aimeat 1.25.1 → 1.27.0

package/README.md

@@ -346,6 +346,13 @@ npx aimeat seed     # seed example packages (in another terminal, server must be
 npx aimeat connect --url https://your-node --owner your-handle
 ```
 
+**App thumbnails (optional).** `aimeat screenshot-worker` renders each published app and stores a
+thumbnail shown in the App Catalogue and on the landing wall (`--watch N` keeps it backfilling). It
+drives your machine's installed **Chrome/Edge** via Playwright — **no browser download** on
+Windows/desktop; a headless server runs `npx playwright install chromium` once. Auth uses a
+long-lived operator token (mint one with `POST /v1/access/tokens`, `grant_operator: true`). The node
+runs fine without it — screenshots are an opt-in operator feature.
+
 ### From source
 
 Requires Node.js 24+ and pnpm 10+. MongoDB is optional.
@@ -389,7 +396,14 @@ prerequisites** to install. A small control panel starts/stops the node, shows s
 it (port, federation role), connects a local AI (Ollama / LM Studio) to your account, and opens the web
 dashboard in your browser. Your data lives in your own app-data folder and survives restarts.
 
-**Download:** get the latest installer from the [GitHub Releases page](https://github.com/miikkij/aimeat-protocol/releases/latest). Windows installers are code-signed with a certificate provided by the [SignPath Foundation](https://signpath.org) (free code signing for open-source projects).
+**Download:** get the latest installer from the [GitHub Releases page](https://github.com/miikkij/aimeat-protocol/releases/latest).
+
+> **Windows SmartScreen note.** The installer is not yet code-signed, so Windows may show a blue
+> *"Windows protected your PC"* SmartScreen prompt the first time you run it. This is expected for
+> new independent software and does **not** mean anything is wrong with the download. To continue,
+> click **More info → Run anyway**. If you'd like to verify the file first, every release lists the
+> binaries on its [Releases page](https://github.com/miikkij/aimeat-protocol/releases/latest) — you
+> can also build it yourself from source (below). A signed installer is on our roadmap.
 
 <p align="center">
   <img src="assets/screenshots/aimeat-desktop.png" alt="AIMEAT Personal Node desktop app — control panel with Getting Started steps, node status (running on port 40050), and node info" width="640" />

package/dist/.env.example

@@ -8,6 +8,15 @@ AIMEAT_PORT=40050
 # AIMEAT_NODE_TYPE="full"         # full | relay | mirror
 # AIMEAT_BASE_URL="https://your-domain.com"  # Public URL (default: http://localhost:$PORT)
 
+# ── App Origin Isolation (H-2) ─────────────────────────────────
+# User-published apps run on a dedicated origin so they can never reach the
+# authenticated SPA's session. Requires DNS + a *.apps.<host> TLS cert + an nginx
+# server_name block (see docs/internal/app-origin-deployment.md). Keep DISABLED
+# until that infra is live — enabling it without DNS/cert would 301 apps to a host
+# that does not resolve.
+# AIMEAT_APP_HOST="apps.your-domain.com"   # default: apps.<AIMEAT_BASE_URL host>, empty for localhost/IP
+# AIMEAT_APP_ORIGIN_ENABLED=false          # true → apex inline app HTML 301s to the app origin
+
 # ── Storage Backend ───────────────────────────────────────────
 # Choose storage: memory (default, data lost on restart), sqlite (file-based, zero-config),
 # mongodb (production), or postgresql (production). `postgres` is accepted as an alias.
@@ -250,6 +259,14 @@ AIMEAT_PORT=40050
 # AIMEAT_NONCE_TTL_SECONDS=300                                 # verification nonce TTL (60-3600)
 # AIMEAT_NATIONAL_EID_PID_CLAIM="personal_identity_code"       # FI: personal_identity_code, SE: personalNumber, DK: dk.cpr
 
+# ── Social login — Google sign-in (OIDC) ─────────────────────
+# Create OAuth credentials at https://console.cloud.google.com/apis/credentials
+# Authorized redirect URI must exactly match the callback below.
+# AIMEAT_GOOGLE_OAUTH_ENABLED=false
+# AIMEAT_GOOGLE_OAUTH_CLIENT_ID=""                             # OAuth 2.0 client ID from Google Cloud Console
+# AIMEAT_GOOGLE_OAUTH_CLIENT_SECRET=""                         # OAuth 2.0 client secret
+# AIMEAT_GOOGLE_OAUTH_REDIRECT_URI=""                          # default: <baseUrl>/v1/ghii/login/google/callback
+
 # ── Consul (optional fleet management) ───────────────────────
 # Connect to HashiCorp Consul for centralized config management across nodes.
 # Values in Consul KV take precedence over file/.env but below database overrides.

package/dist/locales/en.json

@@ -50,6 +50,62 @@
   "imageDeliverable.open": "Open full image",
   "profile.landing.home": "Home",
   "profile.landing.menu": "Menu",
+  "profile.tabs.notebook": "Notebook",
+  "profile.notebook.title": "Notebook",
+  "profile.notebook.desc": "Write anything freely — capture it now, find it later. The librarian searches across everything you have: every shared space (organism) you have contributed to, plus your personal notes.",
+  "profile.notebook.capturePlaceholder": "Write anything — a thought, an idea, a note to keep…",
+  "profile.notebook.captureBtn": "Capture",
+  "profile.notebook.captureHint": "Saved to your notebook inbox. Sorting into organisms/workspaces comes next.",
+  "profile.notebook.saved": "Captured",
+  "profile.notebook.saveFailed": "Could not capture",
+  "profile.notebook.inboxTitle": "Inbox",
+  "profile.notebook.inboxEmpty": "Nothing captured yet — write something above.",
+  "profile.notebook.inboxLoading": "Loading…",
+  "profile.notebook.deleteBtn": "Delete",
+  "profile.notebook.deleteConfirm": "Delete this note?",
+  "profile.notebook.deleted": "Deleted",
+  "profile.notebook.librarianTitle": "Librarian",
+  "profile.notebook.librarianDesc": "Ask for anything you have — it searches every organism and note, ranked.",
+  "profile.notebook.searchPlaceholder": "What are you looking for?",
+  "profile.notebook.searchBtn": "Search",
+  "profile.notebook.searching": "Searching…",
+  "profile.notebook.noHits": "No matches.",
+  "profile.notebook.hitsCount": "{n} results",
+  "profile.notebook.personalNote": "Personal",
+  "profile.notebook.openInMemory": "Open",
+  "profile.notebook.suggestBtn": "Suggest placement",
+  "profile.notebook.sorting": "Sorting…",
+  "profile.notebook.fieldOrganism": "Organism",
+  "profile.notebook.fieldWorkspace": "Workspace",
+  "profile.notebook.fieldSpace": "Document space",
+  "profile.notebook.fieldTitle": "Title",
+  "profile.notebook.fieldBody": "Document",
+  "profile.notebook.newOrganism": "New organism",
+  "profile.notebook.newWorkspace": "New workspace",
+  "profile.notebook.newOrgNamePlaceholder": "New organism name",
+  "profile.notebook.newWsNamePlaceholder": "New workspace name",
+  "profile.notebook.alternatives": "Alternatives:",
+  "profile.notebook.materializeBtn": "Save as document",
+  "profile.notebook.cancelBtn": "Cancel",
+  "profile.notebook.materialized": "Filed as a document",
+  "profile.notebook.titleRequired": "A title is required",
+  "profile.notebook.orgNameRequired": "Name the new organism",
+  "profile.notebook.step1": "Reading your organism structure…",
+  "profile.notebook.step2": "Asking the AI for the best placement — this can take up to a couple of minutes with a slow model…",
+  "profile.notebook.step3": "Preparing the suggestion…",
+  "profile.notebook.sortErrorTitle": "Sorting failed",
+  "profile.notebook.needKey": "AI sorting needs your own OpenRouter API key. Add it here, then try again:",
+  "profile.notebook.filterPlaceholder": "Filter notes…",
+  "profile.notebook.sortNew": "Newest first",
+  "profile.notebook.sortOld": "Oldest first",
+  "profile.notebook.toggleView": "Collapse / expand",
+  "profile.notebook.noMatch": "No notes match the filter.",
+  "profile.notebook.scopeOwn": "Mine",
+  "profile.notebook.scopePublic": "Public knowledge",
+  "profile.notebook.kindKnowledge": "knowledge",
+  "profile.notebook.producer": "Producer",
+  "profile.notebook.tryAgain": "Try again",
+  "profile.notebook.dismiss": "Dismiss",
   "profile.tabs.workflows": "Workflows",
   "profile.workflows.title": "Workflows",
   "profile.workflows.desc": "Declared, ordered agent pipelines with per-step health checks — they show whether each step actually produced, not just that it fired.",
@@ -187,10 +243,25 @@
   "profile.scheduler.soon": "soon",
   "profile.scheduler.paused": "paused",
   "profile.scheduler.autoKey": "(auto)",
+  "appGrant": {
+    "title": "Allow this app to access your data?",
+    "intro": "It will receive its own scoped, revocable token — never your login session. You can revoke it anytime in Profile › Access.",
+    "scopesLabel": "Requested access",
+    "approve": "Allow access",
+    "approving": "Approving…",
+    "deny": "Deny",
+    "loginTitle": "Log in to continue",
+    "loginBody": "Log in on aimeat.io, then re-open the app’s link to approve access.",
+    "loginCta": "Log in",
+    "errorTitle": "Cannot grant access",
+    "missing": "No authorization request.",
+    "expired": "This request has expired."
+  },
   "common": {
     "cancel": "Cancel",
     "confirm": "Confirm",
     "delete": "Delete",
+    "back": "Back",
     "somethingWentWrong": "Something went wrong",
     "retry": "Retry",
     "save": "Save",
@@ -324,8 +395,8 @@
       "offerPosted": "Your service is now listed in the directory.",
       "backToChoices": "Back",
       "registerTitle": "Create your free identity",
-      "registerDesc": "When you register, you get a GHII (Global Human Intelligence Identifier) — your own digital identity. Your data is protected by your password: only you can access it. No one else can see your private memory, not even the server operator. You don't have to share anything with anyone.",
-      "registerBtn": "Create free GHII",
+      "registerDesc": "When you register, you get your own private space — your own digital identity. Your data is protected by your password: only you can access it. No one else can see your private memory, not even the server operator. You don't have to share anything with anyone.",
+      "registerBtn": "Create your free space",
       "registerBenefits": [
         "Your own private memory space, password-protected",
         "Full control — only you access your data",
@@ -406,6 +477,33 @@
     "workaroundNote": "Copy your memories and paste directly into any AI chat. Always works, everywhere."
   },
   "comingSoon": "Coming soon",
+  "presence": {
+    "status": {
+      "available": "Available",
+      "busy": "Busy",
+      "away": "Away",
+      "offline": "Offline",
+      "invisible": "Invisible",
+      "unknown": "Unknown"
+    },
+    "control": {
+      "title": "Presence",
+      "desc": "Let others see whether you're reachable. Keep it automatic, set it manually, or choose who can see it.",
+      "modeLabel": "How your status is set",
+      "modeAuto": "Automatic",
+      "modeAutoHint": "Shown as available while you have the portal open.",
+      "modeManual": "Manual",
+      "statusLabel": "Your status",
+      "visibilityLabel": "Who can see it",
+      "visEveryone": "Everyone",
+      "visEveryoneHint": "Anyone on the network (shared with federated nodes).",
+      "visContacts": "Contacts only",
+      "visContactsHint": "People you've messaged (this node only).",
+      "visNobody": "Nobody",
+      "saved": "Presence updated",
+      "saveError": "Couldn't update presence"
+    }
+  },
   "profile": {
     "title": "My Profile",
     "subtitle": "Profile",
@@ -686,7 +784,7 @@
       "setupStep3Why": "Turn on automation and your agent runs the moment new data arrives — you get fresh insights without lifting a finger.",
       "setupStep3Cta": "Set up automation",
       "setupStep4Title": "Get your insights everywhere",
-      "setupStep4Why": "Pick an organism and your results show up in Claude / Grok / ChatGPT, ready to reuse for marketing or reports and to share with your team — not locked inside this one app.",
+      "setupStep4Why": "Pick a shared space (an organism) and your results show up in Claude / Grok / ChatGPT, ready to reuse for marketing or reports and to share with your team — not locked inside this one app.",
       "setupStep4Cta": "Pick an organism",
       "mcpTitle": "Ask your insights in Claude, Grok, or ChatGPT",
       "mcpSub": "Connect AIMEAT to your AI chat once → then just ask, and get answers, exploration, save and follow-up — straight from everything this app and your agent produce.",
@@ -1966,6 +2064,11 @@
       "peers": "Connected Peers",
       "online": "Online",
       "offline": "Offline",
+      "tier_visiting": "Visiting",
+      "tier_member": "Member",
+      "tier_genesis": "Genesis",
+      "avail_temporary": "Temporary",
+      "avail_permanent": "Permanent",
       "statusConnected": "Connected to {count} nodes",
       "statusStandalone": "Standalone"
     },
@@ -1986,6 +2089,17 @@
       "hoverReveal": "Click to copy",
       "keepSafe": "Keep this safe — it's your owner recovery key.",
       "keyCopied": "Key copied to clipboard!",
+      "agTitle": "Connected Apps",
+      "agDesc": "Published apps you have granted scoped access to your data. Each holds its own revocable token — never your login session.",
+      "agLoading": "Loading...",
+      "agEmpty": "No apps have access to your data.",
+      "agScopes": "scopes",
+      "agGrantedAt": "Granted",
+      "agLastUsed": "Last used",
+      "agNever": "never",
+      "agConfirmRevoke": "Revoke access for \"{name}\"? It loses access immediately.",
+      "agRevoked": "App access revoked",
+      "agRevoke": "Revoke",
       "patTitle": "Agent Access Tokens",
       "patDesc": "Create a revocable token an agent can use (as a Bearer header) to log in and test your apps. One token can be shared across all your agents.",
       "patLabelRequired": "Give the token a name",
@@ -3561,7 +3675,11 @@
     "realtimeMaxPeersPerRoom": "Maximum peers per room",
     "extensionsEnabled": "Enable V8 isolate extension system?",
     "extensionMaxMemoryMb": "Max memory per extension isolate (MB)",
-    "extensionTimeoutMs": "Extension execution timeout (ms)"
+    "extensionTimeoutMs": "Extension execution timeout (ms)",
+    "appOrigin": "Serve user apps from a separate app origin (*.apps.<domain>) to isolate them from your session? Requires DNS + a wildcard TLS cert (see docs/internal/app-origin-deployment.md). Defaults to off.",
+    "appHost": "App origin host (e.g. apps.example.com)",
+    "appHostHint": "Set up DNS (apps.<domain> + wildcard *.apps.<domain>) and a wildcard TLS cert first — see docs/internal/app-origin-deployment.md",
+    "appHostRequired": "App host is required when app origin isolation is enabled"
   },
   "join": {
     "title": "Join AIMEAT Federation",
@@ -3642,6 +3760,8 @@
     "displayNamePlaceholder": "Display Name (optional, for new accounts)",
     "signInBtn": "Sign In / Register",
     "cancelBtn": "Cancel",
+    "orLabel": "OR",
+    "googleSignIn": "Continue with Google",
     "working": "Working...",
     "errUserShort": "Username must be at least 3 characters",
     "errPassShort": "Password must be at least 4 characters",
@@ -3674,7 +3794,7 @@
     "sendUsername": "Send My Username",
     "usernameSent": "If an account with that email exists, your username was sent.",
     "whyTitle": "✨ What do you get?",
-    "whyGhii": "A free GHII (Global Human Intelligence Identifier), your personal AI identity",
+    "whyGhii": "Your own digital identity — only you control it",
     "whyPrivacy": "Your own private memory space, protected by your password",
     "whyControl": "Full control: only you can access your data, no need to share with anyone",
     "whyAgents": "Connect AI agents that remember you and work on your behalf",
@@ -4142,6 +4262,17 @@
     "portal": "Portal",
     "portalDesc": "Manage your node's public portal — the landing page visitors see. Customize the HTML template, set dynamic content via memory keys and KV pairs, preview changes live, and generate an AI-friendly prompt summary of your portal for chat integrations.",
     "portalTemplate": "Template Editor",
+    "portalNavTitle": "Header Navigation",
+    "portalNavExplain": "Choose which public links appear in the site header and in what order. Auth-only links (Apps, Profile, Admin) always follow their sign-in/role rules and aren't listed here.",
+    "portalNavLink": "Link",
+    "portalNavVisible": "Visible",
+    "portalNavOrder": "Order",
+    "portalNavShown": "Shown",
+    "portalNavHidden": "Hidden",
+    "portalNavMoveUp": "Move up",
+    "portalNavMoveDown": "Move down",
+    "portalNavSave": "Save Navigation",
+    "portalNavSaved": "Header navigation saved",
     "portalPreview": "Portal Preview",
     "portalMemoryKeys": "Portal Memory Keys",
     "portalKvPairs": "KV Pairs (Environment)",
@@ -4597,6 +4728,37 @@
     "fedPeerApproved": "Peering request approved successfully",
     "fedPeerRejected": "Peering request rejected",
     "fedLivePeersTitle": "Live Peers",
+    "fedTierLabel": "Tier",
+    "fedVersionLabel": "Version",
+    "fedBehind": "behind",
+    "fedBookTitle": "Federation Book",
+    "fedBookDesc": "Directory of the federation: each node's operators, offered resources, version and settings. The primary (genesis) maintains it; other nodes mirror it.",
+    "fedBookRebuild": "Rebuild",
+    "fedBookPull": "Mirror from genesis",
+    "fedBookRebuilt": "Federation book rebuilt",
+    "fedBookPulled": "Federation book mirrored",
+    "fedBookUpToDate": "Already up to date",
+    "fedBookEmpty": "The federation book is empty. The primary node builds it from its peers; mirrors pull it from the genesis.",
+    "fedBookOperators": "Operators",
+    "fedBookResources": "Resources",
+    "fedBookSettings": "Settings",
+    "fedBookOpenJoin": "open join",
+    "fedBookCrossFed": "cross-fed",
+    "fedBookVersion": "Book version",
+    "fedTier_visiting": "Visiting",
+    "fedTier_member": "Member",
+    "fedTier_genesis": "Genesis",
+    "fedAvail_temporary": "Temporary",
+    "fedAvail_permanent": "Permanent",
+    "fedOpenJoinLabel": "Open join",
+    "fedOpenJoinDesc": "Let any node self-join as a low-trust visiting peer (browse + request work) without manual approval. Promote good ones to full members later.",
+    "fedOpenJoinUpdated": "Open-join setting saved",
+    "fedPromote": "Promote",
+    "fedPromoteHint": "Promote this visiting node to a full member (grants provider, relay and replication rights).",
+    "fedPromoteConfirm": "Promote this visiting node to a full member? This vouches for it and grants full federation rights.",
+    "fedPromoteNotEligible": "Not yet eligible",
+    "fedPromoteForceConfirm": "This node does not yet meet the promotion criteria. Promote anyway (your vouch)?",
+    "fedPromoted": "Peer promoted to member",
     "fedLivePeersExplain": "Currently registered peers and their real-time health status. The heartbeat monitor pings each peer every 5 minutes.",
     "fedLivePeersHelpTitle": "Understanding peer statuses",
     "fedLivePeersHelpDetail": "Active: Peer is healthy and responding to heartbeats. Approved: Peer has been approved but not yet activated (needs activation). Degraded: Peer has failed 3+ consecutive heartbeats but is still reachable. Offline: Peer has failed 10+ consecutive heartbeats. Depeering: Peer is in the grace period before removal (default 72h) — in-flight work can still complete.",
@@ -5406,7 +5568,7 @@
       "loggedIn": "logged in",
       "logoutBtn": "Logout",
       "whyTitle": "✨ What do you get?",
-      "whyGhii": "A free GHII (Global Human Intelligence Identifier), your personal AI identity",
+      "whyGhii": "Your own digital identity — only you control it",
       "whyPrivacy": "Your own private memory space, protected by your password",
       "whyControl": "Full control: only you can access your data, no need to share with anyone",
       "whyAgents": "Connect AI agents that remember you and work on your behalf",
@@ -6970,6 +7132,16 @@
     "heroSub2": "A real app, built and run by AI on AIMEAT — look before you sign up.",
     "heroTryFree": "Try it free →",
     "heroGetOwn": "Get your own →",
+    "buildHeroKicker": "A safe place to build with AI.",
+    "buildHeroTitle": "Build a real app with your AI in minutes, and it’s yours.",
+    "buildHeroSub": "Copy one prompt into Claude, ChatGPT or any AI. It builds you a working app on AIMEAT, published live and yours to keep. Then let your agents run it for you, the way AIMEAT Sanomat writes itself every evening.",
+    "buildHeroCopy": "Copy the build prompt →",
+    "buildHeroCopied": "Copied ✓ — paste into your AI",
+    "wallTitle": "Built by people with their AI. Yours goes here too.",
+    "wallEmpty": "Be the first — copy the prompt above, build something, and it lands here.",
+    "wallAnon": "someone",
+    "wallSearch": "Search apps…",
+    "wallNoMatch": "No apps match your search.",
     "agentBuildTitle": "Build an agent in 10 minutes — copy this prompt",
     "agentBuildSub": "Paste into Claude, ChatGPT or any AI. It builds a local AI agent — running on your own machine, no API keys — connected to your node, and shows you how to share it. For coders and tinkerers; beginners can use the desktop app instead."
   },