aimeat 2.7.0 → 3.0.0

package/dist/public/views/profile/agents/agent-card.js

@@ -3,6 +3,11 @@
  * @description Agent card component with collapsed/expanded states,
  *   Two-Zone Header (identity + state-dependent status), and tab bar.
  * @version-history
+ *   v1.21.0 -- 2026-08-09 -- Renders the server's health verdict instead of deriving one. Removed
+ *     the dead reads: agent.webhookFailCount (never in the response), agent.mcpEnabled (not a
+ *     field on any record) and onboarding.previousReadinessLevel (likewise), plus the second
+ *     READINESS_RANKS copy. The problem panel finally names what is wrong -- its sentence was
+ *     empty in every real case -- and Test webhook is offered only when one is configured.
  *   2026-07-19 — AppDev tab (KB UI): learned-pitfall + template management surface, start-prompt copy, model badge
  *   v1.20.0 -- 2026-07-17 -- Style unification: collapsed-bar summary separators use a
  *     middle dot (·) instead of a pipe, matching the rest of the profile meta rows.
@@ -68,7 +73,7 @@ import htm from 'htm';
 import { t, tOr } from '/js/i18n.js';
 import { apiGet, apiPatch } from '/js/api.js';
 import { timeAgo } from '/js/utils.js';
-import { detectAgentState, getDefaultTab } from './state-detector.js';
+import { agentState, getDefaultTab } from './state-detector.js';
 import { testWebhook, updateWebhook } from '/js/services/agent-integration.js';
 import TabReadme from './tab-readme.js';
 import TabIntegration from './tab-integration.js';
@@ -143,7 +148,7 @@ function totalChanges(changes) {
 }
 
 export default function AgentCard({ agent, onboarding, expanded, onToggle, session, showToast, allAgents, changes, onTabSeen, onScopesClick, onDeleteClick, onFederateToggle, onPopOut, soloMode = false, preSelectedTab = null, openTaskId = null, openTaskNonce = 0 }) {
-  const state = detectAgentState(agent, onboarding);
+  const state = agentState(agent);
   const [activeTab, setActiveTab] = useState(null);
   // README markdown: undefined = not loaded, '' = none published, string = show tab.
   const [readme, setReadme] = useState(undefined);
@@ -390,22 +395,21 @@ function renderChangeBadge(changes) {
   return html`<span class="pf-agd-change-badge pf-agd-change-badge--dot ${failed ? 'pf-agd-change-badge--failed' : ''}" title=${title}></span>`;
 }
 
+/**
+ * How this agent is reached, from the server's verdict.
+ *
+ * Was computed here from `agent.webhookUrl` (not in the response), `agent.mcpEnabled` (not a field
+ * on any record) and a fail threshold of 5 that disagreed with the server's 10. So the warning icon
+ * could never appear, and the MCP labels could never be chosen. The MCP branch is gone rather than
+ * rewired: there is nothing to rewire it to.
+ */
 function renderDeliveryIndicator(agent) {
-  const hasWebhook = agent.webhookUrl || agent.webhook_url;
-  const hasMcp = agent.mcpEnabled || agent.mcp_enabled;
-  const failCount = agent.webhookFailCount ?? 0;
-  const icon = hasWebhook ? (failCount >= 5 ? '⚠' : '✓') : '';
-
-  let label;
-  if (hasMcp && hasWebhook) {
-    label = t('profile.agents.detail.deliveryMcpWh');
-  } else if (hasWebhook) {
-    label = t('profile.agents.detail.deliveryWh');
-  } else if (hasMcp) {
-    label = t('profile.agents.detail.deliveryMcp');
-  } else {
-    label = t('profile.agents.detail.deliveryPolling');
-  }
+  const delivery = agent?.health?.delivery;
+  if (!delivery) return null;
+  const label = delivery.webhook_configured
+    ? t('profile.agents.detail.deliveryWh')
+    : t('profile.agents.detail.deliveryPolling');
+  const icon = delivery.webhook_configured ? (delivery.channel === 'webhook-failing' ? '⚠' : '✓') : '';
 
   return html`<span class="pf-agd-delivery-indicator">${label}${icon ? ` ${icon}` : ''} · </span>`;
 }
@@ -424,8 +428,6 @@ function renderModelBadge(agent) {
   return html`<span class="pf-agd-badge pf-agd-badge--model" title=${t('profile.agents.modelBadgeTitle')}>${agent.model}</span>`;
 }
 
-const READINESS_RANKS = { none: 0, basic: 1, standard: 2, advanced: 3, full: 4 };
-
 function renderReadinessBadge(state, onboarding) {
   if (state === 'system') {
     // Internal (auto-provisioned) agent — no device-auth onboarding / readiness.
@@ -444,8 +446,10 @@ function renderReadinessBadge(state, onboarding) {
     const score = onboarding?.readinessScore;
     if (!score && score !== 0) return html`<span class="pf-agd-badge pf-agd-badge--readiness-none">--</span>`;
     const label = t(`agentOnboarding.readiness.${level}`);
-    const degraded = onboarding?.previousReadinessLevel && (READINESS_RANKS[level] ?? 0) < (READINESS_RANKS[onboarding.previousReadinessLevel] ?? 0);
-    return html`<span class="pf-agd-badge pf-agd-badge--readiness-${level} ${degraded ? 'pf-agd-badge--degraded' : ''}">${degraded ? '↓ ' : ''}${label} (${score})</span>`;
+    // No "degraded ↓" marker: it was driven by onboarding.previousReadinessLevel, which is not a
+    // field on the record, has no column in either backend and is written nowhere — so the arrow
+    // could never appear. Reintroducing it needs a stored previous level first, not a rank table.
+    return html`<span class="pf-agd-badge pf-agd-badge--readiness-${level}">${label} (${score})</span>`;
   }
   // idle and production both show level + score
   const level = onboarding?.readinessLevel || 'none';
@@ -529,13 +533,11 @@ function renderZone2(state, agent, onboarding, setActiveTab, showToast) {
     case 'idle':
     case 'production':
     default: {
-      const hasWebhook = agent.webhookUrl || agent.webhook_url;
-      const hasMcp = agent.mcpEnabled || agent.mcp_enabled;
-      let deliveryLabel;
-      if (hasMcp && hasWebhook) deliveryLabel = t('profile.agents.detail.deliveryMcpWh');
-      else if (hasWebhook) deliveryLabel = t('profile.agents.detail.deliveryWh');
-      else if (hasMcp) deliveryLabel = t('profile.agents.detail.deliveryMcp');
-      else deliveryLabel = t('profile.agents.detail.deliveryPolling');
+      // Same source as the header indicator — see renderDeliveryIndicator for why the MCP branch
+      // is gone rather than rewired.
+      const deliveryLabel = agent?.health?.delivery?.webhook_configured
+        ? t('profile.agents.detail.deliveryWh')
+        : t('profile.agents.detail.deliveryPolling');
       const stats = agent.taskStats;
       return html`
         <div class="pf-agd-zone2 pf-agd-zone2--production">
@@ -663,19 +665,29 @@ function ProblemZone2({ agent, setActiveTab, showToast }) {
     setActiveTab('integration');
   }
 
-  const failCount = agent.webhookFailCount ?? 0;
+  // What is actually wrong, named by the server. This panel's sentence used to be empty in every
+  // real case: it tested a fail count the response did not carry, and `!agent.last_seen`, which is
+  // false for the ordinary problem — an agent that HAS been seen, 25 hours ago.
+  const delivery = agent?.health?.delivery;
+  const reasons = agent?.health?.reasons ?? [];
+  const reasonText = {
+    'webhook-down': () => t('profile.agents.detail.zone2.webhookFailed', { count: delivery?.fail_count ?? 0 }),
+    'never-seen': () => t('profile.agents.detail.zone2.noTelemetry'),
+    'stale-24h': () => t('profile.agents.detail.zone2.noTelemetry'),
+    'onboarding-failed': () => t('profile.agents.detail.zone2.onboardingFailed'),
+  };
 
   return html`
     <div class="pf-agd-zone2 pf-agd-zone2--problem">
       <div class="pf-agd-zone2-title">${t('profile.agents.detail.zone2.problemTitle')}</div>
       <div class="pf-agd-zone2-desc">
-        ${failCount >= 5 ? t('profile.agents.detail.zone2.webhookFailed', { count: failCount }) : ''}
-        ${!agent.last_seen ? t('profile.agents.detail.zone2.noTelemetry') : ''}
+        ${reasons.map(r => html`<div>${(reasonText[r] ?? (() => r))()}</div>`)}
       </div>
       <div class="pf-agd-zone2-actions">
+        ${delivery?.webhook_configured && html`
         <button class="btn-outline btn-sm" onClick=${handleTestWebhook} disabled=${testing}>
           ${t('profile.agents.detail.zone2.testWebhook')}
-        </button>
+        </button>`}
         <button class="btn-outline btn-sm" onClick=${(e) => { e.stopPropagation(); setEditingUrl(!editingUrl); }}>
           ${t('profile.agents.detail.zone2.updateUrl')}
         </button>

package/dist/public/views/profile/agents/scope-config.js

@@ -1,52 +1,22 @@
 /**
  * @file public/views/profile/agents/scope-config.js
- * @description Agent scope-management constants (domains, templates) + label helpers
- *   shared by the agents tab and the scope-management modal. Extracted from
- *   ../agents-tab.js to satisfy max-file-lines.
+ * @description Agent scope labels for the agents tab and the scope-management modal, over the
+ *   pure scope model in ./scope-model.js (re-exported here so both consumers keep one import).
  * @version-history
  *   v1.0.0 — 2026-07-13 — Extracted from views/profile/agents-tab.js (max-file-lines)
+ *   v1.1.0 — 2026-08-08 — memory:write-as-owner, so an owner can let one agent write into their own
+ *     namespace. Deliberately absent from readonly/standard; '*' carries it, as it does for
+ *     messages:send-as-owner.
+ *   v1.2.0 — 2026-08-08 — The constants and the expand/collapse pair moved to ./scope-model.js,
+ *     which imports nothing and so can be unit-tested; this file is now the t()-dependent half.
  */
 import { t } from '/js/i18n.js';
 
-// === Scope Management Constants ===
-export const SCOPE_DOMAINS = [
-  { key: 'memory',    permissions: ['read', 'write', 'delete'] },
-  { key: 'storage',   permissions: ['read', 'write'] },
-  { key: 'work',      permissions: ['request', 'read', 'accept', 'publish'] },
-  { key: 'social',    permissions: ['read', 'write'] },
-  { key: 'messages',  permissions: ['send', 'read', 'send-as-owner'] },
-  { key: 'wallet',    permissions: ['read'] },
-  { key: 'consent',   permissions: ['manage'] },
-  { key: 'tunnel',    permissions: ['connect'] },
-  { key: 'agent',     permissions: ['register'] },
-  { key: 'catalogue', permissions: ['read'] },
-  { key: 'generator', permissions: ['read', 'write', 'execute'] },
-  { key: 'task', permissions: ['read', 'write', 'manage'] },
-  // cortex:write — install/activate/deactivate/delete cortex libraries (browser-side UI)
-  // ext:write    — activate/deactivate/delete extensions, manage instances (server-side WASM)
-  // Note: extension INSTALL is requireAuth-only at the route (agents can push code that stays
-  // inert until ext:write activates it). Cortex INSTALL requires cortex:write.
-  { key: 'cortex',    permissions: ['write'] },
-  { key: 'ext',       permissions: ['write'] },
-];
-
-export const SCOPE_TEMPLATES = {
-  readonly:  ['memory:read', 'storage:read', 'catalogue:read', 'social:read'],
-  standard:  ['memory:read', 'memory:write', 'storage:read', 'storage:write', 'catalogue:read', 'social:read', 'work:request', 'work:read'],
-  full:      ['*'],
-};
-
-export function detectTemplate(scopes) {
-  if (!scopes || scopes.length === 0) return 'full';
-  if (scopes.includes('*')) return 'full';
-  const sorted = [...scopes].sort();
-  for (const [name, tpl] of Object.entries(SCOPE_TEMPLATES)) {
-    if (name === 'full') continue;
-    const tplSorted = [...tpl].sort();
-    if (sorted.length === tplSorted.length && sorted.every((s, i) => s === tplSorted[i])) return name;
-  }
-  return 'custom';
-}
+export {
+  SCOPE_DOMAINS, SCOPE_TEMPLATES, NOT_IN_WILDCARD,
+  wildcardScopes, bulkScopes, expandScopes, collapseScopes, detectTemplate,
+  knownScopes, unknownScopes,
+} from './scope-model.js';
 
 export function templateLabel(name) {
   const map = { readonly: 'readOnly', standard: 'standard', full: 'fullAccess', custom: 'custom' };
@@ -58,7 +28,21 @@ export function domainLabel(domain) {
   return t(`profile.agents.scopeUi.domain${cap}`);
 }
 
-export function permLabel(perm) {
+/**
+ * The label for one checkbox.
+ *
+ * Prefers a per-SCOPE sentence (`scopeText.finance.write` → "Write and send invoices in your
+ * name") over the shared per-permission word. "Write" told an owner nothing: the same word sat on
+ * a row that saves a note and on a row that books an accounting entry, and the only way to tell
+ * them apart was the technical string beside it. Falls back to the old label when a scope has no
+ * sentence yet, and t() returning the key unchanged is what "no sentence yet" looks like.
+ */
+export function permLabel(perm, domain) {
+  if (domain) {
+    const key = `profile.agents.scopeUi.scopeText.${domain}.${perm}`;
+    const text = t(key);
+    if (text && text !== key) return text;
+  }
   const cap = perm.charAt(0).toUpperCase() + perm.slice(1);
   return t(`profile.agents.scopeUi.perm${cap}`);
 }

package/dist/public/views/profile/agents/scope-model.js

@@ -0,0 +1,288 @@
+/**
+ * @file public/views/profile/agents/scope-model.js
+ * @description What an agent's scope set IS and how the checkbox editor converts to and from it —
+ *   the pure half of scope-config.js, with no imports, so it can be executed by a unit test.
+ *
+ *   It is separate for one reason: the editor's expand/collapse pair is a round trip, and a round
+ *   trip that silently loses a member is invisible in every screenshot. `*` used to expand into
+ *   every checkbox and a fully-ticked editor used to collapse back to `['*']`, so
+ *   `memory:write-reserved` — which the server grants on the exact string only — always LOOKED
+ *   granted and could never be SAVED. Both halves have to agree about what the wildcard carries,
+ *   and now they agree here, once, under test/unit/agent-scope-model.test.ts.
+ * @structure NOT_IN_WILDCARD · SCOPE_DOMAINS · SCOPE_TEMPLATES · wildcardScopes · expandScopes ·
+ *   collapseScopes · bulkScopes · detectTemplate
+ * @usage
+ *   import { expandScopes, collapseScopes } from './scope-model.js';
+ *   const checked = expandScopes(agent.default_scopes ?? ['*']);
+ *   await save(collapseScopes(checked));
+ * @version-history
+ *   v1.3.0 — 2026-08-11 — account:security, a sixth word outside the wildcard: the password, the
+ *     recovery address, the second factor, the identity proof, and deleting or exporting the whole
+ *     account. Its own domain, because it is not a permission over the person's data but over
+ *     whether they still reach it.
+ *   v1.2.0 — 2026-08-11 — Five words that no wildcard carries: commerce:psp,
+ *     commerce:beneficiary-verify, agent:permissions, consent:groups and social:members. Each names
+ *     a call the web door reserves to a logged-in person, so it costs its own tick rather than
+ *     riding along with Full access.
+ *   v1.1.0 — 2026-08-10 — Three new domains (agent, app, capability) plus organism:write,
+ *     organism:invite and ext:invoke. These name things an agent could already do with no
+ *     permission at all, because the MCP scope table read silence as consent.
+ *   v1.0.0 — 2026-08-08 — Split out of scope-config.js so the wildcard round trip is testable.
+ *   v1.1.0 — 2026-08-08 — The vocabulary caught up with the node, and the round trip stopped losing
+ *     things. 17 scopes the node enforces had no row — bookkeeping, outgoing email, automations,
+ *     connected accounts, the marketplace — so unticking one unrelated box dropped the agent out of
+ *     '*' and revoked every one of them at once, none of them named anywhere in the dialog. Four
+ *     boxes granted nothing (generator:*, agent:register) and one more (task:manage) was dead too.
+ *     Anything the editor does not recognise is now carried through instead of discarded, an
+ *     unknown domain wildcard no longer collapses the whole grant to ['catalogue:read'], a domain
+ *     wildcard the agent already held is re-emitted when that domain was untouched, and an empty
+ *     scope list no longer reports itself as full access.
+ */
+
+/**
+ * Scopes that `*` deliberately does NOT carry, mirroring the server: hasWriteReserved() in
+ * src/routes/memory/owner-target.ts tests the EXACT string, while every other scope check honours
+ * the wildcard. "Full access" is one click, and nobody clicking it is deciding that an agent may
+ * point their decrypted AI key at a URL of its choosing — so that one costs its own tick.
+ */
+export const NOT_IN_WILDCARD = [
+  'memory:write-reserved',
+  // ── Added 2026-08-11 ─────────────────────────────────────────────────────────────────────────
+  // Eight tool calls the web door reserves to a logged-in person and the agent surface allowed on
+  // an ordinary permission. Each is the owner's money or who else sees their data. The agent is not
+  // shut out — it should be able to do what a person can — but each of these costs its own tick, so
+  // it cannot ride along with "Full access".
+  'commerce:psp',
+  'commerce:beneficiary-verify',
+  'agent:permissions',
+  'consent:groups',
+  // Handing another account a standing right to read part of the owner's memory. Same reasoning:
+  // assembling an audience and giving it a key space are separate acts, and only the second gives
+  // anything away.
+  'share:manage',
+  'social:members',
+  // ── Added 2026-08-11 ─────────────────────────────────────────────────────────────────────────
+  // The account itself: the password, the recovery address, the second factor, the identity proof,
+  // and deleting or exporting everything. An agent that can set the password can become the person,
+  // so this one is never granted by a preset, a bulk header or Full access — only by this box.
+  'account:security',
+];
+
+/**
+ * The vocabulary of the checkbox editor.
+ *
+ * The rule for what belongs here: **ticking or unticking it must change what THIS AGENT can do.**
+ * That is stricter than "the node reads the string somewhere", and the difference is not academic —
+ * an audit of all 49 scope strings the node checks found eight where the tick binds someone else or
+ * nobody:
+ *
+ *   contract:spend      only an app session is ever refused (services/metered-access.ts:151)
+ *   events:emit         requireRole('ecosystem') runs first, so never an agent
+ *   organism:write      requireRoleOrScope('agent', …) — an agent passes by ROLE, tick or no tick
+ *   task:manage         nothing in src/ reads it at all
+ *   agent:register      nothing in src/ reads it at all
+ *   generator:*         the Generator was removed 2026-07-18; three dead strings
+ *
+ * A box that grants nothing is worse than a missing box: it answers the owner's question wrongly.
+ * The dead ones were removed rather than relabelled; an agent that still holds one now shows it in
+ * the editor's "other permissions" section, where it can be unticked (see unknownScopes).
+ */
+export const SCOPE_DOMAINS = [
+  // write-as-owner: write into the OWNER's namespace instead of the agent's own. Same shape as
+  // messages:send-as-owner below — an explicit, owner-granted delegation. The agent must ALSO
+  // ask for it per call, so granting it changes nothing on its own.
+  // write-reserved: ALSO the keys the server itself trusts (openrouter.* / ai-usage.* /
+  // profile.*). For an agent that administers the account. Not in '*' on purpose — see
+  // WRITE_RESERVED_SCOPE in src/routes/memory/owner-target.ts. It is a MODIFIER on write-as-owner:
+  // on its own it lifts a block on writes the agent is not making.
+  { key: 'memory',    permissions: ['read', 'write', 'delete', 'write-as-owner', 'write-reserved'] },
+  { key: 'storage',   permissions: ['read', 'write'] },
+  { key: 'ai',        permissions: ['use'] },
+  { key: 'work',      permissions: ['request', 'read', 'accept', 'publish'] },
+  // social:members — add or remove who may read a shared board. A different promise from posting
+  //   to one, which is what social:write covers.
+  { key: 'social',    permissions: ['read', 'write', 'members'] },
+  { key: 'messages',  permissions: ['send', 'read', 'send-as-owner'] },
+  { key: 'wallet',    permissions: ['read'] },
+  // consent:groups — create a sharing group and decide who is in it. A sharing group IS the
+  //   boundary of who reads the owner's memory, so it is separated from managing consents.
+  { key: 'consent',   permissions: ['manage', 'groups'] },
+  // Key-space shares: what a sharing group actually reaches. The group is the audience (consent:groups);
+  // this is what they may read. Without a row here an owner could not grant it in this editor at all.
+  { key: 'share',     permissions: ['manage'] },
+  { key: 'tunnel',    permissions: ['connect'] },
+  { key: 'catalogue', permissions: ['read'] },
+  { key: 'task',      permissions: ['read', 'write'] },
+  { key: 'workflow',  permissions: ['read', 'write'] },
+  // The money and the outside world. These were enforced by the node with no row in this editor,
+  // so an owner could neither grant nor revoke them here while an agent used them daily.
+  { key: 'finance',   permissions: ['read', 'write'] },
+  { key: 'outbound',  permissions: ['send'] },
+  { key: 'company',   permissions: ['read', 'write'] },
+  { key: 'connections', permissions: ['read', 'write', 'use'] },
+  { key: 'notifications', permissions: ['send'] },
+  { key: 'exchange',  permissions: ['read', 'write', 'grant', 'beneficiary'] },
+  // commerce:psp — write or destroy the payment credentials money is paid out through.
+  // commerce:beneficiary-verify — record a beneficiary as verified, which is what makes a payout
+  //   possible. Kept apart from the rest because a provider who could open this gate for their own
+  //   payee is not a gate at all.
+  { key: 'commerce',  permissions: ['sell', 'buy', 'psp', 'beneficiary-verify'] },
+  // organism:read   — see the organisms and workspaces this agent's owner belongs to
+  // organism:write  — create a workspace, write and publish documents in one, comment, revert
+  // organism:invite — hand somebody else access: invite a member, grant or revoke a workspace role.
+  //                   Separate from write because it changes WHO ELSE can read the owner's knowledge,
+  //                   which is a different promise than changing the knowledge.
+  { key: 'organism',  permissions: ['read', 'write', 'invite'] },
+  { key: 'provenance', permissions: ['write'] },
+  // cortex:write — install/activate/deactivate/delete cortex libraries (browser-side UI)
+  // ext:write    — activate/deactivate/delete extensions, manage instances (server-side WASM)
+  // Note: extension INSTALL is requireAuth-only at the route (agents can push code that stays
+  // inert until ext:write activates it). Cortex INSTALL requires cortex:write.
+  { key: 'cortex',    permissions: ['write'] },
+  { key: 'ext',       permissions: ['write', 'invoke'] },
+
+  // ── Added 2026-08-10 (August 2026 audit, step 3a) ────────────────────────────────────────────
+  // These name things an agent could already do with no permission at all, because the MCP surface
+  // reads a missing entry in its scope table as permission rather than as an omission. Adding the
+  // words is what lets an owner see them and take them away.
+  //
+  // agent:write — reconfigure ANOTHER of the owner's agents: its mode, its tags. Not its own
+  //               record, which needs nothing — an agent describing itself is answering about
+  //               itself. This is the one that reaches sideways, at a sibling principal with its
+  //               own identity and its own trust score.
+  // app:write   — publish or update an app under the owner's account, and save or publish a draft.
+  // app:manage  — the destructive half: delete an app, fork one, remove a template. Split from
+  //               write because publishing an update and deleting the thing are different risks.
+  // capability:write — create, update, delete or vouch for a published capability. A capability is
+  //               how this account offers work to others, so writing one speaks in the owner's name.
+  // agent:permissions — rewrite what another of the owner's agents is allowed to do. Separate
+  //   from agent:write, which is its mode and its tags: this one changes the permission set itself.
+  { key: 'agent',      permissions: ['write', 'permissions'] },
+  { key: 'app',        permissions: ['write', 'manage'] },
+  { key: 'capability', permissions: ['write'] },
+
+  // ── Added 2026-08-11 (August 2026 audit, H-1/H-7) ────────────────────────────────────────────
+  // account:security — the doors that decide who can sign in as this person: the password, the
+  //   recovery address, the second factor, the identity proof, and deleting or exporting the whole
+  //   account. Enforced by requireOwnerPrincipal() in src/auth/middleware.ts. Nobody was
+  //   grandfathered onto it, so an agent has it only if the owner ticked this box.
+  { key: 'account',    permissions: ['security'] },
+];
+
+export const SCOPE_TEMPLATES = {
+  readonly:  ['memory:read', 'storage:read', 'catalogue:read', 'social:read'],
+  standard:  ['memory:read', 'memory:write', 'storage:read', 'storage:write', 'catalogue:read', 'social:read', 'work:request', 'work:read'],
+  full:      ['*'],
+};
+
+/** Every scope `*` actually carries — each box in the editor except the out-of-wildcard ones. */
+export function wildcardScopes() {
+  const set = new Set();
+  for (const d of SCOPE_DOMAINS) {
+    for (const p of d.permissions) {
+      const s = `${d.key}:${p}`;
+      if (!NOT_IN_WILDCARD.includes(s)) set.add(s);
+    }
+  }
+  return set;
+}
+
+/**
+ * The scopes a domain's "all" header covers. An out-of-wildcard scope is left out on purpose: it
+ * costs an explicit tick precisely so it cannot ride along with a bulk gesture.
+ */
+export function bulkScopes(domDef) {
+  return domDef.permissions.map(p => `${domDef.key}:${p}`).filter(s => !NOT_IN_WILDCARD.includes(s));
+}
+
+/** Every scope string the editor has a row for. */
+export function knownScopes() {
+  const set = new Set();
+  for (const d of SCOPE_DOMAINS) for (const p of d.permissions) set.add(`${d.key}:${p}`);
+  return set;
+}
+
+/**
+ * Scopes this agent holds that the editor has no row for — an unknown domain, a scope added to the
+ * node before the editor caught up, or a malformed string from a hand-written PATCH.
+ *
+ * They are surfaced rather than dropped. A scope the owner cannot see is one they cannot revoke,
+ * and silently discarding it on save revokes it without telling them — both directions are wrong,
+ * and which one hurts depends only on whether the scope was doing something.
+ */
+export function unknownScopes(scopeList) {
+  const known = knownScopes();
+  return scopeList.filter(s => s !== '*' && !known.has(s) && !isKnownDomainWildcard(s));
+}
+
+function isKnownDomainWildcard(s) {
+  const [domain, perm] = s.split(':');
+  return perm === '*' && SCOPE_DOMAINS.some(d => d.key === domain);
+}
+
+/** A stored scope array → the set of ticked boxes (plus any scope with no box, kept verbatim). */
+export function expandScopes(scopeList) {
+  // `*` first, then the explicit entries on top: an agent can hold ['*', 'memory:write-reserved'],
+  // and the wildcard must not erase the extra that was granted alongside it.
+  const set = scopeList.includes('*') ? wildcardScopes() : new Set();
+  for (const s of scopeList) {
+    if (s === '*') continue;
+    const [domain, perm] = s.split(':');
+    if (perm === '*') {
+      const domDef = SCOPE_DOMAINS.find(d => d.key === domain);
+      // A domain wildcard carries no more than the global one does. One for a domain the editor
+      // does NOT know is kept as-is: dropping it silently revoked a real grant — `['finance:*']`
+      // used to open-and-save into `['catalogue:read']`.
+      if (domDef) bulkScopes(domDef).forEach(sc => set.add(sc));
+      else set.add(s);
+    } else {
+      set.add(s);
+    }
+  }
+  return set;
+}
+
+/**
+ * The ticked boxes → the scope array to store.
+ *
+ * Collapses to `*` only over what the wildcard carries, keeps every out-of-wildcard scope spelled
+ * out beside it, and carries through anything the editor has no row for. `original` is the array
+ * the dialog opened with: a domain wildcard the agent already held is re-emitted when that domain
+ * was left alone, so looking at an agent and pressing Save does not quietly rewrite `memory:*` into
+ * a snapshot that stops covering whatever memory scope the node adds next.
+ */
+export function collapseScopes(checked, original = []) {
+  const known = knownScopes();
+  const extras = NOT_IN_WILDCARD.filter(s => checked.has(s));
+  const carried = [...checked].filter(s => !known.has(s));
+  if ([...wildcardScopes()].every(s => checked.has(s))) return ['*', ...extras, ...carried];
+
+  const out = [];
+  const consumed = new Set();
+  for (const d of SCOPE_DOMAINS) {
+    const domainWildcard = `${d.key}:*`;
+    const bulk = bulkScopes(d);
+    if (original.includes(domainWildcard) && bulk.every(s => checked.has(s))) {
+      out.push(domainWildcard);
+      bulk.forEach(s => consumed.add(s));
+    }
+  }
+  for (const s of checked) if (!consumed.has(s)) out.push(s);
+  return out.length > 0 ? out : ['catalogue:read'];
+}
+
+export function detectTemplate(scopes) {
+  // A MISSING scope list is the legacy "everything" default (both call sites read
+  // `default_scopes ?? ['*']`). An EMPTY one is not the same thing, and calling it full access
+  // labelled a zero-access agent as the maximum grant.
+  if (!scopes) return 'full';
+  if (scopes.length === 0) return 'custom';
+  if (scopes.includes('*')) return 'full';
+  const sorted = [...scopes].sort();
+  for (const [name, tpl] of Object.entries(SCOPE_TEMPLATES)) {
+    if (name === 'full') continue;
+    const tplSorted = [...tpl].sort();
+    if (sorted.length === tplSorted.length && sorted.every((s, i) => s === tplSorted[i])) return name;
+  }
+  return 'custom';
+}