aimeat 1.14.3 → 1.15.0

package/dist/.env.example

@@ -306,6 +306,10 @@ AIMEAT_STATS_ACCESS=public          # public | authenticated | operator
 # ── Scoped Agent Capabilities (REQ-006) ───────────────────────
 # AIMEAT_DEFAULT_AGENT_SCOPES="memory:read,memory:write,catalogue:read"
 # AIMEAT_MAX_AGENT_SCOPES="*"
+# Enforce per-agent scopes on the /v1/mcp tool surface (mirrors REST requireScope gates).
+# Default true. Set false for a warn-only rollout: all tools stay registered, but tools that
+# WOULD be filtered are logged so you can measure impact before enforcing.
+# AIMEAT_MCP_ENFORCE_SCOPES=true
 
 # ── Prometheus Metrics ─────────────────────────────────────
 # Prometheus metrics endpoint (GET /v1/metrics)

package/dist/locales/en.json

@@ -324,6 +324,7 @@
         "domainAgent": "Agent",
         "domainCatalogue": "Catalogue",
         "domainGenerator": "Generator",
+        "domainTask": "Tasks",
         "permExecute": "Execute",
         "permRead": "Read",
         "permWrite": "Write",
@@ -393,6 +394,11 @@
         "untagged": "Untagged",
         "noMatches": "No agents match the current filter."
       },
+      "reorderHint": "Drag to reorder",
+      "solo": {
+        "notFound": "Agent not found.",
+        "loginRequired": "Please log in to view this agent."
+      },
       "approval": {
         "credentials_ready_title": "Agent approved",
         "credentials_ready_desc": "Copy the credentials below and paste them to your agent.",
@@ -416,8 +422,11 @@
         "newTask": "New Task",
         "createTask": "Create Task",
         "cancel": "Cancel",
-        "titleLabel": "Title",
-        "descLabel": "Description",
+        "titleLabel": "Title (optional)",
+        "titlePlaceholder": "Short label — leave blank to use the first line",
+        "descLabel": "What should the agent do?",
+        "descRequired": "Describe what the agent should do",
+        "taskCreated": "Task created and queued",
         "statusLabel": "Status",
         "draft": "Draft",
         "queued": "Queued",
@@ -433,7 +442,7 @@
         "completed": "Completed",
         "lastEvent": "Last Event",
         "delete": "Delete",
-        "deleteConfirm": "Delete this task?",
+        "deleteConfirm": "Delete this task",
         "taskStarted": "Task started",
         "taskDeleted": "Task deleted",
         "startError": "Failed to start task",
@@ -446,6 +455,20 @@
         "starting": "Starting...",
         "startThisTask": "Start this task",
         "noEventsRecorded": "No events recorded",
+        "deliverable": "Deliverable",
+        "viewDeliverable": "View",
+        "deliverableGone": "The deliverable entry no longer exists.",
+        "revision_requested": "Revision requested",
+        "requestChanges": "Request changes",
+        "requestChangesTitle": "Ask the agent to revise the plan",
+        "requestChangesHelp": "Tell the agent how the proposed TODO list should change. The current plan will move to the history below; the agent will read your message and propose a revised plan.",
+        "requestChangesPlaceholder": "e.g. Skip the second step and add a verification step at the end. Use the EU price list for the comparison.",
+        "requestChangesSend": "Send to agent",
+        "requestChangesSending": "Sending...",
+        "requestChangesSent": "Change request sent. Waiting for the agent to revise.",
+        "requestChangesError": "Failed to send change request",
+        "revisionWaiting": "Waiting for the agent to propose a revised plan.",
+        "outdatedTodos": "Previously proposed (outdated)",
         "builder": {
           "title": "New Task",
           "placeholder": "What should the agent do? Describe in plain language or technical detail.",
@@ -569,7 +592,10 @@
         "sendError": "Failed to send message",
         "inboxLabel": "inbox",
         "deliveredLabel": "delivered",
-        "errorsLabel": "errors"
+        "errorsLabel": "errors",
+        "promptOther": "Other...",
+        "promptOtherHint": "Type your answer below and send it.",
+        "promptOtherPlaceholder": "Type your own answer..."
       },
       "webhook": {
         "title": "Webhook",
@@ -615,6 +641,7 @@
       },
       "detail": {
         "tabs": {
+          "readme": "README",
           "integration": "Integration",
           "tasks": "Tasks",
           "messages": "Messages",
@@ -636,6 +663,7 @@
         },
         "sharedTags": "Shared tags",
         "lastSeen": "Last seen",
+        "popOut": "Open in its own window",
         "deliveryMcp": "MCP notifications",
         "deliveryWebhook": "Webhook",
         "deliveryPolling": "Polling",
@@ -761,7 +789,32 @@
           "addAreaError": "Failed to add memory area",
           "linkPackageError": "Failed to link knowledge package",
           "packageNamePlaceholder": "Package name or URL",
-          "packageDescPlaceholder": "Description"
+          "packageDescPlaceholder": "Description",
+          "edit": "Edit",
+          "saving": "Saving...",
+          "valueSaved": "Value saved",
+          "saveValueError": "Failed to save value",
+          "confirmDeleteKey": "Delete memory key \"{key}\"? This cannot be undone.",
+          "keyDeleted": "Memory key deleted",
+          "deleteKeyError": "Failed to delete memory key",
+          "areaUpdated": "Memory area updated",
+          "updateAreaError": "Failed to update memory area",
+          "areaRemoved": "Memory area removed",
+          "removeAreaError": "Failed to remove memory area",
+          "confirmDeleteArea": "Remove this memory area from the agent?",
+          "addKey": "Add key",
+          "keyNamePlaceholder": "Key (e.g., agents.myagent.notes)",
+          "keyValuePlaceholder": "Value — plain text or JSON",
+          "noKeys": "No memory keys stored yet",
+          "keyCreated": "Memory key created",
+          "createKeyError": "Failed to create memory key",
+          "created": "Created",
+          "updated": "Updated",
+          "sortBy": "Sort",
+          "sortUpdated": "Last updated",
+          "sortCreated": "Created",
+          "sortNewestFirst": "Newest first",
+          "sortOldestFirst": "Oldest first"
         },
         "agent_config": {
           "copy": "Copy",
@@ -820,6 +873,7 @@
           "rules": "Rules"
         },
         "empty": {
+          "readme": "No README published",
           "tasks": "No tasks yet. Create a task to give this agent work.",
           "messages": "No messages yet. Send a message or use a command.",
           "data_access": "No data access configured. Use the buttons below to add tags, memory areas, or knowledge packages.",
@@ -3100,6 +3154,7 @@
     "cfgReadOnlyHelpDetail": "Config persistence requires a database (MongoDB or SQLite). In-memory nodes lose all changes on restart. Configure this node via .env file, aimeat.ini, aimeat.json, or CLI arguments (aimeat start --db sqlite).",
     "cfgHelpTitle": "Help",
     "cfgReset": "Reset",
+    "cfgOnePerLine": "One entry per line",
     "cfgResetDone": "Reset {path} — DB override removed.",
     "cfgSource": "Source",
     "consul": "Consul",

package/dist/locales/fi.json

@@ -324,6 +324,7 @@
         "domainAgent": "Agentti",
         "domainCatalogue": "Hakemisto",
         "domainGenerator": "Generaattori",
+        "domainTask": "Tehtävät",
         "permExecute": "Suoritus",
         "permRead": "Luku",
         "permWrite": "Kirjoitus",
@@ -393,6 +394,11 @@
         "untagged": "Ei tageja",
         "noMatches": "Yksikään agentti ei vastaa nykyistä suodatinta."
       },
+      "reorderHint": "Raahaa järjestääksesi",
+      "solo": {
+        "notFound": "Agenttia ei löytynyt.",
+        "loginRequired": "Kirjaudu sisään nähdäksesi tämän agentin."
+      },
       "approval": {
         "credentials_ready_title": "Agentti hyväksytty",
         "credentials_ready_desc": "Kopioi alla olevat tunnistetiedot ja liitä ne agentillesi.",
@@ -416,8 +422,11 @@
         "newTask": "Uusi tehtävä",
         "createTask": "Luo tehtävä",
         "cancel": "Peruuta",
-        "titleLabel": "Otsikko",
-        "descLabel": "Kuvaus",
+        "titleLabel": "Otsikko (valinnainen)",
+        "titlePlaceholder": "Lyhyt nimi — jätä tyhjäksi käyttääksesi ensimmäistä riviä",
+        "descLabel": "Mitä agentin pitäisi tehdä?",
+        "descRequired": "Kuvaile mitä agentin pitäisi tehdä",
+        "taskCreated": "Tehtävä luotu ja lisätty jonoon",
         "statusLabel": "Tila",
         "draft": "Luonnos",
         "queued": "Jonossa",
@@ -433,7 +442,7 @@
         "completed": "Valmistunut",
         "lastEvent": "Viimeisin tapahtuma",
         "delete": "Poista",
-        "deleteConfirm": "Poista tämä tehtävä?",
+        "deleteConfirm": "Poista tämä tehtävä",
         "taskStarted": "Tehtävä aloitettu",
         "taskDeleted": "Tehtävä poistettu",
         "startError": "Tehtävän aloitus epäonnistui",
@@ -446,6 +455,20 @@
         "starting": "Käynnistetään...",
         "startThisTask": "Käynnistä tehtävä",
         "noEventsRecorded": "Ei tallennettuja tapahtumia",
+        "deliverable": "Tuotos",
+        "viewDeliverable": "Näytä",
+        "deliverableGone": "Tuotosmerkintää ei ole enää olemassa.",
+        "revision_requested": "Korjauspyyntö lähetetty",
+        "requestChanges": "Pyydä muutoksia",
+        "requestChangesTitle": "Pyydä agenttia muokkaamaan suunnitelmaa",
+        "requestChangesHelp": "Kerro agentille miten ehdotettua TODO-listaa pitäisi muuttaa. Nykyinen suunnitelma siirtyy historiaan alle; agentti lukee viestisi ja ehdottaa korjattua suunnitelmaa.",
+        "requestChangesPlaceholder": "esim. Ohita toinen vaihe ja lisää tarkistusvaihe loppuun. Käytä EU:n hintatietoja vertailussa.",
+        "requestChangesSend": "Lähetä agentille",
+        "requestChangesSending": "Lähetetään...",
+        "requestChangesSent": "Muutospyyntö lähetetty. Odotetaan agentin uutta ehdotusta.",
+        "requestChangesError": "Muutospyynnön lähetys epäonnistui",
+        "revisionWaiting": "Odotetaan agentin korjattua ehdotusta.",
+        "outdatedTodos": "Aiemmin ehdotetut (vanhentuneet)",
         "builder": {
           "title": "Uusi tehtävä",
           "placeholder": "Mitä agentin pitäisi tehdä? Kuvaile selkokielellä tai teknisesti.",
@@ -569,7 +592,10 @@
         "sendError": "Viestin lähetys epäonnistui",
         "inboxLabel": "saapuneet",
         "deliveredLabel": "toimitettu",
-        "errorsLabel": "virheet"
+        "errorsLabel": "virheet",
+        "promptOther": "Muu...",
+        "promptOtherHint": "Kirjoita vastauksesi alle ja lähetä se.",
+        "promptOtherPlaceholder": "Kirjoita oma vastauksesi..."
       },
       "webhook": {
         "title": "Webhook",
@@ -615,6 +641,7 @@
       },
       "detail": {
         "tabs": {
+          "readme": "README",
           "integration": "Integraatio",
           "tasks": "Tehtävät",
           "messages": "Viestit",
@@ -636,6 +663,7 @@
         },
         "sharedTags": "Jaetut tunnisteet",
         "lastSeen": "Viimeksi nähty",
+        "popOut": "Avaa omaan ikkunaan",
         "deliveryMcp": "MCP-ilmoitukset",
         "deliveryWebhook": "Webhook",
         "deliveryPolling": "Pollaus",
@@ -761,7 +789,32 @@
           "addAreaError": "Muistialueen lisäys epäonnistui",
           "linkPackageError": "Tietopaketin linkitys epäonnistui",
           "packageNamePlaceholder": "Paketin nimi tai URL",
-          "packageDescPlaceholder": "Kuvaus"
+          "packageDescPlaceholder": "Kuvaus",
+          "edit": "Muokkaa",
+          "saving": "Tallennetaan...",
+          "valueSaved": "Arvo tallennettu",
+          "saveValueError": "Arvon tallennus epäonnistui",
+          "confirmDeleteKey": "Poistetaanko muistiavain \"{key}\"? Tätä ei voi perua.",
+          "keyDeleted": "Muistiavain poistettu",
+          "deleteKeyError": "Muistiavaimen poisto epäonnistui",
+          "areaUpdated": "Muistialue päivitetty",
+          "updateAreaError": "Muistialueen päivitys epäonnistui",
+          "areaRemoved": "Muistialue poistettu",
+          "removeAreaError": "Muistialueen poisto epäonnistui",
+          "confirmDeleteArea": "Poistetaanko tämä muistialue agentilta?",
+          "addKey": "Lisää avain",
+          "keyNamePlaceholder": "Avain (esim. agents.myagent.notes)",
+          "keyValuePlaceholder": "Arvo — pelkkä teksti tai JSON",
+          "noKeys": "Ei tallennettuja muistiavaimia vielä",
+          "keyCreated": "Muistiavain luotu",
+          "createKeyError": "Muistiavaimen luonti epäonnistui",
+          "created": "Luotu",
+          "updated": "Päivitetty",
+          "sortBy": "Järjestä",
+          "sortUpdated": "Viimeksi päivitetty",
+          "sortCreated": "Luotu",
+          "sortNewestFirst": "Uusin ensin",
+          "sortOldestFirst": "Vanhin ensin"
         },
         "agent_config": {
           "copy": "Kopioi",
@@ -820,6 +873,7 @@
           "rules": "Säännöt"
         },
         "empty": {
+          "readme": "Ei README:tä julkaistu",
           "tasks": "Ei tehtäviä. Luo tehtävä antaaksesi agentille työtä.",
           "messages": "Ei viestejä. Lähetä viesti tai käytä komentoa.",
           "data_access": "Ei datayhteyksien asetuksia. Lisää tunnisteita, muistialueita tai tietopaketteja alla olevilla painikkeilla.",
@@ -3100,6 +3154,7 @@
     "cfgReadOnlyHelpDetail": "Asetusten tallennus vaatii tietokannan (MongoDB tai SQLite). Muistinsisäiset solmut menettävät kaikki muutokset uudelleenkäynnistyksessä. Määritä tämä solmu .env-tiedoston, aimeat.ini:n, aimeat.json:n tai CLI-argumenttien kautta.",
     "cfgHelpTitle": "Ohje",
     "cfgReset": "Palauta",
+    "cfgOnePerLine": "Yksi kohta per rivi",
     "cfgResetDone": "Palautettu {path} — tietokantaohitus poistettu.",
     "cfgSource": "Lähde",
     "consul": "Consul",

package/dist/public/components/Markdown.js

@@ -0,0 +1,229 @@
+/**
+ * @file Markdown.js
+ * @description Minimal, safe GitHub-flavored-Markdown renderer for untrusted,
+ *   agent-authored (often LLM-generated) content. Renders to Preact vnodes via
+ *   `h` — never innerHTML — so there is no raw-HTML / <script> / <iframe> XSS
+ *   surface at all (any literal HTML in the source is shown as plain text).
+ *   Link hrefs are scheme-sanitized (only http/https/mailto pass; javascript:,
+ *   data:, etc. are dropped to a non-navigable anchor). Fenced code blocks
+ *   preserve whitespace exactly so ASCII-art logos keep their alignment.
+ *
+ *   Supported GFM subset: headings (#..######), fenced code blocks (```),
+ *   unordered/ordered lists, tables (pipe), blockquotes, paragraphs, and inline
+ *   spans (code, bold, italic, links). This is presentation-only — never use
+ *   rendered content for any trust or routing decision.
+ * @structure
+ *   - Markdown ({ text }) -> vnode tree wrapped in a div.md-body
+ *   - sanitizeHref(url) -> safe href or null
+ * @usage
+ *   import { Markdown } from '/components/Markdown.js';
+ *   html`<${Markdown} text=${someMarkdownString} />`
+ * @version-history
+ *   v1.0.0 -- 2026-05-31 -- Initial creation for the agent README tab
+ */
+import { h } from 'preact';
+
+// Only these schemes may appear in a rendered link. Everything else (javascript:,
+// data:, vbscript:, file:, etc.) is dropped — the anchor renders without href.
+const SAFE_SCHEME = /^(https?:|mailto:)/i;
+
+export function sanitizeHref(url) {
+  if (typeof url !== 'string') return null;
+  const trimmed = url.trim();
+  // Relative links (no scheme) and fragment/anchor links are safe.
+  if (!/^[a-z][a-z0-9+.-]*:/i.test(trimmed)) return trimmed;
+  return SAFE_SCHEME.test(trimmed) ? trimmed : null;
+}
+
+// ── Inline parsing: code, bold, italic, links. Returns an array of vnodes/strings.
+// Order matters: inline code is extracted first so markup inside it is literal.
+function parseInline(text) {
+  const out = [];
+  let i = 0;
+  let buf = '';
+  const flush = () => { if (buf) { out.push(buf); buf = ''; } };
+
+  while (i < text.length) {
+    const c = text[i];
+
+    // Inline code `...` — contents are literal (no further parsing).
+    if (c === '`') {
+      const end = text.indexOf('`', i + 1);
+      if (end > i) {
+        flush();
+        out.push(h('code', { class: 'md-code' }, text.slice(i + 1, end)));
+        i = end + 1;
+        continue;
+      }
+    }
+
+    // Link [label](url)
+    if (c === '[') {
+      const close = text.indexOf(']', i + 1);
+      if (close > i && text[close + 1] === '(') {
+        const paren = text.indexOf(')', close + 2);
+        if (paren > close) {
+          const label = text.slice(i + 1, close);
+          const url = text.slice(close + 2, paren);
+          const href = sanitizeHref(url);
+          flush();
+          out.push(
+            href
+              ? h('a', { href, target: '_blank', rel: 'noopener noreferrer nofollow' }, parseInline(label))
+              : h('span', null, parseInline(label)),
+          );
+          i = paren + 1;
+          continue;
+        }
+      }
+    }
+
+    // Bold **...**
+    if (c === '*' && text[i + 1] === '*') {
+      const end = text.indexOf('**', i + 2);
+      if (end > i) {
+        flush();
+        out.push(h('strong', null, parseInline(text.slice(i + 2, end))));
+        i = end + 2;
+        continue;
+      }
+    }
+
+    // Italic *...* (single asterisk, not part of **)
+    if (c === '*') {
+      const end = text.indexOf('*', i + 1);
+      if (end > i) {
+        flush();
+        out.push(h('em', null, parseInline(text.slice(i + 1, end))));
+        i = end + 1;
+        continue;
+      }
+    }
+
+    buf += c;
+    i++;
+  }
+  flush();
+  return out;
+}
+
+function parseTableRow(line) {
+  // Split on unescaped pipes, dropping the leading/trailing empties.
+  let cells = line.trim().split('|');
+  if (cells.length && cells[0] === '') cells = cells.slice(1);
+  if (cells.length && cells[cells.length - 1] === '') cells = cells.slice(0, -1);
+  return cells.map(c => c.trim());
+}
+
+function isTableDivider(line) {
+  // e.g. | --- | :--: | ---: |
+  return /^\s*\|?\s*:?-{3,}:?\s*(\|\s*:?-{3,}:?\s*)*\|?\s*$/.test(line);
+}
+
+// ── Block parsing. Walks lines, emits block-level vnodes.
+function parseBlocks(src) {
+  const lines = src.replace(/\r\n?/g, '\n').split('\n');
+  const blocks = [];
+  let i = 0;
+
+  while (i < lines.length) {
+    const line = lines[i];
+
+    // Blank line — skip.
+    if (line.trim() === '') { i++; continue; }
+
+    // Fenced code block ``` (preserve whitespace EXACTLY; no inline parsing).
+    const fence = line.match(/^\s*(`{3,}|~{3,})(.*)$/);
+    if (fence) {
+      const marker = fence[1][0];
+      const codeLines = [];
+      i++;
+      while (i < lines.length && !new RegExp('^\\s*' + marker + '{3,}\\s*$').test(lines[i])) {
+        codeLines.push(lines[i]);
+        i++;
+      }
+      i++; // consume closing fence (or EOF)
+      blocks.push(h('pre', { class: 'md-pre' }, h('code', { class: 'md-code' }, codeLines.join('\n'))));
+      continue;
+    }
+
+    // Heading
+    const heading = line.match(/^(#{1,6})\s+(.*)$/);
+    if (heading) {
+      const level = heading[1].length;
+      blocks.push(h('h' + level, null, parseInline(heading[2].trim())));
+      i++;
+      continue;
+    }
+
+    // Blockquote (collect consecutive > lines)
+    if (/^\s*>/.test(line)) {
+      const quoted = [];
+      while (i < lines.length && /^\s*>/.test(lines[i])) {
+        quoted.push(lines[i].replace(/^\s*>\s?/, ''));
+        i++;
+      }
+      blocks.push(h('blockquote', null, parseBlocks(quoted.join('\n'))));
+      continue;
+    }
+
+    // Table: a header row followed by a divider row.
+    if (line.includes('|') && i + 1 < lines.length && isTableDivider(lines[i + 1])) {
+      const header = parseTableRow(line);
+      i += 2; // skip header + divider
+      const rows = [];
+      while (i < lines.length && lines[i].includes('|') && lines[i].trim() !== '') {
+        rows.push(parseTableRow(lines[i]));
+        i++;
+      }
+      blocks.push(h('table', null, [
+        h('thead', null, h('tr', null, header.map((c, ci) => h('th', { key: ci }, parseInline(c))))),
+        h('tbody', null, rows.map((r, ri) =>
+          h('tr', { key: ri }, r.map((c, ci) => h('td', { key: ci }, parseInline(c)))))),
+      ]));
+      continue;
+    }
+
+    // Lists (unordered - / * / +, or ordered 1.)
+    const ulMatch = line.match(/^(\s*)([-*+])\s+(.*)$/);
+    const olMatch = line.match(/^(\s*)(\d+)\.\s+(.*)$/);
+    if (ulMatch || olMatch) {
+      const ordered = !!olMatch;
+      const items = [];
+      while (i < lines.length) {
+        const m = lines[i].match(ordered ? /^(\s*)(\d+)\.\s+(.*)$/ : /^(\s*)([-*+])\s+(.*)$/);
+        if (!m) break;
+        items.push(h('li', { key: items.length }, parseInline(m[3])));
+        i++;
+      }
+      blocks.push(h(ordered ? 'ol' : 'ul', null, items));
+      continue;
+    }
+
+    // Paragraph: collect consecutive non-blank, non-block lines.
+    const para = [];
+    while (
+      i < lines.length &&
+      lines[i].trim() !== '' &&
+      !/^\s*(`{3,}|~{3,})/.test(lines[i]) &&
+      !/^#{1,6}\s/.test(lines[i]) &&
+      !/^\s*>/.test(lines[i]) &&
+      !/^(\s*)([-*+])\s+/.test(lines[i]) &&
+      !/^(\s*)(\d+)\.\s+/.test(lines[i])
+    ) {
+      para.push(lines[i]);
+      i++;
+    }
+    // Join wrapped lines with a space (standard markdown paragraph behavior).
+    blocks.push(h('p', null, parseInline(para.join(' '))));
+  }
+
+  return blocks;
+}
+
+export function Markdown({ text }) {
+  const src = typeof text === 'string' ? text : '';
+  return h('div', { class: 'md-body' }, parseBlocks(src));
+}
+
+export default Markdown;

package/dist/public/css/views/admin.css

@@ -333,6 +333,18 @@
   border: 1px solid #FDE68A;
   border-radius: 8px;
 }
+.adm-config-array-edit {
+  width: 360px;
+  max-width: 100%;
+  min-height: 4.5rem;
+  font-family: 'JetBrains Mono', monospace;
+  font-size: 0.8rem;
+  padding: 6px 8px;
+  border: 1px solid var(--border, #E5E7EB);
+  border-radius: 6px;
+  resize: vertical;
+  box-sizing: border-box;
+}
 .adm-config-readonly { opacity: 0.85; pointer-events: none; }
 .adm-config-readonly input,
 .adm-config-readonly select { background: #F3F4F6; cursor: not-allowed; }