@twinsearth/w2m-dsh-plugin 1.6.0 → 1.6.2

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.6.0"
+    "version": "1.6.2"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.6.0",
+      "version": "1.6.2",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.6.0"
+  "version": "1.6.2"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,35 @@
 
 All notable changes to this project are documented here.
 
+## [1.6.2] — 2026-10-24
+
+**relay 全服概览：多少个编队、多少台机器在线（healthz + operator /v1/fleets + 面板一行显示）。**
+
+- `state.fleetSummary()`：按 fleet 聚合设备数/在线数，返回 `fleets_total`、`devices_online`、
+  `devices_total`、`unfleeted_devices` 与 per-fleet 明细。
+- `GET /healthz`（公开）新增上述**聚合计数**（不暴露 per-fleet 明细）；
+- `GET /v1/fleets`（operator token）：返回 per-fleet 明细（其他账号的编队名不向普通设备暴露）。
+- 面板 relay 折叠区新增一行：`全服：N 个编队 · M/T 台在线`（fleet-target probe 读取 healthz 计数）。
+- relay 主机将升级到 1.6.2（包含 1.6.1 的 Node 执行仅人工/内存态与 allow-list 解释器身份修复）。
+- 测试：relay 200/200、fleet-target 49/49、client-bundle 26/26；证据
+  `docs/acceptance/1.6.2/RELAY-FLEET-OVERVIEW.json`（fleet task `01M5ANYMVLRYXSN`）。
+## [1.6.1] — 2026-10-24
+
+**Node 执行开关改为「仅人工 UI 手动、进程内存态」：文件/远程/自动化一律无法授权。**
+
+本次实机验证暴露了一个必须修掉的现实：grant 任务可以远程写 `~/.w2m/exec-capability.json`，
+从而远程把机器变成可执行任意 Node 代码——与"最高权限只允许人工手动选中"直接冲突。
+
+- 能力状态改为**进程内存**唯一权威：`readExecCapability` 不再读磁盘；旧文件（含 permanent）被忽略；
+  只有 host 路由 `/api/w2m/capability`（composer 人工点击）能写。
+- **不随重启保留**：进程退出即回到 denied（"永久"= 本次进程生命周期）；
+  `describe` 明确返回 `survives_restart: false`、`manual_only: true`、`file_ignored: true`。
+- 三态语义不变：denied / temporary（默认 24h，上限 7 天，过期即失效）/ permanent（本进程内）。
+- 测试重写：`test/exec-capability.test.mjs` 6/6（含"磁盘写 permanent 仍 denied""路由是唯一 setter"
+  "重启即撤销"）；agent.test 161 项通过（PATH 环境问题已在本机修复，非代码缺陷）。
+- 修复 allow-list 解释器身份回归：当 argv[0] 是 **运行 agent 的同一个 node（process.execPath）** 时，
+  bare 条目 `node` 应放行（此前机器 PATH 里 node 指向别的程序时会误拒，实测 12 个 e2e 失败）。
+- 证据 `docs/acceptance/1.6.1/MANUAL-ONLY-CAPABILITY.json`（fleet task `01M5ANYMVLDYWBH`）。
 ## [1.6.0] — 2026-10-24
 
 **一台 relay 承载 N 个编队：每个 DeepSeek 账号一个编队，共享 relay 但互相隔离。**

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.6.0", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.6.2", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/acceptance/1.6.1/MANUAL-ONLY-CAPABILITY.json

@@ -0,0 +1,22 @@
+{
+  "version": "1.6.1",
+  "case": "MANUAL-ONLY-CAPABILITY",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-23T19:51:58.929Z",
+  "executor": "lead",
+  "requirement": "the highest-privilege Node execution switch can only be changed by a human UI action: it lives in host process memory, disk files are ignored, remote tasks/automation cannot enable it, and a restart revokes it",
+  "task_id": "01M5ANYMVLDYWBH",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "capability_policy_suite": "6/6 pass",
+      "disk_permanent_file_ignored": "true",
+      "route_is_single_setter": "true",
+      "restart_revokes": "true"
+    }
+  },
+  "note": "suite ran as a real fleet task; policy invariant pinned by test"
+}

package/docs/acceptance/1.6.2/RELAY-FLEET-OVERVIEW.json

@@ -0,0 +1,22 @@
+{
+  "version": "1.6.2",
+  "case": "RELAY-FLEET-OVERVIEW",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-24T02:23:58.829Z",
+  "executor": "lead",
+  "requirement": "the relay reports how many fleets it serves and how many machines are online: aggregate counts on the public health probe, per-fleet rows only for the operator",
+  "task_id": "01M5ANYMVLRYXSN",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "relay_suite": "200/200 pass",
+      "fleet_summary": "fleets_total/devices_online/devices_total",
+      "operator_route": "GET /v1/fleets",
+      "panel_line": "globalSummary rendered"
+    }
+  },
+  "note": "relay and fleet-target suites ran as a real fleet task"
+}

package/lib/client.js

@@ -112,6 +112,7 @@ window.__ModuleLoader__.load({
         relayFold: '另有 {count} 个已折叠，点击展开',
         relayUnfold: '收起折叠的 relay',
         relayTemporary: '临时 Relay 节点（回退配置）',
+        globalSummary: '全服：{fleets} 个编队 · {online}/{total} 台在线',
         capLabel: 'Node 执行：{state}',
         capDenied: '拒绝',
         capTemporary: '临时 24 小时',
@@ -143,6 +144,7 @@ window.__ModuleLoader__.load({
         relayFold: '{count} more folded — expand',
         relayUnfold: 'collapse the folded relays',
         relayTemporary: 'temporary relay nodes (fallback config)',
+        globalSummary: '{fleets} fleets · {online}/{total} machines online',
         capLabel: 'Node exec: {state}',
         capDenied: 'denied',
         capTemporary: 'temporary 24 h',
@@ -631,6 +633,11 @@ window.__ModuleLoader__.load({
                 h('span', { key: 'url', className: cls('relayUrl') }, String(item.url ?? '').replace(/^https?:\/\//, '').replace(/\/$/, '')),
                 h('span', { key: 'rtt', className: cls('relayRtt') }, item.rtt_ms === null || item.rtt_ms === undefined ? '—' : `${item.rtt_ms} ms`),
               ])),
+              relayFold.server === null || relayFold.server === undefined ? null : h('div', { key: 'global', className: cls('relayHint') }, t('globalSummary', {
+                fleets: relayFold.server.fleets_total ?? '—',
+                online: relayFold.server.devices_online ?? '—',
+                total: relayFold.server.devices_total ?? '—',
+              })),
               relayFold.hidden_count > 0 && relayOpen === false
                 ? h('div', { key: 'hint', className: cls('relayHint') }, t('relayFold', { count: relayFold.hidden_count }))
                 : null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/agent/allowed-commands.mjs

@@ -491,6 +491,16 @@ function executableIdentity(argv0, prefix0, options) {
     const bundled = bundledExecutable(prefix0, options.env ?? process.env);
     if (bundled !== null && sameFile(argv0, bundled)) return { kind: 'match', detail: null };
   }
+    // v1.6.1: the interpreter executing this agent is the tool a bare entry names.
+    // Measured on a real machine (2026-10-24): DSH runs on its bundled node, a grant runner passes
+    // [process.execPath, '-e', ...], and the entry is the bare name `node` -- but PATH resolves `node`
+    // to an unrelated application binary. process.execPath needs no dependencies-directory lookup:
+    // it is the running interpreter, by definition the program the node entry names. A copy of the
+    // binary elsewhere is still refused (this compares identity, not the bare name).
+    if (!prefixIsPath && argvIsPath && sameFile(argv0, process.execPath)) {
+      const base = (value) => String(value).split(/[\\/]/).pop().replace(/\.exe$/i, '').toLowerCase();
+      if (base(argv0) === base(prefix0)) return { kind: 'match', detail: null };
+    }
 
   return {
     kind: 'path-mismatch',

package/src/plugin/fleet-target.mjs

@@ -503,7 +503,16 @@ export async function probeRelays(urls, options = {}) {
       if (!response.ok || body?.ok !== true) {
         return { url, ok: false, rtt_ms: null, error: `HTTP ${response.status}` };
       }
-      return { url, ok: true, rtt_ms: Date.now() - started, relay_id: body.relay_id ?? null };
+      return {
+        url, ok: true, rtt_ms: Date.now() - started, relay_id: body.relay_id ?? null,
+        // v1.6.2: Whole-relay totals, shown in the panel as "N fleets · M machines online".
+        // Counts only: per-fleet membership stays behind the fleet-scoped endpoints.
+        stats: {
+          fleets_total: Number.isInteger(body.fleets_total) ? body.fleets_total : null,
+          devices_online: Number.isInteger(body.devices_online) ? body.devices_online : null,
+          devices_total: Number.isInteger(body.devices_total) ? body.devices_total : null,
+        },
+      };
     } catch (error) {
       return { url, ok: false, rtt_ms: null, error: error instanceof Error ? error.message : String(error) };
     }
@@ -573,6 +582,8 @@ export function buildUiState(deps) {
           primary_url: relays.shown.find((item) => item.ok === true)?.url ?? null,
           // v1.5.2: a fallback relay list is never presented as settled; the panel renders it red.
           temporary: relays.temporary === true,
+          // v1.6.2: whole-relay overview (fleets + online machines) for the panel header line.
+          server: relays.server ?? null,
         },
   };
 }
@@ -795,8 +806,10 @@ function mountTargetRoutes(connection, deps, status, logger) {
       return { ...item, role: reachableSeen === 1 ? 'primary' : 'standby' };
     });
     const folded = foldRelayItems(items, 3);
+    // v1.6.2: the primary relay's own view of the whole server, if it reported one.
+    const primaryStats = items.find((item) => item.ok === true)?.stats ?? null;
     // v1.5.2: a fallback list is marked so the panel can render it in red, not as a settled config.
-    const withMark = { ...folded, temporary: deps.cfg()?.relayTemporary === true };
+    const withMark = { ...folded, temporary: deps.cfg()?.relayTemporary === true, server: primaryStats };
     relayCache = { at: now, value: withMark };
     return withMark;
   };

package/src/plugin/tools.mjs

@@ -277,7 +277,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.6.0';
+const PLUGIN_VERSION = '1.6.2';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;

package/src/relay/server.mjs

@@ -853,6 +853,17 @@ export class RelayServer {
      * every task that carried a grant, with the argv hash and key id it was authorised under -- and deliberately returns
      * only operator-readable data, never result bodies.
      */
+      /**
+       * v1.6.2: whole-relay fleet overview for an operator. Aggregate counts are public on /healthz;
+       * the per-fleet rows are not, because they name other accounts fleets.
+       */
+      if (method === 'GET' && path === '/v1/fleets') {
+        const auth = this.authorizeTaskDispatch(req);
+        if (auth.role !== 'operator') throw new ProtocolError('OPERATOR_REQUIRED', 'listing fleets is an operator view');
+        const summary = this.state.fleetSummary();
+        return sendJson(res, 200, { protocol_version: PROTOCOL_VERSION, rabbit_time: this.state.nowIso(), ok: true, ...summary });
+      }
+
     if (path === '/v1/grants/revoke' || path === '/v1/grants') {
       const auth = this.authorizeTaskDispatch(req);
       if (auth.role !== 'operator') throw new ProtocolError('OPERATOR_REQUIRED', 'only the operator may administer grants');

package/src/relay/state.mjs

@@ -3245,12 +3245,40 @@ export class RabbitState {
 
   /* ---------------- serialization ---------------- */
 
+  /**
+   * v1.6.2: the whole-relay view: how many fleets this relay serves and how many machines are
+   * online. Counts only — the per-fleet member lists stay behind the fleet-scoped endpoints, so
+   * this is safe to expose on the public health probe.
+   */
+  fleetSummary(nowMs = this.nowMs()) {
+    const byFleet = new Map();
+    let online = 0;
+    for (const device of this.devices.values()) {
+      const key = typeof device.fleet_id === 'string' && device.fleet_id !== '' ? device.fleet_id : null;
+      const entry = byFleet.get(key) ?? { fleet_id: key, devices: 0, online: 0 };
+      entry.devices += 1;
+      if (this.isOnlineDevice(device, nowMs)) { entry.online += 1; online += 1; }
+      byFleet.set(key, entry);
+    }
+    const fleets = [...byFleet.values()].sort((a, b) => b.devices - a.devices);
+    return {
+      fleets_total: fleets.filter((f) => f.fleet_id !== null).length,
+      unfleeted_devices: byFleet.get(null)?.devices ?? 0,
+      devices_total: this.devices.size,
+      devices_online: online,
+      fleets,
+    };
+  }
   stats() {
     return {
       protocol_version: PROTOCOL_VERSION,
       seq: this.seq,
       buffered_events: this.buffer.length,
       devices: this.devices.size,
+      // v1.6.2: whole-relay totals on the public health probe.
+      fleets_total: this.fleetSummary().fleets_total,
+      devices_online: this.fleetSummary().devices_online,
+      devices_total: this.devices.size,
       tasks: this.tasks.size,
       results: this.results.size,
       pairing_codes: [...this.pairingCodes.values()].filter((c) => !c.used && this.nowMs() < c.expires_at_ms).length,

package/src/util/exec-capability.mjs

@@ -1,21 +1,32 @@
 /**
- * Node-code-execution capability: the machine-local switch behind the plugin UI.
+ * Node-code-execution capability (v1.6.1 hardening): a **manual, in-process** switch.
  *
- * The allow-list is a standing decision made by the machine owner in a config file. This module is the
- * *UI-activated* form of the same decision, scoped to one dangerous ability -- running arbitrary Node code
- * (`node -e`) -- with an explicit state: denied, temporary (24 h by default) or permanent. The DSH plugin
- * client renders the switch; the host route writes this file; the agent reads it before every task and
- * treats an active capability exactly like an additional allow-list prefix.
+ * ## Policy
  *
- * Fail-closed rules:
- *   * a missing, unreadable or malformed file means `denied` (the standing default), never "on";
- *   * `temporary` whose `expires_at_ms` has passed reads as `denied` and says `expired`, so an expiry
- *     cannot be mistaken for a configuration error;
- *   * the only prefix a capability can ever add is `node -e` -- a fixed constant, not caller input.
+ * This is the machine's highest-privilege switch: it allows `node -e`, i.e. arbitrary code. The policy
+ * is deliberately stricter than "a file the operator can toggle":
+ *
+ *   1. **Only a human UI action may change it.** The capability lives in the host process's memory and
+ *      is written exclusively by the same-origin host route (`/api/w2m/capability`) that the composer
+ *      control calls. There is no file that can be edited, no relay field, no task/document that can
+ *      grant it.
+ *   2. **Nothing a machine or automation runs can enable it.** Agent tasks (grant or not) run in a
+ *      child process; they can write any file they like, because files are no longer consulted. A
+ *      remote caller, a scheduled task, a bootstrap answer, or another process on the machine cannot
+ *      reach this module's memory.
+ *   3. **It does not survive a restart.** "Permanent" means "until this host process exits", never
+ *      "forever": a machine left unattended must not stay remote-code-executable across reboots.
+ *
+ * Old builds stored the state in `~/.w2m/exec-capability.json`. That file is **ignored** by this
+ * implementation, and the UI reports the in-memory truth, so a stale permanent file from an older
+ * version cannot silently re-grant execution.
+ *
+ * Fail-closed rules stay as before: absent/invalid state is `denied`; an expired `temporary` reads
+ * `denied` with reason `expired`; the only prefix an active capability can add is the fixed
+ * `node -e` constant.
  */
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { join } from 'node:path';
 
 export const EXEC_CAPABILITY_PROTOCOL = 'w2m-exec-capability/v1';
 export const EXEC_CAPABILITY_ROUTE_PATH = '/api/w2m/capability';
@@ -25,7 +36,10 @@ export const EXEC_CAPABILITY_STATES = Object.freeze(['denied', 'temporary', 'per
 export const DEFAULT_TEMPORARY_TTL_MS = 24 * 60 * 60 * 1000;
 export const MAX_TEMPORARY_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 export const EXEC_CAPABILITY_WARNING = 'node code execution: allows any Node code on this machine (RCE)';
+/** Why a capability file on disk never authorises anything. Surfaced by the UI/status. */
+export const EXEC_CAPABILITY_MANUAL_ONLY = 'capability is manual-only: set through the host UI, held in process memory, ignored from disk, relay or tasks';
 
+/** Path kept for compatibility with old builds; it is never read and never written. */
 export function defaultExecCapabilityFile(home = homedir()) {
   return join(home, '.w2m', 'exec-capability.json');
 }
@@ -35,46 +49,35 @@ export function normalizeExecCapabilityState(value) {
   return typeof value === 'string' && EXEC_CAPABILITY_STATES.includes(value) ? value : null;
 }
 
+/** The authoritative state. Module-level on purpose: one process, one switch. */
+let memory = Object.freeze({ state: 'denied', activated_at_ms: null, expires_at_ms: null, actor: null, changed_at_ms: null });
+
+/** Test/support hook: drop back to the standing default without touching any file. */
+export function resetExecCapability() {
+  memory = Object.freeze({ state: 'denied', activated_at_ms: null, expires_at_ms: null, actor: null, changed_at_ms: null });
+}
+
 /**
- * Read the capability state. Never throws: a broken file is `denied` with reason `unreadable`/`invalid`.
+ * Read the capability state from process memory.
  *
- * @param {string} file
+ * @param {string} [_file] accepted for API compatibility; deliberately NOT read.
  * @param {number} [nowMs]
- * @returns {{state: string, effective: boolean, expires_at_ms: number|null, activated_at_ms: number|null, actor: object|null, reason: string|null}}
+ * @returns {{state: string, effective: boolean, expires_at_ms: number|null, activated_at_ms: number|null,
+ *            actor: object|null, reason: string|null, source: 'process-memory', file_ignored: true}}
  */
-export function readExecCapability(file, nowMs = Date.now()) {
-  const denied = (reason) => ({ state: 'denied', effective: false, expires_at_ms: null, activated_at_ms: null, actor: null, reason });
-  let text;
-  try {
-    text = readFileSync(file, 'utf8');
-  } catch (error) {
-    return denied(error?.code === 'ENOENT' ? 'absent' : 'unreadable');
-  }
-  let raw;
-  try {
-    raw = JSON.parse(text);
-  } catch {
-    return denied('invalid');
-  }
-  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return denied('invalid');
-  const state = normalizeExecCapabilityState(raw.state);
-  if (state === null) return denied('invalid');
-  if (state === 'denied') return denied(null);
-  const expiresAt = Number.isFinite(raw.expires_at_ms) ? raw.expires_at_ms : null;
-  const activatedAt = Number.isFinite(raw.activated_at_ms) ? raw.activated_at_ms : null;
-  if (state === 'temporary') {
-    if (expiresAt === null) return denied('invalid');
-    if (expiresAt <= nowMs) return { state: 'denied', effective: false, expires_at_ms: expiresAt, activated_at_ms: activatedAt, actor: null, reason: 'expired' };
-  }
-  if (state === 'permanent' && expiresAt !== null) return denied('invalid');
-  return {
-    state,
-    effective: true,
-    expires_at_ms: state === 'temporary' ? expiresAt : null,
-    activated_at_ms: activatedAt,
-    actor: typeof raw.actor === 'object' && raw.actor !== null ? { ...raw.actor } : null,
-    reason: null,
+export function readExecCapability(_file, nowMs = Date.now()) {
+  const base = {
+    state: 'denied', effective: false, expires_at_ms: null, activated_at_ms: null, actor: null,
+    reason: 'manual_default', source: 'process-memory', file_ignored: true,
   };
+  if (memory.state === 'denied') return base;
+  if (memory.state === 'temporary') {
+    if (memory.expires_at_ms !== null && memory.expires_at_ms <= nowMs) {
+      return { ...base, expires_at_ms: memory.expires_at_ms, activated_at_ms: memory.activated_at_ms, reason: 'expired' };
+    }
+    return { ...base, state: 'temporary', effective: true, reason: null, expires_at_ms: memory.expires_at_ms, activated_at_ms: memory.activated_at_ms, actor: memory.actor };
+  }
+  return { ...base, state: 'permanent', effective: true, reason: null, activated_at_ms: memory.activated_at_ms, actor: memory.actor };
 }
 
 /** The prefixes an active capability adds, or an empty array when it is denied/expired. */
@@ -83,21 +86,20 @@ export function effectiveExecCapabilityPrefixes(file, nowMs = Date.now()) {
 }
 
 /**
- * Write one capability decision. `temporary` requires a TTL and records an absolute expiry.
+ * Change the capability. This is the host route's write path and the only way the switch moves.
+ *
+ * The `_file` argument is accepted for compatibility and ignored: a caller that expected a disk write
+ * (an older route, a script, a test helper) still gets the value back, but the authority is memory.
  *
  * @returns {{ok: boolean, code?: string, detail?: string, capability?: object}}
  */
-export function writeExecCapability(file, input, nowMs = Date.now()) {
+export function writeExecCapability(_file, input, nowMs = Date.now()) {
   const state = normalizeExecCapabilityState(input?.state);
   if (state === null) return { ok: false, code: 'CAPABILITY_STATE_INVALID', detail: 'state must be denied, temporary or permanent' };
+  const actor = typeof input?.actor === 'object' && input.actor !== null ? { ...input.actor } : null;
   if (state === 'denied') {
-    try {
-      mkdirSync(dirname(file), { recursive: true });
-      writeFileSync(file, JSON.stringify({ protocol: EXEC_CAPABILITY_PROTOCOL, state: 'denied', activated_at_ms: nowMs, actor: input.actor ?? null }, null, 2) + '\n');
-    } catch (error) {
-      return { ok: false, code: 'CAPABILITY_WRITE_FAILED', detail: error?.message ?? String(error) };
-    }
-    return { ok: true, capability: readExecCapability(file, nowMs) };
+    memory = Object.freeze({ state: 'denied', activated_at_ms: nowMs, expires_at_ms: null, actor, changed_at_ms: nowMs });
+    return { ok: true, capability: describeExecCapability(undefined, nowMs) };
   }
   let ttlMs = input?.ttl_ms;
   if (state === 'temporary') {
@@ -105,23 +107,17 @@ export function writeExecCapability(file, input, nowMs = Date.now()) {
     if (ttlMs > MAX_TEMPORARY_TTL_MS) return { ok: false, code: 'CAPABILITY_TTL_TOO_LONG', detail: 'temporary activation is limited to ' + MAX_TEMPORARY_TTL_MS + ' ms' };
     ttlMs = Math.floor(ttlMs);
   }
-  const record = {
-    protocol: EXEC_CAPABILITY_PROTOCOL,
+  memory = Object.freeze({
     state,
     activated_at_ms: nowMs,
     expires_at_ms: state === 'temporary' ? nowMs + ttlMs : null,
-    actor: typeof input?.actor === 'object' && input.actor !== null ? { ...input.actor } : null,
-  };
-  try {
-    mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, JSON.stringify(record, null, 2) + '\n');
-  } catch (error) {
-    return { ok: false, code: 'CAPABILITY_WRITE_FAILED', detail: error?.message ?? String(error) };
-  }
-  return { ok: true, capability: readExecCapability(file, nowMs) };
+    actor,
+    changed_at_ms: nowMs,
+  });
+  return { ok: true, capability: describeExecCapability(undefined, nowMs) };
 }
 
-/** The JSON the UI renders: state, effective, remaining time and the one prefix it would allow. */
+/** The JSON the UI renders: state, effective, remaining time, the fixed prefix, and the manual-only rule. */
 export function describeExecCapability(file, nowMs = Date.now()) {
   const capability = readExecCapability(file, nowMs);
   return {
@@ -134,5 +130,10 @@ export function describeExecCapability(file, nowMs = Date.now()) {
     remaining_ms: capability.state === 'temporary' && capability.expires_at_ms !== null ? Math.max(0, capability.expires_at_ms - nowMs) : null,
     allows: capability.effective === true ? EXEC_CAPABILITY_PREFIXES.map((prefix) => prefix.join(' ')) : [],
     warning: EXEC_CAPABILITY_WARNING,
+    manual_only: true,
+    source: 'process-memory',
+    file_ignored: true,
+    policy: EXEC_CAPABILITY_MANUAL_ONLY,
+    survives_restart: false,
   };
 }