aimeat 2.7.0 → 3.1.0

package/dist/public/views/profile/agents/scope-model.js

@@ -0,0 +1,296 @@
+/**
+ * @file public/views/profile/agents/scope-model.js
+ * @description What an agent's scope set IS and how the checkbox editor converts to and from it —
+ *   the pure half of scope-config.js, with no imports, so it can be executed by a unit test.
+ *
+ *   It is separate for one reason: the editor's expand/collapse pair is a round trip, and a round
+ *   trip that silently loses a member is invisible in every screenshot. `*` used to expand into
+ *   every checkbox and a fully-ticked editor used to collapse back to `['*']`, so
+ *   `memory:write-reserved` — which the server grants on the exact string only — always LOOKED
+ *   granted and could never be SAVED. Both halves have to agree about what the wildcard carries,
+ *   and now they agree here, once, under test/unit/agent-scope-model.test.ts.
+ * @structure NOT_IN_WILDCARD · SCOPE_DOMAINS · SCOPE_TEMPLATES · wildcardScopes · expandScopes ·
+ *   collapseScopes · bulkScopes · detectTemplate
+ * @usage
+ *   import { expandScopes, collapseScopes } from './scope-model.js';
+ *   const checked = expandScopes(agent.default_scopes ?? ['*']);
+ *   await save(collapseScopes(checked));
+ * @version-history
+ *   v1.4.0 — 2026-08-13 — agent:delete, the word a fleet runtime needs to clear away the agents it
+ *     created. Inside the wildcard on purpose: the route's second condition (only agents this
+ *     caller registered) is the real fence, and a box nobody can find protects nothing.
+ *   v1.3.0 — 2026-08-11 — account:security, a sixth word outside the wildcard: the password, the
+ *     recovery address, the second factor, the identity proof, and deleting or exporting the whole
+ *     account. Its own domain, because it is not a permission over the person's data but over
+ *     whether they still reach it.
+ *   v1.2.0 — 2026-08-11 — Five words that no wildcard carries: commerce:psp,
+ *     commerce:beneficiary-verify, agent:permissions, consent:groups and social:members. Each names
+ *     a call the web door reserves to a logged-in person, so it costs its own tick rather than
+ *     riding along with Full access.
+ *   v1.1.0 — 2026-08-10 — Three new domains (agent, app, capability) plus organism:write,
+ *     organism:invite and ext:invoke. These name things an agent could already do with no
+ *     permission at all, because the MCP scope table read silence as consent.
+ *   v1.0.0 — 2026-08-08 — Split out of scope-config.js so the wildcard round trip is testable.
+ *   v1.1.0 — 2026-08-08 — The vocabulary caught up with the node, and the round trip stopped losing
+ *     things. 17 scopes the node enforces had no row — bookkeeping, outgoing email, automations,
+ *     connected accounts, the marketplace — so unticking one unrelated box dropped the agent out of
+ *     '*' and revoked every one of them at once, none of them named anywhere in the dialog. Four
+ *     boxes granted nothing (generator:*, agent:register) and one more (task:manage) was dead too.
+ *     Anything the editor does not recognise is now carried through instead of discarded, an
+ *     unknown domain wildcard no longer collapses the whole grant to ['catalogue:read'], a domain
+ *     wildcard the agent already held is re-emitted when that domain was untouched, and an empty
+ *     scope list no longer reports itself as full access.
+ */
+
+/**
+ * Scopes that `*` deliberately does NOT carry, mirroring the server: hasWriteReserved() in
+ * src/routes/memory/owner-target.ts tests the EXACT string, while every other scope check honours
+ * the wildcard. "Full access" is one click, and nobody clicking it is deciding that an agent may
+ * point their decrypted AI key at a URL of its choosing — so that one costs its own tick.
+ */
+export const NOT_IN_WILDCARD = [
+  'memory:write-reserved',
+  // ── Added 2026-08-11 ─────────────────────────────────────────────────────────────────────────
+  // Eight tool calls the web door reserves to a logged-in person and the agent surface allowed on
+  // an ordinary permission. Each is the owner's money or who else sees their data. The agent is not
+  // shut out — it should be able to do what a person can — but each of these costs its own tick, so
+  // it cannot ride along with "Full access".
+  'commerce:psp',
+  'commerce:beneficiary-verify',
+  'agent:permissions',
+  'consent:groups',
+  // Handing another account a standing right to read part of the owner's memory. Same reasoning:
+  // assembling an audience and giving it a key space are separate acts, and only the second gives
+  // anything away.
+  'share:manage',
+  'social:members',
+  // ── Added 2026-08-11 ─────────────────────────────────────────────────────────────────────────
+  // The account itself: the password, the recovery address, the second factor, the identity proof,
+  // and deleting or exporting everything. An agent that can set the password can become the person,
+  // so this one is never granted by a preset, a bulk header or Full access — only by this box.
+  'account:security',
+];
+
+/**
+ * The vocabulary of the checkbox editor.
+ *
+ * The rule for what belongs here: **ticking or unticking it must change what THIS AGENT can do.**
+ * That is stricter than "the node reads the string somewhere", and the difference is not academic —
+ * an audit of all 49 scope strings the node checks found eight where the tick binds someone else or
+ * nobody:
+ *
+ *   contract:spend      only an app session is ever refused (services/metered-access.ts:151)
+ *   events:emit         requireRole('ecosystem') runs first, so never an agent
+ *   organism:write      requireRoleOrScope('agent', …) — an agent passes by ROLE, tick or no tick
+ *   task:manage         nothing in src/ reads it at all
+ *   agent:register      nothing in src/ reads it at all
+ *   generator:*         the Generator was removed 2026-07-18; three dead strings
+ *
+ * A box that grants nothing is worse than a missing box: it answers the owner's question wrongly.
+ * The dead ones were removed rather than relabelled; an agent that still holds one now shows it in
+ * the editor's "other permissions" section, where it can be unticked (see unknownScopes).
+ */
+export const SCOPE_DOMAINS = [
+  // write-as-owner: write into the OWNER's namespace instead of the agent's own. Same shape as
+  // messages:send-as-owner below — an explicit, owner-granted delegation. The agent must ALSO
+  // ask for it per call, so granting it changes nothing on its own.
+  // write-reserved: ALSO the keys the server itself trusts (openrouter.* / ai-usage.* /
+  // profile.*). For an agent that administers the account. Not in '*' on purpose — see
+  // WRITE_RESERVED_SCOPE in src/routes/memory/owner-target.ts. It is a MODIFIER on write-as-owner:
+  // on its own it lifts a block on writes the agent is not making.
+  { key: 'memory',    permissions: ['read', 'write', 'delete', 'write-as-owner', 'write-reserved'] },
+  { key: 'storage',   permissions: ['read', 'write'] },
+  { key: 'ai',        permissions: ['use'] },
+  { key: 'work',      permissions: ['request', 'read', 'accept', 'publish'] },
+  // social:members — add or remove who may read a shared board. A different promise from posting
+  //   to one, which is what social:write covers.
+  { key: 'social',    permissions: ['read', 'write', 'members'] },
+  { key: 'messages',  permissions: ['send', 'read', 'send-as-owner'] },
+  { key: 'wallet',    permissions: ['read'] },
+  // consent:groups — create a sharing group and decide who is in it. A sharing group IS the
+  //   boundary of who reads the owner's memory, so it is separated from managing consents.
+  { key: 'consent',   permissions: ['manage', 'groups'] },
+  // Key-space shares: what a sharing group actually reaches. The group is the audience (consent:groups);
+  // this is what they may read. Without a row here an owner could not grant it in this editor at all.
+  { key: 'share',     permissions: ['manage'] },
+  { key: 'tunnel',    permissions: ['connect'] },
+  { key: 'catalogue', permissions: ['read'] },
+  { key: 'task',      permissions: ['read', 'write'] },
+  { key: 'workflow',  permissions: ['read', 'write'] },
+  // The money and the outside world. These were enforced by the node with no row in this editor,
+  // so an owner could neither grant nor revoke them here while an agent used them daily.
+  { key: 'finance',   permissions: ['read', 'write'] },
+  { key: 'outbound',  permissions: ['send'] },
+  { key: 'company',   permissions: ['read', 'write'] },
+  { key: 'connections', permissions: ['read', 'write', 'use'] },
+  { key: 'notifications', permissions: ['send'] },
+  { key: 'exchange',  permissions: ['read', 'write', 'grant', 'beneficiary'] },
+  // commerce:psp — write or destroy the payment credentials money is paid out through.
+  // commerce:beneficiary-verify — record a beneficiary as verified, which is what makes a payout
+  //   possible. Kept apart from the rest because a provider who could open this gate for their own
+  //   payee is not a gate at all.
+  { key: 'commerce',  permissions: ['sell', 'buy', 'psp', 'beneficiary-verify'] },
+  // organism:read   — see the organisms and workspaces this agent's owner belongs to
+  // organism:write  — create a workspace, write and publish documents in one, comment, revert
+  // organism:invite — hand somebody else access: invite a member, grant or revoke a workspace role.
+  //                   Separate from write because it changes WHO ELSE can read the owner's knowledge,
+  //                   which is a different promise than changing the knowledge.
+  { key: 'organism',  permissions: ['read', 'write', 'invite'] },
+  { key: 'provenance', permissions: ['write'] },
+  // cortex:write — install/activate/deactivate/delete cortex libraries (browser-side UI)
+  // ext:write    — activate/deactivate/delete extensions, manage instances (server-side WASM)
+  // Note: extension INSTALL is requireAuth-only at the route (agents can push code that stays
+  // inert until ext:write activates it). Cortex INSTALL requires cortex:write.
+  { key: 'cortex',    permissions: ['write'] },
+  { key: 'ext',       permissions: ['write', 'invoke'] },
+
+  // ── Added 2026-08-10 (August 2026 audit, step 3a) ────────────────────────────────────────────
+  // These name things an agent could already do with no permission at all, because the MCP surface
+  // reads a missing entry in its scope table as permission rather than as an omission. Adding the
+  // words is what lets an owner see them and take them away.
+  //
+  // agent:write — reconfigure ANOTHER of the owner's agents: its mode, its tags. Not its own
+  //               record, which needs nothing — an agent describing itself is answering about
+  //               itself. This is the one that reaches sideways, at a sibling principal with its
+  //               own identity and its own trust score.
+  // app:write   — publish or update an app under the owner's account, and save or publish a draft.
+  // app:manage  — the destructive half: delete an app, fork one, remove a template. Split from
+  //               write because publishing an update and deleting the thing are different risks.
+  // capability:write — create, update, delete or vouch for a published capability. A capability is
+  //               how this account offers work to others, so writing one speaks in the owner's name.
+  // agent:permissions — rewrite what another of the owner's agents is allowed to do. Separate
+  //   from agent:write, which is its mode and its tags: this one changes the permission set itself.
+  // agent:delete — end another of the owner's agents for good. Its own word rather than part of
+  //   agent:write, because reconfiguring a sibling and ending it are different sizes of act, and
+  //   because the caller that needs it is a fleet concierge cleaning up what it created. The route
+  //   adds a second condition the box cannot express: an agent may only delete an agent whose
+  //   registration it authorized itself.
+  { key: 'agent',      permissions: ['write', 'permissions', 'delete'] },
+  { key: 'app',        permissions: ['write', 'manage'] },
+  { key: 'capability', permissions: ['write'] },
+
+  // ── Added 2026-08-11 (August 2026 audit, H-1/H-7) ────────────────────────────────────────────
+  // account:security — the doors that decide who can sign in as this person: the password, the
+  //   recovery address, the second factor, the identity proof, and deleting or exporting the whole
+  //   account. Enforced by requireOwnerPrincipal() in src/auth/middleware.ts. Nobody was
+  //   grandfathered onto it, so an agent has it only if the owner ticked this box.
+  { key: 'account',    permissions: ['security'] },
+];
+
+export const SCOPE_TEMPLATES = {
+  readonly:  ['memory:read', 'storage:read', 'catalogue:read', 'social:read'],
+  standard:  ['memory:read', 'memory:write', 'storage:read', 'storage:write', 'catalogue:read', 'social:read', 'work:request', 'work:read'],
+  full:      ['*'],
+};
+
+/** Every scope `*` actually carries — each box in the editor except the out-of-wildcard ones. */
+export function wildcardScopes() {
+  const set = new Set();
+  for (const d of SCOPE_DOMAINS) {
+    for (const p of d.permissions) {
+      const s = `${d.key}:${p}`;
+      if (!NOT_IN_WILDCARD.includes(s)) set.add(s);
+    }
+  }
+  return set;
+}
+
+/**
+ * The scopes a domain's "all" header covers. An out-of-wildcard scope is left out on purpose: it
+ * costs an explicit tick precisely so it cannot ride along with a bulk gesture.
+ */
+export function bulkScopes(domDef) {
+  return domDef.permissions.map(p => `${domDef.key}:${p}`).filter(s => !NOT_IN_WILDCARD.includes(s));
+}
+
+/** Every scope string the editor has a row for. */
+export function knownScopes() {
+  const set = new Set();
+  for (const d of SCOPE_DOMAINS) for (const p of d.permissions) set.add(`${d.key}:${p}`);
+  return set;
+}
+
+/**
+ * Scopes this agent holds that the editor has no row for — an unknown domain, a scope added to the
+ * node before the editor caught up, or a malformed string from a hand-written PATCH.
+ *
+ * They are surfaced rather than dropped. A scope the owner cannot see is one they cannot revoke,
+ * and silently discarding it on save revokes it without telling them — both directions are wrong,
+ * and which one hurts depends only on whether the scope was doing something.
+ */
+export function unknownScopes(scopeList) {
+  const known = knownScopes();
+  return scopeList.filter(s => s !== '*' && !known.has(s) && !isKnownDomainWildcard(s));
+}
+
+function isKnownDomainWildcard(s) {
+  const [domain, perm] = s.split(':');
+  return perm === '*' && SCOPE_DOMAINS.some(d => d.key === domain);
+}
+
+/** A stored scope array → the set of ticked boxes (plus any scope with no box, kept verbatim). */
+export function expandScopes(scopeList) {
+  // `*` first, then the explicit entries on top: an agent can hold ['*', 'memory:write-reserved'],
+  // and the wildcard must not erase the extra that was granted alongside it.
+  const set = scopeList.includes('*') ? wildcardScopes() : new Set();
+  for (const s of scopeList) {
+    if (s === '*') continue;
+    const [domain, perm] = s.split(':');
+    if (perm === '*') {
+      const domDef = SCOPE_DOMAINS.find(d => d.key === domain);
+      // A domain wildcard carries no more than the global one does. One for a domain the editor
+      // does NOT know is kept as-is: dropping it silently revoked a real grant — `['finance:*']`
+      // used to open-and-save into `['catalogue:read']`.
+      if (domDef) bulkScopes(domDef).forEach(sc => set.add(sc));
+      else set.add(s);
+    } else {
+      set.add(s);
+    }
+  }
+  return set;
+}
+
+/**
+ * The ticked boxes → the scope array to store.
+ *
+ * Collapses to `*` only over what the wildcard carries, keeps every out-of-wildcard scope spelled
+ * out beside it, and carries through anything the editor has no row for. `original` is the array
+ * the dialog opened with: a domain wildcard the agent already held is re-emitted when that domain
+ * was left alone, so looking at an agent and pressing Save does not quietly rewrite `memory:*` into
+ * a snapshot that stops covering whatever memory scope the node adds next.
+ */
+export function collapseScopes(checked, original = []) {
+  const known = knownScopes();
+  const extras = NOT_IN_WILDCARD.filter(s => checked.has(s));
+  const carried = [...checked].filter(s => !known.has(s));
+  if ([...wildcardScopes()].every(s => checked.has(s))) return ['*', ...extras, ...carried];
+
+  const out = [];
+  const consumed = new Set();
+  for (const d of SCOPE_DOMAINS) {
+    const domainWildcard = `${d.key}:*`;
+    const bulk = bulkScopes(d);
+    if (original.includes(domainWildcard) && bulk.every(s => checked.has(s))) {
+      out.push(domainWildcard);
+      bulk.forEach(s => consumed.add(s));
+    }
+  }
+  for (const s of checked) if (!consumed.has(s)) out.push(s);
+  return out.length > 0 ? out : ['catalogue:read'];
+}
+
+export function detectTemplate(scopes) {
+  // A MISSING scope list is the legacy "everything" default (both call sites read
+  // `default_scopes ?? ['*']`). An EMPTY one is not the same thing, and calling it full access
+  // labelled a zero-access agent as the maximum grant.
+  if (!scopes) return 'full';
+  if (scopes.length === 0) return 'custom';
+  if (scopes.includes('*')) return 'full';
+  const sorted = [...scopes].sort();
+  for (const [name, tpl] of Object.entries(SCOPE_TEMPLATES)) {
+    if (name === 'full') continue;
+    const tplSorted = [...tpl].sort();
+    if (sorted.length === tplSorted.length && sorted.every((s, i) => s === tplSorted[i])) return name;
+  }
+  return 'custom';
+}

package/dist/public/views/profile/agents/scopes-modal.js

@@ -5,6 +5,16 @@
  *   to satisfy max-file-lines.
  * @version-history
  *   v1.0.0 — 2026-07-13 — Extracted from views/profile/agents-tab.js (max-file-lines)
+ *   v1.1.0 — 2026-08-08 — The editor stopped treating `*` as "every box". It expanded the wildcard
+ *     into all of them, so memory:write-reserved — which the server grants on the exact string
+ *     only — showed as already granted on a full-access agent, and then collapsed a fully-ticked
+ *     editor back to ['*'] on save, dropping it again. Ticking it therefore could never take
+ *     effect, which is exactly what production showed: the grant looked on, the write was refused.
+ *   v1.2.0 — 2026-08-08 — Each row says what it does ("Write and send invoices, and book accounting
+ *     entries in your name") instead of sharing one word with every other domain's row; a scope the
+ *     editor has no row for is listed under "other permissions" so it can be seen and removed
+ *     rather than silently kept; and the dialog states that a change takes effect on the agent's
+ *     next connection, which is what the session-scope snapshot actually does.
  */
 import { h } from 'preact';
 import { useState } from 'preact/hooks';
@@ -14,46 +24,32 @@ import { t } from '/js/i18n.js';
 import { escHtml } from '/js/utils.js';
 import { InboxLink } from '/components/InboxLink.js';
 import { Modal } from '/components/Modal.js';
-import { SCOPE_DOMAINS, SCOPE_TEMPLATES, detectTemplate, templateLabel, domainLabel, permLabel } from './scope-config.js';
+import {
+  SCOPE_DOMAINS, SCOPE_TEMPLATES, NOT_IN_WILDCARD,
+  wildcardScopes, bulkScopes, expandScopes, collapseScopes, detectTemplate, unknownScopes,
+  templateLabel, domainLabel, permLabel,
+} from './scope-config.js';
 
 export default function ScopesModal({ agent, session, onSave, onCancel }) {
   const scopes = agent.default_scopes ?? ['*'];
-
-  function expandScopes(scopeList) {
-    const set = new Set();
-    if (scopeList.includes('*')) {
-      for (const d of SCOPE_DOMAINS) {
-        for (const p of d.permissions) set.add(`${d.key}:${p}`);
-      }
-      return set;
-    }
-    for (const s of scopeList) {
-      const [domain, perm] = s.split(':');
-      if (perm === '*') {
-        const domDef = SCOPE_DOMAINS.find(d => d.key === domain);
-        if (domDef) domDef.permissions.forEach(p => set.add(`${domain}:${p}`));
-      } else {
-        set.add(s);
-      }
-    }
-    return set;
-  }
+  // Scopes with no row of their own. Rendered anyway, at the bottom: one the owner cannot see is
+  // one they cannot revoke.
+  const unknown = unknownScopes(scopes);
 
   const [checked, setChecked] = useState(() => expandScopes(scopes));
   const [advanced, setAdvanced] = useState(() => detectTemplate(scopes) === 'custom');
   const [saving, setSaving] = useState(false);
-  const currentTemplate = detectTemplate([...checked]);
+  // Read from what would be SAVED, not from the expanded checkbox set — otherwise a fully-ticked
+  // editor never matches a template and "Full access" stays unlit while being exactly what it is.
+  const currentTemplate = detectTemplate(collapseScopes(checked, scopes));
 
   function applyTemplate(name) {
-    if (name === 'full') {
-      const all = new Set();
-      for (const d of SCOPE_DOMAINS) {
-        for (const p of d.permissions) all.add(`${d.key}:${p}`);
-      }
-      setChecked(all);
-    } else {
-      setChecked(new Set(SCOPE_TEMPLATES[name] || []));
-    }
+    // Templates replace the editable rows; a scope with no row is not something a preset can
+    // decide about, so it is carried through rather than silently dropped.
+    const carried = [...checked].filter(s => unknown.includes(s));
+    const next = name === 'full' ? wildcardScopes() : new Set(SCOPE_TEMPLATES[name] || []);
+    carried.forEach(s => next.add(s));
+    setChecked(next);
   }
 
   function toggleScope(scope) {
@@ -68,7 +64,7 @@ export default function ScopesModal({ agent, session, onSave, onCancel }) {
   function toggleDomain(domain) {
     const domDef = SCOPE_DOMAINS.find(d => d.key === domain);
     if (!domDef) return;
-    const domScopes = domDef.permissions.map(p => `${domain}:${p}`);
+    const domScopes = bulkScopes(domDef);
     const allChecked = domScopes.every(s => checked.has(s));
     setChecked(prev => {
       const next = new Set(prev);
@@ -77,16 +73,9 @@ export default function ScopesModal({ agent, session, onSave, onCancel }) {
     });
   }
 
-  function buildScopesArray() {
-    const arr = [...checked];
-    const allScopes = SCOPE_DOMAINS.flatMap(d => d.permissions.map(p => `${d.key}:${p}`));
-    if (allScopes.every(s => checked.has(s))) return ['*'];
-    return arr.length > 0 ? arr : ['catalogue:read'];
-  }
-
   async function handleSave() {
     setSaving(true);
-    await onSave(agent.name, buildScopesArray());
+    await onSave(agent.name, collapseScopes(checked, scopes));
     setSaving(false);
   }
 
@@ -124,8 +113,7 @@ export default function ScopesModal({ agent, session, onSave, onCancel }) {
           ${advanced && html`
             <div class="scope-domains">
               ${SCOPE_DOMAINS.map(d => {
-                const domScopes = d.permissions.map(p => `${d.key}:${p}`);
-                const allChecked = domScopes.every(s => checked.has(s));
+                const allChecked = bulkScopes(d).every(s => checked.has(s));
                 const isCatalogue = d.key === 'catalogue';
                 return html`
                   <div class="scope-domain">
@@ -136,6 +124,7 @@ export default function ScopesModal({ agent, session, onSave, onCancel }) {
                     ${d.permissions.map(p => {
                       const scope = `${d.key}:${p}`;
                       const isLocked = isCatalogue && p === 'read';
+                      const isExtra = NOT_IN_WILDCARD.includes(scope);
                       return html`
                         <div class="scope-row ${isLocked ? 'disabled' : ''}">
                           <label>
@@ -144,17 +133,39 @@ export default function ScopesModal({ agent, session, onSave, onCancel }) {
                               onChange=${() => !isLocked && toggleScope(scope)}
                               disabled=${isLocked}
                             />
-                            <span class="scope-friendly">${permLabel(p)}</span>
+                            <span class="scope-friendly">${permLabel(p, d.key)}</span>
                             <span class="scope-technical">${scope}</span>
                             ${isLocked && html`<span class="scope-lock" title=${t('profile.agents.scopeUi.alwaysOn')}>🔒</span>`}
+                            ${isExtra && html`<span class="scope-extra-note">${t('profile.agents.scopeUi.notInFullAccess')}</span>`}
                           </label>
                         </div>`;
                     })}
                   </div>`;
               })}
+
+              ${unknown.length > 0 && html`
+                <div class="scope-domain">
+                  <div class="scope-domain-header">
+                    <span class="domain-label">${t('profile.agents.scopeUi.domainOther')}</span>
+                  </div>
+                  <p class="scope-domain-desc">${t('profile.agents.scopeUi.otherScopesHint')}</p>
+                  ${unknown.map(scope => html`
+                    <div class="scope-row">
+                      <label>
+                        <input type="checkbox"
+                          checked=${checked.has(scope)}
+                          onChange=${() => toggleScope(scope)}
+                        />
+                        <span class="scope-technical">${escHtml(scope)}</span>
+                      </label>
+                    </div>`)}
+                </div>
+              `}
             </div>
           `}
 
+          <p class="scope-reconnect-note">${t('profile.agents.scopeUi.reconnectNote')}</p>
+
           <div class="form-actions mt-1">
             <button class="btn-primary" onClick=${handleSave} disabled=${saving}>
               ${saving ? t('profile.agents.scopeUi.saving') : t('profile.agents.scopeUi.save')}

package/dist/public/views/profile/agents/shared-board.js

@@ -7,6 +7,11 @@
  *   an "ID card" face (renderIdCard): full GAII with its expansion, issued date, last seen,
  *   task/message tallies, trust + morsels — teaching display-name-vs-GAII at a glance.
  * @version-history
+ *   v3.2.0 -- 2026-08-09 -- Buckets and sort order come from the server verdict. The local
+ *     BUCKET_OF map had no `system` key, so `|| 'quiet'` filed every internal agent under quiet
+ *     on the one surface meant to be read at a glance; there is now an `internal` pill.
+ *   v3.1.0 -- 2026-08-08 -- The GAII copy button uses the shared classes and default labels; .pf-agd-idcard-copy and
+ *       the profile.agents.idcard.copyGaii/copied keys are gone.
  *   v3.0.0 -- 2026-07-12 -- ID-card treatment: each board mini-card reveals a full agent
  *     identity plate on hover/focus (labelled GAII + Global AI Instance Identifier, issued
  *     date, last seen, tasks done/active/failed, messages, trust, morsels, issuer node,
@@ -24,18 +29,19 @@ import { useMemo, useState } from 'preact/hooks';
 import htm from 'htm';
 import { t } from '/js/i18n.js';
 import { CopyButton } from '/components/CopyButton.js';
-import { detectAgentState, getStateColor } from './state-detector.js';
+import { agentState, agentBucket, agentRank, getStateColor } from './state-detector.js';
 
 const html = htm.bind(h);
 
-// Detailed states collapse into four glanceable buckets for the legend/filter.
-const BUCKET_OF = { production: 'online', idle: 'quiet', new: 'onboarding', onboarding: 'onboarding', problem: 'issue' };
-const BUCKET_RANK = { issue: 0, onboarding: 1, online: 2, quiet: 3 };
+// The buckets and their order come from the server (services/agent-health.ts) with the agent. The
+// local BUCKET_OF map had no `system` key, so `BUCKET_OF[state] || 'quiet'` filed every internal
+// agent under "quiet" — on the one surface that exists to be read at a glance.
 const BUCKETS = [
   { id: 'online', color: 'var(--success)', key: 'profile.agents.board.online' },
   { id: 'quiet', color: 'var(--text-muted)', key: 'profile.agents.board.quiet' },
   { id: 'onboarding', color: 'var(--warning)', key: 'profile.agents.board.onboarding' },
   { id: 'issue', color: 'var(--danger)', key: 'profile.agents.board.issue' },
+  { id: 'internal', color: 'var(--text-muted)', key: 'profile.agents.board.internal' },
 ];
 
 export default function SharedBoard({ agents, onboardings, onAgentClick }) {
@@ -43,18 +49,20 @@ export default function SharedBoard({ agents, onboardings, onAgentClick }) {
 
   // Hooks must run unconditionally before any early return (Rules of Hooks).
   const agentStates = useMemo(() => {
-    const rows = (agents || []).map(agent => {
-      const state = detectAgentState(agent, onboardings?.[agent.name]);
-      return { agent, state, bucket: BUCKET_OF[state] || 'quiet', onboarding: onboardings?.[agent.name] };
-    });
+    const rows = (agents || []).map(agent => ({
+      agent,
+      state: agentState(agent),
+      bucket: agentBucket(agent),
+      onboarding: onboardings?.[agent.name],
+    }));
     // Problems first, onboarding second, then the rest — an issue must not drown.
-    rows.sort((a, b) => (BUCKET_RANK[a.bucket] ?? 9) - (BUCKET_RANK[b.bucket] ?? 9));
+    rows.sort((a, b) => agentRank(a.agent) - agentRank(b.agent));
     return rows;
   }, [agents, onboardings]);
 
   const counts = useMemo(() => {
-    const c = { online: 0, quiet: 0, onboarding: 0, issue: 0 };
-    for (const r of agentStates) c[r.bucket]++;
+    const c = { online: 0, quiet: 0, onboarding: 0, issue: 0, internal: 0 };
+    for (const r of agentStates) c[r.bucket] = (c[r.bucket] ?? 0) + 1;
     return c;
   }, [agentStates]);
 
@@ -206,11 +214,7 @@ function renderIdCard(agent) {
             <strong>${t('profile.agents.idcard.gaiiLabel')}</strong> · ${t('profile.agents.idcard.gaiiFull')}
           </span>
           <span onClick=${(e) => e.stopPropagation()}>
-            <${CopyButton}
-              text=${gaii}
-              className="pf-agd-idcard-copy"
-              label=${t('profile.agents.idcard.copyGaii')}
-              copiedLabel=${'✅ ' + t('profile.agents.idcard.copied')} />
+            <${CopyButton} text=${gaii} className="btn-ghost btn-sm btn-copy-inline" />
           </span>
         </div>
         <code class="pf-agd-idcard-gaii-value">${gaii}</code>

package/dist/public/views/profile/agents/state-detector.js

@@ -1,9 +1,26 @@
 /**
  * @file state-detector.js
- * @description Determines agent state from onboarding record and agent data.
- *   States: 'new' | 'onboarding' | 'problem' | 'idle' | 'production'
- *   Also provides default tab selection and state color mapping.
+ * @description Presentation for an agent's state — the default tab and the colour. It does NOT
+ *   decide the state any more: the server does, in src/services/agent-health.ts, and every agent in
+ *   /v1/agents carries a `health` object.
+ *
+ *   It used to decide it here, and could not do so correctly. Two of its three "problem" conditions
+ *   read fields the response has never contained — `webhookFailCount` was not projected at all, and
+ *   `previousReadinessLevel` is not a field on any record in the system — so a broken push channel
+ *   showed as healthy and "problem" silently meant only "not seen in 24 h". Its readiness ladder
+ *   named a level the node never produces (`advanced`) and omitted the one it does (`expert`),
+ *   which inverted the comparison at the top. None of that was visible from this file.
+ *
+ *   States: 'system' | 'new' | 'onboarding' | 'problem' | 'idle' | 'production' — unchanged, which
+ *   is why every locale key and colour below still applies.
+ * @structure agentState(agent) · getDefaultTab(state) · getStateColor(state)
+ * @usage
+ *   import { agentState, getDefaultTab } from './state-detector.js';
+ *   const state = agentState(agent);
  * @version-history
+ *   v2.0.0 -- 2026-08-09 -- Renders the server's verdict instead of computing its own (V1). Removed
+ *     detectAgentState(), READINESS_RANKS, readinessRank() and isStale(); the three dead conditions
+ *     went with them.
  *   v1.3.0 -- 2026-05-24 -- Remove unused getStateLabel() export (audit fix #7)
  *   v1.2.1 -- 2026-05-24 -- Document idle state in design spec, align with audit findings
  *   v1.2.0 -- 2026-05-24 -- Add idle state for inactive production agents
@@ -12,25 +29,24 @@
  */
 
 /**
- * Detect agent state from onboarding record and agent data.
- * Checked in priority order: new > onboarding > problem > idle > production.
+ * The agent's state as the server computed it.
+ *
+ * `health` is always present on /v1/agents. The fallback exists for the one case where it is not —
+ * an object assembled locally before a refresh — and says 'new' rather than guessing 'production',
+ * because claiming an agent is fine is the failure that matters.
  */
-export function detectAgentState(agent, onboarding) {
-  // System agents (Secretary, company Secretary, specialists) are auto-provisioned and never run the
-  // device-auth "Hello Integration" onboarding — so they must never show the 0/11 "onboarding not
-  // started" state. Any `system:*` tag marks an internal agent.
-  if ((agent.tags || []).some((tag) => typeof tag === 'string' && tag.startsWith('system:'))) return 'system';
-  if (!onboarding || onboarding.status === 'pending' || onboarding.status === 'not_started') return 'new';
-  if (onboarding.status === 'in_progress') return 'onboarding';
+export function agentState(agent) {
+  return agent?.health?.state ?? 'new';
+}
 
-  const webhookDown = (agent.webhookFailCount ?? 0) >= 5;
-  const noTelemetry = !agent.last_seen || isStale(agent.last_seen, 24 * 60);
-  const readinessDrop = onboarding.previousReadinessLevel && onboarding.readinessLevel
-    && readinessRank(onboarding.readinessLevel) < readinessRank(onboarding.previousReadinessLevel);
-  if (webhookDown || noTelemetry || readinessDrop) return 'problem';
+/** The fleet-board bucket ('issue' | 'onboarding' | 'online' | 'quiet' | 'internal'). */
+export function agentBucket(agent) {
+  return agent?.health?.bucket ?? 'onboarding';
+}
 
-  if (!agent.last_seen || isStale(agent.last_seen, 60)) return 'idle';
-  return 'production';
+/** Sort key: lower is more urgent. An issue must never drown in a long list. */
+export function agentRank(agent) {
+  return agent?.health?.rank ?? 1;
 }
 
 export function getDefaultTab(state) {
@@ -56,13 +72,3 @@ export function getStateColor(state) {
     default: return 'var(--text-muted)';
   }
 }
-
-const READINESS_RANKS = { none: 0, basic: 1, standard: 2, advanced: 3, full: 4 };
-function readinessRank(level) {
-  return READINESS_RANKS[level] ?? 0;
-}
-
-function isStale(isoDate, thresholdMinutes) {
-  const diff = Date.now() - new Date(isoDate).getTime();
-  return diff > thresholdMinutes * 60 * 1000;
-}