omp-onlyne 0.2.0 → 0.3.0

package/src/runtime.ts

@@ -5,21 +5,30 @@ import type { ExtensionAPI, ExtensionContext } from "@oh-my-pi/pi-coding-agent";
 import { ensureKeyDir } from "@onlyne/node-host/keys";
 import { NetworkDiscovery } from "@onlyne/node-host/network";
 import { resolveLocale, setLocale } from "@onlyne/node-host/i18n";
-import { acquisitionOf } from "./acquire.ts";
+import { acquisitionOf, evaluateAcquisition, type AcquireInput, type AcquireVerdict } from "@onlyne/node-host/acquire";
 import { AcquisitionLog, approvePeer, beginPeer, handshakeEntry, isTrustThread, judgeApproval, judgementFacts, revokePeer, trustThread, TRUST_THREAD, type ApprovalDeps, type ApprovalJudgement, type ApprovalRequest } from "./handshake.ts";
 import { commandText as t } from "./ui/command-text.ts";
 import { registerMsgTool } from "./tool.ts";
 import { currentDecision, JudgeDecider } from "./decider.ts";
 import { loadConfig, normalizeServiceUrl, saveConfig, shortNodeId } from "./config.ts";
 import { createRuntimeBridge } from "./messages.ts";
-import { advertisedHost, createOnlyneNode } from "./node.ts";
-import { canAnswer, ContextRegistry, SqliteStorage } from "./store.ts";
+import { advertisedHost, createOnlyneNode } from "@onlyne/node-host/node";
+import { canAnswer, ContextRegistry, SqliteStorage } from "@onlyne/node-host/store";
 import { resourceQuery } from "./resources.ts";
-import type { OnlyneConfig, OnlyneStatus, QueueItem, ViewerContact, ViewerDiscovery, ViewerMessage, ViewerSnapshot, ViewerThread } from "./types.ts";
+import type { OnlyneConfig } from "@onlyne/node-host/types";
+import type { AcquisitionAuditEntry, OnlyneStatus, QueueItem, ViewerContact, ViewerDiscovery, ViewerMessage, ViewerSnapshot, ViewerThread, ViewerTrustRow } from "./types.ts";
 
 /** The trust transition of RFC 0017 §5, as the host receives it. */
 type TrustNotify = Extract<NotifyEvent, { event: "trust" }>;
 
+/** Which actor a judgement in flight belongs to: the agent that asked, or the policy approving on its own. */
+interface AuditScope {
+	actor: AcquisitionAuditEntry["actor"];
+	action: string;
+	/** The judgement this scope produced, kept because a refusal throws away the value the caller sees. */
+	capture?: (judgement: ApprovalJudgement) => void;
+}
+
 export interface PluginRuntime {
 	readonly config: OnlyneConfig;
 	readonly endpoint: string;
@@ -83,6 +92,16 @@ export async function stopRuntime(): Promise<void> {
 /** How often the discovery catalog is re-observed; well inside the library's 120 s freshness window. */
 const DISCOVERY_REFRESH_MS = 30_000;
 
+/**
+ * The discovery layer's loopback switch. `createOnlyneNode` passes no `plugins.allow_loopback`,
+ * so this host always runs the documented default; the panel reports it beside the policy.
+ */
+const ALLOW_LOOPBACK = false;
+/** Audit rows kept in the store; the panel renders the newest 20, pruning keeps the file bounded. */
+const AUDIT_PREFIX = "acquisition/audit/";
+const AUDIT_KEEP = 64;
+const AUDIT_VISIBLE = 20;
+
 /** The alias the context registry gives this node's main session (`ContextRegistry.ensureMain`). */
 const MAIN_CONTEXT = "main";
 
@@ -112,6 +131,10 @@ class OmpRuntime implements PluginRuntime {
 	endpoint = "";
 	/** RFC 0018 §2.1: where the connection being served came from, for the library's own call into `notify`. */
 	private readonly connection = new AsyncLocalStorage<string | undefined>();
+	/** RFC 0018 §5: the actor a judgement in flight belongs to, so the audit can tell an agent from the policy. */
+	private readonly auditScope = new AsyncLocalStorage<AuditScope>();
+	/** Two audit rows can share a millisecond; the tick keeps their stored order equal to their arrival. */
+	private auditTick = 0;
 	private readonly log: AcquisitionLog;
 	/** The host side of one approval, built once with the node in `start`. */
 	private peers!: ApprovalDeps;
@@ -169,6 +192,21 @@ class OmpRuntime implements PluginRuntime {
 		if (this.config.server.public_url === undefined && this.config.server.port !== bound) {
 			await this.rememberPort(bound);
 		}
+		// RFC 0018 §2.3/§5.1: a trust seed is a human pre-authorization the policy never judges,
+		// so the bypass is written where it can be re-read: one line per seed naming the config
+		// file it came from, and the policy status beside it. A fingerprint is the audit fact,
+		// never a credential. The discovery axis is separate and, like the policy, reported here.
+		const policy = acquisitionOf(this.config);
+		this.pi.logger.info("onlyne.acquisition.policy", {
+			policy: policy.policy, allow: [...policy.allow],
+			allow_loopback: ALLOW_LOOPBACK,
+		});
+		for (const seed of this.config.trust ?? []) {
+			this.pi.logger.info("onlyne.acquisition.seed", {
+				node: seed.node_id, fingerprint: seed.fingerprint, source: this.config.path,
+				actor: "human", conclusion: "seed_authorized",
+			});
+		}
 		const instanceId = crypto.randomUUID();
 		// The decider probes peers for their execution contexts, so it must use the node's own
 		// transport: an unsigned probe is refused by every keyed peer.
@@ -201,7 +239,15 @@ class OmpRuntime implements PluginRuntime {
 				.filter(thread => !isTrustThread(this.config.node.id, thread.thread_ref)),
 			listJoinedThreads: async () => (await allPages(cursor => this.node.threads.joined(this.node.auth, { page_size: 100, cursor })))
 				.filter(thread => !isTrustThread(this.config.node.id, thread.thread_ref)),
-			listMessages: (thread, cursor) => this.node.messages.list(this.node.auth, thread, { attention: "thread", page_size: 100, cursor }),
+			// A joined thread's entries live on its owner; this node holds no local copy, so the
+			// owner's message route is the only source. Both legs keep the same page shape, and
+			// resolving a joined `{thread, seq}` reference now reads the entries it names.
+			listMessages: async (thread, cursor) => {
+				const query = { attention: "thread" as const, page_size: 100, ...(cursor === undefined ? {} : { cursor }) };
+				return thread.owner === this.config.node.id
+					? this.node.messages.list(this.node.auth, thread, query)
+					: this.node.client.threadEntries(thread, query);
+			},
 			listInbox: async () => (await allPages(cursor => this.node.messages.inbox(this.node.auth, { page_size: 100, cursor })))
 				.map(row => ({ context: row.context, attention: row.attention })),
 			threadMembers: async thread => (await this.node.threads.describe(this.node.auth, thread)).members.map(member => member.peer),
@@ -237,7 +283,11 @@ class OmpRuntime implements PluginRuntime {
 			observed: async (nodeId, fingerprint) => (await this.log.observation(nodeId, fingerprint))?.observed,
 			declared: async nodeId => (await this.node.trust.entry(nodeId))?.base_url,
 			recorded: nodeId => this.recorded(nodeId),
-			audit: judgement => this.pi.logger.info("onlyne.acquire.decided", judgementFacts(judgement)),
+			audit: judgement => {
+				this.pi.logger.info("onlyne.acquire.decided", judgementFacts(judgement));
+				// The caller decided the actor; a judgement made with no scope is the policy's own.
+				this.auditScope.getStore()?.capture?.(judgement);
+			},
 			accept: (nodeId, fingerprint) => this.node.trust.accept(this.node.auth, nodeId, fingerprint),
 			revoke: nodeId => this.node.trust.revoke(this.node.auth, nodeId),
 			now: () => new Date().toISOString(),
@@ -248,7 +298,7 @@ class OmpRuntime implements PluginRuntime {
 		if (!current || current.domain_id !== this.config.region) {
 			let expected_revision: string | undefined;
 			try { expected_revision = (await this.node.domains.describe(this.node.auth, this.config.region)).revision; }
-			catch (error) { if (!(error instanceof OnlyneError && error.error.code === "not_found")) throw error; }
+			catch (error) { if (!isNotFoundError(error)) throw error; }
 			await this.node.domains.join(this.node.auth, this.config.region, { ...mutation(), expected_revision });
 		}
 		handler = request => this.node.fetch(request);
@@ -318,6 +368,17 @@ class OmpRuntime implements PluginRuntime {
 				...(observed === undefined ? {} : { observed }), at, cause: event.cause,
 			});
 		} else await this.log.transition(node, fingerprint, at, event.cause);
+		// RFC 0018 §2.3/§5: a pinned seed is a human pre-authorization the policy never judges.
+		// The startup log lists the seeds; this row records the statement that actually used one.
+		const seed = (this.config.trust ?? []).find(row => row.node_id === node && row.fingerprint === fingerprint);
+		if (event.cause === "peer-statement" && seed !== undefined) {
+			await this.recordAudit({
+				at, actor: "seed", action: "seed_authorized", node_id: node, fingerprint,
+				...(observed === undefined ? {} : { observed }),
+				...(event.entry.base_url === "" ? {} : { declared: event.entry.base_url }),
+				policy: this.peers.policy.policy, allowed: true, reason: "seed_authorized", override: true, source: this.config.path,
+			});
+		}
 		// RFC 0018 §2.2: the verdict reads the catalog as it stood when the statement arrived.
 		// The record this host derives from that statement is not part of the judgement, or the
 		// two conditions would collapse into one.
@@ -333,6 +394,8 @@ class OmpRuntime implements PluginRuntime {
 		const judgement = event.phase === "invited" && event.cause === "peer-statement"
 			? await judgeApproval(this.peers, { node_id: node, fingerprint, observed, recorded })
 			: undefined;
+		// §4.1: a verdict is audited whether it allows the approval or refuses it.
+		if (judgement !== undefined) await this.recordAudit(this.auditEntry(judgement, "policy", "approve"));
 		if (judgement?.verdict.allowed === true) this.approveDeferred(node, fingerprint);
 		await this.deliverHandshake(event, observed, judgement);
 	}
@@ -382,7 +445,7 @@ class OmpRuntime implements PluginRuntime {
 			await this.node.threads.describe(this.node.auth, ref);
 			return;
 		} catch (error) {
-			if (!(error instanceof OnlyneError && error.error.code === "not_found")) throw error;
+			if (!isNotFoundError(error)) throw error;
 		}
 		await this.node.threads.create(this.node.auth, { title: TRUST_THREAD, id: ref.id, ...mutation() });
 	}
@@ -391,6 +454,52 @@ class OmpRuntime implements PluginRuntime {
 		const records = await this.node.discovery.listRecords();
 		return [...new Set(records.filter(record => record.node_id === node).map(record => record.base_url))];
 	}
+	/**
+	 * The persisted acquisition audit. One row per fact, keyed by its own time so the scan is the
+	 * history; the oldest rows are pruned past `AUDIT_KEEP`, and the panel reads the newest
+	 * `AUDIT_VISIBLE` back out. A failed write is logged and never doubts a committed decision.
+	 */
+	private async recordAudit(entry: AcquisitionAuditEntry): Promise<void> {
+		if (this.closed) return;
+		try {
+			await this.storage.transaction(async tx => {
+				const rows = await tx.scan<AcquisitionAuditEntry>(AUDIT_PREFIX);
+				await tx.put(`${AUDIT_PREFIX}${entry.at}/${String(this.auditTick++).padStart(12, "0")}-${crypto.randomUUID()}`, entry);
+				const excess = rows.length + 1 - AUDIT_KEEP;
+				for (const row of rows.slice(0, Math.max(0, excess))) await tx.delete(row.key);
+			});
+		} catch (error) {
+			this.pi.logger.warn("onlyne.acquisition.audit_failed", { error: errorText(error) });
+		}
+	}
+	/** One judgement as the audit stores it: the time, the actor, and every input the verdict read. */
+	private auditEntry(judgement: ApprovalJudgement, actor: AcquisitionAuditEntry["actor"], action: string): AcquisitionAuditEntry {
+		return {
+			at: judgement.at, actor, action, node_id: judgement.node_id,
+			...(judgement.fingerprint === undefined ? {} : { fingerprint: judgement.fingerprint }),
+			...(judgement.input.observed === undefined ? {} : { observed: judgement.input.observed }),
+			...(judgement.input.declared === undefined ? {} : { declared: judgement.input.declared }),
+			policy: judgement.policy.policy, allowed: judgement.verdict.allowed, reason: judgement.verdict.reason,
+		};
+	}
+	/**
+	 * What the policy would say about this peer right now, read from the same stored facts a
+	 * judgement reads. The human path asks only to mark an override; it never gates the action.
+	 */
+	private async policyVerdict(node: string, fingerprint?: string): Promise<{ observed?: string; declared?: string; verdict: AcquireVerdict }> {
+		const observed = fingerprint === undefined ? undefined : (await this.log.observation(node, fingerprint))?.observed;
+		const declared = (await this.node.trust.entry(node))?.base_url;
+		const input: AcquireInput = {
+			...(observed === undefined || observed === "" ? {} : { observed }),
+			...(declared === undefined || declared === "" ? {} : { declared }),
+			recorded: await this.recorded(node),
+		};
+		return {
+			...(observed === undefined ? {} : { observed }),
+			...(declared === undefined ? {} : { declared }),
+			verdict: await evaluateAcquisition(this.peers.policy, input),
+		};
+	}
 	/**
 	 * A user-typed address. It is normalized once, read for its own identity and everything it
 	 * declares, and only a successful read becomes a seed. The node keeps running: a seed is a
@@ -449,41 +558,78 @@ class OmpRuntime implements PluginRuntime {
 	}
 	/** Stage one of one exchange: the peer's proved fingerprint, and the session that commits it. */
 	async trustBegin(node: string): Promise<KeyExchange> {
-		return this.node.trust.begin(this.node.auth, node);
+		const session = await this.node.trust.begin(this.node.auth, node);
+		await this.recordAudit({
+			at: new Date().toISOString(), actor: "human", action: "begin",
+			node_id: node, fingerprint: session.fingerprint, declared: session.base_url,
+		});
+		return session;
 	}
 	async trustAccept(node: string, fingerprint: string): Promise<void> {
+		// The panel keeps the human gate outside the policy (RFC 0018 §2). Read the verdict first
+		// so a row the policy would have refused is recorded as the override it is.
+		const admission = await this.policyVerdict(node, fingerprint);
 		await this.node.trust.accept(this.node.auth, node, fingerprint);
+		await this.recordAudit({
+			at: new Date().toISOString(), actor: "human", action: "accept", node_id: node, fingerprint,
+			...(admission.observed === undefined ? {} : { observed: admission.observed }),
+			...(admission.declared === undefined ? {} : { declared: admission.declared }),
+			policy: this.peers.policy.policy, allowed: admission.verdict.allowed, reason: admission.verdict.reason,
+			...(admission.verdict.allowed ? {} : { override: true }),
+		});
 	}
 	async trustRevoke(node: string): Promise<void> {
+		const row = await this.node.trust.entry(node);
+		const observed = row === undefined ? undefined : (await this.log.observation(node, row.fingerprint))?.observed;
 		await this.node.trust.revoke(this.node.auth, node);
+		await this.recordAudit({
+			at: new Date().toISOString(), actor: "human", action: "revoke", node_id: node,
+			...(row === undefined ? {} : { fingerprint: row.fingerprint, declared: row.base_url }),
+			...(observed === undefined ? {} : { observed }),
+		});
 	}
 	/** RFC 0018 §2/§3.1: the agent's approval, refused with `policy_denied` when the policy does not allow it. */
 	async acquireAccept(node: string, fingerprint: string): Promise<TrustEntry> {
-		return approvePeer(this.peers, node, fingerprint);
+		let judged: ApprovalJudgement | undefined;
+		try {
+			return await this.auditScope.run({ actor: "agent", action: "accept", capture: judgement => { judged = judgement; } },
+				() => approvePeer(this.peers, node, fingerprint));
+		} finally {
+			if (judged !== undefined) await this.recordAudit(this.auditEntry(judged, "agent", "accept"));
+		}
 	}
 	/** RFC 0018 §2/§3.1: the agent's revocation, which no policy judges. */
 	async acquireRevoke(node: string): Promise<void> {
 		await revokePeer(this.peers, node);
+		await this.recordAudit({ at: new Date().toISOString(), actor: "agent", action: "revoke", node_id: node });
 	}
 	/**
 	 * RFC 0018 §2/§3.1: the agent's initiation of one exchange. The judgement reads only what this
 	 * host already stores; the peer's key is read after it, so a refusal sends nothing.
 	 */
 	async acquireBegin(node: string): Promise<TrustEntry> {
-		const row = await this.node.trust.entry(node);
-		const statement = row === undefined ? undefined : (await this.log.observation(node, row.fingerprint))?.observed;
-		const records = (await this.node.discovery.listRecords()).filter(record => record.node_id === node);
-		const observed = outboundObserved({ statement, records, declared: row?.base_url });
-		const request: ApprovalRequest = {
-			node_id: node,
-			...(row === undefined ? {} : { fingerprint: row.fingerprint }),
-			...(observed === undefined ? {} : { observed }),
-		};
-		const committed = await beginPeer(this.peers, target => this.node.trust.begin(this.node.auth, target), request);
-		return committed.entry;
+		let judged: ApprovalJudgement | undefined;
+		try {
+			return await this.auditScope.run({ actor: "agent", action: "begin", capture: judgement => { judged = judgement; } }, async () => {
+				const row = await this.node.trust.entry(node);
+				const statement = row === undefined ? undefined : (await this.log.observation(node, row.fingerprint))?.observed;
+				const records = (await this.node.discovery.listRecords()).filter(record => record.node_id === node);
+				const observed = outboundObserved({ statement, records, declared: row?.base_url });
+				const request: ApprovalRequest = {
+					node_id: node,
+					...(row === undefined ? {} : { fingerprint: row.fingerprint }),
+					...(observed === undefined ? {} : { observed }),
+				};
+				const committed = await beginPeer(this.peers, target => this.node.trust.begin(this.node.auth, target), request);
+				return committed.entry;
+			});
+		} finally {
+			if (judged !== undefined) await this.recordAudit(this.auditEntry(judged, "agent", "begin"));
+		}
 	}
 	async trustRotate(): Promise<{ fingerprint: string }> {
 		const identity = await this.node.trust.rotate(this.node.auth);
+		await this.recordAudit({ at: new Date().toISOString(), actor: "human", action: "rotate", fingerprint: identity.fingerprint });
 		return { fingerprint: identity.fingerprint };
 	}
 	async refreshDiscovery(): Promise<void> {
@@ -543,7 +689,7 @@ class OmpRuntime implements PluginRuntime {
 			const entries = await allPages(cursor => this.node.messages.list(this.node.auth, ref, { attention: "thread", page_size: 100, cursor }));
 			views.push({ ref, alias: `${encodeURIComponent(ref.owner)}/${encodeURIComponent(ref.id)}`, title: thread.title, state: thread.state,
 				unread: inbox.filter(item => !item.injected && item.attention.thread_ref.owner === ref.owner && item.attention.thread_ref.id === ref.id).length,
-				last_seq: entries.at(-1)?.seq ?? "0", messages: entries.map(entry => ({ ref: { sender: entry.message.sender, id: entry.message.id }, seq: entry.seq, direction: entry.message.sender === this.config.node.id ? "out" : "in", author: entry.authenticated_author, at: entry.at, text: entry.message.msg, relation: entry.message.meta?.relation })),
+				last_seq: entries.at(-1)?.seq ?? "0", messages: entries.map(entry => ({ ref: { sender: entry.message.sender, id: entry.message.id }, seq: entry.seq, direction: entry.message.sender === this.config.node.id ? "out" : "in", author: entry.authenticated_author, at: entry.at, text: entry.message.msg, relation: entry.message.meta?.relation, ...(entry.message.meta?.work === undefined ? {} : { work: entry.message.meta.work }) })),
 			});
 		}
 		// A member's own message never comes back through its inbox, so the message that
@@ -570,7 +716,7 @@ class OmpRuntime implements PluginRuntime {
 			if (!item.injected) view.unread++;
 			const entry = item.attention.entry;
 			if (entry !== undefined) {
-				view.messages.push({ ref: { sender: entry.message.sender, id: entry.message.id }, seq: entry.seq, direction: entry.message.sender === this.config.node.id ? "out" : "in", author: entry.authenticated_author, at: entry.at, text: entry.message.msg, relation: entry.message.meta?.relation });
+				view.messages.push({ ref: { sender: entry.message.sender, id: entry.message.id }, seq: entry.seq, direction: entry.message.sender === this.config.node.id ? "out" : "in", author: entry.authenticated_author, at: entry.at, text: entry.message.msg, relation: entry.message.meta?.relation, ...(entry.message.meta?.work === undefined ? {} : { work: entry.message.meta.work }) });
 				view.last_seq = entry.seq;
 			}
 		}
@@ -583,7 +729,7 @@ class OmpRuntime implements PluginRuntime {
 			const view = seen.get(key) ?? { ref, alias: `${encodeURIComponent(ref.owner)}/${encodeURIComponent(ref.id)}`, title: t("thread", { node: shortNodeId(ref.owner) }), state: "open", unread: 0, last_seq: "0", messages: [], read_only: true };
 			seen.set(key, view);
 			const message = row.value.request.message;
-			view.messages.push({ ref: { sender: message.sender, id: message.id }, seq: receipt.seq, direction: "out", author: message.sender, at: row.value.created_at ?? "", text: message.msg, relation: message.meta?.relation });
+			view.messages.push({ ref: { sender: message.sender, id: message.id }, seq: receipt.seq, direction: "out", author: message.sender, at: row.value.created_at ?? "", text: message.msg, relation: message.meta?.relation, ...(message.meta?.work === undefined ? {} : { work: message.meta.work }) });
 			if (Number(receipt.seq) > Number(view.last_seq)) view.last_seq = receipt.seq;
 		}
 		for (const view of seen.values()) view.messages.sort((left, right) => Number(left.seq) - Number(right.seq));
@@ -619,9 +765,28 @@ class OmpRuntime implements PluginRuntime {
 			last_seen: record.last_seen,
 		}));
 		const trust = this.node.keys.enabled ? await this.node.trust.list(this.node.auth) : [];
+		// RFC 0018 §2.1: the declared address is what the peer wrote; the observed one is the
+		// connection this host recorded for its last statement. Both are shown, never merged.
+		const trustRows: ViewerTrustRow[] = [];
+		for (const row of trust) {
+			const observation = await this.log.observation(row.node_id, row.fingerprint);
+			trustRows.push({
+				node_id: row.node_id, fingerprint: row.fingerprint, phase: trustPhase(row), base_url: row.base_url,
+				...(observation?.observed === undefined ? {} : { observed: observation.observed }),
+			});
+		}
+		// Newest first: the panel renders this array in order and never sorts it.
+		const auditRows = await this.storage.transaction(tx => tx.scan<AcquisitionAuditEntry>(AUDIT_PREFIX));
+		const audit = auditRows
+			.sort((left, right) => right.value.at.localeCompare(left.value.at) || right.key.localeCompare(left.key))
+			.slice(0, AUDIT_VISIBLE)
+			.map(row => row.value);
+		const policy = acquisitionOf(this.config);
 		const identity = this.node.keys.enabled ? await this.node.keys.describe() : undefined;
 		return { region: this.config.region, endpoint: this.endpoint, contexts, queue, threads: views, discovery, contacts,
-			trust: trust.map(row => ({ node_id: row.node_id, fingerprint: row.fingerprint, phase: trustPhase(row), base_url: row.base_url })),
+			trust: trustRows,
+			acquisition: { policy: policy.policy, allow: [...policy.allow], allow_loopback: ALLOW_LOOPBACK },
+			audit,
 			...(identity === undefined ? {} : { identity: { public_key: identity.public_key, fingerprint: identity.fingerprint } }),
 			...(this.discoveryError === undefined ? {} : { discovery_error: this.discoveryError }) };
 	}
@@ -649,6 +814,17 @@ export async function allPages<T>(read: (cursor?: string) => Promise<Page<T>>):
 
 function errorText(error: unknown): string { return error instanceof Error ? error.message : String(error); }
 
+/** Check if an error represents an Onlyne not_found condition, independent of instanceof identity. */
+function isNotFoundError(error: unknown): boolean {
+	if (error instanceof OnlyneError) return error.error.code === "not_found";
+	if (typeof error === "object" && error !== null) {
+		const failure = (error as { error?: { code?: string } }).error;
+		if (failure?.code === "not_found") return true;
+		if ((error as { message?: string }).message === "The requested record is unavailable.") return true;
+	}
+	return false;
+}
+
 /**
  * RFC 0018 §2.1–2.2: the address an outbound judgement reads for a peer this host may initiate
  * with. The arrival address this host recorded for the peer's last statement is the strongest

package/src/tool.ts

@@ -80,8 +80,17 @@ export function registerMsgTool(pi: ExtensionAPI): void {
 						details: { result: entry },
 					};
 				}
-				if (typeof parsed.data.meta?.draft_id === "string") {
-					const result = await sendDraft(runtime, ctx, parsed.data.meta.draft_id, signal);
+				const draftId = typeof parsed.data.meta?.draft_id === "string" ? parsed.data.meta.draft_id : undefined;
+				// `send_draft` names the act, not the row: the draft is found by the message it
+				// answers, or by the newest one this session created. `meta.draft_id` alone keeps
+				// working because the handoff from a drafting child reports exactly that id.
+				if (op === "send_draft" || draftId !== undefined) {
+					const result = await sendDraft(runtime, ctx, {
+						...(draftId === undefined ? {} : { id: draftId }),
+						...(parsed.data.meta?.in_reply_to === undefined
+							? {}
+							: { in_reply_to: parsed.data.meta.in_reply_to as Json }),
+					}, signal);
 					recordAwaitResult(pi, toolCallId, result, ctx);
 					return { content: [{ type: "text", text: `${summary(result, spelling(parsed.data.meta?.to))}\n\n${JSON.stringify(visibleResult(result), null, 2)}` }], details: { result: visibleResult(result) } };
 				}

package/src/types.ts

@@ -1,63 +1,6 @@
-import type { MessageRef, NodeId, ThreadRef, TrustPhase, TrustSeed } from "@onlyne/lib";
-import type { Locale } from "@onlyne/node-host/i18n";
-import type { AcquisitionPolicy } from "./acquire.ts";
-
-/**
- * Project-scoped configuration in `<project>/.onlyne/config.toml`.
- *
- * Delivery decisions are made by OMP's `judge` model role, so no model
- * endpoint or model name belongs here.
- */
-export interface OnlyneConfig {
-	path: string;
-	language?: Locale;
-	/** Protocol membership, independent from the node identity. */
-	region: string;
-	node: {
-		id: NodeId;
-		key_ref?: string;
-		/** Where the node identity lives: the project's `.onlyne/keys`, the user's key store, or no key at all. */
-		key_scope?: "project" | "global" | "none";
-	};
-	server: {
-		bind: string;
-		/**
-		 * The port this node answers on. Absent asks the operating system for one, and the
-		 * chosen port is written back here: a node whose address changes on every start
-		 * leaves every peer that recorded it calling a port nobody serves.
-		 */
-		port?: number;
-		/** The externally reachable base URL when a reverse proxy fronts the node. */
-		public_url?: string;
-	};
-	threads: {
-		page_size: number;
-	};
-	/** Bootstrap contact seeds the node reaches at every start. */
-	discovery?: {
-		seeds?: string[];
-	};
-	/** Pinned peer fingerprints; an arriving key that matches is trusted without a prompt. */
-	trust?: TrustSeed[];
-	/** RFC 0018 §2: peers this node may approve without a human confirming first. */
-	acquisition?: AcquisitionPolicy;
-}
-
-/** One execution context the plugin registered for a delivered message. */
-export interface ContextRecord {
-	alias: string;
-	node_id: NodeId;
-	main_agent_id: string;
-	source?: { sender: NodeId; id: string };
-	agent_id?: string;
-	session_file?: string;
-	parent_id?: string;
-	thread_ref?: ThreadRef;
-	summary: string;
-	state: "unbound" | "idle" | "running" | "parked" | "lost";
-	created_at: string;
-	bound_at?: string;
-}
+import type { MessageRef, NodeId, ThreadRef, TrustPhase, WorkRef } from "@onlyne/lib";
+import type { AcquirePolicy } from "@onlyne/node-host/acquire";
+import type { ContextRecord } from "@onlyne/node-host/types";
 
 /** One row of the viewer's queue page. */
 export interface QueueItem {
@@ -77,6 +20,8 @@ export interface ViewerMessage {
 	at: string;
 	text: string;
 	relation?: string;
+	/** The work unit the sender named (RFC 0003 §1), when the message carries one. */
+	work?: WorkRef;
 }
 
 /** One thread row in the viewer's chat page. */
@@ -118,6 +63,56 @@ export interface ViewerContact {
 	last_seen: string;
 }
 
+/** RFC 0018 §5: the acquisition settings this runtime actually runs with, read back for the panel. */
+export interface AcquisitionSnapshot {
+	policy: AcquirePolicy;
+	allow: string[];
+	/**
+	 * The discovery layer's separate loopback switch (RFC 0018 §5.1). It decides what may enter
+	 * the catalog, not what may be approved without a human, and the panel shows both values
+	 * together so loosening one is never mistaken for loosening the other.
+	 */
+	allow_loopback: boolean;
+}
+
+/**
+ * One acquisition audit row. The actors stay distinguishable (RFC 0018 §5): a human's panel
+ * action, an agent's decision, a configured seed's pre-authorization, and the policy's own
+ * automatic verdict. `allowed` is the verdict the gate reached; `override` marks a human
+ * approval that committed although the policy refused it, and a seed authorization that
+ * bypasses the policy by design.
+ */
+export interface AcquisitionAuditEntry {
+	at: string;
+	actor: "human" | "agent" | "seed" | "policy";
+	action: string;
+	node_id?: NodeId;
+	fingerprint?: string;
+	/** The address the peer's statement arrived from, as this host observed it. */
+	observed?: string;
+	/** The address the peer wrote into its own statement. */
+	declared?: string;
+	policy?: AcquirePolicy;
+	allowed?: boolean;
+	reason?: string;
+	override?: boolean;
+	/** The configuration file a seed authorization came from. */
+	source?: string;
+}
+
+/**
+ * One trust row with both addresses the panel needs. `base_url` is what the peer declared;
+ * `observed` is where its last statement actually arrived from, and the two need not agree
+ * (RFC 0018 §2.1).
+ */
+export interface ViewerTrustRow {
+	node_id: NodeId;
+	fingerprint: string;
+	phase: TrustPhase;
+	base_url: string;
+	observed?: string;
+}
+
 /** Read-only snapshot the viewer renders. */
 export interface ViewerSnapshot {
 	region?: string;
@@ -129,12 +124,11 @@ export interface ViewerSnapshot {
 	contacts: ViewerContact[];
 	discovery_error?: string;
 	/** Every trust row, projected through `trustPhase`: the only stage this package renders. */
-	trust?: Array<{
-		node_id: NodeId;
-		fingerprint: string;
-		phase: TrustPhase;
-		base_url: string;
-	}>;
+	trust?: ViewerTrustRow[];
+	/** RFC 0018 §5: the acquisition panel's current settings. */
+	acquisition?: AcquisitionSnapshot;
+	/** The persisted acquisition audit, newest first; the panel renders the first 20. */
+	audit?: AcquisitionAuditEntry[];
 	identity?: { public_key: string; fingerprint: string };
 }
 

package/src/ui/bootstrap-text.ts

@@ -15,6 +15,8 @@ const en = {
 	"bootstrap.field.keyScope": "Node key (project/global/none)",
 	"bootstrap.field.pageSize": "Page size",
 	"bootstrap.field.contact": "Node addresses (optional)",
+	"bootstrap.field.policy": "Acquisition policy (all/segment/none)",
+	"bootstrap.field.allow": "Acquisition allow set",
 	"bootstrap.hint.region": "A short name is stored as urn:onlyne:region:<name>",
 	"bootstrap.hint.nodeId": "A short name is stored as urn:onlyne:agent:<name>",
 	"bootstrap.hint.bind": "127.0.0.1",
@@ -23,6 +25,16 @@ const en = {
 	"bootstrap.hint.pageSize": "1..100, default 50",
 	"bootstrap.hint.contact":
 		"Nodes discovery cannot reach are contacted by address; stored as discovery.seeds and contacted on every start. Separate addresses with commas",
+	"bootstrap.hint.policy":
+		"segment: only addresses inside the allow set are approved automatically; all: any peer; none: only a human approves",
+	"bootstrap.hint.allow":
+		"CIDR blocks or host names, comma separated. The default is loopback only; a private range lets every host in it pair without asking you",
+	"bootstrap.policyInvalid": "Acquisition policy must be all, segment or none.",
+	"bootstrap.allowInvalid": "Allow entries must be network/prefix blocks or host names, got {value}.",
+	"bootstrap.policy.all": "all",
+	"bootstrap.policy.segment": "segment",
+	"bootstrap.policy.none": "none",
+	"bootstrap.policy.title": "Set the acquisition policy to {value}",
 	"bootstrap.empty": "[empty]",
 	"bootstrap.regionMissing": "Region is required; a short name is stored as urn:onlyne:region:<name>",
 	"bootstrap.regionPreview": "Will be stored as {uri}",
@@ -53,6 +65,7 @@ const en = {
 	"mail.thread": "Thread",
 	"mail.relation": "Relation",
 	"mail.inReplyTo": "In-Reply-To",
+	"mail.work": "Work",
 	"mail.delivery": "Delivery",
 	"mail.status": "Status",
 	"mail.consumed": " · consumed {state}",
@@ -73,6 +86,8 @@ const zh: Record<keyof typeof en, string> = {
 	"bootstrap.field.keyScope": "Node key (project/global/none)",
 	"bootstrap.field.pageSize": "Page size",
 	"bootstrap.field.contact": "节点地址（可选）",
+	"bootstrap.field.policy": "获取策略（all/segment/none）",
+	"bootstrap.field.allow": "获取允许集合",
 	"bootstrap.hint.region": "短名保存为 urn:onlyne:region:<短名>",
 	"bootstrap.hint.nodeId": "短名保存为 urn:onlyne:agent:<短名>",
 	"bootstrap.hint.bind": "127.0.0.1",
@@ -80,6 +95,14 @@ const zh: Record<keyof typeof en, string> = {
 		"project：密钥存 .onlyne/keys（git 内需 ignore）；global：存 ~/.config/onlyne/keys；none：回环开发绑定",
 	"bootstrap.hint.pageSize": "1..100，默认 50",
 	"bootstrap.hint.contact": "自动发现到不了的节点按地址联系；保存为 discovery.seeds，每次启动都会联系。多个地址用逗号分隔",
+	"bootstrap.hint.policy": "segment：只自动批准允许集合内的地址；all：任意对端；none：只有人类能批准",
+	"bootstrap.hint.allow": "CIDR 网段或主机名，逗号分隔。默认只允许回环；填私有网段等于允许其中每台主机不经你确认完成配对",
+	"bootstrap.policyInvalid": "获取策略只能是 all、segment 或 none。",
+	"bootstrap.allowInvalid": "允许条目必须是 network/prefix 网段或主机名，收到的是 {value}。",
+	"bootstrap.policy.all": "all",
+	"bootstrap.policy.segment": "segment",
+	"bootstrap.policy.none": "none",
+	"bootstrap.policy.title": "把获取策略设为 {value}",
 	"bootstrap.empty": "[空]",
 	"bootstrap.regionMissing": "Region 必填；短名将保存为 urn:onlyne:region:<短名>",
 	"bootstrap.regionPreview": "将保存为 {uri}",
@@ -110,6 +133,7 @@ const zh: Record<keyof typeof en, string> = {
 	"mail.thread": "线程",
 	"mail.relation": "关系",
 	"mail.inReplyTo": "回复",
+	"mail.work": "工作单元",
 	"mail.delivery": "投送",
 	"mail.status": "状态",
 	"mail.consumed": " · 已消费 {state}",