wiki-viewer 1.4.3 → 1.5.1

package/.next/standalone/src/components/ai-panel/ai-panel.tsx

@@ -1,12 +1,11 @@
 "use client";
 
 import { useEffect, useCallback, useRef, useState } from "react";
-import { X, Copy, Check, Bot, Wifi, Download, ExternalLink } from "lucide-react";
+import { X, Copy, Check, Bot, Wifi, ExternalLink } from "lucide-react";
 import { Button } from "@/components/ui/button";
 import { useAIPanelStore } from "@/stores/ai-panel-store";
 import { TokenSection } from "./token-section";
 import { ActivityRow } from "./activity-row";
-import { authClient } from "@/lib/auth/client";
 const SKILL_CLI = "npx skills add anh-chu/wiki-viewer/agents/wiki-viewer-skill";
 
 function useCopyCurl(currentPath: string | null) {
@@ -55,7 +54,6 @@ export function AIPanel({ currentPath }: { currentPath?: string | null }) {
 	const close = useAIPanelStore((s) => s.close);
 	const activity = useAIPanelStore((s) => s.activity);
 	const connections = useAIPanelStore((s) => s.connections);
-	const rateLimit = useAIPanelStore((s) => s.rateLimit);
 	const loadActivity = useAIPanelStore((s) => s.loadActivity);
 	const { copied, copy } = useCopyCurl(currentPath ?? null);
 	const [bootstrapPrompt, setBootstrapPrompt] = useState<string>("");
@@ -68,8 +66,36 @@ export function AIPanel({ currentPath }: { currentPath?: string | null }) {
 		() => bootstrapPrompt.replace(/\$WIKI_URL/g, origin),
 		[bootstrapPrompt, origin]
 	);
+	const getMcpRegister = useCallback(
+		() =>
+			`npx wiki-viewer-mcp register --url ${origin} --id ai:myagent --name "My Agent"`,
+		[origin]
+	);
+	const getMcpJson = useCallback(
+		() =>
+			JSON.stringify(
+				{
+					servers: {
+						"wiki-viewer": {
+							command: "npx",
+							args: ["wiki-viewer-mcp"],
+							env: {
+								WIKI_VIEWER_URL: origin,
+								WIKI_VIEWER_TOKEN: "<token from register>",
+								WIKI_VIEWER_AGENT_ID: "ai:myagent",
+							},
+						},
+					},
+				},
+				null,
+				2
+			),
+		[origin]
+	);
 	const skillCli = useCopyButton(getSkillCli);
 	const bootstrapCopy = useCopyButton(getBootstrapPrompt);
+	const mcpRegister = useCopyButton(getMcpRegister);
+	const mcpJson = useCopyButton(getMcpJson);
 
 	// Keyboard: Esc closes
 	useEffect(() => {
@@ -144,74 +170,84 @@ export function AIPanel({ currentPath }: { currentPath?: string | null }) {
 
 				{/* Scrollable body */}
 				<div className="flex-1 overflow-y-auto space-y-5 px-4 py-4">
-					<SignedInUser />
+					{/* What this does — one line */}
+					<section className="rounded-md border border-border bg-muted/30 p-3">
+						<p className="text-sm font-medium text-foreground">
+							Work with this wiki using AI
+						</p>
+						<p className="mt-1 text-xs leading-relaxed text-muted-foreground">
+							Connect Claude, Cursor, ChatGPT, and more. Pick by what you want —
+							each option gives a copy-paste setup. You approve every assistant
+							in <span className="font-medium text-foreground/80">Agents</span> below before it gets access.
+						</p>
+					</section>
 
-					{/* Bridge endpoint */}
-					<section className="space-y-2">
-						<h3 className="text-xs font-semibold uppercase tracking-widest text-muted-foreground">
-							Bridge Endpoint
-						</h3>
-						<div className="rounded-md border border-border bg-muted/40 p-3 space-y-2">
+					{/* Choose by goal */}
+					<section className="space-y-3">
+						{/* Goal 1: collaborate (one-off instructions + permanent skill) */}
+						<div className="rounded-md border border-border bg-muted/40 p-3 space-y-1.5">
+							<p className="text-xs font-semibold text-foreground">
+								Co-write docs with you
+							</p>
+							<p className="text-[10px] text-muted-foreground/70">
+								Edits arrive as suggestions with comments you accept or revert.
+								No MCP needed.
+							</p>
+							<Button size="sm" variant="outline" className="h-7 w-full text-xs gap-1.5" onClick={() => void bootstrapCopy.copy()} disabled={!bootstrapPrompt}>
+								{bootstrapCopy.copied
+									? <><Check className="h-3.5 w-3.5 text-green-500" /> Copied!</>
+									: <><Copy className="h-3.5 w-3.5" /> Paste into any chatbot</>}
+							</Button>
+							<p className="text-[10px] text-muted-foreground/50 pt-1">
+								Or install once so it sticks{" "}
+								<span className="text-muted-foreground/40">· Claude, OpenCode</span>:
+							</p>
 							<div className="flex items-center gap-2">
-								<code className="flex-1 text-xs font-mono text-foreground/80 truncate">
-									{origin}
+								<code className="flex-1 text-[10px] font-mono text-foreground/80 truncate bg-muted rounded px-1 py-0.5">
+									{SKILL_CLI}
 								</code>
-								<Button
-									size="sm"
-									variant="ghost"
-									className="h-6 w-6 p-0 shrink-0"
-									title="Copy curl example"
-									onClick={() => void copy()}
-								>
-									{copied ? (
-										<Check className="h-3.5 w-3.5 text-green-500" />
-									) : (
-										<Copy className="h-3.5 w-3.5" />
-									)}
+								<Button size="sm" variant="ghost" className="h-6 w-6 p-0 shrink-0" title="Copy this command" onClick={() => void skillCli.copy()}>
+									{skillCli.copied ? <Check className="h-3.5 w-3.5 text-green-500" /> : <Copy className="h-3.5 w-3.5" />}
 								</Button>
 							</div>
-							<p className="text-[10px] text-muted-foreground/70">
-								Copy icon copies a registration-flow <code className="bg-muted px-0.5 rounded">curl</code> trace for the current file.
-							</p>
 						</div>
-					</section>
 
-					{/* Install for AI agents */}
-					<section className="space-y-2">
-						<h3 className="text-xs font-semibold uppercase tracking-widest text-muted-foreground">
-							Install for AI Agents
-						</h3>
-						<div className="rounded-md border border-border bg-muted/40 p-3 space-y-3">
-							<div className="space-y-1">
-								<p className="text-[10px] text-muted-foreground/70">Agent Skills standard:</p>
-								<div className="flex items-center gap-2">
-									<code className="flex-1 text-[10px] font-mono text-foreground/80 truncate bg-muted rounded px-1 py-0.5">
-										{SKILL_CLI}
-									</code>
-									<Button size="sm" variant="ghost" className="h-6 w-6 p-0 shrink-0" title="Copy CLI command" onClick={() => void skillCli.copy()}>
-										{skillCli.copied ? <Check className="h-3.5 w-3.5 text-green-500" /> : <Copy className="h-3.5 w-3.5" />}
-									</Button>
-								</div>
-							</div>
-							<div className="space-y-1">
-								<p className="text-[10px] text-muted-foreground/70">Any agent (paste into chat):</p>
-								<Button size="sm" variant="outline" className="h-7 w-full text-xs gap-1.5" onClick={() => void bootstrapCopy.copy()} disabled={!bootstrapPrompt}>
-									{bootstrapCopy.copied
-										? <><Check className="h-3.5 w-3.5 text-green-500" /> Copied!</>
-										: <><Copy className="h-3.5 w-3.5" /> Copy bootstrap prompt</>}
+						{/* Goal 2: raw filework */}
+						<div className="rounded-md border border-border bg-muted/40 p-3 space-y-1.5">
+							<p className="text-xs font-semibold text-foreground">
+								Edit files directly{" "}
+								<span className="font-normal text-muted-foreground/60">· Claude Code, Cursor, Codex</span>
+							</p>
+							<p className="text-[10px] text-muted-foreground/70">
+								Native read / search / edit tools over MCP. Run to request access:
+							</p>
+							<div className="flex items-center gap-2">
+								<code className="flex-1 text-[10px] font-mono text-foreground/80 truncate bg-muted rounded px-1 py-0.5">
+									{getMcpRegister()}
+								</code>
+								<Button size="sm" variant="ghost" className="h-6 w-6 p-0 shrink-0" title="Copy this command" onClick={() => void mcpRegister.copy()}>
+									{mcpRegister.copied ? <Check className="h-3.5 w-3.5 text-green-500" /> : <Copy className="h-3.5 w-3.5" />}
 								</Button>
 							</div>
-							<div className="flex flex-wrap gap-x-3 gap-y-1 pt-1">
-								<a href="/api/agents/skill.tar.gz" download className="inline-flex items-center gap-1 text-[10px] text-primary hover:underline">
-									<Download className="h-3 w-3" /> skill (.tar.gz)
-								</a>
-								<a href="/api/agents/skill" target="_blank" rel="noreferrer" className="inline-flex items-center gap-1 text-[10px] text-primary hover:underline">
-									<ExternalLink className="h-3 w-3" /> skill markdown
-								</a>
-								<a href="/api/agents/install" target="_blank" rel="noreferrer" className="inline-flex items-center gap-1 text-[10px] text-primary hover:underline">
-									<ExternalLink className="h-3 w-3" /> install JSON
-								</a>
-							</div>
+							<p className="text-[10px] text-muted-foreground/50">Approve in <span className="font-medium text-foreground/70">Agents</span>, then add to your tool:</p>
+							<Button size="sm" variant="outline" className="h-7 w-full text-xs gap-1.5" onClick={() => void mcpJson.copy()}>
+								{mcpJson.copied
+									? <><Check className="h-3.5 w-3.5 text-green-500" /> Copied!</>
+									: <><Copy className="h-3.5 w-3.5" /> Copy config (mcp.json)</>}
+							</Button>
+						</div>
+
+						<div className="flex flex-wrap items-center gap-x-3 gap-y-1">
+							<span className="text-[10px] text-muted-foreground/50">For developers:</span>
+							<button type="button" onClick={() => void copy()} className="inline-flex items-center gap-1 text-[10px] text-primary hover:underline">
+								{copied ? <Check className="h-3 w-3 text-green-500" /> : <Copy className="h-3 w-3" />} curl example
+							</button>
+							<a href="/api/agents/skill" target="_blank" rel="noreferrer" className="inline-flex items-center gap-1 text-[10px] text-primary hover:underline">
+								<ExternalLink className="h-3 w-3" /> skill
+							</a>
+							<a href="/api/agents/install" target="_blank" rel="noreferrer" className="inline-flex items-center gap-1 text-[10px] text-primary hover:underline">
+								<ExternalLink className="h-3 w-3" /> install JSON
+							</a>
 						</div>
 					</section>
 
@@ -263,24 +299,6 @@ export function AIPanel({ currentPath }: { currentPath?: string | null }) {
 						</div>
 					</section>
 
-					{/* Settings */}
-					<section className="space-y-2">
-						<h3 className="text-xs font-semibold uppercase tracking-widest text-muted-foreground">
-							Settings
-						</h3>
-						<div className="rounded-md border border-border bg-muted/40 p-3 space-y-1.5">
-							<div className="flex items-center justify-between text-xs">
-								<span className="text-muted-foreground">Rate limit</span>
-								<span className="font-mono">
-									{rateLimit !== null ? `${rateLimit} ops/min` : "--"}
-								</span>
-							</div>
-							<p className="text-[10px] text-muted-foreground/60">
-								Override with <code className="bg-muted px-0.5 rounded">AGENT_RATE_LIMIT</code> env var.
-							</p>
-						</div>
-					</section>
-
 					{/* Docs link */}
 					<section>
 						<a
@@ -297,26 +315,3 @@ export function AIPanel({ currentPath }: { currentPath?: string | null }) {
 		</>
 	);
 }
-
-function SignedInUser() {
-	const { data: session } = authClient.useSession();
-	if (!session?.user) return null;
-	return (
-		<div className="flex items-center justify-between rounded-md border border-border bg-muted/40 p-3">
-			<div className="text-sm min-w-0">
-				<div className="font-medium truncate">{session.user.name}</div>
-				<div className="text-xs text-muted-foreground truncate">{session.user.email}</div>
-			</div>
-			<button
-				type="button"
-				onClick={async () => {
-					await authClient.signOut();
-					window.location.href = "/signin";
-				}}
-				className="ml-2 shrink-0 text-xs px-2 py-1 rounded border border-border hover:bg-accent"
-			>
-				Sign out
-			</button>
-		</div>
-	);
-}

package/.next/standalone/src/components/ai-panel/token-section.tsx

@@ -251,7 +251,7 @@ export function TokenSection() {
 		<section className="space-y-2">
 			<div className="flex items-center justify-between">
 				<h3 className="text-xs font-semibold uppercase tracking-widest text-muted-foreground">
-					Agents
+					Agents · approve &amp; manage access
 				</h3>
 				<Button
 					size="sm"
@@ -269,7 +269,7 @@ export function TokenSection() {
 				<div className="rounded-md border border-amber-500/40 bg-amber-50/10 p-2">
 					<p className="text-[10px] font-semibold uppercase tracking-widest text-amber-600/80 mb-1 flex items-center gap-1">
 						<Clock className="h-3 w-3" />
-						Pending ({pending.length})
+						Waiting for your approval ({pending.length})
 					</p>
 					<ul>
 						{pending.map((reg) => (
@@ -288,9 +288,10 @@ export function TokenSection() {
 			<div className="rounded-md border border-border bg-muted/40 p-2">
 				{agents.length === 0 ? (
 					<p className="text-xs text-muted-foreground/60 py-1">
-						No registered agents.{" "}
+						No assistants connected yet.{" "}
 						<span className="text-muted-foreground/40">
-							Agents register via POST /api/agent/register.
+							Connect one above; once it requests access it’ll appear here
+							for you to approve.
 						</span>
 					</p>
 				) : (
@@ -303,9 +304,9 @@ export function TokenSection() {
 			</div>
 
 			<p className="text-[10px] text-muted-foreground/60 leading-relaxed">
-				Agents authenticate via bearer token + X-Agent-Id header. Use{" "}
-				<code className="bg-muted px-0.5 rounded">POST /api/agent/register</code> to start the
-				TOFU flow.
+				Each assistant gets its own access that you can revoke anytime. New
+				requests appear above for your approval before they can read or edit
+				anything.
 			</p>
 		</section>
 	);

package/.next/standalone/src/components/auth-settings-sheet.tsx

@@ -1,24 +1,19 @@
 "use client";
 
 import { useCallback, useEffect, useState } from "react";
-import { AlertCircle, Loader2 } from "lucide-react";
+import { AlertCircle, Loader2, X } from "lucide-react";
 
 import { Button } from "@/components/ui/button";
-import {
-	Sheet,
-	SheetContent,
-	SheetDescription,
-	SheetFooter,
-	SheetHeader,
-	SheetTitle,
-} from "@/components/ui/sheet";
+import { Sheet, SheetContent, SheetClose } from "@/components/ui/sheet";
 import { showError } from "@/lib/toast";
+import { authClient } from "@/lib/auth/client";
 
 interface AuthSettings {
 	allowedEmails: string[];
 	allowedDomains: string[];
 	source: "config" | "env";
 	envFallbackActive: boolean;
+	rateLimit?: number;
 }
 
 function listToText(list: string[]): string {
@@ -45,6 +40,8 @@ export function AuthSettingsSheet({
 	const [source, setSource] = useState<"config" | "env">("env");
 	const [emailsText, setEmailsText] = useState("");
 	const [domainsText, setDomainsText] = useState("");
+	const [rateLimit, setRateLimit] = useState<number | null>(null);
+	const { data: session } = authClient.useSession();
 
 	const load = useCallback(async () => {
 		setLoading(true);
@@ -56,6 +53,7 @@ export function AuthSettingsSheet({
 			setEmailsText(listToText(data.allowedEmails));
 			setDomainsText(listToText(data.allowedDomains));
 			setSource(data.source);
+			setRateLimit(typeof data.rateLimit === "number" ? data.rateLimit : null);
 		} catch (e) {
 			setError(e instanceof Error ? e.message : "Failed to load");
 		} finally {
@@ -101,22 +99,63 @@ export function AuthSettingsSheet({
 
 	return (
 		<Sheet open={open} onOpenChange={onOpenChange}>
-			<SheetContent side="right" className="w-full sm:max-w-md flex flex-col">
-				<SheetHeader>
-					<SheetTitle>Signup allowlist</SheetTitle>
-					<SheetDescription>
-						Control who can create an account. Leave both lists empty to allow
-						any email. Saving here overrides the AUTH_ALLOWED_EMAILS and
-						AUTH_ALLOWED_DOMAIN environment variables.
-					</SheetDescription>
-				</SheetHeader>
+			<SheetContent
+				side="right"
+				className="w-80 sm:max-w-md flex flex-col border-l border-border p-0"
+			>
+				{/* Header — matches AI panel chrome */}
+				<div className="flex items-center justify-between border-b border-border px-4 py-3 shrink-0">
+					<span className="text-sm font-semibold">Settings</span>
+					<SheetClose className="flex h-7 w-7 items-center justify-center rounded-md text-muted-foreground hover:bg-accent focus:outline-none focus:ring-2 focus:ring-ring">
+						<X className="h-3.5 w-3.5" />
+						<span className="sr-only">Close</span>
+					</SheetClose>
+				</div>
 
 				{loading ? (
 					<div className="flex flex-1 items-center justify-center">
 						<Loader2 className="h-5 w-5 animate-spin text-muted-foreground" />
 					</div>
 				) : (
-					<div className="flex-1 space-y-5 overflow-auto py-4">
+					<div className="flex-1 space-y-5 overflow-y-auto px-4 py-4">
+						{/* Account */}
+						{session?.user && (
+							<section className="space-y-2">
+								<h3 className="text-xs font-semibold uppercase tracking-widest text-muted-foreground">
+									Account
+								</h3>
+								<div className="flex items-center justify-between rounded-md border border-border bg-muted/40 p-3">
+									<div className="text-sm min-w-0">
+										<div className="font-medium truncate">{session.user.name}</div>
+										<div className="text-xs text-muted-foreground truncate">{session.user.email}</div>
+									</div>
+									<button
+										type="button"
+										onClick={async () => {
+											await authClient.signOut();
+											window.location.href = "/signin";
+										}}
+										className="ml-2 shrink-0 text-xs px-2 py-1 rounded border border-border hover:bg-accent"
+									>
+										Sign out
+									</button>
+								</div>
+							</section>
+						)}
+
+						{/* Signup allowlist */}
+						<section className="space-y-2">
+							<h3 className="text-xs font-semibold uppercase tracking-widest text-muted-foreground">
+								Signup allowlist
+							</h3>
+						<p className="text-xs leading-relaxed text-muted-foreground">
+							Control who can create an account. Leave both lists empty to
+							allow any email. Saving here overrides the{" "}
+							<code className="bg-muted px-0.5 rounded">AUTH_ALLOWED_EMAILS</code>{" "}
+							and{" "}
+							<code className="bg-muted px-0.5 rounded">AUTH_ALLOWED_DOMAIN</code>{" "}
+							environment variables.
+						</p>
 						{source === "env" && (
 							<div className="flex items-start gap-2 rounded-md bg-muted px-3 py-2 text-xs text-muted-foreground">
 								<AlertCircle className="h-3.5 w-3.5 shrink-0 mt-0.5" />
@@ -187,22 +226,42 @@ export function AuthSettingsSheet({
 								{error}
 							</div>
 						)}
+						</section>
+
+						{/* Agent rate limit */}
+						<section className="space-y-2">
+							<h3 className="text-xs font-semibold uppercase tracking-widest text-muted-foreground">
+								Agent rate limit
+							</h3>
+							<div className="rounded-md border border-border bg-muted/40 p-3 space-y-1.5">
+								<div className="flex items-center justify-between text-xs">
+									<span className="text-muted-foreground">Per agent</span>
+									<span className="font-mono">
+										{rateLimit !== null ? `${rateLimit} ops/min` : "--"}
+									</span>
+								</div>
+								<p className="text-[10px] text-muted-foreground/60">
+									Override with <code className="bg-muted px-0.5 rounded">AGENT_RATE_LIMIT</code> env var.
+								</p>
+							</div>
+						</section>
 					</div>
 				)}
 
-				<SheetFooter>
+				<div className="flex items-center justify-end gap-2 border-t border-border px-4 py-3 shrink-0">
 					<Button
+						size="sm"
 						variant="ghost"
 						onClick={() => onOpenChange(false)}
 						disabled={saving}
 					>
 						Cancel
 					</Button>
-					<Button onClick={handleSave} disabled={saving || loading} className="gap-1.5">
+					<Button size="sm" onClick={handleSave} disabled={saving || loading} className="gap-1.5">
 						{saving && <Loader2 className="h-3.5 w-3.5 animate-spin" />}
 						Save
 					</Button>
-				</SheetFooter>
+				</div>
 			</SheetContent>
 		</Sheet>
 	);

package/.next/standalone/src/components/editor/editor.tsx

@@ -184,6 +184,44 @@ export function KBEditor() {
 		void useProofStore.getState().loadSidecar(currentPath);
 	}, [currentPath]);
 
+	// Human edit-lease heartbeat: tell the server a human has this markdown doc
+	// open so computeCollabState() reports "active" even before the first
+	// suggestion/comment. This is what makes raw-fs writes from agents defer to
+	// the collaborative (Tier-2) path while a human is editing. Only markdown
+	// files participate in the collab-state machine.
+	useEffect(() => {
+		if (typeof window === "undefined") return;
+		if (!currentPath) return;
+		if (!/\.(md|markdown)$/i.test(currentPath)) return;
+
+		const path = currentPath;
+		const ping = (action: "open" | "heartbeat" | "close") => {
+			// keepalive lets the "close" beacon survive page unload.
+			void fetch("/api/wiki/presence", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ path, action }),
+				keepalive: action === "close",
+			}).catch(() => {
+				/* presence is best-effort; ignore failures */
+			});
+		};
+
+		ping("open");
+		// Refresh well within the 90s server lease TTL.
+		const id = setInterval(() => ping("heartbeat"), 30_000);
+		const onHidden = () => {
+			if (document.visibilityState === "hidden") ping("heartbeat");
+		};
+		document.addEventListener("visibilitychange", onHidden);
+
+		return () => {
+			clearInterval(id);
+			document.removeEventListener("visibilitychange", onHidden);
+			ping("close");
+		};
+	}, [currentPath]);
+
 	// Subscribe to chokidar SSE: when current file changes on disk, reload sidecar.
 	useEffect(() => {
 		if (typeof window === "undefined") return;

package/.next/standalone/src/lib/proof/audit.ts

@@ -0,0 +1,79 @@
+/**
+ * Minimal durable audit log for raw-fs mutations (Tier 1).
+ *
+ * Uses the same ~/.wiki-viewer/auth.db already opened by better-auth.
+ * Table: agent_fs_audit
+ *
+ * For .md files the sidecar event covers provenance; this covers ALL types.
+ */
+import Database from "better-sqlite3";
+import path from "node:path";
+import os from "node:os";
+import { mkdirSync } from "node:fs";
+
+function dataDir(): string {
+	return path.join(process.env.HOME ?? os.homedir(), ".wiki-viewer");
+}
+
+// Lazily initialised so tests can set HOME before first import.
+let _db: InstanceType<typeof Database> | null = null;
+
+function getDb(): InstanceType<typeof Database> {
+	if (_db) return _db;
+	const dir = dataDir();
+	mkdirSync(dir, { recursive: true });
+	const dbPath = path.join(dir, "auth.db");
+	_db = new Database(dbPath);
+	_db.pragma("journal_mode = WAL");
+	_db.exec(`
+		CREATE TABLE IF NOT EXISTS agent_fs_audit (
+			id      INTEGER PRIMARY KEY AUTOINCREMENT,
+			agent_id TEXT NOT NULL,
+			op      TEXT NOT NULL,
+			path    TEXT NOT NULL,
+			old_sha TEXT,
+			new_sha TEXT,
+			forced  INTEGER NOT NULL DEFAULT 0,
+			at      TEXT NOT NULL
+		)
+	`);
+	return _db;
+}
+
+export interface AuditRow {
+	agentId: string;
+	op: string;
+	path: string;
+	oldSha?: string;
+	newSha?: string;
+	forced?: boolean;
+}
+
+/**
+ * Write one audit row synchronously (SQLite sync is fine here — it's a WAL journal append).
+ * Fire-and-forget: never throws; logs to stderr on error.
+ */
+export function writeAuditRow(row: AuditRow): void {
+	try {
+		const db = getDb();
+		db.prepare(
+			`INSERT INTO agent_fs_audit (agent_id, op, path, old_sha, new_sha, forced, at)
+			 VALUES (?, ?, ?, ?, ?, ?, ?)`,
+		).run(
+			row.agentId,
+			row.op,
+			row.path,
+			row.oldSha ?? null,
+			row.newSha ?? null,
+			row.forced ? 1 : 0,
+			new Date().toISOString(),
+		);
+	} catch (e) {
+		console.error("[agent-fs audit] write failed:", e);
+	}
+}
+
+/** Reset cached DB handle (used by tests to pick up new HOME). */
+export function _resetAuditDb(): void {
+	_db = null;
+}

package/.next/standalone/src/lib/proof/auth.ts

@@ -34,7 +34,7 @@ export async function checkAuth(req: Request): Promise<CheckAuthResult> {
 				id: `user:${u.id}`,
 				displayName: u.name,
 				tokenHash: "",
-				scope: { paths: ["**/*"], ops: ["read", "mutate"] },
+				scope: { paths: ["**/*"], ops: ["read", "mutate", "delete"] },
 				createdAt: "",
 				lastSeen: "",
 			},
@@ -71,7 +71,7 @@ export async function checkAuth(req: Request): Promise<CheckAuthResult> {
 
 export interface ScopeParams {
 	filePath?: string;
-	op: "read" | "mutate";
+	op: "read" | "mutate" | "delete";
 }
 
 export function enforceScope(