@stravica-ai/digital-operator-pa 0.1.3 → 0.1.4

package/dist/engineering-pa-core/src/desk/team-scope.mjs

@@ -33,6 +33,7 @@
 // not silently start hiding projects on a package bump.
 
 import { readFile } from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 /**
@@ -93,6 +94,30 @@ export function filterProjectsByTeam(projects, opts = {}) {
   return projects.filter((p) => isOwnProject(p, set));
 }
 
+/**
+ * Normalise a parsed preferences.json object (or null when the file was
+ * missing/malformed) into the effective team-scope config. Shared by the
+ * async and sync readers so both derive `teamIdentities`, `scopeEnabled`
+ * and `team` identically.
+ *
+ * `team` is the DEVICE's display team id (e.g. "hq"), a distinct namespace
+ * from `teamIdentities` (agent/role identities): teams are the named
+ * library-repo teams the workspace nav scopes display by (see nav.mjs).
+ * Absent/blank -> null, which means "do not team-scope nav" (fail open,
+ * backwards compatible: pre-team devices show every nav fragment).
+ */
+function normaliseTeamScopeConfig(config) {
+  const c = config && typeof config === 'object' ? config : {};
+  const paName = c.paName || c.agentName || 'pa';
+  const scopeEnabled = c.scopeProjectsToTeam === true;
+  const configured = Array.isArray(c.teamIdentities)
+    ? c.teamIdentities.filter((x) => typeof x === 'string' && x.length > 0)
+    : null;
+  const team = typeof c.team === 'string' && c.team.length > 0 ? c.team : null;
+  const teamIdentities = [...new Set([paName, ...(configured || [])])];
+  return { paName, teamIdentities, scopeEnabled, team };
+}
+
 /**
  * Read the team-scoping config out of operator/config/preferences.json.
  * Falls back to disabled scoping + no identity if the file is missing or
@@ -104,26 +129,40 @@ export function filterProjectsByTeam(projects, opts = {}) {
  * even when the configured list omits it (documented belt-and-braces: the
  * local agent can never scope out its own directly-assigned projects).
  *
+ * `team` is the device's display team id (or null); see
+ * normaliseTeamScopeConfig above.
+ *
  * @param {string} repoRoot
- * @returns {Promise<{ paName: string, teamIdentities: string[], scopeEnabled: boolean }>}
+ * @returns {Promise<{ paName: string, teamIdentities: string[], scopeEnabled: boolean, team: string|null }>}
  */
 export async function readTeamScopeConfig(repoRoot) {
-  let paName = 'pa';
-  let configured = null;
-  let scopeEnabled = false;
+  let config = null;
   try {
-    const raw = await readFile(join(repoRoot, 'operator', 'config', 'preferences.json'), 'utf8');
-    const config = JSON.parse(raw);
-    paName = config.paName || config.agentName || 'pa';
-    scopeEnabled = config.scopeProjectsToTeam === true;
-    if (Array.isArray(config.teamIdentities)) {
-      configured = config.teamIdentities.filter((x) => typeof x === 'string' && x.length > 0);
-    }
+    config = JSON.parse(await readFile(join(repoRoot, 'operator', 'config', 'preferences.json'), 'utf8'));
   } catch {
-    // Missing/malformed file -> defaults above (scoping disabled).
+    // Missing/malformed file -> defaults (scoping disabled, no team).
   }
-  const teamIdentities = [...new Set([paName, ...(configured || [])])];
-  return { paName, teamIdentities, scopeEnabled };
+  return normaliseTeamScopeConfig(config);
+}
+
+/**
+ * Synchronous mirror of {@link readTeamScopeConfig}. The workspace nav loader
+ * (nav.mjs) is a synchronous, mtime-cached read surface, so it resolves the
+ * device team through this variant rather than awaiting the async reader.
+ * Same fail-open posture: a missing/malformed file yields disabled scoping
+ * and a null team.
+ *
+ * @param {string} repoRoot
+ * @returns {{ paName: string, teamIdentities: string[], scopeEnabled: boolean, team: string|null }}
+ */
+export function readTeamScopeConfigSync(repoRoot) {
+  let config = null;
+  try {
+    config = JSON.parse(readFileSync(join(repoRoot, 'operator', 'config', 'preferences.json'), 'utf8'));
+  } catch {
+    // Missing/malformed file -> defaults (scoping disabled, no team).
+  }
+  return normaliseTeamScopeConfig(config);
 }
 
 /**

package/dist/engineering-pa-workspace/README.md

@@ -138,6 +138,8 @@ The main sidebar is driven by a declarative manifest rather than hard-coded mark
 
 **Extension manifest (optional):** `operator/extensions/workspace/nav.json`. Same shape, merged after core. Missing file is not an error.
 
+**Team fragments (optional):** alongside `nav.json`, both dirs may carry `nav.<team>.json` files (e.g. `nav.hq.json`, `nav.wsd.json`). These are composed together, base `nav.json` first then team fragments alphabetically. They exist because the extension dir is materialised from multiple library repos merged by file path — a single shared `nav.json` collides (highest-precedence repo wins the whole file, dropping the other teams' entries), whereas distinctly-named fragments don't collide, so every team's entries materialise side by side. Which of them a device *displays* is then decided by team scoping (below).
+
 **Shape:**
 
 ```json
@@ -158,10 +160,13 @@ The main sidebar is driven by a declarative manifest rather than hard-coded mark
 | `href` | yes | Navigation target. Extension pages typically use `/<name>.html`; core pages use `/core/tools/workspace/app/<name>.html`. |
 | `section` | no | Section header. Defaults to `Navigation`. Any other string creates a new section appended after the core sections (in manifest order). |
 | `aliases` | no | Additional paths that should highlight this nav item when loaded (e.g. `project-detail.html` highlights `Projects`). |
+| `team` | no | The team this entry belongs to (used by team scoping — see below). Resolution order: this inline field > the `nav.<team>.json` filename it lives in > `null` (untagged). Untagged entries are shown on every device. |
 
 **Endpoint:** `GET /__api/nav` returns `{ "items": [...] }` — the merged manifest in final order. The shell fetches this on load and renders the sidebar dynamically. Read-through cached with mtime invalidation; no restart needed after editing a manifest. If the endpoint fails, the shell falls back to a minimal Home-only nav rather than rendering a white page.
 
-**Missing pages:** if an `href` doesn't resolve to a real page (neither a core page nor an extension overlay), a warning is logged at startup but the item stays in the list — useful while building.
+**Missing pages:** if an `href` doesn't resolve to a real page (neither a core page nor an extension overlay), the item is dropped with a `[nav] hidden:` warning — `library-sync` only writes a page file when the owning repo is mounted here, so page-presence is the per-entry materialisation signal (external/deep hrefs whose shape can't be resolved are left untouched).
+
+**Team scoping (display):** a device declares its display team in `operator/config/preferences.json:team` (e.g. `"team": "hq"`), reusing the same team-scope config the project surfaces read (`readTeamScopeConfig` in `packages/core/src/desk/team-scope.mjs`). The default view keeps entries whose team matches the device team **or** are untagged (`null`), and hides other teams' — so a device that is *entitled* to another team's tooling (its pages are on disk) still only *shows* its own team's nav. This is the entitlement-vs-display split. Defaults are fail-open and backwards compatible: a device with no `team`, or nav that carries no team tags, renders unfiltered exactly as before. `team` is resolved once at server start (a change is a restart, like the port beside it). Escape hatches mirror the desk/projects convention: `GET /__api/nav?allTeams=1` bypasses scoping entirely, and `?team=<id>` is a strict single-team inspection filter (untagged excluded).
 
 **Example:** copy `core/tools/workspace/nav.json.example` to `operator/extensions/workspace/nav.json` and adjust for your pages. A worked demo:
 

package/dist/engineering-pa-workspace/src/nav.mjs

@@ -1,53 +1,110 @@
 /**
  * Workspace nav manifest loader.
  *
- * Reads the core manifest at core/tools/workspace/app/nav.json and, if present,
- * the operator extension manifest at operator/extensions/workspace/nav.json.
- * Merges them into a single ordered list of nav items.
+ * Composes the sidebar nav from a set of manifest FRAGMENTS discovered on
+ * disk, then scopes the result two ways: by page presence (per-device
+ * materialisation) and by team (per-device display).
  *
- * Merge rules:
- *   - Core items come first, in manifest order.
- *   - Extension items are appended; on id collision, the extension entry
- *     replaces the core entry in place (extension wins, warning logged).
- *   - A missing or absent operator manifest is not an error.
- *   - A malformed manifest is logged and skipped; the other side still loads.
+ * Fragments
+ * ---------
+ * Each of the two source dirs (core app dir, operator extension dir) may
+ * contribute:
+ *   - `nav.json`            — the base fragment, entries team = null (untagged).
+ *   - `nav.<team>.json`     — a team fragment; every entry inherits team
+ *                             `<team>` from the filename unless it carries its
+ *                             own `"team"` field.
+ * Fragments are read in a deterministic order (base `nav.json` first, then
+ * team fragments alphabetically) so composition is stable across devices.
  *
- * Per-device scoping: after merging, entries whose target page is not
- * materialised on THIS device are dropped (not just warned). The estate runs
- * one shared nav manifest that lists every page across all library repos, but
- * `library-sync` only writes a page file onto a device when the repo that owns
- * it is mounted there. So the presence of the href's target page file IS the
- * per-entry materialisation signal — an hq-only page (e.g. article-ideas,
- * content-calendar, both under operator/extensions/workspace/) is absent on a
- * device that doesn't mount stravica-library-hq, so its nav entry is hidden
- * rather than rendered as a dangling 404 link. This needs no per-entry "owner"
- * field and no coupling to the .library-sync manifest internals: the page file
- * library-sync lays down (or omits) is the source of truth. Hrefs whose shape
- * we can't resolve to a local page (external links, deep paths) are left
- * untouched.
+ * Why fragments instead of a single extension nav.json: the operator
+ * extension dir is materialised from MULTIPLE library repos (company, hq,
+ * wsd) merged by file path. A single shared `nav.json` collides — the
+ * highest-precedence repo's copy wins the whole file and silently drops the
+ * other teams' entries (this is exactly the HQ regression that motivated
+ * this change: wsd's nav.json won and HQ's article-ideas/content-calendar
+ * vanished from the sidebar). Distinctly-named `nav.<team>.json` fragments do
+ * not collide, so every team's entries materialise side by side; team
+ * scoping (below) then decides which to DISPLAY on a given device.
  *
- * Caching: each load checks both manifest mtimes. The cached (merged + scoped)
- * list is returned unchanged if neither file changed since the last load.
- * Missing files are tracked with mtime 0 so their appearance triggers a reload.
- * `library-sync` rewrites the extension nav.json as part of the same mount tree
- * whenever it materialises or removes pages, so a materialisation transition
- * always bumps a manifest mtime and re-triggers scoping.
+ * Team declaration + resolution order for each entry:
+ *   1. the entry's own `"team"` field (string), if present;
+ *   2. else the team encoded in the fragment filename (`nav.<team>.json`);
+ *   3. else `null` (untagged — belongs to no team, always shown).
+ *
+ * Team scoping (display)
+ * ----------------------
+ * The device declares its team via `operator/config/preferences.json:team`
+ * (resolved by the server through readTeamScopeConfigSync and passed in as
+ * `opts.team`). The default scoped view keeps entries whose team is the
+ * device team OR untagged (null). Untagged-always-shown keeps core nav and
+ * shared/company pages visible everywhere and makes the whole mechanism
+ * backwards compatible: a device with no `team` configured, or fragments
+ * that carry no team, are shown unfiltered exactly as before. `?allTeams=1`
+ * (opts.allTeams) bypasses scoping; `?team=<id>` (opts.requestedTeam) is a
+ * strict single-team inspection filter, mirroring the desk/projects
+ * team-scope convention.
+ *
+ * Page presence (materialisation)
+ * -------------------------------
+ * Independent of team scoping and applied first: an entry whose resolvable
+ * target page is not present on disk is dropped (library-sync only writes a
+ * page file when the owning repo is mounted here, so page-presence is the
+ * per-entry materialisation signal). Hrefs whose shape we can't resolve to a
+ * local page (external links, deep paths) are left untouched. Entitlement
+ * (which pages materialise) and display (which team's nav shows) are now
+ * separate axes: a wsd-entitled HQ device has wsd pages ON DISK but, being an
+ * HQ device, does not SHOW wsd nav entries.
+ *
+ * Caching: the merged + team-tagged + page-scoped list is device-team
+ * independent, so it is cached against a signature over every discovered
+ * fragment's mtime (a new/removed fragment or a content change bumps it). The
+ * per-request team filter is applied on top of the cached list and, when it
+ * is a pass-through (allTeams, or no device team and no requested team),
+ * returns the cached array by reference.
  */
 
-import { readFileSync, statSync, existsSync } from 'node:fs';
+import { readFileSync, statSync, existsSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 
 const CACHE = {
-  coreMtimeMs: -1,
-  extMtimeMs: -1,
-  items: null,
+  signature: null,
+  tagged: null,
 };
 
+const FRAGMENT_RE = /^nav(?:\.([A-Za-z0-9_-]+))?\.json$/;
+
 function mtime(path) {
   try { return statSync(path).mtimeMs; } catch { return 0; }
 }
 
-function validateItem(raw, source, warn) {
+/**
+ * Discover nav fragments in a dir. Returns an ordered list of
+ * { path, team, source } — base `nav.json` (team null) first, then
+ * `nav.<team>.json` fragments sorted by team. A missing dir yields [].
+ */
+function discoverFragments(dir, sourceLabel) {
+  if (!dir || !existsSync(dir)) return [];
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const base = [];
+  const teamed = [];
+  for (const name of names) {
+    const m = name.match(FRAGMENT_RE);
+    if (!m) continue;
+    const team = m[1] || null;
+    const entry = { path: join(dir, name), team, source: sourceLabel + ' nav manifest' };
+    if (team === null) base.push(entry);
+    else teamed.push(entry);
+  }
+  teamed.sort((a, b) => (a.team < b.team ? -1 : a.team > b.team ? 1 : 0));
+  return base.concat(teamed);
+}
+
+function validateItem(raw, source, fragmentTeam, warn) {
   if (!raw || typeof raw !== 'object') {
     warn('[nav] warning: ' + source + ' contains a non-object entry, skipping');
     return null;
@@ -69,6 +126,8 @@ function validateItem(raw, source, warn) {
     label: raw.label,
     href: raw.href,
     section: typeof raw.section === 'string' && raw.section ? raw.section : 'Workspace',
+    // Resolution order: inline entry.team > fragment-filename team > null.
+    team: typeof raw.team === 'string' && raw.team ? raw.team : fragmentTeam,
   };
   if (Array.isArray(raw.aliases)) {
     item.aliases = raw.aliases.filter(function(a) { return typeof a === 'string' && a; });
@@ -78,7 +137,8 @@ function validateItem(raw, source, warn) {
   return item;
 }
 
-function readManifest(path, source, warn) {
+function readFragment(fragment, warn) {
+  const { path, team, source } = fragment;
   if (!existsSync(path)) return [];
   let raw;
   try {
@@ -93,31 +153,30 @@ function readManifest(path, source, warn) {
   }
   const items = [];
   for (let i = 0; i < raw.length; i++) {
-    const item = validateItem(raw[i], source, warn);
+    const item = validateItem(raw[i], source, team, warn);
     if (item) items.push(item);
   }
   return items;
 }
 
 /**
- * Merge core and extension items. Extension items with a matching id replace
- * the corresponding core item in its original slot (preserving core ordering)
- * and emit a warning. Extension items with no collision are appended in
- * manifest order.
+ * Fold `additions` into a copy of `base`. An addition whose id already exists
+ * replaces the existing entry in place (preserving order); a new id is
+ * appended. `warn` fires on each collision — pass a no-op to fold silently.
  */
-function mergeItems(coreItems, extItems, warn) {
-  const merged = coreItems.slice();
+function foldItems(base, additions, warn) {
+  const merged = base.slice();
   const indexById = new Map();
   for (let i = 0; i < merged.length; i++) {
     indexById.set(merged[i].id, i);
   }
-  for (const ext of extItems) {
-    if (indexById.has(ext.id)) {
-      warn('[nav] warning: extension nav id "' + ext.id + '" shadows core item');
-      merged[indexById.get(ext.id)] = ext;
+  for (const add of additions) {
+    if (indexById.has(add.id)) {
+      warn('[nav] warning: extension nav id "' + add.id + '" shadows core item');
+      merged[indexById.get(add.id)] = add;
     } else {
-      indexById.set(ext.id, merged.length);
-      merged.push(ext);
+      indexById.set(add.id, merged.length);
+      merged.push(add);
     }
   }
   return merged;
@@ -126,11 +185,6 @@ function mergeItems(coreItems, extItems, warn) {
 /**
  * Classify an href by whether its target page is materialised on this device.
  * Returns 'present', 'absent', or 'unresolvable'.
- *
- *   - Core-shape paths (/core/tools/workspace/app/<file>) resolve under appDir.
- *   - Top-level extension-shape paths (/<file>.html) resolve under extDir or appDir.
- *   - Any other shape (external links, deep paths) is 'unresolvable' — we cannot
- *     (and should not) judge its local presence, so callers leave it untouched.
  */
 function pagePresence(href, appDir, extDir) {
   const corePrefix = '/core/tools/workspace/app/';
@@ -150,13 +204,8 @@ function pagePresence(href, appDir, extDir) {
 }
 
 /**
- * Scope the merged list to this device: drop any entry whose target page is
- * resolvable-in-shape but absent from disk (i.e. its owning library repo is not
- * materialised here), logging why. Entries whose page is present, or whose href
- * shape we can't resolve to a local page, are kept. This is what makes a shared
- * estate-wide nav manifest render cleanly per-device without hand-editing:
- * hq-only entries vanish on non-HQ devices because their pages were never
- * written there.
+ * Drop any entry whose target page is resolvable-in-shape but absent from
+ * disk (its owning library repo is not materialised here), logging why.
  */
 function scopeToMaterialised(items, appDir, extDir, warn) {
   const kept = [];
@@ -171,52 +220,92 @@ function scopeToMaterialised(items, appDir, extDir, warn) {
 }
 
 /**
- * Returns the merged nav items array. Reads from disk when either manifest's
- * mtime has changed since the previous call; otherwise returns the cached list.
+ * Apply the per-request team filter to the (cached, device-independent)
+ * tagged list. Returns the input array BY REFERENCE when the filter is a
+ * pass-through, so the loader preserves cache identity for the common case.
+ *
+ * Precedence (mirrors filterProjectsByTeam):
+ *   1. requestedTeam (?team=<id>) — strict: only entries whose team matches
+ *      exactly. Untagged entries are excluded from this narrow inspection view.
+ *   2. allTeams (?allTeams=1) — bypass, return everything.
+ *   3. no device team — bypass, return everything (backwards compatible).
+ *   4. default — entries whose team is the device team OR untagged (null).
+ */
+function applyTeamFilter(items, opts) {
+  const requestedTeam = opts.requestedTeam || null;
+  if (requestedTeam) {
+    return items.filter(function(i) { return i.team === requestedTeam; });
+  }
+  if (opts.allTeams) return items;
+
+  const deviceTeam = opts.team;
+  const teamSet = deviceTeam == null
+    ? null
+    : (deviceTeam instanceof Set
+        ? deviceTeam
+        : new Set(Array.isArray(deviceTeam) ? deviceTeam : [deviceTeam]));
+  if (!teamSet || teamSet.size === 0) return items;
+
+  return items.filter(function(i) { return i.team == null || teamSet.has(i.team); });
+}
+
+/**
+ * Returns the composed, scoped nav items array.
  *
  * @param {object} opts
  * @param {string} opts.appDir   absolute path to core app dir
  * @param {string} [opts.extDir] absolute path to operator extension dir
+ * @param {string|string[]|Set<string>} [opts.team] device display team(s);
+ *   absent/null => nav shown unfiltered (backwards compatible)
+ * @param {boolean} [opts.allTeams] bypass team scoping (?allTeams=1)
+ * @param {string} [opts.requestedTeam] strict single-team filter (?team=<id>)
  * @param {function(string):void} [opts.warn] warning sink (defaults to console.warn)
- * @returns {Array<{id:string,label:string,href:string,section:string,aliases:string[]}>}
+ * @returns {Array<{id:string,label:string,href:string,section:string,team:string|null,aliases:string[]}>}
  */
 export function loadNav(opts) {
   const appDir = opts.appDir;
   const extDir = opts.extDir || null;
   const warn = opts.warn || function(m) { console.warn(m); };
 
-  const coreManifest = join(appDir, 'nav.json');
-  const extManifest = extDir ? join(extDir, 'nav.json') : null;
+  const fragments = discoverFragments(appDir, 'core').concat(discoverFragments(extDir, 'extension'));
 
-  const coreMtime = mtime(coreManifest);
-  const extMtime = extManifest ? mtime(extManifest) : 0;
+  // Signature: every fragment path + mtime, sorted. A content change, a new
+  // fragment appearing, or a fragment removed all change the signature.
+  const signature = fragments
+    .map(function(f) { return f.path + ':' + mtime(f.path); })
+    .sort()
+    .join('|');
 
-  if (
-    CACHE.items !== null &&
-    CACHE.coreMtimeMs === coreMtime &&
-    CACHE.extMtimeMs === extMtime
-  ) {
-    return CACHE.items;
-  }
+  let tagged;
+  if (CACHE.tagged !== null && CACHE.signature === signature) {
+    tagged = CACHE.tagged;
+  } else {
+    const coreFragments = fragments.filter(function(f) { return f.source.indexOf('core') === 0; });
+    const extFragments = fragments.filter(function(f) { return f.source.indexOf('core') !== 0; });
 
-  const coreItems = readManifest(coreManifest, 'core nav manifest', warn);
-  const extItems = extManifest
-    ? readManifest(extManifest, 'extension nav manifest', warn)
-    : [];
-  const merged = mergeItems(coreItems, extItems, warn);
-  const scoped = scopeToMaterialised(merged, appDir, extDir, warn);
+    let coreItems = [];
+    for (const f of coreFragments) coreItems = foldItems(coreItems, readFragment(f, warn), function() {});
+    let extItems = [];
+    for (const f of extFragments) extItems = foldItems(extItems, readFragment(f, warn), function() {});
+
+    const merged = foldItems(coreItems, extItems, warn);
+    tagged = scopeToMaterialised(merged, appDir, extDir, warn);
+
+    CACHE.signature = signature;
+    CACHE.tagged = tagged;
+  }
 
-  CACHE.coreMtimeMs = coreMtime;
-  CACHE.extMtimeMs = extMtime;
-  CACHE.items = scoped;
-  return scoped;
+  return applyTeamFilter(tagged, {
+    team: opts.team,
+    allTeams: opts.allTeams === true,
+    requestedTeam: opts.requestedTeam || null,
+  });
 }
 
 /**
  * Test-only helper: clear the in-memory cache so reloads re-read manifests.
  */
 export function _resetNavCache() {
-  CACHE.coreMtimeMs = -1;
-  CACHE.extMtimeMs = -1;
-  CACHE.items = null;
+  CACHE.signature = null;
+  CACHE.tagged = null;
 }

package/dist/engineering-pa-workspace/src/server.mjs

@@ -26,6 +26,7 @@ import { resolve, join, extname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { handleApi } from './api.mjs';
 import { loadNav } from './nav.mjs';
+import { readTeamScopeConfigSync } from '../../engineering-pa-core/src/desk/team-scope.mjs';
 import { startPoller as startStatusMonPoller } from './status-mon/poller.mjs';
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url));
@@ -73,6 +74,14 @@ const warnAlways = console.warn.bind(console);
 const EXT_DIR_PATH = join(REPO_ROOT, 'operator', 'extensions', 'workspace');
 const EXT_DIR = existsSync(EXT_DIR_PATH) ? EXT_DIR_PATH : null;
 
+// --- Device display team ---
+// The nav sidebar is scoped to the device's team (operator/config/
+// preferences.json:team), reusing the same team-scope config the project
+// surfaces use (PR #87). null => nav shown unfiltered (backwards compatible).
+// Resolved once at startup; a `team` change is a workspace restart, same as
+// the port it sits beside in preferences.json.
+const DEVICE_TEAM = readTeamScopeConfigSync(REPO_ROOT).team;
+
 // --- Args ---
 const args = process.argv.slice(2);
 let port = 4200;
@@ -315,10 +324,19 @@ const server = createServer(async (req, res) => {
     const extRoute = extRoutes.find(r => r.method === req.method && r.pathname === pathname);
     if (extRoute) { extRoute.handler(req, res, url, REPO_ROOT); return; }
 
-    // GET /__api/nav -- merged core + extension nav manifest
+    // GET /__api/nav -- merged core + extension nav manifest, team-scoped to
+    // this device. ?allTeams=1 bypasses scoping; ?team=<id> is a strict
+    // single-team inspection filter (mirrors the desk/projects convention).
     if (req.method === 'GET' && pathname === '/__api/nav') {
       try {
-        const items = loadNav({ appDir: APP_DIR, extDir: EXT_DIR, warn: warn });
+        const items = loadNav({
+          appDir: APP_DIR,
+          extDir: EXT_DIR,
+          team: DEVICE_TEAM,
+          allTeams: url.searchParams.get('allTeams') === '1',
+          requestedTeam: url.searchParams.get('team'),
+          warn: warn,
+        });
         const body = JSON.stringify({ items: items });
         res.writeHead(200, {
           'Content-Type': 'application/json',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/digital-operator-pa",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Digital Operator PA — single-bundled public package surface (bins + library) for the platform.",
   "type": "module",
   "main": "./index.mjs",