 N 个编队：每个 DeepSeek 账号一个编队，共享 relay 但互相隔离。**
+
+- bootstrap 答案从"单个编队的归属"改为"relay 拓扑声明"：签名与有效期仍严格，fleet_id 不匹配不再拒绝
+  （`strictFleet: true` 保留旧行为）。一份 operator 签名即可服务全部编队，新账号机器无需人工重签。
+- `scripts/verify-fleet-isolation.mjs` 扩展到 **3 个编队** 14 项检查（设备枚举/任务/聊天/记忆），全过。
+- 新增 `docs/MULTI-FLEET.md`：编排模型、运维视图、零人工接入新账号、配额与边界。
+- 测试：bootstrap 6/6（含拓扑答案用例）、fleet isolation 14/14；证据 `docs/acceptance/1.6.0/N-FLEET.json`
+  （fleet task `01M5ANYMVLBU716`）。
 ## [1.5.5] — 2026-10-23
 
 **跨编队隔离：同 relay 上的另一账号机器不再出现在本编队的枚举/任务/聊天/记忆里。**

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.5.5", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.6.1", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/MULTI-FLEET.md

@@ -0,0 +1,38 @@
+# 多编队（N Fleets）：每个 DeepSeek 账号一个编队
+
+一台 relay 可以同时承载多个编队。编队身份**不需要注册**：每个账号派生自己的 fleet key，
+`sha256(fleet_key)` 就是它的 fleet id；任意机器配对时携带自己的 fleet key，relay 就把它记进对应编队。
+
+## 一、编排模型
+
+```
+DeepSeek 账号 A ── fleet_key_A ── sha256 ──► fleet_id_A ──┐
+DeepSeek 账号 B ── fleet_key_B ── sha256 ──► fleet_id_B ──┼── 同一台 relay（共享基础设施）
+DeepSeek 账号 C ── fleet_key_C ── sha256 ──► fleet_id_C ──┘
+```
+
+- **每账号一个编队**：fleet_id 不同即不同编队，机器之间在设备列表、任务、聊天、共享记忆四个面互相不可见（v1.5.5 隔离）。
+- **relay 无状态注册**：不需要预创建编队、不需要分配名额；第一台机器配对即产生该编队。
+- **operator 只签一次**：bootstrap 签名描述的是 relay 拓扑（哪些 relay 节点），一份签名服务全部编队（v1.6.0）。
+  需要把某台机器强制绑定到指定 fleet 时，用 `strictFleet: true` 保留旧行为。
+
+## 二、运维视图
+
+- 查看编队成员：`GET /v1/devices`（按调用者编队过滤）；relay 侧的 `devices.json` 里每个设备带 `fleet_id` / `fleet_source`。
+- 编队聊天：`/v1/fleet/messages`，POST 的 fleet 取自已认证设备，GET 只返回本编队消息。
+- 共享记忆：`/v1/fleet/memory/<doc>`，文档按 `fleet_id` 前缀隔离存储。
+- 任务：记录携带 `fleet_id`，`GET /v1/tasks` 只列本编队；operator token 的派发是 relay 级权限。
+- 配额：relay 级限制（任务/结果/配对码等）按 relay 计数；每编队建议自行控制设备数量（例如 ≤50），
+  以便故障时 lease 与任务表保持可读。
+
+## 三、接入新账号（零人工）
+
+1. 机器安装插件 **1.6.0+**（内置 bootstrap 端点 + operator 公钥）；
+2. 该机器登录对应 DeepSeek 账号 → 账号派生 fleet key → 自动配对到自己的编队；
+3. `w2m_status` 的 `bootstrap` 字段会显示 `source`、`relays`、`fleet_mismatch`（拓扑答案跨编队时）与 `last_error`。
+
+## 四、边界与注意
+
+- 跨编队不共享任何**读写面**；共享的只有 relay 进程、磁盘与网络带宽。
+- 运维账号（operator token）是 relay 级凭据，可跨编队派发任务/管理 grant——它不等同于任一编队成员。
+- 清理编队：删除该编队的设备记录即可（设备 token 失效后需重新配对）；relay 不保留编队级历史数据。

package/docs/acceptance/1.6.0/N-FLEET.json

@@ -0,0 +1,21 @@
+{
+  "version": "1.6.0",
+  "case": "N-FLEET",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-23T18:52:24.400Z",
+  "executor": "lead",
+  "requirement": "one relay hosts N fleets (one per DeepSeek account) isolated from each other, and one operator-signed bootstrap answer serves all of them",
+  "task_id": "01M5ANYMVLBU716",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "verify_script": "14/14 checks over 3 fleets",
+      "bootstrap_suite": "6/6",
+      "topology_answer": "fleet mismatch tolerated unless strictFleet"
+    }
+  },
+  "note": "real relay process, three fleets paired with three fleet keys"
+}

package/docs/acceptance/1.6.1/MANUAL-ONLY-CAPABILITY.json

@@ -0,0 +1,22 @@
+{
+  "version": "1.6.1",
+  "case": "MANUAL-ONLY-CAPABILITY",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-23T19:51:58.929Z",
+  "executor": "lead",
+  "requirement": "the highest-privilege Node execution switch can only be changed by a human UI action: it lives in host process memory, disk files are ignored, remote tasks/automation cannot enable it, and a restart revokes it",
+  "task_id": "01M5ANYMVLDYWBH",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "capability_policy_suite": "6/6 pass",
+      "disk_permanent_file_ignored": "true",
+      "route_is_single_setter": "true",
+      "restart_revokes": "true"
+    }
+  },
+  "note": "suite ran as a real fleet task; policy invariant pinned by test"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.5.5",
+  "version": "1.6.1",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.5.5",
+  "version": "1.6.1",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/agent/allowed-commands.mjs

@@ -491,6 +491,16 @@ function executableIdentity(argv0, prefix0, options) {
     const bundled = bundledExecutable(prefix0, options.env ?? process.env);
     if (bundled !== null && sameFile(argv0, bundled)) return { kind: 'match', detail: null };
   }
+    // v1.6.1: the interpreter executing this agent is the tool a bare entry names.
+    // Measured on a real machine (2026-10-24): DSH runs on its bundled node, a grant runner passes
+    // [process.execPath, '-e', ...], and the entry is the bare name `node` -- but PATH resolves `node`
+    // to an unrelated application binary. process.execPath needs no dependencies-directory lookup:
+    // it is the running interpreter, by definition the program the node entry names. A copy of the
+    // binary elsewhere is still refused (this compares identity, not the bare name).
+    if (!prefixIsPath && argvIsPath && sameFile(argv0, process.execPath)) {
+      const base = (value) => String(value).split(/[\\/]/).pop().replace(/\.exe$/i, '').toLowerCase();
+      if (base(argv0) === base(prefix0)) return { kind: 'match', detail: null };
+    }
 
   return {
     kind: 'path-mismatch',

package/src/plugin/bootstrap.mjs

@@ -155,8 +155,18 @@ export function verifyBootstrapAnswer(answer, input) {
   // v1.5.3: when the machine cannot derive a fleet key yet, it still must not be stranded: the
   // signed relay list is public routing information, so a signature-only answer is adopted for relay
   // assignment. Joining the fleet still needs the account-derived key, which is a separate step.
-  if (input.fleetId !== null && input.fleetId !== undefined && (typeof answer.fleet_id !== 'string' || answer.fleet_id !== input.fleetId)) {
-    return refuse(BOOTSTRAP_REFUSAL.WRONG_FLEET, 'the answer names a different fleet; it is not for this machine');
+  /**
+   * v1.6.0: a signed answer states relay topology, not one fleet's identity.
+   *
+   * Every DeepSeek account derives its own fleet key and therefore its own fleet id; on a shared
+   * relay those fleets coexist and are isolated per fleet (v1.5.5). The relay list is the same for
+   * all of them, so one operator-signed answer can serve N fleets -- refusing it for a fleet id
+   * mismatch would require the operator to re-sign per account, which is exactly the manual step
+   * this release removes. The signature and expiry remain strict; only the fleet binding relaxes.
+   */
+  const fleetMismatch = typeof input.fleetId === 'string' && answer.fleet_id !== input.fleetId;
+  if (fleetMismatch && input.strictFleet === true) {
+    return refuse(BOOTSTRAP_REFUSAL.WRONG_FLEET, 'the answer names a different fleet and strictFleet is set');
   }
   const relays = Array.isArray(answer.relays)
     ? [...new Set(answer.relays.filter((url) => typeof url === 'string' && url.trim() !== '').map((url) => url.trim().replace(/\/+$/, '')))]
@@ -194,7 +204,7 @@ export function verifyBootstrapAnswer(answer, input) {
   if (!verifiedSignatureOk(signatureOk)) {
     return refuse(BOOTSTRAP_REFUSAL.BAD_SIGNATURE, 'the answer signature does not match the pinned operator key and the canonical payload');
   }
-  return { ok: true, relays, issued_at: answer.issued_at, expires_at: answer.expires_at };
+  return { ok: true, relays, issued_at: answer.issued_at, expires_at: answer.expires_at, answer_fleet_id: typeof answer.fleet_id === 'string' ? answer.fleet_id : null, fleet_mismatch: fleetMismatch };
 }
 
 /** Kept separate so a test can assert the failure branch without a real crypto fault. */

package/src/plugin/tools.mjs

@@ -277,7 +277,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.5.5';
+const PLUGIN_VERSION = '1.6.1';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;

package/src/util/exec-capability.mjs

@@ -1,21 +1,32 @@
 /**
- * Node-code-execution capability: the machine-local switch behind the plugin UI.
+ * Node-code-execution capability (v1.6.1 hardening): a **manual, in-process** switch.
  *
- * The allow-list is a standing decision made by the machine owner in a config file. This module is the
- * *UI-activated* form of the same decision, scoped to one dangerous ability -- running arbitrary Node code
- * (`node -e`) -- with an explicit state: denied, temporary (24 h by default) or permanent. The DSH plugin
- * client renders the switch; the host route writes this file; the agent reads it before every task and
- * treats an active capability exactly like an additional allow-list prefix.
+ * ## Policy
  *
- * Fail-closed rules:
- *   * a missing, unreadable or malformed file means `denied` (the standing default), never "on";
- *   * `temporary` whose `expires_at_ms` has passed reads as `denied` and says `expired`, so an expiry
- *     cannot be mistaken for a configuration error;
- *   * the only prefix a capability can ever add is `node -e` -- a fixed constant, not caller input.
+ * This is the machine's highest-privilege switch: it allows `node -e`, i.e. arbitrary code. The policy
+ * is deliberately stricter than "a file the operator can toggle":
+ *
+ *   1. **Only a human UI action may change it.** The capability lives in the host process's memory and
+ *      is written exclusively by the same-origin host route (`/api/w2m/capability`) that the composer
+ *      control calls. There is no file that can be edited, no relay field, no task/document that can
+ *      grant it.
+ *   2. **Nothing a machine or automation runs can enable it.** Agent tasks (grant or not) run in a
+ *      child process; they can write any file they like, because files are no longer consulted. A
+ *      remote caller, a scheduled task, a bootstrap answer, or another process on the machine cannot
+ *      reach this module's memory.
+ *   3. **It does not survive a restart.** "Permanent" means "until this host process exits", never
+ *      "forever": a machine left unattended must not stay remote-code-executable across reboots.
+ *
+ * Old builds stored the state in `~/.w2m/exec-capability.json`. That file is **ignored** by this
+ * implementation, and the UI reports the in-memory truth, so a stale permanent file from an older
+ * version cannot silently re-grant execution.
+ *
+ * Fail-closed rules stay as before: absent/invalid state is `denied`; an expired `temporary` reads
+ * `denied` with reason `expired`; the only prefix an active capability can add is the fixed
+ * `node -e` constant.
  */
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { join } from 'node:path';
 
 export const EXEC_CAPABILITY_PROTOCOL = 'w2m-exec-capability/v1';
 export const EXEC_CAPABILITY_ROUTE_PATH = '/api/w2m/capability';
@@ -25,7 +36,10 @@ export const EXEC_CAPABILITY_STATES = Object.freeze(['denied', 'temporary', 'per
 export const DEFAULT_TEMPORARY_TTL_MS = 24 * 60 * 60 * 1000;
 export const MAX_TEMPORARY_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 export const EXEC_CAPABILITY_WARNING = 'node code execution: allows any Node code on this machine (RCE)';
+/** Why a capability file on disk never authorises anything. Surfaced by the UI/status. */
+export const EXEC_CAPABILITY_MANUAL_ONLY = 'capability is manual-only: set through the host UI, held in process memory, ignored from disk, relay or tasks';
 
+/** Path kept for compatibility with old builds; it is never read and never written. */
 export function defaultExecCapabilityFile(home = homedir()) {
   return join(home, '.w2m', 'exec-capability.json');
 }
@@ -35,46 +49,35 @@ export function normalizeExecCapabilityState(value) {
   return typeof value === 'string' && EXEC_CAPABILITY_STATES.includes(value) ? value : null;
 }
 
+/** The authoritative state. Module-level on purpose: one process, one switch. */
+let memory = Object.freeze({ state: 'denied', activated_at_ms: null, expires_at_ms: null, actor: null, changed_at_ms: null });
+
+/** Test/support hook: drop back to the standing default without touching any file. */
+export function resetExecCapability() {
+  memory = Object.freeze({ state: 'denied', activated_at_ms: null, expires_at_ms: null, actor: null, changed_at_ms: null });
+}
+
 /**
- * Read the capability state. Never throws: a broken file is `denied` with reason `unreadable`/`invalid`.
+ * Read the capability state from process memory.
  *
- * @param {string} file
+ * @param {string} [_file] accepted for API compatibility; deliberately NOT read.
  * @param {number} [nowMs]
- * @returns {{state: string, effective: boolean, expires_at_ms: number|null, activated_at_ms: number|null, actor: object|null, reason: string|null}}
+ * @returns {{state: string, effective: boolean, expires_at_ms: number|null, activated_at_ms: number|null,
+ *            actor: object|null, reason: string|null, source: 'process-memory', file_ignored: true}}
  */
-export function readExecCapability(file, nowMs = Date.now()) {
-  const denied = (reason) => ({ state: 'denied', effective: false, expires_at_ms: null, activated_at_ms: null, actor: null, reason });
-  let text;
-  try {
-    text = readFileSync(file, 'utf8');
-  } catch (error) {
-    return denied(error?.code === 'ENOENT' ? 'absent' : 'unreadable');
-  }
-  let raw;
-  try {
-    raw = JSON.parse(text);
-  } catch {
-    return denied('invalid');
-  }
-  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return denied('invalid');
-  const state = normalizeExecCapabilityState(raw.state);
-  if (state === null) return denied('invalid');
-  if (state === 'denied') return denied(null);
-  const expiresAt = Number.isFinite(raw.expires_at_ms) ? raw.expires_at_ms : null;
-  const activatedAt = Number.isFinite(raw.activated_at_ms) ? raw.activated_at_ms : null;
-  if (state === 'temporary') {
-    if (expiresAt === null) return denied('invalid');
-    if (expiresAt <= nowMs) return { state: 'denied', effective: false, expires_at_ms: expiresAt, activated_at_ms: activatedAt, actor: null, reason: 'expired' };
-  }
-  if (state === 'permanent' && expiresAt !== null) return denied('invalid');
-  return {
-    state,
-    effective: true,
-    expires_at_ms: state === 'temporary' ? expiresAt : null,
-    activated_at_ms: activatedAt,
-    actor: typeof raw.actor === 'object' && raw.actor !== null ? { ...raw.actor } : null,
-    reason: null,
+export function readExecCapability(_file, nowMs = Date.now()) {
+  const base = {
+    state: 'denied', effective: false, expires_at_ms: null, activated_at_ms: null, actor: null,
+    reason: 'manual_default', source: 'process-memory', file_ignored: true,
   };
+  if (memory.state === 'denied') return base;
+  if (memory.state === 'temporary') {
+    if (memory.expires_at_ms !== null && memory.expires_at_ms <= nowMs) {
+      return { ...base, expires_at_ms: memory.expires_at_ms, activated_at_ms: memory.activated_at_ms, reason: 'expired' };
+    }
+    return { ...base, state: 'temporary', effective: true, reason: null, expires_at_ms: memory.expires_at_ms, activated_at_ms: memory.activated_at_ms, actor: memory.actor };
+  }
+  return { ...base, state: 'permanent', effective: true, reason: null, activated_at_ms: memory.activated_at_ms, actor: memory.actor };
 }
 
 /** The prefixes an active capability adds, or an empty array when it is denied/expired. */
@@ -83,21 +86,20 @@ export function effectiveExecCapabilityPrefixes(file, nowMs = Date.now()) {
 }
 
 /**
- * Write one capability decision. `temporary` requires a TTL and records an absolute expiry.
+ * Change the capability. This is the host route's write path and the only way the switch moves.
+ *
+ * The `_file` argument is accepted for compatibility and ignored: a caller that expected a disk write
+ * (an older route, a script, a test helper) still gets the value back, but the authority is memory.
  *
  * @returns {{ok: boolean, code?: string, detail?: string, capability?: object}}
  */
-export function writeExecCapability(file, input, nowMs = Date.now()) {
+export function writeExecCapability(_file, input, nowMs = Date.now()) {
   const state = normalizeExecCapabilityState(input?.state);
   if (state === null) return { ok: false, code: 'CAPABILITY_STATE_INVALID', detail: 'state must be denied, temporary or permanent' };
+  const actor = typeof input?.actor === 'object' && input.actor !== null ? { ...input.actor } : null;
   if (state === 'denied') {
-    try {
-      mkdirSync(dirname(file), { recursive: true });
-      writeFileSync(file, JSON.stringify({ protocol: EXEC_CAPABILITY_PROTOCOL, state: 'denied', activated_at_ms: nowMs, actor: input.actor ?? null }, null, 2) + '\n');
-    } catch (error) {
-      return { ok: false, code: 'CAPABILITY_WRITE_FAILED', detail: error?.message ?? String(error) };
-    }
-    return { ok: true, capability: readExecCapability(file, nowMs) };
+    memory = Object.freeze({ state: 'denied', activated_at_ms: nowMs, expires_at_ms: null, actor, changed_at_ms: nowMs });
+    return { ok: true, capability: describeExecCapability(undefined, nowMs) };
   }
   let ttlMs = input?.ttl_ms;
   if (state === 'temporary') {
@@ -105,23 +107,17 @@ export function writeExecCapability(file, input, nowMs = Date.now()) {
     if (ttlMs > MAX_TEMPORARY_TTL_MS) return { ok: false, code: 'CAPABILITY_TTL_TOO_LONG', detail: 'temporary activation is limited to ' + MAX_TEMPORARY_TTL_MS + ' ms' };
     ttlMs = Math.floor(ttlMs);
   }
-  const record = {
-    protocol: EXEC_CAPABILITY_PROTOCOL,
+  memory = Object.freeze({
     state,
     activated_at_ms: nowMs,
     expires_at_ms: state === 'temporary' ? nowMs + ttlMs : null,
-    actor: typeof input?.actor === 'object' && input.actor !== null ? { ...input.actor } : null,
-  };
-  try {
-    mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, JSON.stringify(record, null, 2) + '\n');
-  } catch (error) {
-    return { ok: false, code: 'CAPABILITY_WRITE_FAILED', detail: error?.message ?? String(error) };
-  }
-  return { ok: true, capability: readExecCapability(file, nowMs) };
+    actor,
+    changed_at_ms: nowMs,
+  });
+  return { ok: true, capability: describeExecCapability(undefined, nowMs) };
 }
 
-/** The JSON the UI renders: state, effective, remaining time and the one prefix it would allow. */
+/** The JSON the UI renders: state, effective, remaining time, the fixed prefix, and the manual-only rule. */
 export function describeExecCapability(file, nowMs = Date.now()) {
   const capability = readExecCapability(file, nowMs);
   return {
@@ -134,5 +130,10 @@ export function describeExecCapability(file, nowMs = Date.now()) {
     remaining_ms: capability.state === 'temporary' && capability.expires_at_ms !== null ? Math.max(0, capability.expires_at_ms - nowMs) : null,
     allows: capability.effective === true ? EXEC_CAPABILITY_PREFIXES.map((prefix) => prefix.join(' ')) : [],
     warning: EXEC_CAPABILITY_WARNING,
+    manual_only: true,
+    source: 'process-memory',
+    file_ignored: true,
+    policy: EXEC_CAPABILITY_MANUAL_ONLY,
+    survives_restart: false,
   };
 }