@@ -0,0 +1,12 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/fields': patch
+---
+
+fix(console): starting an impersonation lands on home, and a person's permission-set picker no longer offers the MCP agent sets
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Impersonation landing.** An administrator who starts an impersonation from a Setup page used to stay on that page, which the impersonated user usually cannot open, so the console showed "You don't have access to this app". The impersonation banner now navigates to `/` the moment a session the console held as an ordinary one becomes impersonated, and the console resolves the landing for the user it now holds. A console that boots into an impersonated session (a reload, a new tab, a deep link) stays on the URL it was opened at, and ending an impersonation does not move the page. The navigation goes through the host navigate the console supplies, so a deployment's basename applies.
+- **Agent sets in the person picker.** The `permission-ref` field (the permission set on a person's grant, `sys_user_permission_set.permission_set`) no longer offers the three MCP agent ceiling sets (`mcp_agent_data_read`, `mcp_agent_data_write`, `mcp_agent_restricted`, the spec's `MCP_AGENT_PERMISSION_SETS`). Those are an AI assistant's own grants, which the runtime puts on the agent principal directly. A grant that already names one still shows it as the row's value, by its label beside its name. `position-ref` is unchanged.
@@ -50,12 +50,28 @@
  * session impersonated keeps the banner up and states what happened. Silently
  * appearing to succeed would be strictly worse than the original defect —
  * the operator would go back to ordinary work believing they were themselves.
+ *
+ * ## Starting one lands on home
+ *
+ * An administrator starts an impersonation from a Setup page, and the user they
+ * become usually cannot open Setup: left where it was, the console would answer
+ * the page the administrator was on with "no access to this app". So the moment
+ * a session this console already held as an ordinary one becomes impersonated,
+ * the banner navigates to `/`, where the console resolves the landing for the
+ * identity it now holds. Only that transition moves the page: a console that
+ * boots into an impersonated session (a reload, a new tab, a deep link) stays on
+ * the URL it was opened at, and ending an impersonation moves nothing.
+ *
+ * The navigate is the host's (`useHostNavigation`), which the console supplies
+ * from its router so the deployment's basename applies. A tree with no host
+ * navigate, such as a test that mounts the banner alone, does not move.
  */
 
-import { useEffect, useState } from 'react';
+import { useEffect, useRef, useState } from 'react';
 import { UserCog } from 'lucide-react';
 import { Button } from '@object-ui/components';
-import { createAuthenticatedFetch } from '@object-ui/auth';
+import { createAuthenticatedFetch, useAuth } from '@object-ui/auth';
+import { useHostNavigation } from '@object-ui/react';
 import { GetDataResponseSchema } from '@objectstack/spec/api';
 import { useObjectTranslation } from '@object-ui/i18n';
 import { PERSON_DISPLAY_FIELDS, rowLabel } from '../utils/approverIdentity.js';
@@ -108,6 +124,30 @@ function useAdministratorName(adminId: string | undefined): AdministratorName {
   return answer.name;
 }
 
+/** What the last render saw: whether a session was resolved, and whom it impersonated. */
+interface ObservedSession {
+  resolved: boolean;
+  impersonatedBy: string | undefined;
+}
+
+/**
+ * Navigate home when an ordinary session this console held becomes
+ * impersonated. See the module header for which transitions move the page.
+ */
+function useLandOnImpersonationStart(impersonatedBy: string | undefined): void {
+  const { session } = useAuth();
+  const { navigate } = useHostNavigation();
+  const resolved = session != null;
+  const previous = useRef<ObservedSession | null>(null);
+
+  useEffect(() => {
+    const before = previous.current;
+    previous.current = { resolved, impersonatedBy };
+    if (!navigate || !impersonatedBy) return;
+    if (before?.resolved && !before.impersonatedBy) navigate('/');
+  }, [resolved, impersonatedBy, navigate]);
+}
+
 export function ImpersonationBanner() {
   const { t } = useObjectTranslation();
   // The exit itself — request, token adoption, outcome — is shared with the
@@ -116,6 +156,7 @@ export function ImpersonationBanner() {
   const { impersonatedBy, impersonatedName, stop, stopping, stopError, notRestored } =
     useImpersonationExit();
   const administrator = useAdministratorName(impersonatedBy);
+  useLandOnImpersonationStart(impersonatedBy);
 
   // Nothing to say on an ordinary session. Below every hook, so the hook order
   // is stable across the transition out of impersonation.
 
@@ -36,7 +36,9 @@ import userEvent from '@testing-library/user-event';
 import { AuthProvider, TokenStorage } from '@object-ui/auth';
 import type { AuthClient } from '@object-ui/auth';
 import { I18nProvider } from '@object-ui/i18n';
+import { MemoryRouter, useLocation } from 'react-router-dom';
 import { ImpersonationBanner } from '../ImpersonationBanner';
+import { HostNavigationBridge } from '../../console/HostNavigationBridge';
 
 const ADMIN_TOKEN = 'admin-token';
 const IMPERSONATED_TOKEN = 'impersonated-token';
@@ -306,3 +308,85 @@ describe('ImpersonationBanner (#4467)', () => {
     expect(screen.queryByTestId('impersonation-stop-error')).toBeNull();
   });
 });
+
+/**
+ * Starting an impersonation from a Setup page lands the administrator on home,
+ * not on the page they were on, which the impersonated user usually cannot
+ * open. Mounted the way `ConsoleShell` mounts the banner: under a router, inside
+ * the console's `HostNavigationBridge`, with the current path read back.
+ */
+describe('ImpersonationBanner: starting an impersonation lands on home', () => {
+  const SETUP_PAGE = '/apps/setup/sys_user/usr_dave';
+
+  function LocationProbe() {
+    const location = useLocation();
+    return <output data-testid="location">{location.pathname}</output>;
+  }
+
+  function renderInConsole(initialPath: string) {
+    return render(
+      <MemoryRouter initialEntries={[initialPath]}>
+        <HostNavigationBridge>
+          <I18nProvider config={{ defaultLanguage: 'en', detectBrowserLanguage: false }}>
+            <AuthProvider authUrl="/api/v1/auth" client={tokenBoundClient()}>
+              <ImpersonationBanner />
+              <LocationProbe />
+            </AuthProvider>
+          </I18nProvider>
+        </HostNavigationBridge>
+      </MemoryRouter>,
+    );
+  }
+
+  const location = () => screen.getByTestId('location').textContent;
+
+  beforeEach(() => {
+    TokenStorage.clear();
+    stubStopEndpoint((url) =>
+      url.endsWith(STOP_PATH)
+        ? new Response('{}', { status: 200, headers: { 'set-auth-token': ADMIN_TOKEN } })
+        : new Response('{}'),
+    );
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+    TokenStorage.clear();
+  });
+
+  it('navigates to / when an ordinary session becomes impersonated', async () => {
+    TokenStorage.set(ADMIN_TOKEN);
+    renderInConsole(SETUP_PAGE);
+    // The administrator's ordinary session has resolved on the Setup page.
+    await waitFor(() => expect(TokenStorage.get()).toBe(ADMIN_TOKEN));
+    await new Promise((r) => setTimeout(r, 0));
+    expect(location()).toBe(SETUP_PAGE);
+
+    // The impersonate action's response rotates the token; the provider
+    // re-resolves identity from it.
+    TokenStorage.set(IMPERSONATED_TOKEN);
+
+    await screen.findByTestId('impersonation-banner');
+    await waitFor(() => expect(location()).toBe('/'));
+  });
+
+  it('stays on the URL it was opened at when the console boots already impersonated', async () => {
+    TokenStorage.set(IMPERSONATED_TOKEN);
+    renderInConsole(SETUP_PAGE);
+
+    await screen.findByTestId('impersonation-banner');
+    await new Promise((r) => setTimeout(r, 0));
+    expect(location()).toBe(SETUP_PAGE);
+  });
+
+  it('does not move the page when the impersonation ends', async () => {
+    TokenStorage.set(IMPERSONATED_TOKEN);
+    renderInConsole(SETUP_PAGE);
+
+    await screen.findByTestId('impersonation-banner');
+    await userEvent.click(screen.getByTestId('impersonation-stop'));
+    await waitFor(() => expect(screen.queryByTestId('impersonation-banner')).toBeNull());
+    expect(location()).toBe(SETUP_PAGE);
+  });
+});
@@ -11,6 +11,7 @@ import { AlertTriangle } from 'lucide-react';
 import { Combobox, EmptyValue, Input, cn } from '@object-ui/components';
 import { SchemaRendererContext } from '@object-ui/react';
 import { AUDIENCE_ANCHOR_POSITIONS } from '@objectstack/spec';
+import { MCP_AGENT_PERMISSION_SETS } from '@objectstack/spec/ai';
 import type { FieldWidgetComponentProps } from './types.js';
 import { registryLister, type RegistryItemHeader } from './registryCatalog.js';
 import { toDomProps } from './toDomProps.js';
@@ -56,10 +57,13 @@ import { useFieldTranslation } from './useFieldTranslation.js';
  * grant cannot name an audience anchor — `everyone` or `guest` (ADR-0090
  * D5/D9), held implicitly by every authenticated or anonymous principal — and
  * the server refuses a `sys_user_position` row that does. So `position-ref`
- * leaves the anchors out of its options ({@link nonGrantableNames}). A stored
- * anchor is still the row's value: it stays on screen as its own option, by its
- * label beside its name, and it is not flagged "not found", because the
- * registry does list it.
+ * leaves the anchors out of its options ({@link nonGrantableNames}). A
+ * permission grant names a set for a PERSON, and the MCP agent ceiling sets
+ * (ADR-0090 D10) are an AI assistant's own grants, which the runtime injects
+ * onto the agent principal directly rather than through any grant row; so
+ * `permission-ref` leaves them out. A stored name left out is still the row's value: it stays on screen as
+ * its own option, by its label beside its name, and it is not flagged "not
+ * found", because the registry does list it.
  *
  * ⛔ No arm writes anything but a name the person picked or typed: no label,
  * no id, no first-item default.
@@ -83,27 +87,40 @@ function failureMessage(err: unknown): string {
 }
 
 const AUDIENCE_ANCHORS: ReadonlySet<string> = new Set(AUDIENCE_ANCHOR_POSITIONS);
+const AGENT_CEILING_SETS: ReadonlySet<string> = new Set(MCP_AGENT_PERMISSION_SETS);
 const NO_EXCLUSIONS: ReadonlySet<string> = new Set();
 
 /**
  * The names of a registry type that a grant cannot name, which the picker
  * therefore does not offer. For `position`, the audience anchors: the list is
  * the spec's own `AUDIENCE_ANCHOR_POSITIONS`, read and never copied, so an
- * anchor the spec adds is left out with no change here. Every other type
- * excludes nothing: a permission set named like an anchor is an ordinary set.
+ * anchor the spec adds is left out with no change here. For `permission`, the
+ * MCP agent ceiling sets, read the same way from the spec's
+ * `MCP_AGENT_PERMISSION_SETS`. Every other type excludes nothing, and each list
+ * applies to its own type only: a permission set named like an anchor is an
+ * ordinary set.
  *
- * Imported statically from the spec's ROOT entry, as `@object-ui/auth` imports
- * `BUILTIN_MEMBERSHIP_ROLES`, and not from `@objectstack/spec/identity`. The
+ * The anchors are imported statically from the spec's ROOT entry, as
+ * `@object-ui/auth` imports `BUILTIN_MEMBERSHIP_ROLES`, and not from
+ * `@objectstack/spec/identity`. The
  * console builds this widget into an eager chunk (`ui-components`), so a
  * static `/identity` import would carry that subpath's whole module into every
  * page load; `pnpm check:eager-closure` is the instrument that weighs it. A
  * lazy `import()` keeps that module out of the eager closure, but out of
  * `pnpm check:spec-floors` too: that gate judges the `@objectstack/spec` floor
  * from static imports only, and on the publish lane it reports a subpath it
  * cannot judge as a finding.
+ *
+ * The agent sets have no root export, so they come from `@objectstack/spec/ai`,
+ * statically for the same `check:spec-floors` reason. That subpath's
+ * `mcp.zod` module already reaches the eager closure through the console's
+ * OAuth consent page, which imports its scope constants statically;
+ * `pnpm check:eager-closure` weighs what this import adds.
  */
 function nonGrantableNames(type: string): ReadonlySet<string> {
-  return type === 'position' ? AUDIENCE_ANCHORS : NO_EXCLUSIONS;
+  if (type === 'position') return AUDIENCE_ANCHORS;
+  if (type === 'permission') return AGENT_CEILING_SETS;
+  return NO_EXCLUSIONS;
 }
 
 /** A settled answer, with the inputs it answers for. */
 
@@ -17,14 +17,18 @@
  *  - a registry that lists nothing BUT anchors offers no picker;
  *  - a stored anchor still shows, by its label beside its name, unflagged, and
  *    is not offered when the row holds another value;
- *  - `permission-ref` filters nothing: a permission set named like an anchor is
- *    an ordinary set.
+ *  - `permission-ref` does not apply the anchor list: a permission set named
+ *    like an anchor is an ordinary set;
+ *  - `permission-ref` leaves out exactly the spec's `MCP_AGENT_PERMISSION_SETS`,
+ *    the AI assistant ceiling sets a person is never granted, and a stored one
+ *    still shows as the row's value.
  */
 import { describe, it, expect, vi, afterEach } from 'vitest';
 import React from 'react';
 import { render, screen, waitFor, fireEvent, cleanup } from '@testing-library/react';
 import '@testing-library/jest-dom';
 import { AUDIENCE_ANCHOR_POSITIONS } from '@objectstack/spec';
+import { MCP_AGENT_PERMISSION_SETS } from '@objectstack/spec/ai';
 import { PositionRefField, PermissionRefField } from '../RegistryRefField';
 
 /** The assignable positions, by label beside name, as the picker reads them. */
@@ -118,7 +122,7 @@ describe('a stored anchor still shows, and is not offered as a fresh choice (obj
   });
 });
 
-describe('permission-ref filters nothing (objectui#12200)', () => {
+describe('permission-ref does not apply the anchor list (objectui#12200)', () => {
   it('lists, and writes, a permission set named like an anchor', async () => {
     const sets = lister([
       { name: 'everyone', label: 'Everyone Baseline' },
@@ -132,3 +136,51 @@ describe('permission-ref filters nothing (objectui#12200)', () => {
     expect(onChange).toHaveBeenCalledWith('everyone');
   });
 });
+
+describe('permission-ref leaves the MCP agent sets out of what it offers', () => {
+  /** The person-assignable sets, by label beside name, as the picker reads them. */
+  const PERSON_SETS = ['Sales User (sales_user)', 'Standard User (standard_user)'];
+
+  const SETS = [
+    { name: 'standard_user', label: 'Standard User' },
+    { name: 'sales_user', label: 'Sales User' },
+    // The agent ceiling sets, as the permission registry serves them: listed
+    // beside the sets a person can hold.
+    { name: 'mcp_agent_data_read', label: 'MCP Agent — Read Only' },
+    { name: 'mcp_agent_data_write', label: 'MCP Agent — Read & Write' },
+    { name: 'mcp_agent_restricted', label: 'MCP Agent — No Data Access' },
+  ];
+
+  it('offers the sets a person can hold and no agent set', async () => {
+    // The names the registry serves are the ones the spec publishes.
+    expect([...MCP_AGENT_PERMISSION_SETS].sort()).toEqual(
+      ['mcp_agent_data_read', 'mcp_agent_data_write', 'mcp_agent_restricted'],
+    );
+
+    mount(PermissionRefField, { dataSource: lister(SETS) });
+
+    expect(await openOptions()).toEqual(PERSON_SETS);
+    for (const set of MCP_AGENT_PERMISSION_SETS) {
+      expect(screen.queryByText(new RegExp(`\\(${set}\\)$`))).toBeNull();
+    }
+  });
+
+  it('a stored agent set still shows by its label beside its name, unflagged, and writes nothing', async () => {
+    const { onChange } = mount(PermissionRefField, { dataSource: lister(SETS), value: 'mcp_agent_data_read' });
+
+    const trigger = await screen.findByRole('combobox');
+    expect(trigger).toHaveTextContent('MCP Agent — Read Only (mcp_agent_data_read)');
+    expect(trigger).not.toHaveAttribute('data-not-found');
+    expect(onChange).not.toHaveBeenCalled();
+    // Its own option, as the row's value; the other agent sets are not offered.
+    expect(await openOptions()).toEqual(['MCP Agent — Read Only (mcp_agent_data_read)', ...PERSON_SETS]);
+  });
+
+  it('position-ref does not apply the agent list: a position named like an agent set is ordinary', async () => {
+    mount(PositionRefField, {
+      dataSource: lister([{ name: 'mcp_agent_restricted', label: 'Restricted Desk' }, { name: 'auditor' }]),
+    });
+
+    expect(await openOptions()).toEqual(['auditor', 'Restricted Desk (mcp_agent_restricted)']);
+  });
+});