omp-onlyne 0.1.0 → 0.3.0

package/src/tool-text.ts

@@ -7,7 +7,7 @@ const en = {
 	"param.meta": "Explicit references and operation fields",
 	description: `The only surface for Onlyne messages, threads and resources. There is no CLI and nothing else to look up: call this tool with your intent instead of reading docs or source first.
 
-Shape: { delivery_kind, msg, meta }. delivery_kind names the intent in plain language ("reply to dpdp's greeting", "show this thread", "read that message"). meta carries references you already know: to, thread, context, in_reply_to {thread,seq} or {sender,id}, relation (reply|followup), mentions, message {sender,id} or {thread,seq}, resource {owner,id}, operation, expected_revision, op, title, scope, seq, attention, cursor, page_size, data, domain_id, owner, since, event_id, operation_id.
+Shape: { delivery_kind, msg, meta }. delivery_kind names the intent in plain language ("reply to dpdp's greeting", "show this thread", "read that message"). meta carries references you already know: to, thread, context, in_reply_to {thread,seq} (preferred) or {sender,id}, relation (reply|followup), mentions, message {sender,id} or {thread,seq}, resource {owner,id}, operation, expected_revision, op, title, scope, seq, attention, cursor, page_size, data, domain_id, owner, since, event_id, operation_id.
 
 A send is one call. The result is the delivery fact: admission "accepted" means the receiver recorded the message; wait "timed_out" only means no reply arrived before the wait bound, the message is still delivered; reply_body "withheld" means this context already showed that body. Report the outcome and stop there.
 
@@ -32,27 +32,36 @@ meta.to takes one node or a list of nodes. A list is delivered one target at a t
 
 Use cases, each a complete call:
 
-- Reply to a message you received. Do not name a thread; the receiver lands the reply where the original lives:
-  { delivery_kind: "answer dpdp's question", msg: "Yes, the second set is fine.", meta: { in_reply_to: { sender: "urn:onlyne:agent:dpdp", id: "<message id>" }, relation: "reply" } }
+- Reply to a message you received. Reference it as {thread, seq}, copied from the delivery card — never an id from memory; the receiver lands the reply where the original lives:
+  { delivery_kind: "answer dpdp's question", msg: "Yes, the second set is fine.", meta: { in_reply_to: { thread: "<thread id>", seq: "<seq>" }, relation: "reply" } }
 - Send a fresh message to one peer: { delivery_kind: "greet lazuli", msg: "Hello from the workbench.", meta: { to: "lazuli" } }
 - Send the same note to two peers: { delivery_kind: "notify both", msg: "Report is up.", meta: { to: ["caerulea", "lazuli"] } } — you get one result per target, and a failure on one does not hide the other.
 - Read the whole exchange with one peer: read \`onlyne://conversations/<sender>/<id>\` from a list you got at \`onlyne://conversations\`. Read one message with \`onlyne://messages/<sender>/<id>\`.
 - Check what happened to a message you sent: read \`onlyne://outbound/<message-id>\`; it shows the landing the receiver reported, whether it is accepted, and the reply if one arrived.
 - Look at what a resource offers before operating it: read \`onlyne://resources\` or \`onlyne://resources/<owner>/<id>\`, then send the operation as { delivery_kind: "list the operations of this resource", msg: "show me what it can do", meta: { resource: { owner: "<node>", id: "<resource>" }, operation: "<name>" } }. meta.data carries the arguments; meta.expected_revision requires the revision you read.
-- In a subagent, answer without sending: { delivery_kind: "draft the reply", msg: "Here is the answer.", meta: { op: "draft", to: "dpdp", relation: "reply", in_reply_to: { sender: "urn:onlyne:agent:dpdp", id: "<message id>" } } } returns { draft_id }. The main session sends exactly that draft: { delivery_kind: "send the drafted reply", msg: "send draft", meta: { draft_id: "<draft id>" } }.
-- When a send fails with no trusted key, do not retry and do not try to pair: the error names both nodes, the responsible holder and the entry in the host surface. Report it and stop.
-
-The judge role chooses the action and plan from your intent, so never invent message ids, idempotency keys or revisions. A reply or followup states its relation; omitting it is rejected rather than assumed. A reply targets the original reply authority, so a conflicting to is rejected. A subagent session reads its own slice (onlyne://threads, onlyne://inbox, onlyne://contexts) and returns the result to the main session, which does the sending.`,
+- In a subagent, answer without sending: { delivery_kind: "draft the reply", msg: "Here is the answer.", meta: { op: "draft", to: "dpdp", relation: "reply", in_reply_to: { thread: "<thread id>", seq: "<seq>" } } } returns { draft_id }. The main session sends exactly that draft: { delivery_kind: "send the drafted reply", msg: "send draft", meta: { draft_id: "<draft id>" } }.
+- Approve a peer whose invitation waits for you: { delivery_kind: "accept the trust handshake", msg: "accept the peer", meta: { op: "trust_accept", node_id: "<node>", fingerprint: "<fingerprint>" } }. The acquisition policy judges it first, and a refusal names the rule it matched and leaves the peer as it was.
+- Drop an approval: { delivery_kind: "revoke the trust handshake", msg: "revoke the peer", meta: { op: "trust_revoke", node_id: "<node>" } }. Revocation is never judged by the policy and names no fingerprint.
+- Start an exchange with a discovered peer you are not paired with yet: { delivery_kind: "start the handshake with lazuli", msg: "start the exchange", meta: { op: "trust_begin", node_id: "lazuli" } }. The acquisition policy judges it before anything is sent: a refusal names the rule it matched and leaves the peer as it was, and an allow commits the local approval, sends the statement and reports the phase that followed.
+- Put a peer into a conversation, so the thread carries several members: { delivery_kind: "add dpdp to the plan thread", msg: "add dpdp", meta: { op: "member_add", thread: "<thread id or title>", to: "dpdp" } }; one call per member when meta.to is a list. Take one out with op "member_remove". Adding a member puts them in that thread, so a later meta.to array WITH meta.thread addresses one thread, while without meta.thread each target gets its own.
+- When a send fails with no trusted key, do not retry: the error names both nodes, and a pending invitation is confirmed by the acquisition policy or by that node's holder, not by another send. Report it and stop.
+
+The judge role chooses the action and plan from your intent, so never invent message ids, idempotency keys or revisions. Reference a message as {thread, seq}; when a call states neither a reference nor a relation and this context has unanswered inbound messages, the judge asks which one it answers. A reply targets the original reply authority, so a conflicting to is rejected. A subagent session reads its own slice (onlyne://threads, onlyne://inbox, onlyne://contexts) and returns the result to the main session, which does the sending.`,
 	"summary.no_result": "Onlyne returned no structured result.",
-	"summary.where": " to {owner}",
-	"summary.thread_ref": " (thread {thread} seq {seq}{answering})",
+	"summary.addressee": "Sent to {to}",
+	"summary.addressee_self": "Sent to yourself",
+	"summary.stored_here": "thread {thread} is hosted on your node, seq {seq}{answering}",
+	"summary.stored_there": "thread {thread} is hosted on {owner}, seq {seq}{answering}",
 	"summary.answering": ", answering {sender}/{id}",
-	"summary.outbound": " · read back: onlyne://outbound/{id}",
-	"summary.delivered": "Delivered{where}{facts}{trail} and recorded durably.",
-	"summary.delivered_answered": "Delivered{where}{facts}{trail}. {author} answered at seq {seq}.",
-	"summary.delivered_withheld": "Delivered{where}{facts}{trail}. {author} answered at seq {seq}, but that body was already shown in this context, so only its arrival is reported.",
-	"summary.delivered_timed_out": "Delivered{where}{facts}{trail} and recorded durably. No reply arrived within the wait; it will arrive on its own as an inbound message.",
-	"summary.delivered_cancelled": "Delivered{where}{facts}{trail} and recorded durably. The wait was cancelled; a reply will arrive on its own as an inbound message.",
+	"summary.sep": " · ",
+	"summary.resolved": "resolved: {node}",
+	"summary.outbound": "read back: onlyne://outbound/{id}",
+	"summary.grant_notice": "; the entry lives here because you host the thread, and {to} reads it as a member once the grant notice reaches it",
+	"summary.delivered": "{facts} and recorded durably{mechanism}.",
+	"summary.delivered_answered": "{facts} and recorded durably{mechanism}. {author} answered at seq {seq}.",
+	"summary.delivered_withheld": "{facts} and recorded durably{mechanism}. {author} answered at seq {seq}, but that body was already shown in this context, so only its arrival is reported.",
+	"summary.delivered_timed_out": "{facts} and recorded durably{mechanism}. No reply arrived within the wait; it will arrive on its own as an inbound message.",
+	"summary.delivered_cancelled": "{facts} and recorded durably{mechanism}. The wait was cancelled; a reply will arrive on its own as an inbound message.",
 	"summary.not_confirmed": "Not confirmed: {failure}. {next}",
 	"summary.retry": "The record stays open and the runtime retries it; sending again would commit a second intent.",
 	"summary.recover": "The record stays open for recovery; do not re-send the same intent.",
@@ -63,6 +72,14 @@ The judge role chooses the action and plan from your intent, so never invent mes
 	"draft.ready": "Draft {draft_id} is ready; the main session sends it with meta.draft_id.",
 	"multi.delivered": "→ {to}: {summary}",
 	"multi.failed": "→ {to}: not sent — {error}",
+	"trust.accepted": "Approved {node} ({fingerprint}); the trust phase is now {phase}.",
+	"trust.revoked": "Revoked {node}; local approval is dropped.",
+	"trust.begun": "Started the exchange with {node} ({fingerprint}); the trust phase is now {phase}. The local approval is committed and the statement is sent, so this peer can exchange messages once it approves in turn.",
+	"thread.member_added": "Added {member} to thread {thread}. That member now reads and posts in it, and a later meta.to array with meta.thread {thread} puts every target in this one thread; the same array without meta.thread gives each target its own thread.",
+	"thread.member_removed": "Removed {member} from thread {thread}. The thread stays open and its earlier entries are still its history; a later bare send to {member} opens its own two-party thread.",
+	"failure.trust_node_unknown": "{action} names no known node {node}. Name the node id, or a short alias that exactly one known peer carries.",
+	"failure.trust_fields": "A trust action needs a non-empty string {field}.",
+	"failure.trust_main_only": "Only the main session approves or revokes a peer; a subagent drafts instead.",
 } as const;
 
 const zh: Record<keyof typeof en, string> = {
@@ -72,7 +89,7 @@ const zh: Record<keyof typeof en, string> = {
 	"param.meta": "显式引用与操作字段",
 	description: `Onlyne 消息、thread 与资源的唯一入口。没有 CLI，也没有别处要查：把意图交给这个工具，不要先去读文档或源码。
 
-形状：{ delivery_kind, msg, meta }。delivery_kind 用日常语言说出意图（“回复 dpdp 的问候”“看看这个 thread”“读那条消息”）。meta 放你已经知道的引用：to、thread、context、in_reply_to {thread,seq} 或 {sender,id}、relation（reply|followup）、mentions、message {sender,id} 或 {thread,seq}、resource {owner,id}、operation、expected_revision、op、title、scope、seq、attention、cursor、page_size、data、domain_id、owner、since、event_id、operation_id。
+形状：{ delivery_kind, msg, meta }。delivery_kind 用日常语言说出意图（“回复 dpdp 的问候”“看看这个 thread”“读那条消息”）。meta 放你已经知道的引用：to、thread、context、in_reply_to {thread,seq}（首选）或 {sender,id}、relation（reply|followup）、mentions、message {sender,id} 或 {thread,seq}、resource {owner,id}、operation、expected_revision、op、title、scope、seq、attention、cursor、page_size、data、domain_id、owner、since、event_id、operation_id。
 
 发送是一次调用。结果就是投递事实：admission "accepted" 表示接收方已经记录这条消息；wait "timed_out" 只表示等待期内没有回信，消息本身已经投递；reply_body "withheld" 表示这个上下文已经展示过那段正文。报告结果，到此为止。
 
@@ -97,27 +114,36 @@ meta.to 接受一个节点或一组节点。一组会逐个目标投递，每个
 
 用例，每个都是完整调用：
 
-- 回复你收到的消息。不要指名 thread；接收方会把回信放到原消息所在的 thread：
-  { delivery_kind: "回答 dpdp 的问题", msg: "可以，第二组没问题。", meta: { in_reply_to: { sender: "urn:onlyne:agent:dpdp", id: "<message id>" }, relation: "reply" } }
+- 回复你收到的消息。引用写成 {thread, seq}，从投递卡片上照抄——绝不凭记忆写 id；接收方会把回信放到原消息所在的 thread：
+  { delivery_kind: "回答 dpdp 的问题", msg: "可以，第二组没问题。", meta: { in_reply_to: { thread: "<thread id>", seq: "<seq>" }, relation: "reply" } }
 - 给一个 peer 发新消息：{ delivery_kind: "向 lazuli 问好", msg: "来自工作台的问候。", meta: { to: "lazuli" } }
 - 把同一段话发给两个 peer：{ delivery_kind: "通知双方", msg: "报告已上传。", meta: { to: ["caerulea", "lazuli"] } } —— 每个目标各得一条结果，某个目标失败不会掩盖另一个。
 - 读与某个 peer 的整段往来：先读 \`onlyne://conversations\` 拿到一条，再读 \`onlyne://conversations/<sender>/<id>\`。读单条消息用 \`onlyne://messages/<sender>/<id>\`。
 - 查你发出的消息后来怎样了：读 \`onlyne://outbound/<message-id>\`；它显示接收方报告的落点、是否被接纳，以及回信（如果到了）。
 - 操作资源前先看它提供什么：读 \`onlyne://resources\` 或 \`onlyne://resources/<owner>/<id>\`，然后发操作 { delivery_kind: "列出该资源的操作", msg: "看看它能做什么", meta: { resource: { owner: "<node>", id: "<resource>" }, operation: "<name>" } }。meta.data 带参数；meta.expected_revision 要求版本与你读到的一致。
-- 在子代理里，只写不发：{ delivery_kind: "起草回复", msg: "这是答案。", meta: { op: "draft", to: "dpdp", relation: "reply", in_reply_to: { sender: "urn:onlyne:agent:dpdp", id: "<message id>" } } } 返回 { draft_id }。主会话原样发出这份草稿：{ delivery_kind: "发出起草的回复", msg: "发送草稿", meta: { draft_id: "<draft id>" } }。
-- 发送失败且没有可信密钥时，不要重试也不要尝试配对：错误里写明了两个节点、负责的持有者和宿主界面上的入口。报告它，然后停下。
-
-动作和执行计划由 judge 角色根据你的意图选择，所以永远不要自己编 message id、幂等键或版本号。回信或 followup 必须说明关系；省略会被拒绝，而不是被假定。回信只针对原来的回信权限方，所以冲突的 to 会被拒绝。子代理会话读自己的切片（onlyne://threads、onlyne://inbox、onlyne://contexts），把结果交回主会话，由主会话发送。`,
+- 在子代理里，只写不发：{ delivery_kind: "起草回复", msg: "这是答案。", meta: { op: "draft", to: "dpdp", relation: "reply", in_reply_to: { thread: "<thread id>", seq: "<seq>" } } } 返回 { draft_id }。主会话原样发出这份草稿：{ delivery_kind: "发出起草的回复", msg: "发送草稿", meta: { draft_id: "<draft id>" } }。
+- 批准一个在等你决定的对端：{ delivery_kind: "批准信任握手", msg: "批准这个对端", meta: { op: "trust_accept", node_id: "<node>", fingerprint: "<fingerprint>" } }。先由获取策略判定；被拒时错误里写明命中的规则，对端保持原样。
+- 撤回一次批准：{ delivery_kind: "撤销信任握手", msg: "撤销这个对端", meta: { op: "trust_revoke", node_id: "<node>" } }。撤销永远不受策略限制，也不需要指纹。
+- 与一个已发现但尚未配对的对端发起交换：{ delivery_kind: "与 lazuli 开始握手", msg: "开始交换", meta: { op: "trust_begin", node_id: "lazuli" } }。获取策略会在发出任何请求之前判定：被拒时错误里写明命中的规则，对端保持原样；放行时提交本地批准、发出陈述，并报告其后的信任阶段。
+- 把一个对端加进一段对话，让这个 thread 带多个成员：{ delivery_kind: "把 dpdp 加进 plan thread", msg: "加上 dpdp", meta: { op: "member_add", thread: "<thread id 或标题>", to: "dpdp" } }；meta.to 是列表时每个成员各一次调用。用 op "member_remove" 移出。加入成员就是把他放进那个 thread，所以之后带 meta.thread 的 meta.to 数组只指向一个 thread，不带 meta.thread 时每个目标各得一个。
+- 发送失败且没有可信密钥时，不要重试：错误里写明了两个节点；待确认的邀请由获取策略或那一侧的持有者确认，再发一次不会。报告它，然后停下。
+
+动作和执行计划由 judge 角色根据你的意图选择，所以永远不要自己编 message id、幂等键或版本号。引用消息一律写成 {thread, seq}；当一次调用既没有引用也没有 relation、而本上下文还有未答复的入站消息时，由 judge 判断它在回答哪一条。回信只针对原来的回信权限方，所以冲突的 to 会被拒绝。子代理会话读自己的切片（onlyne://threads、onlyne://inbox、onlyne://contexts），把结果交回主会话，由主会话发送。`,
 	"summary.no_result": "Onlyne 没有返回结构化结果。",
-	"summary.where": "，投递给 {owner}",
-	"summary.thread_ref": "（thread {thread} seq {seq}{answering}）",
+	"summary.addressee": "已发给 {to}",
+	"summary.addressee_self": "已发给自己",
+	"summary.stored_here": "thread {thread} 建在你这侧，seq {seq}{answering}",
+	"summary.stored_there": "thread {thread} 建在 {owner} 那侧，seq {seq}{answering}",
 	"summary.answering": "，回复 {sender}/{id}",
-	"summary.outbound": "；读回: onlyne://outbound/{id}",
-	"summary.delivered": "已送达{where}{facts}，并已持久记录{trail}。",
-	"summary.delivered_answered": "已送达{where}{facts}，并已持久记录{trail}。{author} 在 seq {seq} 回复了。",
-	"summary.delivered_withheld": "已送达{where}{facts}，并已持久记录{trail}。{author} 在 seq {seq} 回复了，但那段正文已经在这个上下文里展示过，所以只报告它到达。",
-	"summary.delivered_timed_out": "已送达{where}{facts}，并已持久记录{trail}。等待期内没有回信；回信会作为入站消息自己到达。",
-	"summary.delivered_cancelled": "已送达{where}{facts}，并已持久记录{trail}。等待被取消；回信会作为入站消息自己到达。",
+	"summary.sep": "；",
+	"summary.resolved": "resolved: {node}",
+	"summary.outbound": "读回: onlyne://outbound/{id}",
+	"summary.grant_notice": "；条目留在你这里是因为 thread 由你持有，{to} 收到 grant 通知后作为成员读它",
+	"summary.delivered": "{facts}，并已持久记录{mechanism}。",
+	"summary.delivered_answered": "{facts}，并已持久记录{mechanism}。{author} 在 seq {seq} 回复了。",
+	"summary.delivered_withheld": "{facts}，并已持久记录{mechanism}。{author} 在 seq {seq} 回复了，但那段正文已经在这个上下文里展示过，所以只报告它到达。",
+	"summary.delivered_timed_out": "{facts}，并已持久记录{mechanism}。等待期内没有回信；回信会作为入站消息自己到达。",
+	"summary.delivered_cancelled": "{facts}，并已持久记录{mechanism}。等待被取消；回信会作为入站消息自己到达。",
 	"summary.not_confirmed": "未确认：{failure}。{next}",
 	"summary.retry": "记录保持打开，运行时自己重试；再发一次会提交第二个意图。",
 	"summary.recover": "记录保持打开，等待恢复；不要再发同一个意图。",
@@ -128,6 +154,14 @@ meta.to 接受一个节点或一组节点。一组会逐个目标投递，每个
 	"draft.ready": "草稿 {draft_id} 已就绪；主会话用 meta.draft_id 发出它。",
 	"multi.delivered": "→ {to}: {summary}",
 	"multi.failed": "→ {to}: 未发送 —— {error}",
+	"trust.accepted": "已批准 {node}（{fingerprint}），信任阶段现在是 {phase}。",
+	"trust.revoked": "已撤销 {node}；本地批准已撤回。",
+	"trust.begun": "已与 {node}（{fingerprint}）发起交换，信任阶段现在是 {phase}。本地批准已提交、陈述已发出，等对端反向批准后即可互通消息。",
+	"thread.member_added": "已把 {member} 加入 thread {thread}。该成员现在可以读写这个 thread；之后带 meta.thread {thread} 的 meta.to 数组会把每个目标都放进这一个 thread，而不带 meta.thread 的同一数组会让每个目标各得一个 thread。",
+	"thread.member_removed": "已把 {member} 移出 thread {thread}。thread 本身保留、此前的条目仍是它的历史；之后单独发给 {member} 的消息会另开一个两人 thread。",
+	"failure.trust_node_unknown": "{action} 没有指名任何已知节点 {node}。写节点 id，或写只有一个已知对端持有的短别名。",
+	"failure.trust_fields": "信任动作需要非空字符串字段 {field}。",
+	"failure.trust_main_only": "只有主会话可以批准或撤销对端；子代理只能起草。",
 };
 
 export const toolText = createTranslator({ en, "zh-CN": zh });

package/src/tool.ts

@@ -1,10 +1,10 @@
 import type { AgentToolResult } from "@oh-my-pi/pi-agent-core";
 import { type ExtensionAPI, type ExtensionContext, type SessionEntry, z } from "@oh-my-pi/pi-coding-agent";
-import type { Json, MsgInput, SendOutcome } from "@onlyne/lib";
+import { OnlyneError, trustPhase, type Json, type MsgInput, type SendOutcome } from "@onlyne/lib";
 import { runDecision } from "./decider.ts";
 import { createDraft, sendDraft } from "./drafts.ts";
 import { observeToolResult } from "./messages.ts";
-import { getRuntime } from "./runtime.ts";
+import { getRuntime, type PluginRuntime } from "./runtime.ts";
 import { toolText } from "./tool-text.ts";
 
 /** Custom entry naming a reply an `await` returned, left pending for the host bridge to confirm. */
@@ -57,10 +57,42 @@ export function registerMsgTool(pi: ExtensionAPI): void {
 					const draft = result as { draft_id: string };
 					return { content: [{ type: "text", text: toolText("draft.ready", { draft_id: draft.draft_id }) }], details: { result } };
 				}
-				if (typeof parsed.data.meta?.draft_id === "string") {
-					const result = await sendDraft(runtime, ctx, parsed.data.meta.draft_id, signal);
+				// RFC 0018 §3.1: a trust action is mechanical — no judging, and no action kind
+				// invented for it, because the library executes exactly five and a trust action is
+				// not one of them (client.ts admits send, read, thread, resource and domain).
+				if (op === "trust_accept" || op === "trust_revoke" || op === "trust_begin") {
+					if (ctx.agent.kind === "sub") throw new OnlyneError("forbidden", toolText("failure.trust_main_only"));
+					const node = await trustNode(runtime, op, parsed.data.meta);
+					if (op === "trust_revoke") {
+						await runtime.acquireRevoke(node);
+						return { content: [{ type: "text", text: toolText("trust.revoked", { node }) }], details: { result: { op, node_id: node } } };
+					}
+					if (op === "trust_begin") {
+						const entry = await runtime.acquireBegin(node);
+						return {
+							content: [{ type: "text", text: toolText("trust.begun", { node, fingerprint: entry.fingerprint, phase: trustPhase(entry) }) }],
+							details: { result: entry },
+						};
+					}
+					const entry = await runtime.acquireAccept(node, trustField(parsed.data.meta, "fingerprint"));
+					return {
+						content: [{ type: "text", text: toolText("trust.accepted", { node, fingerprint: entry.fingerprint, phase: trustPhase(entry) }) }],
+						details: { result: entry },
+					};
+				}
+				const draftId = typeof parsed.data.meta?.draft_id === "string" ? parsed.data.meta.draft_id : undefined;
+				// `send_draft` names the act, not the row: the draft is found by the message it
+				// answers, or by the newest one this session created. `meta.draft_id` alone keeps
+				// working because the handoff from a drafting child reports exactly that id.
+				if (op === "send_draft" || draftId !== undefined) {
+					const result = await sendDraft(runtime, ctx, {
+						...(draftId === undefined ? {} : { id: draftId }),
+						...(parsed.data.meta?.in_reply_to === undefined
+							? {}
+							: { in_reply_to: parsed.data.meta.in_reply_to as Json }),
+					}, signal);
 					recordAwaitResult(pi, toolCallId, result, ctx);
-					return { content: [{ type: "text", text: `${summary(result)}\n\n${JSON.stringify(visibleResult(result), null, 2)}` }], details: { result: visibleResult(result) } };
+					return { content: [{ type: "text", text: `${summary(result, spelling(parsed.data.meta?.to))}\n\n${JSON.stringify(visibleResult(result), null, 2)}` }], details: { result: visibleResult(result) } };
 				}
 				const targets = parsed.data.meta?.to;
 				if (Array.isArray(targets)) {
@@ -78,7 +110,7 @@ export function registerMsgTool(pi: ExtensionAPI): void {
 						}
 					}
 					const text = rows.map(row => row.error === undefined
-						? toolText("multi.delivered", { to: String(row.to), summary: summary(row.outcome) })
+						? toolText("multi.delivered", { to: String(row.to), summary: summary(row.outcome, spelling(row.to)) })
 						: toolText("multi.failed", { to: String(row.to), error: row.error })).join("\n");
 					pi.logger.info("onlyne.msg.multi", { targets: rows.length, failed: rows.filter(row => row.error !== undefined).length });
 					return { content: [{ type: "text", text: `${text}\n\n${JSON.stringify(rows, null, 2)}` }], details: { result: rows } };
@@ -92,8 +124,11 @@ export function registerMsgTool(pi: ExtensionAPI): void {
 				recordAwaitResult(pi, toolCallId, result, ctx);
 				const visible = visibleResult(result);
 				pi.logger.info("onlyne.msg.result", { kind: input.delivery_kind, ms: Date.now() - started, ...outcomeFacts(result) });
+				const text = op === "member_add" || op === "member_remove"
+					? membershipText(op, visible, parsed.data.meta)
+					: summary(result, spelling(parsed.data.meta?.to));
 				return {
-					content: [{ type: "text", text: `${summary(result)}\n\n${JSON.stringify(visible, null, 2)}` }],
+					content: [{ type: "text", text: `${text}\n\n${JSON.stringify(visible, null, 2)}` }],
 					details: { result: visible },
 				};
 			} catch (error) {
@@ -112,22 +147,47 @@ export function registerMsgTool(pi: ExtensionAPI): void {
  * `wait: timed_out` beside `admission: accepted` reads as a contradiction until the
  * reader knows the contract — so the delivery fact is stated first and the JSON below
  * it is for the rare case that needs a machine-readable detail.
+ *
+ * `addressed` is the target as the caller wrote it. A receipt names the thread's owner, which
+ * is this node whenever it started the conversation, so leading with it made a message to a
+ * peer read as a message to itself; the addressee comes first and the storage second.
  */
-export function summary(result: unknown): string {
+export function summary(result: unknown, addressed?: string): string {
 	if (result === null || typeof result !== "object") return toolText("summary.no_result");
 	const outcome = result as Partial<SendOutcome>;
-	const owner = outcome.receipt?.thread_ref?.owner ?? outcome.reply?.thread_ref.owner;
-	const where = owner === undefined ? "" : toolText("summary.where", { owner });
+	const receipt = outcome.receipt;
+	// The message's own sender is this node: `send` refuses a message another node authors.
+	const self = receipt?.message_ref.sender;
+	const to = outcome.resolved ?? outcome.requested ?? addressed;
 	// The answer is part of the delivery fact: a reply the receipt cannot attribute is one the
 	// sender cannot prove landed on the message it meant (cyanea report 2, problem 2).
-	const answers = outcome.receipt?.in_reply_to;
+	const answers = receipt?.in_reply_to;
 	const answering = answers === undefined ? "" : toolText("summary.answering", { sender: answers.sender, id: answers.id });
-	const facts = outcome.receipt === undefined
-		? ""
-		: toolText("summary.thread_ref", { thread: outcome.receipt.thread_ref.id, seq: outcome.receipt.seq, answering });
-	// The receipt names a thread the receiver owns, which is not a local object; the outbound
-	// record is. Point the reader at the handle that opens (dpdp report, problem 1).
-	const trail = outcome.receipt === undefined ? "" : toolText("summary.outbound", { id: outcome.receipt.message_ref.id });
+	// The receipt names the thread owner, which is this node when it started the conversation;
+	// a peer's thread is stored at the peer, so the two cases are stated apart.
+	const storedHere = receipt !== undefined && receipt.thread_ref.owner === self;
+	const storage = receipt === undefined ? "" : toolText(storedHere ? "summary.stored_here" : "summary.stored_there", {
+		owner: receipt.thread_ref.owner, thread: receipt.thread_ref.id, seq: receipt.seq, answering,
+	});
+	const facts = [
+		// The self case is the one the reader has to be told about: this node's own id reads as a
+		// peer name, and the thread is hosted here either way.
+		to === undefined ? "" : toolText(to === self ? "summary.addressee_self" : "summary.addressee", { to }),
+		storage,
+		// The resolved addressee is what keeps an alias send from reading as a self-send.
+		outcome.resolved === undefined || outcome.resolved === outcome.requested ? "" : toolText("summary.resolved", { node: outcome.resolved }),
+		// The receipt names a thread the receiver owns, which is not a local object; the outbound
+		// record is. Point the reader at the handle that opens (dpdp report, problem 1).
+		receipt === undefined ? "" : toolText("summary.outbound", { id: receipt.message_ref.id }),
+	].filter(part => part.length > 0).join(toolText("summary.sep"));
+	// A thread this node hosts and a peer it addressed: the entry sits here because this node
+	// hosts the thread, so the sentence names the addressee that reads it. Without that, "hosted
+	// on your node" beside "Sent to <peer>" reads as a message this node wrote to itself.
+	const mechanism = storedHere && to !== undefined && to !== self
+		? toolText("summary.grant_notice", { to })
+		: "";
+	// With no addressee the sentence opens on the storage fact, so it is capitalized like a lead.
+	const body = to === undefined && facts.length > 0 ? facts.charAt(0).toUpperCase() + facts.slice(1) : facts;
 	if (outcome.admission !== undefined) {
 		if (outcome.admission !== "accepted") {
 			const error = outcome.error;
@@ -139,23 +199,31 @@ export function summary(result: unknown): string {
 				: toolText("summary.recover");
 			return toolText("summary.not_confirmed", { failure, next });
 		}
+		// No receipt means no addressee and no storage to state; the JSON below carries the rest.
+		if (body.length === 0) return toolText("summary.plain");
+		const vars = { facts: body, mechanism };
 		if (outcome.wait === "answered" && outcome.reply !== undefined) {
-			const answer = { author: outcome.reply.authenticated_author, seq: outcome.reply.seq, where, facts, trail };
+			const answer = { ...vars, author: outcome.reply.authenticated_author, seq: outcome.reply.seq };
 			return outcome.reply_body === "withheld"
 				? toolText("summary.delivered_withheld", answer)
 				: toolText("summary.delivered_answered", answer);
 		}
 		if (outcome.wait === "timed_out") {
-			return toolText("summary.delivered_timed_out", { where, facts, trail });
+			return toolText("summary.delivered_timed_out", vars);
 		}
 		if (outcome.wait === "cancelled") {
-			return toolText("summary.delivered_cancelled", { where, facts, trail });
+			return toolText("summary.delivered_cancelled", vars);
 		}
-		return toolText("summary.delivered", { where, facts, trail });
+		return toolText("summary.delivered", vars);
 	}
 	return toolText("summary.plain");
 }
 
+/** The caller's spelling of one target, when it is a plain name rather than a structured ref. */
+function spelling(value: unknown): string | undefined {
+	return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+
 /** The facts one `msg` call produced, without the reply body. */
 function outcomeFacts(result: unknown): Record<string, unknown> {
 	if (result === null || typeof result !== "object") return {};
@@ -234,3 +302,50 @@ function failure(text: string): AgentToolResult<{ result: unknown }> {
 		isError: true,
 	};
 }
+
+/**
+ * RFC 0018 §3.1: a trust op names its peer mechanically. The fields are read before any
+ * judgement or storage write, so a malformed call is a caller error, never a policy answer.
+ */
+function trustField(meta: Record<string, unknown> | undefined, field: string): string {
+	const value = meta?.[field];
+	if (typeof value !== "string" || value.length === 0) throw new OnlyneError("invalid_request", toolText("failure.trust_fields", { field }));
+	return value;
+}
+
+/**
+ * RFC 0018 §3.1: the peer a trust op names, resolved through the same peer set a send resolves
+ * `meta.to` from. An ambiguous alias names its matches; an unknown one is `not_found` and says
+ * which action asked, because the same alias may be valid for another one.
+ */
+async function trustNode(runtime: PluginRuntime, op: string, meta: Record<string, unknown> | undefined): Promise<string> {
+	const node = trustField(meta, "node_id");
+	try {
+		return await runtime.decider.peerId(node);
+	} catch (error) {
+		if (error instanceof OnlyneError && error.error.code === "not_found") {
+			throw new OnlyneError("not_found", toolText("failure.trust_node_unknown", { action: op, node }), error.error.details);
+		}
+		throw error;
+	}
+}
+
+/** The sentence one membership op earns: the member, the thread, and where a later array send lands. */
+function membershipText(op: "member_add" | "member_remove", result: unknown, meta: Record<string, unknown> | undefined): string {
+	const named = result !== null && typeof result === "object" && "peer" in result && typeof result.peer === "string"
+		? result.peer
+		: threadLabel(meta?.to);
+	return toolText(op === "member_add" ? "thread.member_added" : "thread.member_removed", {
+		member: named,
+		thread: threadLabel(meta?.thread),
+	});
+}
+
+/** A reference as the caller wrote it: one name, or `owner/id` for the record form. */
+function threadLabel(value: unknown): string {
+	if (typeof value === "string") return value;
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return "";
+	const owner = "owner" in value ? value.owner : undefined;
+	const id = "id" in value ? value.id : undefined;
+	return typeof owner === "string" && typeof id === "string" ? `${owner}/${id}` : "";
+}

package/src/types.ts

@@ -1,54 +1,6 @@
-import type { MessageRef, NodeId, ThreadRef, TrustPhase, TrustSeed } from "@onlyne/lib";
-import type { Locale } from "@onlyne/node-host/i18n";
-
-/**
- * Project-scoped configuration in `<project>/.onlyne/config.toml`.
- *
- * Delivery decisions are made by OMP's `judge` model role, so no model
- * endpoint or model name belongs here.
- */
-export interface OnlyneConfig {
-	path: string;
-	language?: Locale;
-	/** Protocol membership, independent from the node identity. */
-	region: string;
-	node: {
-		id: NodeId;
-		key_ref?: string;
-		/** Where the node identity lives: the project's `.onlyne/keys`, the user's key store, or no key at all. */
-		key_scope?: "project" | "global" | "none";
-	};
-	server: {
-		bind: string;
-		/** The externally reachable base URL when a reverse proxy fronts the node. */
-		public_url?: string;
-	};
-	threads: {
-		page_size: number;
-	};
-	/** Bootstrap contact seeds the node reaches at every start. */
-	discovery?: {
-		seeds?: string[];
-	};
-	/** Pinned peer fingerprints; an arriving key that matches is trusted without a prompt. */
-	trust?: TrustSeed[];
-}
-
-/** One execution context the plugin registered for a delivered message. */
-export interface ContextRecord {
-	alias: string;
-	node_id: NodeId;
-	main_agent_id: string;
-	source?: { sender: NodeId; id: string };
-	agent_id?: string;
-	session_file?: string;
-	parent_id?: string;
-	thread_ref?: ThreadRef;
-	summary: string;
-	state: "unbound" | "idle" | "running" | "parked" | "lost";
-	created_at: string;
-	bound_at?: string;
-}
+import type { MessageRef, NodeId, ThreadRef, TrustPhase, WorkRef } from "@onlyne/lib";
+import type { AcquirePolicy } from "@onlyne/node-host/acquire";
+import type { ContextRecord } from "@onlyne/node-host/types";
 
 /** One row of the viewer's queue page. */
 export interface QueueItem {
@@ -68,6 +20,8 @@ export interface ViewerMessage {
 	at: string;
 	text: string;
 	relation?: string;
+	/** The work unit the sender named (RFC 0003 §1), when the message carries one. */
+	work?: WorkRef;
 }
 
 /** One thread row in the viewer's chat page. */
@@ -79,6 +33,11 @@ export interface ViewerThread {
 	unread: number;
 	last_seq: string;
 	messages: ViewerMessage[];
+	/**
+	 * A thread another node hosts: this node was invited into it, so the viewer can show it and
+	 * cannot offer the writes that belong to its owner.
+	 */
+	read_only?: boolean;
 }
 
 /** One discovery record row the viewer lists as an automatic-discovery candidate. */
@@ -104,6 +63,56 @@ export interface ViewerContact {
 	last_seen: string;
 }
 
+/** RFC 0018 §5: the acquisition settings this runtime actually runs with, read back for the panel. */
+export interface AcquisitionSnapshot {
+	policy: AcquirePolicy;
+	allow: string[];
+	/**
+	 * The discovery layer's separate loopback switch (RFC 0018 §5.1). It decides what may enter
+	 * the catalog, not what may be approved without a human, and the panel shows both values
+	 * together so loosening one is never mistaken for loosening the other.
+	 */
+	allow_loopback: boolean;
+}
+
+/**
+ * One acquisition audit row. The actors stay distinguishable (RFC 0018 §5): a human's panel
+ * action, an agent's decision, a configured seed's pre-authorization, and the policy's own
+ * automatic verdict. `allowed` is the verdict the gate reached; `override` marks a human
+ * approval that committed although the policy refused it, and a seed authorization that
+ * bypasses the policy by design.
+ */
+export interface AcquisitionAuditEntry {
+	at: string;
+	actor: "human" | "agent" | "seed" | "policy";
+	action: string;
+	node_id?: NodeId;
+	fingerprint?: string;
+	/** The address the peer's statement arrived from, as this host observed it. */
+	observed?: string;
+	/** The address the peer wrote into its own statement. */
+	declared?: string;
+	policy?: AcquirePolicy;
+	allowed?: boolean;
+	reason?: string;
+	override?: boolean;
+	/** The configuration file a seed authorization came from. */
+	source?: string;
+}
+
+/**
+ * One trust row with both addresses the panel needs. `base_url` is what the peer declared;
+ * `observed` is where its last statement actually arrived from, and the two need not agree
+ * (RFC 0018 §2.1).
+ */
+export interface ViewerTrustRow {
+	node_id: NodeId;
+	fingerprint: string;
+	phase: TrustPhase;
+	base_url: string;
+	observed?: string;
+}
+
 /** Read-only snapshot the viewer renders. */
 export interface ViewerSnapshot {
 	region?: string;
@@ -115,12 +124,11 @@ export interface ViewerSnapshot {
 	contacts: ViewerContact[];
 	discovery_error?: string;
 	/** Every trust row, projected through `trustPhase`: the only stage this package renders. */
-	trust?: Array<{
-		node_id: NodeId;
-		fingerprint: string;
-		phase: TrustPhase;
-		base_url: string;
-	}>;
+	trust?: ViewerTrustRow[];
+	/** RFC 0018 §5: the acquisition panel's current settings. */
+	acquisition?: AcquisitionSnapshot;
+	/** The persisted acquisition audit, newest first; the panel renders the first 20. */
+	audit?: AcquisitionAuditEntry[];
 	identity?: { public_key: string; fingerprint: string };
 }
 

package/src/ui/bootstrap-text.ts

@@ -15,6 +15,8 @@ const en = {
 	"bootstrap.field.keyScope": "Node key (project/global/none)",
 	"bootstrap.field.pageSize": "Page size",
 	"bootstrap.field.contact": "Node addresses (optional)",
+	"bootstrap.field.policy": "Acquisition policy (all/segment/none)",
+	"bootstrap.field.allow": "Acquisition allow set",
 	"bootstrap.hint.region": "A short name is stored as urn:onlyne:region:<name>",
 	"bootstrap.hint.nodeId": "A short name is stored as urn:onlyne:agent:<name>",
 	"bootstrap.hint.bind": "127.0.0.1",
@@ -23,6 +25,16 @@ const en = {
 	"bootstrap.hint.pageSize": "1..100, default 50",
 	"bootstrap.hint.contact":
 		"Nodes discovery cannot reach are contacted by address; stored as discovery.seeds and contacted on every start. Separate addresses with commas",
+	"bootstrap.hint.policy":
+		"segment: only addresses inside the allow set are approved automatically; all: any peer; none: only a human approves",
+	"bootstrap.hint.allow":
+		"CIDR blocks or host names, comma separated. The default is loopback only; a private range lets every host in it pair without asking you",
+	"bootstrap.policyInvalid": "Acquisition policy must be all, segment or none.",
+	"bootstrap.allowInvalid": "Allow entries must be network/prefix blocks or host names, got {value}.",
+	"bootstrap.policy.all": "all",
+	"bootstrap.policy.segment": "segment",
+	"bootstrap.policy.none": "none",
+	"bootstrap.policy.title": "Set the acquisition policy to {value}",
 	"bootstrap.empty": "[empty]",
 	"bootstrap.regionMissing": "Region is required; a short name is stored as urn:onlyne:region:<name>",
 	"bootstrap.regionPreview": "Will be stored as {uri}",
@@ -53,6 +65,7 @@ const en = {
 	"mail.thread": "Thread",
 	"mail.relation": "Relation",
 	"mail.inReplyTo": "In-Reply-To",
+	"mail.work": "Work",
 	"mail.delivery": "Delivery",
 	"mail.status": "Status",
 	"mail.consumed": " · consumed {state}",
@@ -73,6 +86,8 @@ const zh: Record<keyof typeof en, string> = {
 	"bootstrap.field.keyScope": "Node key (project/global/none)",
 	"bootstrap.field.pageSize": "Page size",
 	"bootstrap.field.contact": "节点地址（可选）",
+	"bootstrap.field.policy": "获取策略（all/segment/none）",
+	"bootstrap.field.allow": "获取允许集合",
 	"bootstrap.hint.region": "短名保存为 urn:onlyne:region:<短名>",
 	"bootstrap.hint.nodeId": "短名保存为 urn:onlyne:agent:<短名>",
 	"bootstrap.hint.bind": "127.0.0.1",
@@ -80,6 +95,14 @@ const zh: Record<keyof typeof en, string> = {
 		"project：密钥存 .onlyne/keys（git 内需 ignore）；global：存 ~/.config/onlyne/keys；none：回环开发绑定",
 	"bootstrap.hint.pageSize": "1..100，默认 50",
 	"bootstrap.hint.contact": "自动发现到不了的节点按地址联系；保存为 discovery.seeds，每次启动都会联系。多个地址用逗号分隔",
+	"bootstrap.hint.policy": "segment：只自动批准允许集合内的地址；all：任意对端；none：只有人类能批准",
+	"bootstrap.hint.allow": "CIDR 网段或主机名，逗号分隔。默认只允许回环；填私有网段等于允许其中每台主机不经你确认完成配对",
+	"bootstrap.policyInvalid": "获取策略只能是 all、segment 或 none。",
+	"bootstrap.allowInvalid": "允许条目必须是 network/prefix 网段或主机名，收到的是 {value}。",
+	"bootstrap.policy.all": "all",
+	"bootstrap.policy.segment": "segment",
+	"bootstrap.policy.none": "none",
+	"bootstrap.policy.title": "把获取策略设为 {value}",
 	"bootstrap.empty": "[空]",
 	"bootstrap.regionMissing": "Region 必填；短名将保存为 urn:onlyne:region:<短名>",
 	"bootstrap.regionPreview": "将保存为 {uri}",
@@ -110,6 +133,7 @@ const zh: Record<keyof typeof en, string> = {
 	"mail.thread": "线程",
 	"mail.relation": "关系",
 	"mail.inReplyTo": "回复",
+	"mail.work": "工作单元",
 	"mail.delivery": "投送",
 	"mail.status": "状态",
 	"mail.consumed": " · 已消费 {state}",