aimeat 1.32.1 → 1.33.2

package/dist/public/css/views/secretary.css

@@ -2,7 +2,10 @@
  * @file secretary.css
  * @description Styles for the Secretary view (Phase 0 shell) and the header Secretary button.
  *   Prefix `sec-`. Dark/light safe — uses theme tokens only, no hardcoded colors.
- * @version-history v0.1.0 — 2026-06-23 — Phase 0: hero + provisioning status card + header button/icon.
+ * @version-history
+ *   v0.3.0 — 2026-06-25 — `.sec-consent` specialist scope-consent checklist (declare → consent → grant).
+ *   v0.2.0 — 2026-06-24 — P3-A: doc/image attach control + status line in the chat input row.
+ *   v0.1.0 — 2026-06-23 — Phase 0: hero + provisioning status card + header button/icon.
  */
 
 .sec {
@@ -108,6 +111,484 @@
   font-size: 0.9rem;
 }
 
+.sec-h2 {
+  font-size: 1rem;
+  color: var(--text);
+  margin: 1.25rem 0 0.5rem;
+}
+
+.sec-h2:first-child {
+  margin-top: 0;
+}
+
+/* P2 reach cards (create-resource / knowledge / access / crew): sub-section heading. */
+.sec-h3 {
+  font-size: 0.9rem;
+  font-weight: 600;
+  color: var(--text);
+  margin: 1rem 0 0.25rem;
+}
+
+/* ── Hire / onboarding flow ── */
+.sec-hire .sec-desc {
+  margin-top: 0;
+}
+
+.sec-step {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  font-weight: 600;
+  color: var(--text);
+  margin: 1.25rem 0 0.5rem;
+}
+
+.sec-step-n {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.4rem;
+  height: 1.4rem;
+  border-radius: 50%;
+  background: var(--accent-subtle);
+  color: var(--accent);
+  font-size: 0.8rem;
+}
+
+.sec-prompt-box {
+  background: var(--bg-dim);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm, 8px);
+  padding: 1rem;
+  font-family: monospace;
+  font-size: 0.78rem;
+  line-height: 1.45;
+  max-height: 280px;
+  overflow-y: auto;
+  white-space: pre-wrap;
+  word-break: break-word;
+  margin-bottom: 0.75rem;
+}
+
+.sec-paste {
+  width: 100%;
+  box-sizing: border-box;
+  background: var(--bg-dim);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm, 8px);
+  padding: 0.75rem;
+  color: var(--text);
+  font-family: monospace;
+  font-size: 0.82rem;
+  resize: vertical;
+  margin-bottom: 0.75rem;
+}
+
+.sec-actions {
+  display: flex;
+  justify-content: flex-end;
+}
+
+/* ── Hired display ── */
+.sec-purpose {
+  color: var(--text);
+  margin: 0 0 0.75rem;
+}
+
+.sec-rules,
+.sec-ws {
+  margin: 0 0 0.75rem;
+  padding-left: 1.2rem;
+  color: var(--text-dim);
+}
+
+.sec-rules li,
+.sec-ws li {
+  margin: 0.2rem 0;
+}
+
+.sec-ws li strong {
+  color: var(--text);
+}
+
+.sec-orgname {
+  color: var(--text);
+  margin: 0 0 0.5rem;
+}
+
+.sec-meta-card {
+  margin-top: 1rem;
+}
+
+/* Chat (per active context) */
+.sec-chat-log {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  max-height: 360px;
+  overflow-y: auto;
+  padding: 0.25rem 0 0.75rem;
+}
+
+.sec-msg {
+  max-width: 85%;
+  padding: 0.5rem 0.75rem;
+  border-radius: var(--radius-md, 12px);
+  white-space: pre-wrap;
+  word-break: break-word;
+  font-size: 0.9rem;
+  line-height: 1.4;
+}
+
+.sec-msg-user {
+  align-self: flex-end;
+  background: var(--accent-subtle);
+  color: var(--text);
+  border-bottom-right-radius: 4px;
+}
+
+.sec-msg-assistant {
+  align-self: flex-start;
+  background: var(--bg-dim);
+  border: 1px solid var(--border);
+  color: var(--text);
+  border-bottom-left-radius: 4px;
+}
+
+.sec-msg-pending {
+  opacity: 0.6;
+}
+
+.sec-chat-input {
+  display: flex;
+  gap: 0.5rem;
+  align-items: flex-end;
+}
+
+.sec-chat-input textarea {
+  flex: 1;
+  box-sizing: border-box;
+  background: var(--bg-dim);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm, 8px);
+  padding: 0.5rem 0.75rem;
+  color: var(--text);
+  font-family: inherit;
+  font-size: 0.9rem;
+  resize: vertical;
+}
+
+/* Doc/image attach control in the chat input row (P3-A) */
+.sec-attach-btn { display: inline-flex; align-items: center; gap: 0.25rem; cursor: pointer; white-space: nowrap; }
+.sec-attach-btn.disabled { opacity: 0.6; pointer-events: none; }
+.sec-attach-status { margin: 0.25rem 0; }
+
+/* Learning loop — goals + decision log (5) */
+.sec-form { display: flex; flex-direction: column; gap: 0.5rem; margin-bottom: 0.75rem; }
+.sec-input { width: 100%; padding: 0.5rem 0.6rem; background: var(--bg-dim); color: var(--text); border: 1px solid var(--border); border-radius: 6px; font-size: 0.9rem; box-sizing: border-box; }
+.sec-input-sm { width: 5rem; }
+.sec-goal-list { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 0.4rem; }
+.sec-goal-row { display: flex; align-items: center; gap: 0.5rem; padding: 0.45rem 0; border-top: 1px solid var(--border); }
+.sec-goal-row.done .sec-goal-title { text-decoration: line-through; color: var(--text-dim); }
+.sec-goal-main { flex: 1; min-width: 0; }
+.sec-goal-title { color: var(--text); font-size: 0.9rem; }
+
+/* Specialist scope-consent checklist (declare → consent → grant) */
+.sec-consent { border: 1px solid var(--border); border-radius: 8px; padding: 0.6rem 0.75rem; background: var(--bg-dim); }
+.sec-consent .sec-goal-main { display: flex; align-items: center; gap: 0.5rem; cursor: pointer; }
+.sec-score { font-size: 0.78rem; font-weight: 600; padding: 0.1rem 0.45rem; border-radius: 999px; white-space: nowrap; }
+.sec-score.good { background: var(--success-bg); color: var(--success-fg); }
+.sec-score.mid { background: var(--bg-dim); color: var(--warning); }
+.sec-score.bad { background: var(--danger-bg); color: var(--danger-fg); }
+
+/* Home feed (4) */
+.sec-feed-list { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 0.6rem; }
+.sec-feed-item { padding: 0.5rem 0; border-top: 1px solid var(--border); }
+.sec-feed-meta { font-size: 0.72rem; color: var(--text-dim); margin-bottom: 0.2rem; }
+.sec-feed-text { color: var(--text); font-size: 0.9rem; white-space: pre-wrap; }
+
+/* Autonomous tick / calendar (4) */
+.sec-auto-row { display: flex; align-items: center; justify-content: space-between; gap: 0.75rem; flex-wrap: wrap; }
+.sec-auto-actions { display: flex; gap: 0.4rem; }
+
+/* Guided plan (3c) */
+.sec-plan-steps ol {
+  margin: 0.5rem 0;
+}
+
+.sec-plan-result {
+  display: flex;
+  flex-direction: column;
+  gap: 0.3rem;
+}
+
+/* File-a-note composer */
+.sec-note-bar {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+}
+
+/* Context routing suggestion (chat) */
+.sec-route-hint {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.5rem;
+  padding: 0.4rem 0.6rem;
+  margin-bottom: 0.5rem;
+  border: 1px dashed var(--accent);
+  border-radius: var(--radius-sm, 8px);
+  background: var(--accent-subtle);
+  color: var(--text);
+  font-size: 0.82rem;
+}
+
+/* Resource finder (aimeat_discover) */
+.sec-find-bar {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+  flex-wrap: wrap;
+  margin-bottom: 0.75rem;
+}
+
+.sec-find-in {
+  flex: 1;
+  min-width: 12rem;
+  background: var(--bg-dim);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm, 8px);
+  padding: 0.5rem 0.75rem;
+  color: var(--text);
+  font-size: 0.9rem;
+}
+
+.sec-find-results {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.sec-find-row {
+  display: flex;
+  gap: 0.6rem;
+  align-items: flex-start;
+  padding: 0.5rem 0;
+  border-top: 1px solid var(--border);
+}
+
+.sec-find-type {
+  flex: 0 0 auto;
+  font-size: 0.68rem;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+  padding: 0.1rem 0.45rem;
+  border-radius: var(--radius-xs, 6px);
+  background: var(--accent-subtle);
+  color: var(--accent);
+  margin-top: 0.1rem;
+}
+
+.sec-find-main { min-width: 0; }
+
+.sec-find-title { color: var(--text); font-weight: 600; font-size: 0.9rem; }
+.sec-find-title a { color: var(--accent); text-decoration: none; }
+.sec-find-title a:hover { text-decoration: underline; }
+.sec-find-desc { color: var(--text-dim); font-size: 0.82rem; margin-top: 0.15rem; }
+
+/* Context switcher (hats) */
+.sec-ctx-bar {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 0.4rem;
+  margin-bottom: 1rem;
+}
+
+.sec-ctx-chip {
+  padding: 0.3rem 0.8rem;
+  border-radius: 999px;
+  border: 1px solid var(--border);
+  background: var(--bg-dim);
+  color: var(--text-dim);
+  font-size: 0.85rem;
+  cursor: pointer;
+}
+
+.sec-ctx-chip.active {
+  border-color: var(--accent);
+  background: var(--accent-subtle);
+  color: var(--accent);
+  font-weight: 600;
+}
+
+.sec-ctx-add {
+  width: 1.9rem;
+  height: 1.9rem;
+  border-radius: 999px;
+  border: 1px dashed var(--border);
+  background: transparent;
+  color: var(--text-dim);
+  cursor: pointer;
+  font-size: 1rem;
+  line-height: 1;
+}
+
+.sec-ctx-add:hover {
+  color: var(--accent);
+  border-color: var(--accent);
+}
+
+.sec-card-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.5rem;
+}
+
+.sec-hint {
+  color: var(--text-dim);
+  font-size: 0.82rem;
+}
+
+/* Hire options (copy-paste vs in-app) */
+.sec-opt {
+  margin: 1rem 0;
+  padding: 0.75rem;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm, 8px);
+  background: var(--bg-dim);
+}
+
+.sec-opt-h {
+  font-weight: 600;
+  color: var(--text);
+  margin-bottom: 0.5rem;
+}
+
+.sec-opt .sec-paste {
+  background: var(--card);
+}
+
+/* Operating model — stop-spending + budget + bands */
+.sec-stop {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.6rem;
+  padding: 0.75rem;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm, 8px);
+  cursor: pointer;
+  margin-bottom: 0.75rem;
+}
+
+.sec-stop.on {
+  border-color: var(--danger, #e5534b);
+  background: var(--accent-subtle);
+}
+
+.sec-stop input {
+  margin-top: 0.2rem;
+}
+
+.sec-budget {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+  margin-bottom: 0.75rem;
+}
+
+.sec-budget-in {
+  width: 7rem;
+  background: var(--bg-dim);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-xs, 6px);
+  color: var(--text);
+  padding: 0.3rem 0.5rem;
+}
+
+.sec-bands-note {
+  margin: 0.25rem 0 0.75rem;
+}
+
+.sec-caps {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+
+.sec-cap {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  padding: 0.5rem 0;
+  border-top: 1px solid var(--border);
+}
+
+.sec-cap-label {
+  color: var(--text);
+  font-size: 0.9rem;
+}
+
+.sec-cap-tag {
+  margin-left: 0.5rem;
+  font-size: 0.68rem;
+  padding: 0.05rem 0.4rem;
+  border-radius: var(--radius-xs, 6px);
+  background: var(--bg-dim);
+  border: 1px solid var(--border);
+  color: var(--text-dim);
+}
+
+.sec-cap-locked {
+  font-size: 0.8rem;
+  color: var(--text-dim);
+}
+
+.sec-cap-ent {
+  padding: 0.1rem 0.45rem;
+  border-radius: var(--radius-xs, 6px);
+  border: 1px solid var(--accent);
+  color: var(--accent);
+}
+
+.sec-band {
+  background: var(--bg-dim);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-xs, 6px);
+  color: var(--text);
+  padding: 0.25rem 0.5rem;
+  font-size: 0.82rem;
+}
+
+/* Brain history */
+.sec-hist {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+
+.sec-hist-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  padding: 0.4rem 0;
+  border-top: 1px solid var(--border);
+}
+
+.sec-hist-purpose {
+  color: var(--text-dim);
+  font-size: 0.85rem;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
 /* Header Secretary button (in .topnav) */
 .sec-nav-link {
   display: inline-flex;

package/dist/public/js/services/admin.js

@@ -78,6 +78,13 @@ export const deleteHook      = (name)   => apiDelete(`/v1/admin/hooks/${encodeUR
 // ── Economy ──
 export const mintMorsels     = (gaii, amount) => apiPost('/v1/admin/mint', { gaii, amount });
 
+// ── Applications (moderation) ──
+export const getAdminApps    = ()       => apiGet('/v1/admin/apps');
+export const moderateApp     = (owner, filename, hidden, reason) =>
+  apiPost(`/v1/admin/apps/${encodeURIComponent(owner)}/${encodeURIComponent(filename)}/moderate`, { hidden, reason });
+export const deleteAppAdmin  = (owner, filename) =>
+  apiDelete(`/v1/admin/apps/${encodeURIComponent(owner)}/${encodeURIComponent(filename)}`);
+
 // ── Chat Instances ──
 export const getChatInstances = ()      => apiGet('/v1/chat-instances');
 export const createChatChannel = (name, platform) => apiPost('/v1/chat-instances', { app_name: name, platform: platform || 'admin' });

package/dist/public/js/services/agents.js

@@ -18,9 +18,10 @@ export async function listAgents(owner, opts = {}) {
   return owner ? list.filter(a => a.owner === owner) : list;
 }
 
-/** Workspace-contract advertising via owner-managed agent tags (colon-free — the server tag
- *  pattern allows only [a-z0-9._-]): the tag 'workspace-contract' marks an agent as a contract
- *  provider, and 'contract.<name>' tags name the contract(s) it serves. Convention documented in
+/** Workspace-contract advertising via agent tags (this convention is dot-based so 'contract.<name>'
+ *  parses by prefix; the server tag pattern is [a-z0-9._:-], colons allowed, no '@'): the tag
+ *  'workspace-contract' marks an agent as a contract provider, and 'contract.<name>' tags name the
+ *  contract(s) it serves. Convention documented in
  *  docs/agent-workspace-contracts.md; agents set tags via aimeat_agent_tags_set / PATCH tags. */
 export const offersWorkspaceContract = (a) => (a?.tags || []).includes('workspace-contract');
 
@@ -63,6 +64,20 @@ export async function deleteAgent(name) {
   return apiDelete(`/v1/agents/${encodeURIComponent(name)}`);
 }
 
+/**
+ * Provision a SPECIALIST agent (POST /v1/specialists). When `approvedScopes` is omitted the specialist is
+ * provisioned conservatively and the response carries `requestable_extras` (scope + plain-language
+ * description) so the UI can present a consent checklist; pass `approvedScopes` (a subset of those extras)
+ * to grant them on the owner's explicit consent. Returns the raw `success()` envelope.
+ * @param {{ name: string, role?: string, displayName?: string, approvedScopes?: string[] }} opts
+ */
+export async function createSpecialist({ name, role, displayName, approvedScopes }) {
+  const body = { name, role };
+  if (displayName) body.display_name = displayName;
+  if (Array.isArray(approvedScopes)) body.approved_scopes = approvedScopes;
+  return apiPost('/v1/specialists', body);
+}
+
 /** Update agent scopes. */
 export async function updateAgentScopes(name, scopes) {
   return api(`/v1/agents/${encodeURIComponent(name)}/scopes`, {

package/dist/public/js/services/generator-prompts-build.js

@@ -14,6 +14,8 @@
  *   // OLD (deprecated): import { buildComponentPrompt } from '/js/services/generator-prompts-build.js';
  *   // NEW: session.fetch('/v1/generator/${projectId}/prompts/${componentId}')
  * @version-history
+ *   v2.1.0 — 2026-06-24 — Secretary P5 (S-C): emit `type: secret` (not coerced to string) for secret
+ *     settings so the install pipeline encrypts them at rest. See services/extension-secrets.ts.
  *   v1.0.0 — 2026-03-22 — Extracted from generator-prompts.js
  *   v1.1.0 — 2026-03-24 — Add API URL usage rules + notes to extension data source details
  *   v2.0.0 — 2026-04-02 — DEPRECATED: prompts now served from database. File kept as backup.
@@ -857,7 +859,9 @@ export async function buildComponentPrompt(type, label, projectDescription, blue
       context += 'These settings are injected into `ctx.config` at runtime. Use these EXACT key names:\n\n';
       context += '```yaml\nconfig:\n';
       for (const s of allSettings) {
-        const yamlType = s.type === 'secret' ? 'string' : s.type === 'boolean' ? 'boolean' : s.type === 'number' ? 'number' : 'string';
+        // `secret` is preserved as a first-class config type so the install pipeline encrypts the
+        // value at rest (AES-256-GCM, node key) and decrypts only just before the sandbox VM.
+        const yamlType = s.type === 'secret' ? 'secret' : s.type === 'boolean' ? 'boolean' : s.type === 'number' ? 'number' : 'string';
         context += `  ${s.key}:\n    type: ${yamlType}\n    description: "${s.label}"\n`;
         if (s.required) context += `    required: true\n`;
       }

package/dist/public/js/services/organisms.js

@@ -6,6 +6,8 @@
  *   resolve gate approvals.
  * @usage import * as orgService from '/js/services/organisms.js';
  * @version-history
+ *   v1.5.0 — 2026-06-24 — uploadFile(orgId, file): generic blob upload (any document/image) to an
+ *     organism's private storage, returning {key,url,mime} — used by the Secretary doc/image intake.
  *   v1.4.0 — 2026-06-23 — Optional color tags: getAllColors()/saveColors() read/write the per-item
  *     color map at …w.{ws}.meta.colors.{type} (mirrors getAllSections/saveSections).
  *   v1.3.0 — 2026-06-22 — Batch endpoints: discoverWorkspaces({include:'enrichment'}) folds the
@@ -1164,6 +1166,20 @@ export async function uploadImage(orgId, blob, mime) {
   return `/v1/storage/${encodeURIComponent(resp?.data?.key || key)}`;
 }
 
+/** Upload any file blob (document or image) to an organism's private storage. Returns
+ *  { key, url, mime } where url is a /v1/storage/<key> path (the owner fetches it with the
+ *  session token). Generic sibling of uploadImage — used by the Secretary doc/image intake. */
+export async function uploadFile(orgId, file) {
+  const mime = (file && file.type) || 'application/octet-stream';
+  const rawName = (file && file.name) || 'file';
+  const safe = rawName.replace(/[^a-z0-9.\-_]/gi, '_').slice(-60);
+  const key = `organism.${orgId}.files.${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 7)}-${safe}`;
+  const resp = await apiPost('/v1/storage', { key, visibility: 'private', data: await blobToBase64(file), mime_type: mime });
+  if (resp?.ok === false) throw new Error(resp?.error?.message || 'Upload failed');
+  const finalKey = resp?.data?.key || key;
+  return { key: finalKey, url: `/v1/storage/${encodeURIComponent(finalKey)}`, mime };
+}
+
 /** Fetch a /v1/storage file with the session token and return an object URL (for <img>). */
 export async function fetchStorageObjectUrl(url) {
   const jwt = window.AIMEAT?.auth?.getSession?.()?.jwt;