@geminixiang/mikan 1.0.0-beta.44 → 1.0.0-beta.46

package/dist/web/admin/portal.js

@@ -1,11 +1,25 @@
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { basename, join, resolve as pathResolve, sep as pathSep } from "node:path";
-import { defaultExtensionDirs, listInstalledExtensions, MikanModels, parseFrontmatter, SessionStore, validateEventFilename, } from "../../harness/index.js";
+import { MikanModels, parseFrontmatter, SessionStore, validateEventFilename, } from "../../harness/index.js";
+import { InMemoryTokenStore } from "../token-store.js";
+const ADMIN_TOKEN_TTL_MS = 30 * 60 * 1000;
+export class InMemoryAdminTokenStore extends InMemoryTokenStore {
+    create(args) {
+        this.deleteWhere((token) => token.platform === args.platform && token.platformUserId === args.platformUserId);
+        return this.createRecord(ADMIN_TOKEN_TTL_MS, {
+            platform: args.platform,
+            platformUserId: args.platformUserId,
+            ...(args.platformUserName ? { platformUserName: args.platformUserName } : {}),
+            conversationId: args.conversationId,
+        });
+    }
+}
 import { loadConversationAutoReplyConfig, loadConversationWorkspaceOverride, loadGlobalSettings, loadScopeMcpServers, resolveConversationSettings, saveConversationAutoReplyConfig, } from "../../config.js";
+import { findMcpPreset, listMcpPresets, materializeMcpPreset } from "../../mcp/catalog.js";
 import { applyConversationSettings, applyConversationWorkspacePolicy, applyGlobalSettings, applyGlobalWorkspacePolicy, } from "../../settings-mutation.js";
 import { addPackage, inspectConversationPackages, refreshPackage, removePackage, } from "../../packages/index.js";
-import { escapeHtml, readJsonBody, renderPortalShell } from "../portal-shell.js";
-import { resolveExistingSessionFile } from "../session-view/service.js";
+import { escapeHtml, jsonResponse as jsonRes, readJsonBody, renderPortalShell, } from "../portal-shell.js";
+import { resolveExistingSessionFile } from "../session-view/portal.js";
 import { PRODUCT_NAME } from "../../platform-messages.js";
 import { credentialAuthorizationKey } from "../../sandbox/identity.js";
 import { resolveWorkspaceProjection } from "../../workspace-projection/index.js";
@@ -40,152 +54,93 @@ export async function handleAdminRequest(req, res, url, services) {
 // ── API routing ────────────────────────────────────────────────────────────────
 async function routeApiRequest(req, res, url, services) {
     if (req.method === "GET") {
-        const token = services.adminTokenStore.peek(url.searchParams.get("token") ?? "");
-        if (!token) {
-            jsonRes(res, 403, { error: "Unauthorized" });
-            return;
-        }
-        if (url.pathname === "/admin/api/me") {
-            serveMe(res, token);
-            return;
-        }
-        if (url.pathname === "/admin/api/conversations") {
-            serveConversationsList(res, services);
-            return;
-        }
-        if (url.pathname === "/admin/api/session-usage") {
-            await serveSessionUsage(res, services);
-            return;
-        }
-        if (url.pathname === "/admin/api/conversation-usage") {
-            await serveConversationUsage(res, url, services);
-            return;
-        }
-        if (url.pathname === "/admin/api/conversation-state") {
-            serveConversationState(res, url, services, token);
-            return;
-        }
-        if (url.pathname === "/admin/api/settings/global") {
-            serveGlobalSettings(res);
-            return;
-        }
-        if (url.pathname === "/admin/api/models") {
-            void serveModelsList(res);
-            return;
-        }
-        if (url.pathname === "/admin/api/workspace/tree") {
-            serveWorkspaceTree(res, url, services, token);
-            return;
-        }
-        if (url.pathname === "/admin/api/workspace/file") {
-            serveWorkspaceFile(res, url, services, token);
-            return;
-        }
-        if (url.pathname === "/admin/api/skills") {
-            serveSkillsList(res, url, services, token);
-            return;
-        }
-        if (url.pathname === "/admin/api/skills/file") {
-            serveSkillFile(res, url, services, token);
-            return;
-        }
-        if (url.pathname === "/admin/api/packages") {
-            await servePackagesList(res, url, services, token);
-            return;
-        }
-        if (url.pathname === "/admin/api/extension-secrets") {
-            serveExtensionSecretsList(res, url, services, token);
-            return;
-        }
-        if (url.pathname === "/admin/api/mcp-servers") {
-            serveMcpServersList(res, url, services, token);
-            return;
-        }
-        if (url.pathname === "/admin/api/events") {
-            await serveEventsList(res, services);
-            return;
-        }
-        if (url.pathname === "/admin/api/events/file") {
-            serveEventsFile(res, url, services);
-            return;
-        }
-        if (url.pathname === "/admin/api/conversations/events") {
-            await serveConversationEventsList(res, url, services, token);
-            return;
-        }
-        jsonRes(res, 404, { error: "Not found" });
+        await routeGetApiRequest(res, url, services);
         return;
     }
     if (req.method !== "POST") {
         jsonRes(res, 405, { error: "Method not allowed" });
         return;
     }
-    const body = await readJsonBody(req, res, 32 * 1024);
-    if (!body)
-        return;
-    const rawToken = typeof body.token === "string" ? body.token : "";
-    const token = services.adminTokenStore.peek(rawToken);
+    await routePostApiRequest(req, res, url, services);
+}
+async function routeGetApiRequest(res, url, services) {
+    const token = services.adminTokenStore.peek(url.searchParams.get("token") ?? "");
     if (!token) {
         jsonRes(res, 403, { error: "Unauthorized" });
         return;
     }
-    if (url.pathname === "/admin/api/conversations/model") {
-        serveConversationModelUpdate(res, body, services, token);
-        return;
-    }
-    if (url.pathname === "/admin/api/conversations/sandbox") {
-        serveConversationSandboxUpdate(res, body, services, token);
-        return;
-    }
-    if (url.pathname === "/admin/api/conversations/auto-reply") {
-        serveConversationAutoReplyUpdate(res, body, services, token);
-        return;
-    }
-    if (url.pathname === "/admin/api/conversations/slack") {
-        serveConversationSlackUpdate(res, body, services, token);
-        return;
-    }
-    if (url.pathname === "/admin/api/conversations/session-link") {
-        serveConversationSessionLink(res, body, services, token);
-        return;
-    }
-    if (url.pathname === "/admin/api/conversations/login-link") {
-        serveConversationLoginLink(res, body, services, token);
-        return;
-    }
-    if (url.pathname === "/admin/api/conversations/events/delete") {
-        await serveConversationEventDelete(res, body, services, token);
-        return;
-    }
-    if (url.pathname === "/admin/api/mcp-servers/mutate") {
-        serveMcpServerMutation(res, body, services, token);
-        return;
-    }
-    if (url.pathname === "/admin/api/packages/mutate") {
-        servePackageMutation(res, body, services, token);
-        return;
-    }
-    if (url.pathname === "/admin/api/extension-secrets/mutate") {
-        serveExtensionSecretMutation(res, body, services);
-        return;
-    }
-    if (url.pathname === "/admin/api/settings/model") {
-        serveGlobalModelUpdate(res, body, services);
-        return;
+    switch (url.pathname) {
+        case "/admin/api/conversations":
+            return serveConversationsList(res, services);
+        case "/admin/api/session-usage":
+            return serveSessionUsage(res, services);
+        case "/admin/api/conversation-usage":
+            return serveConversationUsage(res, url, services);
+        case "/admin/api/conversation-state":
+            return serveConversationState(res, url, services, token);
+        case "/admin/api/settings/global":
+            return serveGlobalSettings(res);
+        case "/admin/api/models":
+            return serveModelsList(res);
+        case "/admin/api/workspace/tree":
+            return serveWorkspaceTree(res, url, services, token);
+        case "/admin/api/workspace/file":
+            return serveWorkspaceFile(res, url, services, token);
+        case "/admin/api/skills":
+            return serveSkillsList(res, url, services, token);
+        case "/admin/api/skills/file":
+            return serveSkillFile(res, url, services, token);
+        case "/admin/api/packages":
+            return servePackagesList(res, url, services, token);
+        case "/admin/api/mcp-servers":
+            return serveMcpServersList(res, url, services, token);
+        case "/admin/api/events":
+            return serveEventsList(res, services);
+        case "/admin/api/conversations/events":
+            return serveConversationEventsList(res, url, services, token);
+        default:
+            jsonRes(res, 404, { error: "Not found" });
     }
-    if (url.pathname === "/admin/api/settings/workspace") {
-        serveGlobalWorkspaceUpdate(res, body, services);
+}
+async function routePostApiRequest(req, res, url, services) {
+    const body = await readJsonBody(req, res, 32 * 1024);
+    if (!body)
         return;
-    }
-    if (url.pathname === "/admin/api/settings/sandbox") {
-        serveGlobalSandboxUpdate(res, body, services);
+    const token = services.adminTokenStore.peek(typeof body.token === "string" ? body.token : "");
+    if (!token) {
+        jsonRes(res, 403, { error: "Unauthorized" });
         return;
     }
-    if (url.pathname === "/admin/api/settings/slack") {
-        serveGlobalSlackUpdate(res, body, services);
-        return;
+    switch (url.pathname) {
+        case "/admin/api/conversations/model":
+            return serveConversationModelUpdate(res, body, services, token);
+        case "/admin/api/conversations/sandbox":
+            return serveConversationSandboxUpdate(res, body, services, token);
+        case "/admin/api/conversations/auto-reply":
+            return serveConversationAutoReplyUpdate(res, body, services, token);
+        case "/admin/api/conversations/slack":
+            return serveConversationSlackUpdate(res, body, services, token);
+        case "/admin/api/conversations/session-link":
+            return serveConversationSessionLink(res, body, services, token);
+        case "/admin/api/conversations/login-link":
+            return serveConversationLoginLink(res, body, services, token);
+        case "/admin/api/conversations/events/delete":
+            return serveConversationEventDelete(res, body, services, token);
+        case "/admin/api/mcp-servers/mutate":
+            return serveMcpServerMutation(res, body, services, token);
+        case "/admin/api/packages/mutate":
+            return servePackageMutation(res, body, services, token);
+        case "/admin/api/settings/model":
+            return serveGlobalModelUpdate(res, body, services);
+        case "/admin/api/settings/workspace":
+            return serveGlobalWorkspaceUpdate(res, body, services);
+        case "/admin/api/settings/sandbox":
+            return serveGlobalSandboxUpdate(res, body, services);
+        case "/admin/api/settings/slack":
+            return serveGlobalSlackUpdate(res, body, services);
+        default:
+            jsonRes(res, 404, { error: "Not found" });
     }
-    jsonRes(res, 404, { error: "Not found" });
 }
 /**
  * Admin scope is a full office address. The platform defaults to the token's
@@ -219,15 +174,6 @@ function requireAdminWorkspace(res, services) {
     return services.workspace;
 }
 // ── API handlers ───────────────────────────────────────────────────────────────
-function serveMe(res, token) {
-    jsonRes(res, 200, {
-        platform: token.platform,
-        platformUserId: token.platformUserId,
-        platformUserName: token.platformUserName ?? null,
-        conversationId: token.conversationId,
-        expiresAt: token.expiresAt,
-    });
-}
 /**
  * Office directories are office-key named and not reversible to raw ids, so
  * enumeration reads the office registry — the durable raw-id ↔ office
@@ -503,9 +449,11 @@ function serveConversationState(res, url, services, token) {
         globalThinkingLevel: globalConfig.thinkingLevel,
         workspaceDoorPolicy: conversationWorkspace.doorPolicy,
         workspaceLayout: conversationWorkspace.layout,
+        workspaceVisibility: conversationWorkspace.visibility,
         workspaceOverride: doorPolicyChoiceKey(loadConversationWorkspaceOverride(office)),
         globalWorkspaceDoorPolicy: globalWorkspaceSettings?.doorPolicy ?? "isolated",
         globalWorkspaceLayout: globalWorkspaceSettings?.layout ?? "conversation",
+        globalWorkspaceVisibility: globalWorkspaceSettings?.visibility ?? "public",
         autoReplyEnabled: autoReply.enabled,
         autoReplyRules: autoReply.rules,
         slack: {
@@ -525,8 +473,9 @@ function serveGlobalSettings(res) {
             sandboxMemory: config.sandbox?.memory ?? null,
             sandboxBoostCpus: config.sandbox?.boost?.cpus ?? null,
             sandboxBoostMemory: config.sandbox?.boost?.memory ?? null,
-            workspaceDoorPolicy: config.sandbox?.workspace?.doorPolicy ?? "isolated",
-            workspaceLayout: config.sandbox?.workspace?.layout ?? "conversation",
+            workspaceDoorPolicy: config.sandbox?.workspace?.doorPolicy ?? null,
+            workspaceLayout: config.sandbox?.workspace?.layout ?? null,
+            workspaceVisibility: config.sandbox?.workspace?.visibility ?? null,
             defaultSharedVault: config.sandbox?.defaultSharedVault ?? null,
             slack: {
                 replyMode: config.slack?.replyMode ?? "top-level",
@@ -595,7 +544,13 @@ function serveConversationModelUpdate(res, body, services, token) {
         jsonRes(res, 500, { error: err instanceof Error ? err.message : String(err) });
     }
 }
-/** Wire values for a door-policy selection; "default" clears the office's override. */
+/**
+ * Wire values for a door-policy selection; "default" clears the office's
+ * override. `trusted-shared-support` keeps the historical read-write shared
+ * MEMORY.md; `trusted-shared-support-private` is the same layout with the
+ * shared MEMORY.md mounted read-only (modeled on Claude Tag's private-
+ * channel memory: read the shared pool, never write into it).
+ */
 function parseDoorPolicyChoice(value) {
     switch (value) {
         case "default":
@@ -603,7 +558,11 @@ function parseDoorPolicyChoice(value) {
         case "isolated":
             return { choice: { doorPolicy: "isolated" } };
         case "trusted-shared-support":
-            return { choice: { doorPolicy: "trusted", layout: "shared-support" } };
+            return { choice: { doorPolicy: "trusted", layout: "shared-support", visibility: "public" } };
+        case "trusted-shared-support-private":
+            return {
+                choice: { doorPolicy: "trusted", layout: "shared-support", visibility: "private" },
+            };
         case "trusted-full":
             return { choice: { doorPolicy: "trusted", layout: "full" } };
         default:
@@ -615,13 +574,17 @@ function doorPolicyChoiceKey(choice) {
         return "default";
     if (choice.doorPolicy === "isolated")
         return "isolated";
-    return choice.layout === "full" ? "trusted-full" : "trusted-shared-support";
+    if (choice.layout === "full")
+        return "trusted-full";
+    return choice.visibility === "private"
+        ? "trusted-shared-support-private"
+        : "trusted-shared-support";
 }
 function serveConversationSandboxUpdate(res, body, services, token) {
     const parsed = parseDoorPolicyChoice(body.doorPolicy);
     if (!parsed) {
         jsonRes(res, 400, {
-            error: "doorPolicy must be 'default', 'isolated', 'trusted-shared-support', or 'trusted-full'",
+            error: "doorPolicy must be 'default', 'isolated', 'trusted-shared-support', 'trusted-shared-support-private', or 'trusted-full'",
         });
         return;
     }
@@ -649,7 +612,7 @@ function serveGlobalWorkspaceUpdate(res, body, services) {
     const parsed = parseDoorPolicyChoice(body.doorPolicy);
     if (!parsed) {
         jsonRes(res, 400, {
-            error: "doorPolicy must be 'default', 'isolated', 'trusted-shared-support', or 'trusted-full'",
+            error: "doorPolicy must be 'default', 'isolated', 'trusted-shared-support', 'trusted-shared-support-private', or 'trusted-full'",
         });
         return;
     }
@@ -739,7 +702,14 @@ function serveConversationSessionLink(res, body, services, token) {
         return;
     }
     try {
-        const { token: viewToken } = services.sessionViewTokenStore.create(token.platform, token.platformUserId, scope.conversationId, scope.conversationId, sessionFile, token.platformUserName);
+        const { token: viewToken } = services.sessionViewTokenStore.create({
+            platform: token.platform,
+            platformUserId: token.platformUserId,
+            conversationId: scope.conversationId,
+            sessionKey: scope.conversationId,
+            sessionFile,
+            platformUserName: token.platformUserName,
+        });
         const url = `${services.portalBaseUrl}/session?token=${encodeURIComponent(viewToken)}`;
         jsonRes(res, 200, { ok: true, url });
     }
@@ -1157,77 +1127,6 @@ async function servePackagesList(res, url, services, token) {
         jsonRes(res, 500, { error: err instanceof Error ? err.message : String(err) });
     }
 }
-const EXTENSION_SLUG_PATTERN = /^[a-z0-9_-]{1,64}$/;
-const EXTENSION_SECRET_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/**
- * Declared + provisioned secrets for every extension visible to the selected
- * conversation (global scope plus the conversation's own installs, deduped by
- * slug — the vault is keyed by slug, so two scopes share one secret set).
- * Values never leave the server; only key names and provisioning status do.
- */
-function serveExtensionSecretsList(res, url, services, token) {
-    const scope = resolveConversationFromQuery(url, token);
-    if (scope.error) {
-        jsonRes(res, 403, { error: scope.error });
-        return;
-    }
-    const workspace = requireAdminWorkspace(res, services);
-    if (!workspace)
-        return;
-    const infosBySlug = new Map();
-    for (const info of listInstalledExtensions(defaultExtensionDirs(scope.address, workspace.stateDir))) {
-        infosBySlug.set(info.slug, info);
-    }
-    const extensions = [...infosBySlug.values()]
-        .toSorted((left, right) => left.slug.localeCompare(right.slug))
-        .map((info) => {
-        const provisioned = Object.keys(services.vaultManager.resolve(`extensions/${info.slug}`)?.env ?? {}).toSorted();
-        const declaredKeys = new Set(info.secrets.map((secret) => secret.key));
-        return {
-            slug: info.slug,
-            name: info.name,
-            declared: info.secrets.map((secret) => ({
-                ...secret,
-                provisioned: provisioned.includes(secret.key),
-            })),
-            extraProvisioned: provisioned.filter((key) => !declaredKeys.has(key)),
-        };
-    });
-    jsonRes(res, 200, { extensions });
-}
-/** Set or delete one extension secret. Values are write-only through here. */
-function serveExtensionSecretMutation(res, body, services) {
-    const action = body.action;
-    if (action !== "set" && action !== "delete") {
-        jsonRes(res, 400, { error: "action must be 'set' or 'delete'" });
-        return;
-    }
-    const slug = typeof body.slug === "string" ? body.slug : "";
-    if (!EXTENSION_SLUG_PATTERN.test(slug)) {
-        jsonRes(res, 400, { error: "invalid extension slug" });
-        return;
-    }
-    const key = typeof body.key === "string" ? body.key : "";
-    if (!EXTENSION_SECRET_KEY_PATTERN.test(key)) {
-        jsonRes(res, 400, { error: "invalid secret key (expected an env-style name)" });
-        return;
-    }
-    const vaultKey = `extensions/${slug}`;
-    if (action === "set") {
-        const value = typeof body.value === "string" ? body.value : "";
-        if (!value) {
-            jsonRes(res, 400, { error: "value is required" });
-            return;
-        }
-        services.vaultManager.upsertEnv(vaultKey, { [key]: value });
-    }
-    else if (!services.vaultManager.deleteEnvKey(vaultKey, key)) {
-        jsonRes(res, 404, { error: "Not provisioned." });
-        return;
-    }
-    const provisioned = Object.keys(services.vaultManager.resolve(vaultKey)?.env ?? {}).toSorted();
-    jsonRes(res, 200, { ok: true, provisioned });
-}
 /**
  * Add / remove / refresh, in one route because they share validation and all
  * three answer with the freshly re-read inventory: the panel never has to
@@ -1294,6 +1193,7 @@ function serveMcpServersList(res, url, services, token) {
     const servers = loadScopeMcpServers(workspace.office(scope.address));
     jsonRes(res, 200, {
         conversationId: scope.conversationId,
+        presets: listMcpPresets(),
         global: redactMcpServers(servers.global),
         conversation: redactMcpServers(servers.conversation),
     });
@@ -1358,12 +1258,19 @@ function parseMcpServerEntry(raw) {
  */
 function serveMcpServerMutation(res, body, services, token) {
     const action = body.action;
-    if (action !== "set" && action !== "remove" && action !== "toggle") {
-        jsonRes(res, 400, { error: "action must be 'set', 'remove', or 'toggle'" });
+    if (action !== "set" && action !== "install" && action !== "remove" && action !== "toggle") {
+        jsonRes(res, 400, { error: "action must be 'set', 'install', 'remove', or 'toggle'" });
+        return;
+    }
+    const preset = action === "install" && typeof body.presetId === "string"
+        ? findMcpPreset(body.presetId)
+        : undefined;
+    if (action === "install" && !preset) {
+        jsonRes(res, 400, { error: "unknown MCP preset" });
         return;
     }
     const mutationScope = body.scope === "global" ? "global" : "conversation";
-    const name = typeof body.name === "string" ? body.name.trim() : "";
+    const name = preset?.serverName ?? (typeof body.name === "string" ? body.name.trim() : "");
     if (!MCP_SERVER_NAME_PATTERN.test(name)) {
         jsonRes(res, 400, {
             error: "invalid server name (letters, digits, '_' or '-', starting with a letter)",
@@ -1399,6 +1306,15 @@ function serveMcpServerMutation(res, body, services, token) {
                 : {}),
         };
     }
+    else if (action === "install") {
+        try {
+            next[name] = materializeMcpPreset(preset, mcpStringMap(body.credentials) ?? {});
+        }
+        catch (err) {
+            jsonRes(res, 400, { error: err instanceof Error ? err.message : String(err) });
+            return;
+        }
+    }
     else if (action === "remove") {
         if (!(name in next)) {
             jsonRes(res, 404, { error: "Not declared here." });
@@ -1470,7 +1386,6 @@ function serveSkillFile(res, url, services, token) {
     servePreviewFile(res, safe.absolute, { source, directory }, "Skill file not found");
 }
 // ── Events ─────────────────────────────────────────────────────────────────────
-const EVENTS_FILE_MAX_BYTES = 64 * 1024;
 /**
  * List events through the owning store, whose payloads are validated by the
  * event-format module (files that fail validation stay visible with a null
@@ -1520,45 +1435,6 @@ async function serveConversationEventsList(res, url, services, token) {
     const events = (await listAllEvents(store)).filter((e) => e.conversationId === scope.conversationId);
     jsonRes(res, 200, { conversationId: scope.conversationId, events });
 }
-function serveEventsFile(res, url, services) {
-    const workspace = requireAdminWorkspace(res, services);
-    if (!workspace)
-        return;
-    let name;
-    try {
-        name = validateEventFilename(url.searchParams.get("name") ?? "");
-    }
-    catch {
-        jsonRes(res, 400, { error: "Invalid name" });
-        return;
-    }
-    const filePath = join(workspace.eventsDir, name);
-    let stats;
-    try {
-        stats = statSync(filePath);
-    }
-    catch {
-        jsonRes(res, 404, { error: "Not found" });
-        return;
-    }
-    if (!stats.isFile()) {
-        jsonRes(res, 400, { error: "Not a file" });
-        return;
-    }
-    if (stats.size > EVENTS_FILE_MAX_BYTES) {
-        jsonRes(res, 413, { error: "File too large" });
-        return;
-    }
-    let raw;
-    try {
-        raw = readFileSync(filePath, "utf-8");
-    }
-    catch (err) {
-        jsonRes(res, 500, { error: err instanceof Error ? err.message : String(err) });
-        return;
-    }
-    jsonRes(res, 200, { name, content: raw });
-}
 /** Delete a single event file scoped to the caller's conversation. */
 async function serveConversationEventDelete(res, body, services, token) {
     const scope = resolveTargetConversation(body, token);
@@ -1599,18 +1475,9 @@ async function serveConversationEventDelete(res, body, services, token) {
     }
 }
 // ── Utilities ──────────────────────────────────────────────────────────────────
-function jsonRes(res, status, body) {
-    res.writeHead(status, {
-        "Content-Type": "application/json; charset=utf-8",
-        "Cache-Control": "no-store",
-    });
-    res.end(JSON.stringify(body));
-}
 const esc = escapeHtml;
 // ── HTML ───────────────────────────────────────────────────────────────────────
-function renderAdminPage(token) {
-    const userLabel = token.platformUserName ?? token.platformUserId;
-    const body = `<nav class="tab-nav" role="tablist" aria-label="Admin sections">
+const adminViewBody = `<nav class="tab-nav" role="tablist" aria-label="Admin sections">
       <button class="tab-btn active" role="tab" aria-selected="true" aria-controls="panel-conversation" data-tab="conversation">Conversation</button>
       <button class="tab-btn" role="tab" aria-selected="false" aria-controls="panel-global" data-tab="global">Global</button>
     </nav>
@@ -1658,8 +1525,8 @@ function renderAdminPage(token) {
       <section class="card sect" id="sect-packages" data-section="packages">
         <header class="sect-head">
           <div>
-            <p class="eyebrow">Extensions</p>
-            <h2 class="card-title">此對話的 extension 套件</h2>
+            <p class="eyebrow">Skill Packages</p>
+            <h2 class="card-title">此對話的 skill 套件</h2>
           </div>
           <button class="refresh-btn" onclick="loadPackages()">↻</button>
         </header>
@@ -1766,8 +1633,8 @@ function renderAdminPage(token) {
       <section class="card sect">
         <header class="sect-head">
           <div>
-            <p class="eyebrow">Global Extensions</p>
-            <h2 class="card-title">所有對話都會載入的 extension 套件</h2>
+            <p class="eyebrow">Global Skill Packages</p>
+            <h2 class="card-title">所有對話都會載入的 skill 套件</h2>
           </div>
           <button class="refresh-btn" onclick="loadPackages()">↻</button>
         </header>
@@ -1794,18 +1661,6 @@ function renderAdminPage(token) {
         <div id="mcp-global-content"><div class="loading-msg">Loading…</div></div>
       </section>
 
-      <section class="card sect">
-        <header class="sect-head">
-          <div>
-            <p class="eyebrow">Extension Secrets</p>
-            <h2 class="card-title">Extension 密鑰(依 slug 全域共用)</h2>
-          </div>
-          <button class="refresh-btn" onclick="loadExtensionSecrets()">↻</button>
-        </header>
-        <div id="ext-secrets-msg" class="pkg-msg" style="display:none"></div>
-        <div id="ext-secrets-content"><div class="loading-msg">Loading…</div></div>
-      </section>
-
       <section class="card sect">
         <header class="sect-head">
           <div>
@@ -1827,13 +1682,24 @@ function renderAdminPage(token) {
         </header>
         <div id="global-events-content"><div class="loading-msg">Loading…</div></div>
       </section>
-    </div>`;
-    const script = `
-    const adminToken = ${JSON.stringify(token.token)};
-    // Conversation ids never contain ":" (session-key grammar), so
-    // "platform:id" is a safe composite scope key for the UI.
-    const defaultConversationKey = ${JSON.stringify(`${token.platform}:${token.conversationId}`)};
-    let activeConversationKey = defaultConversationKey;
+    </div>
+
+    <dialog id="mcp-install-dialog" class="mcp-dialog" aria-labelledby="mcp-dialog-title">
+      <div class="mcp-dialog-head">
+        <div>
+          <p class="eyebrow">Install MCP preset</p>
+          <h2 id="mcp-dialog-title" class="card-title"></h2>
+        </div>
+        <button class="mcp-dialog-close" type="button" aria-label="Close" onclick="closeMcpInstall()">×</button>
+      </div>
+      <div id="mcp-dialog-content"></div>
+      <div id="mcp-dialog-error" class="inline-result err" style="display:none"></div>
+      <div class="mcp-dialog-actions">
+        <button class="pkg-btn" type="button" onclick="closeMcpInstall()">Cancel</button>
+        <button id="mcp-dialog-install" class="primary-action-btn" type="button" onclick="installMcpPreset(this)">Install preset</button>
+      </div>
+    </dialog>`;
+const adminViewScript = `    let activeConversationKey = defaultConversationKey;
     function scopeOf(key) {
       const sep = key.indexOf(':');
       return { platform: key.slice(0, sep), conversationId: key.slice(sep + 1) };
@@ -1849,6 +1715,9 @@ function renderAdminPage(token) {
     }
     let availableModels = [];
     let modelsLoaded = false;
+    let mcpPresets = [];
+    let mcpServersByScope = { conversation: {}, global: {} };
+    let pendingMcpInstall = null;
 
     // ── Helpers ──────────────────────────────────────────────────────────────────
 
@@ -1865,6 +1734,30 @@ function renderAdminPage(token) {
     async function copyToClipboard(text) {
       try { await navigator.clipboard.writeText(text); } catch { prompt('Copy this link:', text); }
     }
+    document.addEventListener('click', (event) => {
+      const target = event.target instanceof Element
+        ? event.target.closest('[data-admin-action]')
+        : null;
+      if (!target) return;
+      switch (target.dataset.adminAction) {
+        case 'preview-file':
+          void previewFile(target.dataset.filePath || '');
+          break;
+        case 'copy-link':
+          void copyToClipboard(target.dataset.copyText || '');
+          break;
+        case 'delete-event':
+          void deleteEvent(target.dataset.eventName || '', target);
+          break;
+        case 'select-conversation':
+          setActiveConversation(target.dataset.conversationId || '');
+          switchTab('conversation');
+          break;
+        case 'toggle-timeline-filter':
+          toggleTimelineFilter(target.dataset.filterKey || '');
+          break;
+      }
+    });
     async function apiGet(path) {
       const url = path + (path.includes('?') ? '&' : '?') + 'token=' + encodeURIComponent(adminToken);
       const r = await fetch(url);
@@ -2008,9 +1901,10 @@ function renderAdminPage(token) {
       const globalModel = [data.globalProvider, data.globalModel].filter(Boolean).join('/');
       const globalModelLabel = globalModel + (data.globalThinkingLevel ? ':' + data.globalThinkingLevel : '');
       const doorPolicyChoices = [
-        ['default', 'Global default (' + data.globalWorkspaceDoorPolicy + ' / ' + data.globalWorkspaceLayout + ')'],
+        ['default', 'Automatic — follows the platform channel (public shares, private reads only, DMs isolated)'],
         ['isolated', 'isolated — own office only'],
-        ['trusted-shared-support', 'trusted / shared-support — office + shared memory, skills, events'],
+        ['trusted-shared-support', 'trusted / shared-support (public) — office + shared memory, skills, events — read-write'],
+        ['trusted-shared-support-private', 'trusted / shared-support (private) — same, but shared MEMORY.md is read-only'],
         ['trusted-full', 'trusted / full — entire workspace'],
       ];
       const doorPolicyOpts = doorPolicyChoices.map(([value, label]) =>
@@ -2036,7 +1930,7 @@ function renderAdminPage(token) {
           '<div class="config-block">',
             '<h3 class="card-subtitle">Office data policy</h3>',
             '<div class="config-row"><label>Door policy</label><select id="m-door-policy">' + doorPolicyOpts + '</select></div>',
-            '<p class="muted-note">Effective: ' + escHtml(data.workspaceDoorPolicy + ' / ' + data.workspaceLayout) + '</p>',
+            '<p class="muted-note">Effective: ' + escHtml(data.workspaceDoorPolicy + ' / ' + data.workspaceLayout + ' / ' + (data.workspaceVisibility || 'public')) + '</p>',
             '<p class="muted-note">Changing the policy rebuilds the office sandbox container with the new mounts on its next message; the container contents are preserved.</p>',
             '<button class="primary-action-btn" onclick="saveDoorPolicy(this)">Save door policy</button>',
             '<div id="mount-save-result" class="inline-result" style="display:none"></div>',
@@ -2149,14 +2043,14 @@ function renderAdminPage(token) {
 
     function renderTreeChildren(node) {
       if (node.type === 'file') {
-        return '<li><button class="tree-file" onclick="previewFile(\\'' + escAttr(node.path) + '\\')">' + escHtml(node.name) + '</button></li>';
+        return '<li><button class="tree-file" data-admin-action="preview-file" data-file-path="' + escAttr(node.path) + '">' + escHtml(node.name) + '</button></li>';
       }
       if (!node.children || node.children.length === 0) {
         return '<li><span class="tree-dir empty">' + escHtml(node.name || '.') + '/</span></li>';
       }
       const inner = node.children.map((c) =>
         c.type === 'file'
-          ? '<li><button class="tree-file" onclick="previewFile(\\'' + escAttr(c.path) + '\\')">' + escHtml(c.name) + '</button></li>'
+          ? '<li><button class="tree-file" data-admin-action="preview-file" data-file-path="' + escAttr(c.path) + '">' + escHtml(c.name) + '</button></li>'
           : '<li><details open><summary class="tree-dir">' + escHtml(c.name) + '/</summary><ul>' + renderTreeChildren(c) + '</ul></details></li>'
       ).join('');
       return inner;
@@ -2199,16 +2093,11 @@ function renderAdminPage(token) {
         return;
       }
       container.innerHTML = '<div class="pkg-list">' + rows.map((p) => {
-        const provides = []
-          .concat(p.extensions.map((s) => 'ext: ' + s))
-          .concat(p.skills.map((s) => 'skill: ' + s));
+        const provides = p.skills.map((s) => 'skill: ' + s);
         const status = p.error
           ? '<span class="pkg-badge pkg-badge-err">' + escHtml(p.error) + '</span>'
           : p.shadowed
             ? '<span class="pkg-badge pkg-badge-warn">被此對話的同名套件覆蓋，不會載入</span>'
-            // "downloaded", not "ready": this status means the checkout is on
-            // disk and was inspected, which is not the same as activated. The
-            // extension loads on the conversation's next harness instance.
             : '<span class="pkg-badge pkg-badge-ok">已下載</span>'
               + '<span class="pkg-badge pkg-badge-warn">需 /pi-new 才會載入</span>';
         return '<div class="pkg-row">' +
@@ -2217,7 +2106,7 @@ function renderAdminPage(token) {
           '</div>' +
           (provides.length > 0
             ? '<div class="pkg-provides">' + provides.map((t) => '<span class="pkg-chip">' + escHtml(t) + '</span>').join('') + '</div>'
-            : '<div class="pkg-provides pkg-provides-empty">此套件沒有提供 extension 或 skill</div>') +
+            : '<div class="pkg-provides pkg-provides-empty">此套件沒有提供 skill</div>') +
           '<div class="pkg-actions">' +
             '<button class="pkg-btn" data-pkg-action="refresh" data-pkg-scope="' + scope + '" data-pkg-source="' + escAttr(p.source) + '">Update</button>' +
             '<button class="pkg-btn pkg-btn-danger" data-pkg-action="remove" data-pkg-scope="' + scope + '" data-pkg-source="' + escAttr(p.source) + '">Remove</button>' +
@@ -2294,10 +2183,14 @@ function renderAdminPage(token) {
       el.textContent = text;
     }
 
+    function mcpTransport(server) {
+      return server.command
+        ? server.command + (server.args && server.args.length ? ' ' + server.args.join(' ') : '')
+        : (server.url || '');
+    }
+
     function renderMcpServer(scope, name, server) {
-      const transport = server.command
-        ? 'stdio: ' + server.command + (server.args && server.args.length ? ' ' + server.args.join(' ') : '')
-        : 'http: ' + (server.url || '');
+      const transport = (server.command ? 'stdio: ' : 'http: ') + mcpTransport(server);
       const keys = [];
       if (server.envKeys && server.envKeys.length) keys.push('env: ' + server.envKeys.join(', '));
       if (server.headerKeys && server.headerKeys.length) keys.push('headers: ' + server.headerKeys.join(', '));
@@ -2313,16 +2206,41 @@ function renderAdminPage(token) {
       '</div>';
     }
 
+    function renderMcpPreset(scope, preset, servers) {
+      const installed = Boolean(servers[preset.serverName]);
+      const transport = preset.server.command ? 'Runs on host' : 'Remote service';
+      return '<article class="mcp-preset">' +
+        '<div class="mcp-preset-top">' +
+          '<span class="mcp-preset-category">' + escHtml(preset.category) + '</span>' +
+          (installed ? '<span class="pkg-badge pkg-badge-ok">Installed here</span>' : '') +
+        '</div>' +
+        '<h3>' + escHtml(preset.name) + '</h3>' +
+        '<p>' + escHtml(preset.description) + '</p>' +
+        '<div class="mcp-preset-meta">' + escHtml(transport) + ' · <code>' + escHtml(preset.serverName) + '</code></div>' +
+        '<div class="mcp-preset-actions">' +
+          '<a href="' + escAttr(preset.sourceUrl) + '" target="_blank" rel="noopener">Source ↗</a>' +
+          '<button class="primary-action-btn" data-mcp-action="preset" data-mcp-scope="' + scope + '" data-mcp-preset="' + escAttr(preset.id) + '">' + (installed ? 'Review' : 'Install') + '</button>' +
+        '</div>' +
+      '</article>';
+    }
+
     function renderMcpScope(el, scope, servers) {
+      const presets = mcpPresets.map((preset) => renderMcpPreset(scope, preset, servers)).join('');
       const rows = Object.entries(servers).map(([name, server]) => renderMcpServer(scope, name, server)).join('');
       el.innerHTML =
-        '<div class="pkg-list">' + (rows || '<div class="pkg-provides-empty">No MCP servers</div>') + '</div>' +
-        '<div class="pkg-add" style="margin-top:10px">' +
-          '<input id="mcp-' + scope + '-name" class="pkg-input pkg-input-ref" type="text" spellcheck="false" placeholder="name" />' +
-          '<input id="mcp-' + scope + '-target" class="pkg-input" type="text" spellcheck="false" placeholder="npx -y @modelcontextprotocol/server-github 或 https://host/mcp" />' +
-          '<input id="mcp-' + scope + '-env" class="pkg-input" type="text" spellcheck="false" placeholder="KEY=value KEY2=value2（可留空；HTTP 則為 header）" />' +
-          '<button class="primary-action-btn" data-mcp-action="add" data-mcp-scope="' + scope + '">Add</button>' +
-        '</div>';
+        '<div class="mcp-market-head"><div><h3>Explore presets</h3><p>Reviewed recipes that install into this scope.</p></div><span>' + mcpPresets.length + ' available</span></div>' +
+        '<div class="mcp-preset-grid">' + presets + '</div>' +
+        '<details class="mcp-installed" open><summary>Installed in this scope</summary>' +
+          '<div class="pkg-list">' + (rows || '<div class="pkg-provides-empty">No MCP servers installed here</div>') + '</div>' +
+        '</details>' +
+        '<details class="mcp-manual"><summary>Advanced: add a custom server</summary>' +
+          '<div class="pkg-add">' +
+            '<input id="mcp-' + scope + '-name" class="pkg-input pkg-input-ref" type="text" spellcheck="false" placeholder="name" />' +
+            '<input id="mcp-' + scope + '-target" class="pkg-input" type="text" spellcheck="false" placeholder="npx -y package@version 或 https://host/mcp" />' +
+            '<input id="mcp-' + scope + '-env" class="pkg-input" type="text" spellcheck="false" placeholder="KEY=value（HTTP 則為 header）" />' +
+            '<button class="primary-action-btn" data-mcp-action="add" data-mcp-scope="' + scope + '">Add custom</button>' +
+          '</div>' +
+        '</details>';
     }
 
     async function loadMcpServers() {
@@ -2332,8 +2250,10 @@ function renderAdminPage(token) {
       if (globalEl) globalEl.innerHTML = '<div class="loading-msg">Loading…</div>';
       try {
         const data = await apiGet('/admin/api/mcp-servers?' + scopeQuery());
-        if (convEl) renderMcpScope(convEl, 'conversation', data.conversation);
-        if (globalEl) renderMcpScope(globalEl, 'global', data.global);
+        mcpPresets = Array.isArray(data.presets) ? data.presets : [];
+        mcpServersByScope = { conversation: data.conversation || {}, global: data.global || {} };
+        if (convEl) renderMcpScope(convEl, 'conversation', mcpServersByScope.conversation);
+        if (globalEl) renderMcpScope(globalEl, 'global', mcpServersByScope.global);
       } catch (err) {
         if (convEl) convEl.innerHTML = '<div class="err-msg">' + escHtml(err.message) + '</div>';
         if (globalEl) globalEl.innerHTML = '<div class="err-msg">' + escHtml(err.message) + '</div>';
@@ -2357,6 +2277,68 @@ function renderAdminPage(token) {
       }
     }
 
+    function openMcpPreset(scope, presetId) {
+      const preset = mcpPresets.find((item) => item.id === presetId);
+      if (!preset) return;
+      pendingMcpInstall = { scope: scope, preset: preset };
+      const local = Boolean(preset.server.command);
+      const installed = Boolean(mcpServersByScope[scope][preset.serverName]);
+      const credentials = preset.credentials.map((credential, index) =>
+        '<label class="mcp-credential"><span>' + escHtml(credential.label) + (credential.required ? ' *' : '') + '</span>' +
+          '<input data-mcp-credential="' + index + '" type="' + (credential.secret ? 'password' : 'text') + '" autocomplete="off" />' +
+          '<small>' + escHtml(credential.description) + '</small></label>'
+      ).join('');
+      document.getElementById('mcp-dialog-title').textContent = preset.name;
+      const dialogError = document.getElementById('mcp-dialog-error');
+      dialogError.style.display = 'none';
+      dialogError.textContent = '';
+      document.getElementById('mcp-dialog-content').innerHTML =
+        '<p class="mcp-dialog-desc">' + escHtml(preset.description) + '</p>' +
+        '<div class="mcp-install-preview"><span>' + (local ? 'Host command' : 'Remote endpoint') + '</span><code>' + escHtml(mcpTransport(preset.server)) + '</code></div>' +
+        '<div class="mcp-security-note ' + (local ? 'local' : 'remote') + '">' +
+          (local
+            ? '<strong>Host code execution.</strong> This command runs outside the conversation sandbox with the mikan process user permissions.'
+            : '<strong>External service.</strong> Tool calls and selected data will be sent to this remote origin.') +
+        '</div>' +
+        (installed ? '<div class="mcp-replace-note">Installing again replaces the existing <code>' + escHtml(preset.serverName) + '</code> entry in this scope.</div>' : '') +
+        (credentials || '<p class="mcp-no-credentials">No credentials required.</p>') +
+        '<p class="mcp-secret-note">These values are stored in host-private settings and are not shown to the model or sandbox.</p>' +
+        '<a class="mcp-setup-link" href="' + escAttr(preset.setupUrl) + '" target="_blank" rel="noopener">Setup documentation ↗</a>';
+      document.getElementById('mcp-install-dialog').showModal();
+    }
+
+    function closeMcpInstall() {
+      pendingMcpInstall = null;
+      document.getElementById('mcp-install-dialog').close();
+    }
+
+    async function installMcpPreset(btn) {
+      if (!pendingMcpInstall) return;
+      const { scope, preset } = pendingMcpInstall;
+      const credentials = {};
+      document.querySelectorAll('[data-mcp-credential]').forEach((input) => {
+        const descriptor = preset.credentials[Number(input.dataset.mcpCredential)];
+        if (descriptor) credentials[descriptor.key] = input.value;
+      });
+      btn.disabled = true;
+      btn.textContent = 'Installing…';
+      try {
+        await apiPost('/admin/api/mcp-servers/mutate', {
+          action: 'install', scope: scope, presetId: preset.id, credentials: credentials, ...scopeBody(),
+        });
+        closeMcpInstall();
+        mcpMessage(scope, preset.name + ' installed. It will be available on the next response.', 'ok');
+        await loadMcpServers();
+      } catch (err) {
+        const dialogError = document.getElementById('mcp-dialog-error');
+        dialogError.textContent = err.message;
+        dialogError.style.display = 'block';
+      } finally {
+        btn.disabled = false;
+        btn.textContent = 'Install preset';
+      }
+    }
+
     function addMcpServer(scope) {
       const name = document.getElementById('mcp-' + scope + '-name').value.trim();
       const target = document.getElementById('mcp-' + scope + '-target').value.trim();
@@ -2384,97 +2366,10 @@ function renderAdminPage(token) {
       const btn = event.target.closest('[data-mcp-action]');
       if (!btn) return;
       if (btn.dataset.mcpAction === 'add') { addMcpServer(btn.dataset.mcpScope); return; }
+      if (btn.dataset.mcpAction === 'preset') { openMcpPreset(btn.dataset.mcpScope, btn.dataset.mcpPreset); return; }
       void mutateMcpServer(btn.dataset.mcpScope, btn.dataset.mcpAction, btn.dataset.mcpName);
     });
 
-    // ── Extension secrets ───────────────────────────────────────────────────────
-
-    function extSecretsMessage(text, kind) {
-      const el = document.getElementById('ext-secrets-msg');
-      if (!el) return;
-      el.style.display = 'block';
-      el.className = 'pkg-msg pkg-msg-' + kind;
-      el.textContent = text;
-    }
-
-    function renderSecretRow(slug, key, meta) {
-      return '<div class="pkg-row">' +
-        '<div class="pkg-row-main"><span class="pkg-source">' + escHtml(key) + '</span>' +
-        (meta.required ? '<span class="pkg-badge pkg-badge-warn">required</span>' : '') +
-        (meta.provisioned
-          ? '<span class="pkg-badge pkg-badge-ok">provisioned</span>'
-          : '<span class="pkg-badge pkg-badge-err">missing</span>') +
-        '</div>' +
-        (meta.description ? '<div class="skill-desc">' + escHtml(meta.description) + '</div>' : '') +
-        '<div class="pkg-actions">' +
-          '<button class="pkg-btn" data-secret-action="set" data-secret-slug="' + escAttr(slug) + '" data-secret-key="' + escAttr(key) + '">Set</button>' +
-          (meta.provisioned
-            ? '<button class="pkg-btn pkg-btn-danger" data-secret-action="delete" data-secret-slug="' + escAttr(slug) + '" data-secret-key="' + escAttr(key) + '">Delete</button>'
-            : '') +
-        '</div>' +
-      '</div>';
-    }
-
-    async function loadExtensionSecrets() {
-      const container = document.getElementById('ext-secrets-content');
-      if (!container) return;
-      container.innerHTML = '<div class="loading-msg">Loading…</div>';
-      try {
-        const data = await apiGet('/admin/api/extension-secrets?' + scopeQuery());
-        if (data.extensions.length === 0) {
-          container.innerHTML = '<div class="empty-state">No extensions installed</div>';
-          return;
-        }
-        container.innerHTML = data.extensions.map((ext) => {
-          const declared = ext.declared.map((s) => renderSecretRow(ext.slug, s.key, s)).join('');
-          const extras = ext.extraProvisioned
-            .map((key) => renderSecretRow(ext.slug, key, { provisioned: true }))
-            .join('');
-          return '<div class="pkg-group">' +
-            '<div class="pkg-group-head"><strong>' + escHtml(ext.name) + '</strong>' +
-              '<span class="pkg-source">' + escHtml(ext.slug) + '</span>' +
-              '<button class="pkg-btn" data-secret-action="add" data-secret-slug="' + escAttr(ext.slug) + '">Add key</button>' +
-            '</div>' +
-            '<div class="pkg-list">' +
-              (declared + extras || '<div class="pkg-provides-empty">No secrets declared</div>') +
-            '</div>' +
-          '</div>';
-        }).join('');
-      } catch (err) {
-        container.innerHTML = '<div class="err-msg">' + escHtml(err.message) + '</div>';
-      }
-    }
-
-    document.addEventListener('click', async (event) => {
-      const btn = event.target.closest('[data-secret-action]');
-      if (!btn) return;
-      const slug = btn.dataset.secretSlug;
-      const action = btn.dataset.secretAction;
-      let key = btn.dataset.secretKey;
-      if (action === 'add') {
-        key = (prompt('Secret key for ' + slug + '(e.g. SLACK_BOT_TOKEN)') || '').trim();
-        if (!key) return;
-      }
-      if (action === 'delete' && !confirm('Delete ' + key + ' from ' + slug + '?')) return;
-      let value;
-      if (action !== 'delete') {
-        value = prompt('Value for ' + key + '(' + slug + ')');
-        if (!value) return;
-      }
-      try {
-        await apiPost('/admin/api/extension-secrets/mutate', {
-          action: action === 'delete' ? 'delete' : 'set',
-          slug: slug,
-          key: key,
-          value: value,
-        });
-        extSecretsMessage('已更新。對話輸入 /pi-new 生效。', 'ok');
-        await loadExtensionSecrets();
-      } catch (err) {
-        extSecretsMessage(err.message, 'err');
-      }
-    });
-
     async function loadSkills() {
       const container = document.getElementById('skills-content');
       const previewEl = document.getElementById('skills-preview');
@@ -2533,7 +2428,7 @@ function renderAdminPage(token) {
         result.innerHTML =
           '<span class="link-vault">vault: <code>' + escHtml(data.vaultId) + '</code></span>' +
           '<a href="' + escAttr(data.url) + '" target="_blank" rel="noopener">' + escHtml(data.url) + '</a>' +
-          '<button class="copy-link-btn" onclick="copyToClipboard(' + JSON.stringify(data.url) + ')">Copy</button>';
+          '<button class="copy-link-btn" data-admin-action="copy-link" data-copy-text="' + escAttr(data.url) + '">Copy</button>';
         frame.src = data.url; frame.style.display = 'block';
       } catch (err) {
         result.className = 'link-result err'; result.textContent = err.message;
@@ -2553,7 +2448,7 @@ function renderAdminPage(token) {
         result.className = 'link-result ok';
         result.innerHTML =
           '<a href="' + escAttr(data.url) + '" target="_blank" rel="noopener">' + escHtml(data.url) + '</a>' +
-          '<button class="copy-link-btn" onclick="copyToClipboard(' + JSON.stringify(data.url) + ')">Copy</button>';
+          '<button class="copy-link-btn" data-admin-action="copy-link" data-copy-text="' + escAttr(data.url) + '">Copy</button>';
         frame.src = data.url; frame.style.display = 'block';
       } catch (err) {
         result.className = 'link-result err'; result.textContent = err.message;
@@ -2602,7 +2497,7 @@ function renderAdminPage(token) {
         .filter(Boolean).map(escHtml).join(' · ');
       const preview = e.text ? '<div class="event-text">' + escHtml(e.text.length > 240 ? e.text.slice(0, 237) + '…' : e.text) + '</div>' : '';
       const deleteBtn = allowDelete
-        ? '<button class="event-delete-btn" onclick="deleteEvent(\\'' + escAttr(e.name) + '\\', this)">Delete</button>'
+        ? '<button class="event-delete-btn" data-admin-action="delete-event" data-event-name="' + escAttr(e.name) + '">Delete</button>'
         : '';
       return '<div class="event-row">' +
         '<div class="event-row-top">' +
@@ -2639,7 +2534,6 @@ function renderAdminPage(token) {
       loadGlobalSettings();
       loadGlobalSkills();
       loadEvents();
-      loadExtensionSecrets();
       loadMcpServers();
     }
 
@@ -2654,7 +2548,7 @@ function renderAdminPage(token) {
         }
         container.innerHTML = '<div class="conv-list">' + data.conversations.map((c) => {
           const last = c.lastActivityAt ? new Date(c.lastActivityAt).toLocaleString() : '—';
-          return '<button class="conv-row-btn" onclick="setActiveConversation(\\'' + escAttr(c.conversationId) + '\\'); switchTab(\\'conversation\\');">' +
+          return '<button class="conv-row-btn" data-admin-action="select-conversation" data-conversation-id="' + escAttr(c.conversationId) + '">' +
             '<span class="conv-id">' + escHtml(c.label || c.conversationId) + '</span>' +
             (c.running ? '<span class="status-pill running">running</span>' : '') +
             '<span class="conv-last">' + escHtml(last) + '</span>' +
@@ -2794,7 +2688,7 @@ function renderAdminPage(token) {
       const legend = '<div class="tl-legend">' + TL_SERIES.map((s) => {
         const cls = 'tl-legend-item' +
           (active && active.key === s.key ? ' active' : (active ? ' dim' : ''));
-        return '<span class="' + cls + '" onclick="toggleTimelineFilter(\\'' + s.key + '\\')">' +
+        return '<span class="' + cls + '" data-admin-action="toggle-timeline-filter" data-filter-key="' + escAttr(s.key) + '">' +
           '<i class="sw ' + s.sw + '"></i>' + s.label + '</span>';
       }).join('') + '</div>';
 
@@ -2854,12 +2748,18 @@ function renderAdminPage(token) {
       const replyModeOpts = replyModes.map((m) =>
         '<option value="' + m + '"' + (((data.slack && data.slack.replyMode) || 'top-level') === m ? ' selected' : '') + '>' + m + '</option>'
       ).join('');
-      const gDoorKey = data.workspaceDoorPolicy === 'isolated'
-        ? 'isolated'
-        : (data.workspaceLayout === 'full' ? 'trusted-full' : 'trusted-shared-support');
+      const gDoorKey = !data.workspaceDoorPolicy
+        ? 'default'
+        : (data.workspaceDoorPolicy === 'isolated'
+          ? 'isolated'
+          : (data.workspaceLayout === 'full'
+            ? 'trusted-full'
+            : ((data.workspaceVisibility || 'public') === 'private' ? 'trusted-shared-support-private' : 'trusted-shared-support')));
       const gDoorPolicyChoices = [
-        ['isolated', 'isolated — own office only (built-in default)'],
-        ['trusted-shared-support', 'trusted / shared-support — office + shared memory, skills, events'],
+        ['default', 'Automatic — follows each platform channel (public shares, private reads only, DMs isolated)'],
+        ['isolated', 'isolated — own office only'],
+        ['trusted-shared-support', 'trusted / shared-support (public) — office + shared memory, skills, events — read-write'],
+        ['trusted-shared-support-private', 'trusted / shared-support (private) — same, but shared MEMORY.md is read-only'],
         ['trusted-full', 'trusted / full — entire workspace'],
       ];
       const gDoorPolicyOpts = gDoorPolicyChoices.map(([value, label]) =>
@@ -3001,12 +2901,20 @@ function renderAdminPage(token) {
       loadConversationEvents();
     });
   `;
+function renderAdminPage(token) {
+    const userLabel = token.platformUserName ?? token.platformUserId;
+    const script = `
+    const adminToken = ${JSON.stringify(token.token)};
+    // Conversation ids never contain ":" (session-key grammar), so
+    // "platform:id" is a safe composite scope key for the UI.
+    const defaultConversationKey = ${JSON.stringify(`${token.platform}:${token.conversationId}`)};
+${adminViewScript}`;
     return renderPortalShell({
         activeView: "admin",
         pageTitle: "Admin",
         identity: { primary: token.platform, secondary: userLabel },
         conversationSwitcher: { currentId: token.conversationId },
-        body,
+        body: adminViewBody,
         extraStyles: adminViewStyles,
         inlineScript: script,
     });
@@ -3234,6 +3142,111 @@ const adminViewStyles = `
   }
   .pkg-group-head .pkg-btn { margin-left: auto; }
 
+  /* ── MCP marketplace ───────────────────────────────────────────────── */
+
+  .mcp-market-head {
+    display: flex; align-items: end; justify-content: space-between; gap: 16px;
+    margin-bottom: 12px;
+  }
+  .mcp-market-head h3 { margin: 0; font-size: 1rem; }
+  .mcp-market-head p { margin: 3px 0 0; color: var(--muted); font-size: 0.8rem; }
+  .mcp-market-head > span {
+    color: var(--subtle); font: 500 0.72rem/1.2 'JetBrains Mono', ui-monospace, monospace;
+  }
+  .mcp-preset-grid {
+    display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px;
+  }
+  .mcp-preset {
+    min-width: 0; padding: 14px; border: 1px solid var(--border); border-radius: 12px;
+    background:
+      linear-gradient(145deg, rgba(255,255,255,0.85), rgba(247,245,238,0.72)),
+      var(--card);
+    display: flex; flex-direction: column; min-height: 190px;
+  }
+  .mcp-preset-top { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
+  .mcp-preset-category {
+    color: var(--accent); font-size: 0.66rem; font-weight: 700;
+    letter-spacing: 0.09em; text-transform: uppercase;
+  }
+  .mcp-preset h3 { margin: 14px 0 5px; font-size: 1.06rem; letter-spacing: -0.02em; }
+  .mcp-preset p { margin: 0; color: var(--muted); font-size: 0.8rem; line-height: 1.5; }
+  .mcp-preset-meta {
+    margin-top: 12px; color: var(--subtle); font-size: 0.72rem;
+  }
+  .mcp-preset-meta code { color: var(--text); background: transparent; }
+  .mcp-preset-actions {
+    margin-top: auto; padding-top: 16px; display: flex; align-items: center;
+    justify-content: space-between; gap: 10px;
+  }
+  .mcp-preset-actions a, .mcp-setup-link {
+    color: var(--muted); font-size: 0.76rem; text-decoration: none;
+  }
+  .mcp-preset-actions a:hover, .mcp-setup-link:hover { color: var(--text); text-decoration: underline; }
+  .mcp-preset-actions .primary-action-btn { padding: 6px 12px; }
+  .mcp-installed, .mcp-manual {
+    margin-top: 14px; border-top: 1px solid var(--border); padding-top: 12px;
+  }
+  .mcp-installed > summary, .mcp-manual > summary {
+    cursor: pointer; color: var(--muted); font-size: 0.8rem; font-weight: 600;
+    margin-bottom: 10px;
+  }
+  .mcp-manual .pkg-add { margin: 12px 0 0; }
+
+  .mcp-dialog {
+    width: min(620px, calc(100vw - 28px)); max-height: calc(100vh - 40px);
+    border: 1px solid var(--border); border-radius: 18px; padding: 22px;
+    color: var(--text); background: #fbfaf6; box-shadow: 0 28px 90px rgba(18,18,16,0.24);
+  }
+  .mcp-dialog::backdrop { background: rgba(20,20,18,0.5); backdrop-filter: blur(3px); }
+  .mcp-dialog-head {
+    display: flex; align-items: flex-start; justify-content: space-between; gap: 18px;
+    padding-bottom: 14px; border-bottom: 1px solid var(--border);
+  }
+  .mcp-dialog-head .card-title { margin: 4px 0 0; }
+  .mcp-dialog-close {
+    border: 0; background: transparent; color: var(--muted); cursor: pointer;
+    font-size: 1.6rem; line-height: 1; padding: 2px 5px;
+  }
+  .mcp-dialog-desc { color: var(--muted); line-height: 1.55; font-size: 0.88rem; }
+  .mcp-install-preview {
+    display: grid; gap: 6px; padding: 12px; border-radius: 10px;
+    background: #1d211f; color: #f5f2e9;
+  }
+  .mcp-install-preview span {
+    color: #aeb8b1; font-size: 0.66rem; font-weight: 700;
+    letter-spacing: 0.08em; text-transform: uppercase;
+  }
+  .mcp-install-preview code {
+    color: #f5f2e9; background: transparent; word-break: break-all; font-size: 0.78rem;
+  }
+  .mcp-security-note, .mcp-replace-note {
+    margin-top: 12px; padding: 10px 12px; border-radius: 9px;
+    font-size: 0.78rem; line-height: 1.5;
+  }
+  .mcp-security-note.local {
+    background: rgba(220,38,38,0.08); border: 1px solid rgba(185,28,28,0.18); color: #991b1b;
+  }
+  .mcp-security-note.remote {
+    background: rgba(59,130,246,0.08); border: 1px solid rgba(29,78,216,0.16); color: #1e40af;
+  }
+  .mcp-replace-note { background: rgba(217,119,6,0.1); color: #92400e; }
+  .mcp-credential { display: grid; gap: 5px; margin-top: 14px; }
+  .mcp-credential span { font-size: 0.78rem; font-weight: 650; }
+  .mcp-credential input {
+    width: 100%; padding: 9px 10px; border: 1px solid var(--border); border-radius: 8px;
+    background: #fff; color: var(--text); font: 0.8rem/1.3 'JetBrains Mono', ui-monospace, monospace;
+  }
+  .mcp-credential small, .mcp-secret-note, .mcp-no-credentials {
+    color: var(--subtle); font-size: 0.72rem; line-height: 1.45;
+  }
+  .mcp-secret-note { margin: 14px 0 8px; }
+  .mcp-no-credentials { margin: 14px 0 0; }
+  #mcp-dialog-error { margin-top: 14px; }
+  .mcp-dialog-actions {
+    display: flex; justify-content: flex-end; gap: 8px; margin-top: 20px;
+    padding-top: 14px; border-top: 1px solid var(--border);
+  }
+
   /* ── Events ─────────────────────────────────────────────────────────── */
 
   .events-list { display: flex; flex-direction: column; gap: 8px; }
@@ -3368,6 +3381,8 @@ const adminViewStyles = `
     .portal-frame { min-height: 520px; }
     .workspace-split { grid-template-columns: 1fr; }
     .workspace-tree, .workspace-preview { max-height: 260px; }
+    .mcp-preset-grid { grid-template-columns: 1fr; }
+    .mcp-dialog { padding: 18px; }
   }
 `;
 //# sourceMappingURL=portal.js.map