madarx 2.15.1 → 2.16.0

package/app/globals.css

@@ -3048,10 +3048,17 @@ a.admin-record-link{display:block;text-decoration:none;color:inherit;transition:
   gap: 8px;
 }
 
-/* Quick facts — three calm cards: schedule, last run, status. */
+/* Controls block — facts grid + tools strip + the shared editor drawer. */
+.mkt-page[data-page="agent-detail"] .ad-controls {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+/* Quick facts — calm cards: publish, model, schedule, last run, status. */
 .mkt-page[data-page="agent-detail"] .ad-facts {
   display: grid;
-  grid-template-columns: repeat(4, minmax(0, 1fr));
+  grid-template-columns: repeat(auto-fit, minmax(190px, 1fr));
   gap: 10px;
 }
 .mkt-page[data-page="agent-detail"] .ad-fact {
@@ -3076,62 +3083,371 @@ a.admin-record-link{display:block;text-decoration:none;color:inherit;transition:
   overflow-wrap: anywhere;
 }
 
-/* Artifact destination — subtle, optional. Lives inside the facts grid,
-   next to the schedule. */
-.mkt-page[data-page="agent-detail"] .ad-fact--publish {
+/* Editable fact cards (publish, model, schedule) — a fact that's also a button. */
+.mkt-page[data-page="agent-detail"] .ad-fact--edit {
+  position: relative;
+  text-align: left;
+  cursor: pointer;
   background: #fff;
+  font: inherit;
+  transition: border-color .15s ease, box-shadow .15s ease, background .15s ease;
+}
+.mkt-page[data-page="agent-detail"] .ad-fact--edit:hover {
+  border-color: rgba(17, 19, 24, .18);
+}
+.mkt-page[data-page="agent-detail"] .ad-fact--edit.is-active {
+  border-color: rgba(17, 19, 24, .30);
+  box-shadow: 0 0 0 3px rgba(17, 19, 24, .05);
+}
+.mkt-page[data-page="agent-detail"] .ad-fact--edit .ad-fact-value { padding-right: 20px; }
+.mkt-page[data-page="agent-detail"] .ad-fact-edit {
+  position: absolute;
+  top: 13px;
+  right: 13px;
+  color: #b7bcc4;
+  transition: color .15s ease;
+}
+.mkt-page[data-page="agent-detail"] .ad-fact--edit:hover .ad-fact-edit,
+.mkt-page[data-page="agent-detail"] .ad-fact--edit.is-active .ad-fact-edit { color: #6b7280; }
+
+.mkt-page[data-page="agent-detail"] .ad-fact-status {
+  display: inline-flex;
+  align-items: center;
+  gap: 7px;
+}
+.mkt-page[data-page="agent-detail"] .ad-fact-status.tone-active { color: #2d7044; }
+.mkt-page[data-page="agent-detail"] .ad-fact-status.tone-active .ad-dot { background: #3da76a; }
+.mkt-page[data-page="agent-detail"] .ad-fact-status.tone-error { color: #9a3325; }
+.mkt-page[data-page="agent-detail"] .ad-fact-status.tone-error .ad-dot { background: var(--accent-500, #c2452a); }
+
+/* Tools strip — declared toolset as brand icons + one editor entry point. */
+.mkt-page[data-page="agent-detail"] .ad-tools-strip {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  flex-wrap: wrap;
+  padding: 12px 16px;
+  border: 1px solid rgba(17, 19, 24, .07);
+  border-radius: 14px;
+  background: rgba(17, 19, 24, .02);
+}
+.mkt-page[data-page="agent-detail"] .ad-tools-icons {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  flex: 1;
+  flex-wrap: wrap;
+}
+.mkt-page[data-page="agent-detail"] .ad-tool-chip {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 30px;
+  height: 30px;
+  border-radius: 9px;
+  border: 1px solid rgba(17, 19, 24, .08);
+  background: #fff;
+}
+.mkt-page[data-page="agent-detail"] .ad-tools-empty {
+  font: 500 13px/1 var(--font-sans, system-ui);
+  color: #9aa0a8;
+}
+.mkt-page[data-page="agent-detail"] .ad-edit-btn {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+}
+
+/* Shared editor drawer — animates open via grid-template-rows. */
+.mkt-page[data-page="agent-detail"] .ad-drawer {
+  display: grid;
+  grid-template-rows: 0fr;
+  transition: grid-template-rows .26s cubic-bezier(.22, 1, .36, 1);
+}
+.mkt-page[data-page="agent-detail"] .ad-drawer[data-open="true"] { grid-template-rows: 1fr; }
+.mkt-page[data-page="agent-detail"] .ad-drawer-inner { overflow: hidden; }
+
+.mkt-page[data-page="agent-detail"] .ad-editor {
+  border: 1px solid rgba(17, 19, 24, .10);
+  border-radius: 16px;
+  background: #fff;
+  padding: 18px;
+  margin-top: 2px;
+}
+.mkt-page[data-page="agent-detail"] .ad-editor-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  margin-bottom: 14px;
+}
+.mkt-page[data-page="agent-detail"] .ad-editor-head h3 {
+  margin: 0;
+  font: 600 15px/1.2 var(--font-sans, system-ui);
+  letter-spacing: -.01em;
+  color: #1d2026;
+}
+.mkt-page[data-page="agent-detail"] .ad-editor-close {
+  display: inline-flex;
+  border: 0;
+  background: transparent;
+  color: #9aa0a8;
+  cursor: pointer;
+  padding: 4px;
+  border-radius: 8px;
+  transition: color .15s ease, background .15s ease;
+}
+.mkt-page[data-page="agent-detail"] .ad-editor-close:hover { color: #1d2026; background: rgba(17, 19, 24, .05); }
+
+.mkt-page[data-page="agent-detail"] .ad-editor-form {
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+}
+.mkt-page[data-page="agent-detail"] .ad-editor-row {
+  display: flex;
+  gap: 10px;
+  flex-wrap: wrap;
+}
+.mkt-page[data-page="agent-detail"] .ad-editor-row select,
+.mkt-page[data-page="agent-detail"] .ad-editor-row input {
+  flex: 1;
+  min-width: 160px;
+  border: 1px solid rgba(17, 19, 24, .12);
+  border-radius: 10px;
+  background: #fff;
+  padding: 9px 12px;
+  font: 500 13px/1.4 var(--font-sans, system-ui);
+  color: #1d2026;
+}
+.mkt-page[data-page="agent-detail"] .ad-editor-actions {
+  display: flex;
   gap: 8px;
 }
-.mkt-page[data-page="agent-detail"] .ad-space-row {
+
+/* Schedule composer. */
+.mkt-page[data-page="agent-detail"] .ad-sched-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
+  gap: 12px;
+}
+.mkt-page[data-page="agent-detail"] .ad-field {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+.mkt-page[data-page="agent-detail"] .ad-field--wide { grid-column: 1 / -1; }
+.mkt-page[data-page="agent-detail"] .ad-field > span {
+  font: 700 10.5px/1 var(--font-sans, system-ui);
+  letter-spacing: .08em;
+  text-transform: uppercase;
+  color: #8a8f99;
+}
+.mkt-page[data-page="agent-detail"] .ad-field .admin-input {
+  border-radius: 10px;
+}
+.mkt-page[data-page="agent-detail"] .ad-inline-num {
   display: flex;
   align-items: center;
   gap: 8px;
 }
-.mkt-page[data-page="agent-detail"] .ad-space-select {
+.mkt-page[data-page="agent-detail"] .ad-inline-num input { width: 80px; }
+.mkt-page[data-page="agent-detail"] .ad-inline-num em {
+  font: 500 13px/1 var(--font-sans, system-ui);
+  font-style: normal;
+  color: #6b7280;
+}
+.mkt-page[data-page="agent-detail"] .ad-sched-preview {
+  margin: 0;
+  font: 600 13.5px/1.4 var(--font-sans, system-ui);
+  color: #2a2d33;
+}
+
+/* Tools picker. */
+.mkt-page[data-page="agent-detail"] .ad-tools-search {
+  display: flex;
+  align-items: center;
+  gap: 9px;
+  padding: 9px 12px;
+  border: 1px solid rgba(17, 19, 24, .12);
+  border-radius: 10px;
+  color: #9aa0a8;
+}
+.mkt-page[data-page="agent-detail"] .ad-tools-search input {
   flex: 1;
-  min-width: 0;
-  /* Custom chevron with a right offset so the arrow isn't flush to the border. */
-  appearance: none;
-  -webkit-appearance: none;
-  padding-right: 34px;
-  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 24 24' fill='none' stroke='%23111318' stroke-width='1.8' stroke-linecap='round' stroke-linejoin='round'><path d='M6 9l6 6 6-6'/></svg>");
-  background-repeat: no-repeat;
-  background-position: right 12px center;
-  background-size: 12px 12px;
+  border: 0;
+  outline: 0;
+  background: transparent;
+  font: 500 13px/1.4 var(--font-sans, system-ui);
+  color: #1d2026;
+}
+.mkt-page[data-page="agent-detail"] .ad-tools-count {
+  font: 600 11.5px/1 var(--font-sans, system-ui);
+  color: #8a8f99;
+  white-space: nowrap;
+}
+.mkt-page[data-page="agent-detail"] .ad-tools-groups {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+  max-height: 340px;
+  overflow-y: auto;
+  padding-right: 2px;
+}
+.mkt-page[data-page="agent-detail"] .ad-tools-group-head {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  margin-bottom: 9px;
+  font: 700 10.5px/1 var(--font-sans, system-ui);
+  letter-spacing: .08em;
+  text-transform: uppercase;
+  color: #6b7280;
+}
+.mkt-page[data-page="agent-detail"] .ad-tools-options {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+}
+.mkt-page[data-page="agent-detail"] .ad-tool-option {
+  display: inline-flex;
+  align-items: center;
+  gap: 7px;
+  padding: 8px 12px;
+  border: 1px solid rgba(17, 19, 24, .12);
+  border-radius: 999px;
+  background: #fff;
+  cursor: pointer;
+  font: 500 12.5px/1 var(--font-sans, system-ui);
+  color: #2a2d33;
+  transition: border-color .14s ease, background .14s ease, color .14s ease;
+}
+.mkt-page[data-page="agent-detail"] .ad-tool-option:hover { border-color: rgba(17, 19, 24, .26); }
+.mkt-page[data-page="agent-detail"] .ad-tool-option.is-on {
+  border-color: #1d2026;
+  background: #1d2026;
+  color: #fff;
+}
+.mkt-page[data-page="agent-detail"] .ad-tool-tag {
+  font: 700 9px/1 var(--font-sans, system-ui);
+  letter-spacing: .06em;
+  text-transform: uppercase;
+  color: #9aa0a8;
+  padding: 3px 6px;
+  border-radius: 6px;
+  background: rgba(17, 19, 24, .05);
+}
+.mkt-page[data-page="agent-detail"] .ad-tool-option.is-on .ad-tool-tag { color: #cfd3d9; background: rgba(255, 255, 255, .12); }
+.mkt-page[data-page="agent-detail"] .ad-tool-tag.warn { color: #9a6324; background: rgba(194, 132, 42, .12); }
+.mkt-page[data-page="agent-detail"] .ad-tools-noresult {
+  font: 500 13px/1.5 var(--font-sans, system-ui);
+  color: #8a8f99;
 }
-.mkt-page[data-page="agent-detail"] .ad-space-select::-ms-expand { display: none; }
 
-/* Recent activity. */
+/* Recent activity feed — executions + approvals, searchable. */
 .mkt-page[data-page="agent-detail"] .ad-activity-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 14px;
+  flex-wrap: wrap;
+  margin-bottom: 10px;
+}
+.mkt-page[data-page="agent-detail"] .ad-activity-title {
   font: 700 11px/1 var(--font-sans, system-ui);
   letter-spacing: .10em;
   text-transform: uppercase;
   color: #8a8f99;
-  margin-bottom: 6px;
 }
-.mkt-page[data-page="agent-detail"] .ad-runs {
+.mkt-page[data-page="agent-detail"] .ad-activity-search {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 7px 11px;
+  border: 1px solid rgba(17, 19, 24, .12);
+  border-radius: 999px;
+  color: #9aa0a8;
+  min-width: 220px;
+}
+.mkt-page[data-page="agent-detail"] .ad-activity-search input {
+  flex: 1;
+  border: 0;
+  outline: 0;
+  background: transparent;
+  font: 500 13px/1.2 var(--font-sans, system-ui);
+  color: #1d2026;
+}
+.mkt-page[data-page="agent-detail"] .ad-feed {
   list-style: none;
   margin: 0;
   padding: 0;
-  display: flex;
-  flex-direction: column;
 }
-.mkt-page[data-page="agent-detail"] .ad-run {
-  display: flex;
+.mkt-page[data-page="agent-detail"] .ad-feed-row {
+  display: grid;
+  grid-template-columns: auto 1fr auto auto;
   align-items: center;
-  justify-content: space-between;
-  gap: 12px;
+  gap: 14px;
   padding: 13px 2px;
   border-bottom: 1px solid rgba(17, 19, 24, .06);
-  font: 500 13px/1.4 var(--font-sans, system-ui);
 }
-.mkt-page[data-page="agent-detail"] .ad-run:last-child { border-bottom: 0; }
-.mkt-page[data-page="agent-detail"] .ad-run-label { color: #2a2d33; font-weight: 600; }
-.mkt-page[data-page="agent-detail"] .ad-run-when {
-  color: #8a8f99;
+.mkt-page[data-page="agent-detail"] .ad-feed-row:last-child { border-bottom: 0; }
+.mkt-page[data-page="agent-detail"] .ad-feed-icon {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 30px;
+  height: 30px;
+  border-radius: 9px;
+  background: rgba(17, 19, 24, .05);
+  color: #5b626c;
+}
+.mkt-page[data-page="agent-detail"] .ad-feed-icon.kind-approval { color: #1f6c9f; background: rgba(31, 108, 159, .10); }
+.mkt-page[data-page="agent-detail"] .ad-feed-main {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  min-width: 0;
+}
+.mkt-page[data-page="agent-detail"] .ad-feed-title {
+  font: 600 13.5px/1.35 var(--font-sans, system-ui);
+  color: #1d2026;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.mkt-page[data-page="agent-detail"] .ad-feed-meta {
+  font: 500 11.5px/1 var(--font-sans, system-ui);
+  color: #9aa0a8;
+}
+.mkt-page[data-page="agent-detail"] .ad-feed-status {
+  font: 600 12px/1 var(--font-sans, system-ui);
+  white-space: nowrap;
+}
+.mkt-page[data-page="agent-detail"] .ad-feed-status.tone-ok { color: #2d7044; }
+.mkt-page[data-page="agent-detail"] .ad-feed-status.tone-warn { color: #9a6324; }
+.mkt-page[data-page="agent-detail"] .ad-feed-status.tone-bad { color: #9a3325; }
+.mkt-page[data-page="agent-detail"] .ad-feed-status.tone-neutral { color: #6b7280; }
+.mkt-page[data-page="agent-detail"] .ad-feed-when {
+  font: 500 12px/1 var(--font-sans, system-ui);
+  color: #9aa0a8;
   font-variant-numeric: tabular-nums;
   white-space: nowrap;
 }
+.mkt-page[data-page="agent-detail"] .ad-feed-empty {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+  padding: 26px 2px;
+  font: 500 13px/1.5 var(--font-sans, system-ui);
+  color: #8a8f99;
+}
+.mkt-page[data-page="agent-detail"] .ad-feed-empty strong {
+  font-weight: 600;
+  color: #2a2d33;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .mkt-page[data-page="agent-detail"] .ad-drawer { transition: none; }
+}
 
 /* ---- Details view ------------------------------------------- */
 /* Compact overview — operative numbers, calm not debug-dumpy. */
@@ -3216,7 +3532,6 @@ a.admin-record-link{display:block;text-decoration:none;color:inherit;transition:
   .mkt-page[data-page="agent-detail"] .ad-facts,
   .mkt-page[data-page="agent-detail"] .ad-overview { grid-template-columns: 1fr 1fr; }
   .mkt-page[data-page="agent-detail"] .ad-kv-grid { grid-template-columns: 1fr; }
-  .mkt-page[data-page="agent-detail"] .ad-fact--publish { grid-column: 1 / -1; }
 }
 
 /* ============================================================== */

package/lib/agent-templates.js

@@ -18,6 +18,18 @@ export const AGENT_TEMPLATES = [
   ['finance-ops','Finance and Ops','finance_ops','anthropic',['file_read','create_artifact'],[], 'Reads finance docs and drafts advisory runway and ops summaries.'],
   ['legal-compliance','Legal and Compliance','legal_compliance','anthropic',['file_read','web_fetch','create_artifact'],[], 'Reviews policy and compliance documents as advisory output only.'],
   ['customer-support','Customer Support','customer_support','anthropic',['gmail_message_read','file_write'],[], 'Drafts customer replies and escalates approval-required sends.'],
+  // ── Business Agent Suite roles (P4) ───────────────────────────────────────
+  // Each role's external-write capabilities are unlocked by connecting the
+  // matching service and granting through the connection grant flow; the
+  // template ships only the safe built-in tools so a fresh install is runnable
+  // and every spend/send stays approval-gated.
+  ['chief-of-staff','Chief of Staff','chief_of_staff','anthropic',['web_search','file_read','file_write','create_artifact','create_workflow_definition'],['report-builder','market-research'],'Translates founder intent into delegated work across the company, runs the weekly cadence, and surfaces decisions. No direct external writes.'],
+  ['ads-media-buyer','Ads / Media Buyer','ads_media_buyer','anthropic',['web_search','file_write','create_artifact'],['design-shotgun'],'Plans, builds, and reports on paid campaigns across Meta/Google/TikTok within budget caps. Every campaign publish and budget set is approval-gated.'],
+  ['content-social','Content / Social Manager','content_social','anthropic',['web_search','file_write','create_artifact','voice_speak'],['design-shotgun'],'Produces and schedules organic posts, reels, and videos and maintains brand voice. Every publish is approval-gated.'],
+  ['sales-bd','Sales / BD','sales_bd','anthropic',['web_search','web_fetch','gmail_messages_list','email_send','create_artifact'],['inbox-triage'],'Builds target lists, enriches leads, runs outreach, and logs CRM activity. Bulk sends and CRM writes are approval-gated.'],
+  ['ops-manager','Operations','ops_manager','anthropic',['calendar_events_list','calendar_event_read','file_read','file_write','create_artifact'],['meeting-scheduler','report-builder'],'Keeps the business running — scheduling, internal docs, recurring checklists, vendor coordination. Calendar invites and webhooks are approval-gated.'],
+  ['product-pm','Product / Project Manager','product_pm','claude-code',['gh_repo_read','gh_issue_list','gh_issue_create','gh_pr_list','file_read','file_write','create_workflow_definition'],['review'],'Maintains the roadmap, writes specs, tracks delivery, and runs standups. Issue/PR creates respect the GitHub allowlist.'],
+  ['web-ecommerce','Web / Ecommerce','web_ecommerce','claude-code',['web_fetch','supabase_rest_select','browser_open','file_read','file_write','create_artifact'],['web-automation'],'Manages site/store content, products, SEO, and deploys. Deploys, store writes, and DB writes are approval-gated.'],
 ].map(([slug,title,role,engine_default,tools_required,skills,description_long]) => ({
   slug, title, role, engine_default, tools_required, tools_optional: [], skills,
   memory_scopes: ['agent','project'], approval_profile: role === 'personal_assistant' ? 'strict' : 'standard', description_long,

package/lib/connection-grant.js

@@ -0,0 +1,106 @@
+// lib/connection-grant.js — post-connect grant foundation.
+//
+// After a connection verifies, the operator chooses which agents get the tools it
+// unlocks. This is the missing UX glue, not a missing primitive: it composes the
+// connection manifest's `unlocks_tool_slugs` with the existing per-agent
+// enforcement layer (agent_tool_permissions via setAgentToolPermission).
+//
+// SAFE DEFAULTS (load-bearing): a granted tool's permission mode is derived from
+// its registry risk tier — NEVER from the caller:
+//   low / medium            → 'auto'              (runs without a per-call gate)
+//   high / irreversible_*   → 'approval_required' (always stops for a human)
+// irreversible_external additionally ALWAYS gates at execution regardless of the
+// stored mode, so 'approval_required' here is belt-and-suspenders, not the only
+// guard. Unknown tools (no registry descriptor) fall back to 'approval_required'.
+
+import { getDb, nowIso, newId } from './db.js';
+import { listMarketplaceTools } from './tools/registry.js';
+import { getConnection } from './connections.js';
+import { setAgentToolPermission } from './runtime.js';
+
+const AUTO_RISK = new Set(['low', 'medium']);
+
+/** Resolve the safe default permission mode for a tool by its risk tier. */
+export function defaultModeForRisk(riskLevel) {
+  return AUTO_RISK.has(riskLevel) ? 'auto' : 'approval_required';
+}
+
+function writeAudit(meta) {
+  try {
+    getDb().prepare(`
+      INSERT INTO audit_logs (id, at, type, summary, status, meta)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(
+      newId('audit'),
+      nowIso(),
+      'connection.grant',
+      `Granted ${meta.service_key} tools to ${meta.agent_ids.length} agent(s)`,
+      'ok',
+      JSON.stringify(meta),
+    );
+  } catch {
+    // best-effort
+  }
+}
+
+/**
+ * Grant a connection's unlocked tools to one or more agents.
+ *
+ * @param {object} args
+ * @param {string} [args.service_key]      connection slug; its manifest supplies unlocks_tool_slugs
+ * @param {string[]} [args.tool_slugs]     explicit tool slugs (overrides service_key lookup)
+ * @param {string[]} args.agent_ids        agents to grant to
+ * @returns {{ ok, granted: Array, skipped: Array, agent_ids: string[] }}
+ */
+export function grantConnectionToAgents(args = {}) {
+  const agentIds = Array.isArray(args.agent_ids) ? args.agent_ids.filter(Boolean).map(String) : [];
+  if (!agentIds.length) return { ok: false, error: 'no_agents', granted: [], skipped: [] };
+
+  // Resolve the unlocked tool slugs: explicit list wins, else the connection manifest.
+  let toolSlugs = Array.isArray(args.tool_slugs) ? args.tool_slugs.filter(Boolean).map(String) : null;
+  let serviceKey = args.service_key || null;
+  if (!toolSlugs) {
+    if (!serviceKey) return { ok: false, error: 'no_service_or_tools', granted: [], skipped: [] };
+    const connection = getConnection(serviceKey);
+    if (!connection) return { ok: false, error: 'connection_not_found', granted: [], skipped: [] };
+    const manifest = connection.manifest || {};
+    toolSlugs = Array.isArray(manifest.unlocks_tool_slugs) ? manifest.unlocks_tool_slugs.map(String) : [];
+  }
+
+  // Risk map from the live registry (static tools + dynamic composites/connectors).
+  const riskByTool = new Map();
+  for (const tool of listMarketplaceTools()) riskByTool.set(tool.name, tool.risk_level);
+
+  const db = getDb();
+  const granted = [];
+  const skipped = [];
+
+  for (const agentId of agentIds) {
+    const agentRow = db.prepare('SELECT id, tools FROM agents WHERE id = ?').get(agentId);
+    if (!agentRow) {
+      skipped.push({ agent_id: agentId, reason: 'agent_not_found' });
+      continue;
+    }
+    // Union the declared toolset so the agent card reflects the new tools.
+    let declared = [];
+    try { declared = JSON.parse(agentRow.tools || '[]'); } catch { declared = []; }
+    if (!Array.isArray(declared)) declared = [];
+    const declaredSet = new Set(declared);
+
+    for (const slug of toolSlugs) {
+      const risk = riskByTool.get(slug);
+      const mode = defaultModeForRisk(risk);
+      try {
+        setAgentToolPermission(agentId, slug, mode);
+        declaredSet.add(slug);
+        granted.push({ agent_id: agentId, tool: slug, mode, risk_level: risk || null });
+      } catch (err) {
+        skipped.push({ agent_id: agentId, tool: slug, reason: String(err?.message || err) });
+      }
+    }
+    db.prepare('UPDATE agents SET tools = ? WHERE id = ?').run(JSON.stringify([...declaredSet]), agentId);
+  }
+
+  writeAudit({ service_key: serviceKey, agent_ids: agentIds, tool_slugs: toolSlugs, granted_count: granted.length });
+  return { ok: true, granted, skipped, agent_ids: agentIds };
+}