aimeat 1.32.1 → 1.33.2

package/dist/public/js/services/secretary-helpers.js

@@ -0,0 +1,197 @@
+/**
+ * @file secretary-helpers.js
+ * @description Pure helpers for the Secretary view (kept out of the view module so it stays small):
+ *   the interview/design prompt builders + their shared JSON output contract, robust JSON extraction
+ *   from AI text, a brain version-snapshot, a context id generator, and the secretary.config migration
+ *   from the old single-context layout to the multi-context `{contexts[], activeContextId}` shape.
+ *   See docs/plans/2026-06-23-secretary-feature.md (§5 hire, §22 multi-context).
+ * @structure CONTRACT · buildInterviewPrompt · buildDesignPrompt · extractJson · snapshotOf · genCtxId · migrateConfig · buildDecisionRecord
+ * @usage import { buildInterviewPrompt, extractJson, migrateConfig } from '/js/services/secretary-helpers.js';
+ * @version-history
+ *   v0.2.0 — 2026-06-24 — P3-B: buildDecisionRecord — the single source of the decision-log contract
+ *     shape, shared by the manual log form (use-learning), answered Ask cards (use-intake), and
+ *     approved guided plans (use-guided-plan) so real choices feed the learning loop.
+ *   v0.1.0 — 2026-06-23 — Extracted from views/secretary.js (Phase 2, keep view < 500 lines).
+ */
+import { defaultPolicy } from '/js/services/secretary-policy.js';
+
+/** Concise, accurate AIMEAT primer fed to the chat so the Secretary can teach/guide the user
+ *  ("tutustuta AIMEATiin"). Concept-level (avoids brittle exact UI paths so it doesn't drift). */
+export const SECRETARY_AIMEAT_PRIMER = `AIMEAT is the user's own AI-agent platform. Key ideas you can explain:
+- The user owns everything under their identity (GHII). "Morsels" (❤️) are the usage/credit meter — they're spent on actions, not cashable.
+- Memory: the user's private key-value knowledge store.
+- Organisms = spaces (personal or shared) that contain Workspaces (like folders) holding structured records. The user's Secretary keeps each context's info in its own organism.
+- Agents: AI helpers the user connects (each scoped); the Secretary is one of them.
+- Discover (the network search): finds what already exists across the node — agents, services, companies' offerings, knowledge, apps — so you never rebuild what's there. Always suggest discovering before building.
+- Apps, extensions, capabilities: ways to extend AIMEAT; companies can publish offerings others order.
+When the user asks how to do something in AIMEAT, explain clearly and concretely from these concepts, point them to the right area of their Profile, and offer to walk them through it step by step. If unsure, say so rather than inventing exact button names.`;
+
+/** Shared JSON output contract both interview modes ask the AI to produce. */
+export const CONTRACT = `\`\`\`json
+{
+  "brain": {
+    "purpose": "1-3 sentences: who my Secretary is and how it helps me in this context",
+    "rules": [ { "id": "r1", "description": "a concrete operating rule" } ]
+  },
+  "organism": {
+    "name": "a short name for this space",
+    "description": "one line describing it",
+    "workspaces": [ { "name": "workspace name", "purpose": "what it holds and why" } ]
+  }
+}
+\`\`\``;
+
+/** Conversational interview the user runs in their own external AI chat. */
+export function buildInterviewPrompt(owner) {
+  return `I want to set up a context for my personal Secretary inside AIMEAT${owner ? ` (my username is "${owner}")` : ''}.
+
+Act as that Secretary getting to know me for ONE area of my life or work. Interview me with a few focused questions about: what I'm trying to achieve in this area, the kinds of tasks I'd want help with, and how I like to communicate (tone, language, level of detail). Do NOT ask me about "organisms", "workspaces", folders or any technical structure — figure the right structure out yourself from what I tell you. Keep it conversational; ask, wait for my answers, then continue.
+
+When you have enough, design two things and output them as ONE JSON object inside a single code block with EXACTLY this shape and nothing else:
+
+${CONTRACT}
+
+Constraints: 3–7 brain rules; 2–6 workspaces, each designed from my actual needs. Output ONLY the JSON code block.`;
+}
+
+/** Single-shot design prompt for the in-app mode (runs on the owner's OpenRouter key). */
+export function buildDesignPrompt(owner, needs) {
+  return `You are setting up one context of ${owner || 'a user'}'s personal Secretary inside AIMEAT. Based ONLY on the needs described below, design two things and output them as ONE JSON object inside a single code block with EXACTLY this shape and nothing else:
+
+${CONTRACT}
+
+The user's needs:
+"""
+${needs}
+"""
+
+Constraints: 3–7 brain rules; 2–6 workspaces (you choose names + purposes from the needs). Output ONLY the JSON code block — no commentary.`;
+}
+
+/** Pull a JSON object out of an AI's text (may be fenced / surrounded by prose). */
+export function extractJson(text) {
+  let s = String(text || '').trim();
+  const fence = s.match(/```(?:json)?\s*\n?([\s\S]*?)```/i);
+  if (fence) s = fence[1].trim();
+  if (s[0] !== '{') {
+    const i = s.indexOf('{');
+    const j = s.lastIndexOf('}');
+    if (i >= 0 && j > i) s = s.slice(i, j + 1);
+  }
+  return JSON.parse(s);
+}
+
+/** A version snapshot of a context brain (purpose + rules), or null if unset. */
+export function snapshotOf(brain) {
+  if (!brain || !brain.purpose) return null;
+  const rules = Array.isArray(brain.rules) ? brain.rules.map((r) => ({ id: r.id, description: r.description })) : [];
+  return { ts: new Date().toISOString(), purpose: brain.purpose, rules };
+}
+
+export function genCtxId() {
+  return 'ctx-' + Date.now().toString(36) + Math.random().toString(36).slice(2, 5);
+}
+
+/** Cheap, AI-free context routing (plan §22 step 2): score `text` against each context's name +
+ *  purpose + workspaces by word overlap. Returns {id,name} of a NON-active context only when it
+ *  clearly beats the active one — so the view can SUGGEST a switch. Null otherwise (no nagging). */
+export function suggestContextId(text, contexts, activeId) {
+  const t = String(text || '').toLowerCase();
+  if (t.trim().length < 8 || !Array.isArray(contexts) || contexts.length < 2) return null;
+  const words = new Set(t.split(/[^a-z0-9äöå]+/i).filter((w) => w.length >= 4));
+  if (words.size === 0) return null;
+  const score = (ctx) => {
+    const hay = [ctx.name, ctx.brain && ctx.brain.purpose, ...((ctx.workspaces || []).map((w) => w.name + ' ' + (w.purpose || '')))].join(' ').toLowerCase();
+    let s = 0;
+    for (const w of words) if (hay.includes(w)) s++;
+    return s;
+  };
+  let best = null;
+  let bestScore = 0;
+  for (const c of contexts) {
+    const s = score(c);
+    if (s > bestScore) { bestScore = s; best = c; }
+  }
+  const activeCtx = contexts.find((c) => c.id === activeId);
+  const activeScore = activeCtx ? score(activeCtx) : 0;
+  if (best && best.id !== activeId && bestScore >= 2 && bestScore > activeScore) return { id: best.id, name: best.name };
+  return null;
+}
+
+/** P1-C: remaining autonomous morsel budget for a context today, or null when no limit is set.
+ *  `budget` is the context's policy.dailyMorselBudget (number|null); reads the per-day spend ledger
+ *  the tick maintains on `config.autonomousLedger[contextId]`. */
+export function computeBudgetInfo(budget, config, contextId) {
+  if (budget == null) return null;
+  const today = new Date().toISOString().slice(0, 10);
+  const led = (config && config.autonomousLedger && config.autonomousLedger[contextId]) || null;
+  const spent = (led && led.date === today && typeof led.morsels === 'number') ? led.morsels : 0;
+  return { budget, spent, remaining: Math.max(0, budget - spent) };
+}
+
+/** P1-D: self-facing reliability = mean score over REVIEWED decisions (not the marketplace trustScore).
+ *  Returns { count, score } where score is null until at least one decision has been reviewed. */
+export function computeReliability(decisions) {
+  const reviewed = (decisions || []).filter((d) => d && d.status === 'reviewed' && typeof d.score === 'number');
+  if (reviewed.length === 0) return { count: 0, score: null };
+  return { count: reviewed.length, score: Math.round(reviewed.reduce((s, d) => s + d.score, 0) / reviewed.length) };
+}
+
+/** Normalize secretary.config to the multi-context shape, migrating the old single-context layout.
+ *  `directives` (merged) seeds the brain for a migrated legacy context. Returns {config, changed}. */
+export function migrateConfig(cfg, directives) {
+  if (cfg && Array.isArray(cfg.contexts)) return { config: cfg, changed: false };
+  const dirRules = (directives && Array.isArray(directives.rules))
+    ? directives.rules.filter((r) => r.source !== 'system').map((r) => ({ id: r.id, description: r.description }))
+    : [];
+  const dirPurpose = (directives && directives.purpose) || '';
+  if (cfg && (cfg.selfOrganismId || cfg.organismName)) {
+    const ctx = {
+      id: 'ctx-legacy',
+      name: cfg.organismName || 'My space',
+      brain: { purpose: dirPurpose, rules: dirRules },
+      organismId: cfg.selfOrganismId || null,
+      organismName: cfg.organismName || null,
+      workspaces: cfg.workspaces || [],
+      policy: cfg.policy || defaultPolicy(),
+      brainHistory: cfg.brainHistory || [],
+    };
+    return { config: { contexts: [ctx], activeContextId: ctx.id }, changed: true };
+  }
+  if (!cfg && dirPurpose) {
+    const ctx = { id: 'ctx-legacy', name: 'My space', brain: { purpose: dirPurpose, rules: dirRules }, organismId: null, organismName: null, workspaces: [], policy: defaultPolicy(), brainHistory: [] };
+    return { config: { contexts: [ctx], activeContextId: ctx.id }, changed: true };
+  }
+  return { config: { contexts: [], activeContextId: null }, changed: false };
+}
+
+/** Path to the decision-log Memory Contract spec (mirrors use-learning.js). */
+export const DECISION_SPEC = 'docs/specs/secretary-decision-contract.md';
+
+/** Build one `secretary.decision.{id}` Memory Contract value (see docs/specs/secretary-decision-contract.md).
+ *  The SINGLE source of the decision shape — used by the manual log form, answered Ask cards, and
+ *  approved guided plans, so every real choice enters the learning loop the same way. Stays `open`
+ *  (revisitWhen = now + revisitDays) until the tick's review sweep scores it. `active` is the current
+ *  context ({id,name}) for tagging; `options` is an array; goalRef is optional.
+ *  @param {{ decision?: string, options?: string[], chosen?: string, rationale?: string, expectedOutcome?: string, goalRef?: string|null, revisitDays?: number|string, active?: { id?: string, name?: string }|null }} [opts]
+ */
+export function buildDecisionRecord(opts = {}) {
+  const { decision, options, chosen, rationale, expectedOutcome, goalRef, revisitDays, active } = opts;
+  const id = 'd' + Date.now().toString(36) + Math.floor(Math.random() * 1e6).toString(36);
+  const days = Number(revisitDays) || 7;
+  const revisitWhen = new Date(Date.now() + days * 86400000).toISOString();
+  return {
+    type: 'secretary.decision', spec: DECISION_SPEC, id,
+    decision: String(decision || '').trim(),
+    goalRef: goalRef || null,
+    options: Array.isArray(options) ? options.filter(Boolean) : [],
+    chosen: String(chosen || '').trim(),
+    rationale: String(rationale || '').trim(),
+    expectedOutcome: String(expectedOutcome || '').trim(),
+    revisitWhen,
+    actualOutcome: null, score: null, verdict: null, status: 'open',
+    reviewedAt: null, attempts: 0, lastError: null,
+    contextId: (active && active.id) || '', contextName: (active && active.name) || '',
+    createdAt: new Date().toISOString(),
+  };
+}

package/dist/public/js/services/secretary-policy.js

@@ -0,0 +1,63 @@
+/**
+ * @file secretary-policy.js
+ * @description The Secretary's operating model (Phase 1): the capability taxonomy + autonomy bands
+ *   that define what the Secretary may do on its own. Stored on the owner memory key `secretary.config`
+ *   under `.policy` (NOT the generic agent-directives model — keeps the operating model in one
+ *   secretary-specific place). This is the CONTRACT later phases enforce (Phase 3 inbox bands, Phase 4
+ *   autonomous tick read it); for now it is authored + persisted here. Bands: act (do it + log) /
+ *   draft (prepare, ask to approve) / ask (decision card) / off. `discover` is locked to act + free
+ *   (read-only, never blocked by stop-spending). Full design: docs/plans/2026-06-23-secretary-feature.md §6/§9.
+ * @structure BANDS · SECRETARY_CAPABILITIES · defaultPolicy() · mergePolicy()
+ * @usage import { SECRETARY_CAPABILITIES, BANDS, defaultPolicy } from '/js/services/secretary-policy.js';
+ * @version-history
+ *   v0.2.0 — 2026-06-24 — Phase 3d: mark Enterprise-only capabilities (third-party messaging, transacting,
+ *     spending) with `enterprise: true` — gated/locked in the Community Secretary (which lacks the
+ *     messages:send / work:request / wallet scopes). The explicit third-party-send gate.
+ *   v0.1.0 — 2026-06-23 — Phase 1 completion: operating-model taxonomy + bands.
+ */
+
+/** Autonomy bands, least → most restrictive in display order. */
+export const BANDS = ['act', 'draft', 'ask', 'off'];
+
+/**
+ * The Secretary's operating surface. `defaultBand` is the conservative Community default; `locked`
+ * capabilities cannot be changed by the user; `free` ones cost no morsels and are never blocked by the
+ * stop-spending switch; `costs` flags money/outbound actions (shown with a cost hint in the UI);
+ * `enterprise` capabilities require scopes the Community Secretary doesn't have (messages:send /
+ * work:request / wallet) — they're gated/locked here and only unlocked by the company `ee/` edition.
+ */
+export const SECRETARY_CAPABILITIES = [
+  { id: 'discover',            defaultBand: 'act',   locked: true, free: true },
+  { id: 'file_intake',         defaultBand: 'act' },
+  { id: 'briefing',            defaultBand: 'act' },
+  { id: 'reminders',           defaultBand: 'act' },
+  { id: 'curate_knowledge',    defaultBand: 'draft' },
+  { id: 'draft_replies',       defaultBand: 'draft' },
+  { id: 'create_resource',     defaultBand: 'ask' },
+  { id: 'delegate',            defaultBand: 'ask',   costs: true },
+  { id: 'resource_invoke',     defaultBand: 'ask',   costs: true, enterprise: true },
+  { id: 'third_party_message', defaultBand: 'ask',   costs: true, enterprise: true },
+  { id: 'spend',               defaultBand: 'ask',   costs: true, enterprise: true },
+];
+
+/** The conservative default operating model seeded when the Secretary is hired. */
+export function defaultPolicy() {
+  const bands = {};
+  for (const c of SECRETARY_CAPABILITIES) bands[c.id] = c.defaultBand;
+  return { stopSpending: false, dailyMorselBudget: null, bands };
+}
+
+/** Merge a stored (possibly partial / older) policy onto the current defaults so new capabilities
+ *  always have a band and locked ones stay correct. */
+export function mergePolicy(stored) {
+  const base = defaultPolicy();
+  const p = stored && typeof stored === 'object' ? stored : {};
+  const bands = { ...base.bands, ...(p.bands || {}) };
+  // Locked capabilities are always forced to their default band.
+  for (const c of SECRETARY_CAPABILITIES) if (c.locked) bands[c.id] = c.defaultBand;
+  return {
+    stopSpending: !!p.stopSpending,
+    dailyMorselBudget: (typeof p.dailyMorselBudget === 'number' && p.dailyMorselBudget >= 0) ? p.dailyMorselBudget : null,
+    bands,
+  };
+}

package/dist/public/js/services/secretary-routing.js

@@ -0,0 +1,69 @@
+/**
+ * @file secretary-routing.js
+ * @description Pure, AI-free cross-context routing for the Secretary's intake (plan §22 Phase-4, P2-E).
+ *   Classifies a piece of intake text against ALL of the user's Secretary contexts by cheap word
+ *   overlap (context name + brain purpose + workspace names/purposes), biased by recorded CORRECTIONS
+ *   (words the owner has previously associated with a context by moving a note there). The result drives
+ *   the intake hook: a HIGH-confidence match to a NON-active context auto-routes the note there; a
+ *   LOW-confidence match surfaces an Ask card; an item that belongs to the active context (or has no
+ *   signal) returns null and is filed normally. Mirrors the backend helpers in
+ *   src/services/secretary-tick.ts — the node behavior wins on any mismatch.
+ * @structure tokenize · scoreContexts · routeIntake · learnCorrection
+ * @usage import { routeIntake, learnCorrection } from '/js/services/secretary-routing.js';
+ * @version-history v0.1.0 — 2026-06-24 — P2-E: cheap cross-context router + corrections-teach.
+ */
+
+/** Significant words (≥4 chars) from text, lowercased. */
+export function tokenize(text) {
+  return Array.from(new Set(String(text || '').toLowerCase().split(/[^a-z0-9äöå]+/i).filter((w) => w.length >= 4)));
+}
+
+const CORRECTION_BONUS = 5;
+
+/** Score each context by word overlap (+ correction bias). Returns [{id,name,organismId,score}] sorted desc. */
+export function scoreContexts(words, contexts, corrections) {
+  const corr = corrections || {};
+  return (contexts || []).map((ctx) => {
+    const hay = [ctx.name, ctx.brain && ctx.brain.purpose, ...((ctx.workspaces || []).map((w) => w.name + ' ' + (w.purpose || '')))]
+      .join(' ').toLowerCase();
+    let score = 0;
+    for (const w of words) {
+      if (hay.includes(w)) score += 1;
+      if (corr[w] === ctx.id) score += CORRECTION_BONUS;
+    }
+    return { id: ctx.id, name: ctx.name, organismId: ctx.organismId || null, score };
+  }).sort((a, b) => b.score - a.score);
+}
+
+/**
+ * Route intake `text` across all `contexts`. Returns null when the text belongs to the active context
+ * or carries no signal (caller files it normally); otherwise `{ contextId, confidence, score }` where
+ * confidence is 'high' (auto-route into that non-active context) or 'low' (surface an Ask card).
+ */
+export function routeIntake(text, contexts, activeId, corrections) {
+  const t = String(text || '').trim();
+  if (t.length < 8 || !Array.isArray(contexts) || contexts.length < 2) return null;
+  const words = tokenize(t);
+  if (words.length === 0) return null;
+  const scored = scoreContexts(words, contexts, corrections);
+  const best = scored[0];
+  const second = scored[1] || { score: 0 };
+  if (!best || best.score === 0) return null;
+  const activeScore = (scored.find((s) => s.id === activeId) || { score: 0 }).score;
+  if (best.id === activeId) return null; // belongs to the active context → no routing needed
+  const margin = best.score - second.score;
+  const beatsActive = best.score - activeScore;
+  if (best.score >= 2 && beatsActive >= 2 && margin >= 2) {
+    return { contextId: best.id, confidence: 'high', score: best.score };
+  }
+  return { contextId: best.id, confidence: 'low', score: best.score };
+}
+
+/** Record a correction: associate the text's significant words with `toContextId` (bounded map). */
+export function learnCorrection(corrections, text, toContextId) {
+  const next = { ...(corrections || {}) };
+  for (const w of tokenize(text)) next[w] = toContextId;
+  const keys = Object.keys(next);
+  if (keys.length > 200) for (const k of keys.slice(0, keys.length - 200)) delete next[k];
+  return next;
+}

package/dist/public/spa.html

@@ -174,6 +174,19 @@
       "/js/services/notebook-plan.js": "/js/services/notebook-plan.js",
       "/js/services/nodes.js": "/js/services/nodes.js",
       "/js/services/organisms.js": "/js/services/organisms.js",
+      "/js/services/secretary-policy.js": "/js/services/secretary-policy.js",
+      "/js/services/secretary-helpers.js": "/js/services/secretary-helpers.js",
+      "/js/services/secretary-routing.js": "/js/services/secretary-routing.js",
+      "/views/secretary/cards.js": "/views/secretary/cards.js",
+      "/views/secretary/cards-reach.js": "/views/secretary/cards-reach.js",
+      "/views/secretary/use-intake.js": "/views/secretary/use-intake.js",
+      "/views/secretary/use-guided-plan.js": "/views/secretary/use-guided-plan.js",
+      "/views/secretary/use-autonomy.js": "/views/secretary/use-autonomy.js",
+      "/views/secretary/use-learning.js": "/views/secretary/use-learning.js",
+      "/views/secretary/use-create-resource.js": "/views/secretary/use-create-resource.js",
+      "/views/secretary/use-knowledge.js": "/views/secretary/use-knowledge.js",
+      "/views/secretary/use-access.js": "/views/secretary/use-access.js",
+      "/views/secretary/use-crew.js": "/views/secretary/use-crew.js",
       "/js/services/offers.js": "/js/services/offers.js",
       "/js/services/offers-grouping.js": "/js/services/offers-grouping.js",
       "/js/services/packages.js": "/js/services/packages.js",
@@ -198,6 +211,7 @@
       "/components/Mermaid.js": "/components/Mermaid.js",
       "/components/NotificationBell.js": "/components/NotificationBell.js",
       "/components/CopyButton.js": "/components/CopyButton.js",
+      "/components/Toast.js": "/components/Toast.js",
       "/components/ContactCard.js": "/components/ContactCard.js",
       "/components/Spinner.js": "/components/Spinner.js",
       "/components/EmptyState.js": "/components/EmptyState.js",

package/dist/public/views/admin/apps-tab.js

@@ -0,0 +1,208 @@
+/**
+ * @file apps-tab.js
+ * @description Admin dashboard Applications tab — operator moderation surface for
+ *   every published app on the node. Lists all apps (across all owners, including
+ *   parked + operator-hidden), with a hide/restore control. Hiding removes the app
+ *   from every public surface (catalogue/gallery/search + direct download); the
+ *   owner still sees it in their "My Apps" with a "moderated by operator: hidden"
+ *   badge but cannot lift it — only an operator can.
+ * @structure AppsAdminTab (default) — load all apps, filter, table, hide-reason +
+ *   type-to-confirm delete modals.
+ * @usage Mounted by the admin dashboard tab router (views/admin.js).
+ * @version-history
+ *   v1.0.0 — 2026-06-24 — Initial: list-all + hide/restore moderation tool.
+ *   v1.1.0 — 2026-06-25 — Add operator hard-delete (type-to-confirm) — removes an
+ *     app permanently from the node.
+ */
+import { h } from 'preact';
+import { useState, useEffect, useCallback, useMemo } from 'preact/hooks';
+import htm from 'htm';
+const html = htm.bind(h);
+import { t } from '/js/i18n.js';
+import { escHtml } from '/js/utils.js';
+import { dt, fmtBytes, Spinner, Empty, ErrorBox, useToast, Toast } from './shared.js';
+import { Modal } from '/components/Modal.js';
+import * as adminService from '/js/services/admin.js';
+
+export default function AppsAdminTab() {
+  const [apps, setApps] = useState(null);
+  const [error, setError] = useState(null);
+  const [query, setQuery] = useState('');
+  const [hiddenOnly, setHiddenOnly] = useState(false);
+  // { owner, filename, name, reason } while the hide-reason modal is open
+  const [hiding, setHiding] = useState(null);
+  // { owner, filename, name, typed } while the type-to-confirm delete modal is open
+  const [deleting, setDeleting] = useState(null);
+  const [busy, setBusy] = useState(false);
+  const [msg, showError, showSuccess, clearMsg] = useToast();
+
+  const load = useCallback(async () => {
+    setError(null);
+    try {
+      const resp = await adminService.getAdminApps();
+      setApps(resp?.data?.apps || []);
+    } catch (err) {
+      setError(err?.message || String(err));
+      setApps([]);
+    }
+  }, []);
+
+  useEffect(() => { load(); }, [load]);
+
+  useEffect(() => {
+    const handler = () => { load(); };
+    window.addEventListener('aimeat-live-update', handler);
+    return () => window.removeEventListener('aimeat-live-update', handler);
+  }, [load]);
+
+  const filtered = useMemo(() => {
+    if (!apps) return [];
+    const q = query.trim().toLowerCase();
+    return apps.filter(a => {
+      if (hiddenOnly && !a.operator_hidden) return false;
+      if (!q) return true;
+      return (a.filename || '').toLowerCase().includes(q)
+        || (a.owner || '').toLowerCase().includes(q)
+        || (a.manifest?.name || '').toLowerCase().includes(q);
+    });
+  }, [apps, query, hiddenOnly]);
+
+  const hiddenCount = useMemo(() => (apps || []).filter(a => a.operator_hidden).length, [apps]);
+
+  const doHide = useCallback(async () => {
+    if (!hiding) return;
+    setBusy(true);
+    try {
+      await adminService.moderateApp(hiding.owner, hiding.filename, true, hiding.reason?.trim() || undefined);
+      showSuccess(t('admin.apps.hiddenOk'));
+      setHiding(null);
+      await load();
+    } catch (err) {
+      showError(err?.message || String(err));
+    } finally {
+      setBusy(false);
+    }
+  }, [hiding, load, showSuccess, showError]);
+
+  const doRestore = useCallback(async (app) => {
+    try {
+      await adminService.moderateApp(app.owner, app.filename, false);
+      showSuccess(t('admin.apps.restoredOk'));
+      await load();
+    } catch (err) {
+      showError(err?.message || String(err));
+    }
+  }, [load, showSuccess, showError]);
+
+  const doDelete = useCallback(async () => {
+    if (!deleting || deleting.typed !== deleting.filename) return;
+    setBusy(true);
+    try {
+      await adminService.deleteAppAdmin(deleting.owner, deleting.filename);
+      showSuccess(t('admin.apps.deletedOk'));
+      setDeleting(null);
+      await load();
+    } catch (err) {
+      showError(err?.message || String(err));
+    } finally {
+      setBusy(false);
+    }
+  }, [deleting, load, showSuccess, showError]);
+
+  return html`
+    ${msg && html`<${Toast} type=${msg.type} text=${msg.text} onDismiss=${clearMsg} />`}
+    <p class="adm-text-sm adm-text-dim adm-mb-md">${t('admin.apps.desc')}</p>
+
+    <div class="adm-card">
+      <div class="adm-flex-between adm-mb-md">
+        <h2>${t('admin.apps.title')} ${hiddenCount > 0 ? html`<span class="badge badge-warn">${hiddenCount} ${t('admin.apps.hiddenChip')}</span>` : ''}</h2>
+        <div class="adm-flex adm-apps-filters">
+          <input class="adm-input" placeholder=${t('admin.apps.searchPlaceholder')}
+            value=${query} onInput=${e => setQuery(e.target.value)} />
+          <label class="adm-text-sm adm-apps-toggle">
+            <input type="checkbox" checked=${hiddenOnly} onChange=${e => setHiddenOnly(e.target.checked)} />
+            ${t('admin.apps.hiddenOnly')}
+          </label>
+        </div>
+      </div>
+
+      ${error && html`<${ErrorBox} message=${error} />`}
+      ${apps === null ? html`<${Spinner} />`
+        : filtered.length === 0 ? html`<${Empty} text=${t('admin.apps.empty')} />`
+        : html`
+        <div class="scrollable">
+          <table>
+            <thead><tr>
+              <th>${t('admin.apps.colApp')}</th>
+              <th>${t('admin.apps.colOwner')}</th>
+              <th>${t('admin.apps.colSize')}</th>
+              <th>${t('admin.apps.colDownloads')}</th>
+              <th>${t('admin.apps.colStatus')}</th>
+              <th></th>
+            </tr></thead>
+            <tbody>
+              ${filtered.map(a => html`
+                <tr class=${a.operator_hidden ? 'adm-apps-row-hidden' : ''}>
+                  <td>
+                    <div>${escHtml(a.manifest?.name || a.filename)}</div>
+                    <div class="adm-text-sm adm-text-dim mono">${escHtml(a.filename)}</div>
+                  </td>
+                  <td class="mono">${escHtml(a.owner)}</td>
+                  <td>${fmtBytes(a.size || 0)}</td>
+                  <td>${a.downloads || 0}</td>
+                  <td>
+                    ${a.operator_hidden
+                      ? html`<span class="badge badge-danger">\u{1F6AB} ${t('admin.apps.statusHidden')}</span>
+                          ${a.operator_hide_reason ? html`<div class="adm-text-sm adm-text-dim">${escHtml(a.operator_hide_reason)}</div>` : ''}
+                          ${a.operator_hidden_by ? html`<div class="adm-text-sm adm-text-dim">${t('admin.apps.byAt', { by: a.operator_hidden_by, at: dt(a.operator_hidden_at) })}</div>` : ''}`
+                      : a.parked
+                        ? html`<span class="badge badge-dim">\u{1F17F}️ ${t('admin.apps.statusParked')}</span>`
+                        : html`<span class="badge badge-success">${t('admin.apps.statusLive')}</span>`}
+                  </td>
+                  <td>
+                    <div class="adm-flex adm-apps-rowactions">
+                      ${a.operator_hidden
+                        ? html`<button class="adm-btn-sm adm-btn-success" onClick=${() => doRestore(a)}>${t('admin.apps.restore')}</button>`
+                        : html`<button class="adm-btn-sm adm-btn-danger" onClick=${() => setHiding({ owner: a.owner, filename: a.filename, name: a.manifest?.name || a.filename, reason: '' })}>${t('admin.apps.hide')}</button>`}
+                      <button class="adm-btn-sm adm-btn-danger-solid" onClick=${() => setDeleting({ owner: a.owner, filename: a.filename, name: a.manifest?.name || a.filename, typed: '' })}>${t('admin.apps.delete')}</button>
+                    </div>
+                  </td>
+                </tr>
+              `)}
+            </tbody>
+          </table>
+        </div>
+      `}
+    </div>
+
+    <${Modal} open=${!!hiding} onClose=${() => setHiding(null)} title=${t('admin.apps.hideTitle')}>
+      ${hiding && html`
+        <p>${t('admin.apps.hideConfirm')} <strong>${escHtml(hiding.name)}</strong> (<span class="mono">${escHtml(hiding.owner)}</span>)?</p>
+        <p class="adm-text-sm adm-text-dim">${t('admin.apps.hideExplain')}</p>
+        <label class="adm-text-sm adm-mb-half">${t('admin.apps.reasonLabel')}</label>
+        <input class="adm-input adm-input-full" value=${hiding.reason}
+          placeholder=${t('admin.apps.reasonPlaceholder')}
+          onInput=${e => setHiding({ ...hiding, reason: e.target.value })} />
+        <div class="adm-flex adm-mt-md adm-apps-modal-actions">
+          <button class="btn-ghost" onClick=${() => setHiding(null)}>${t('common.cancel')}</button>
+          <button class="btn-danger-solid" disabled=${busy} onClick=${doHide}>${t('admin.apps.hide')}</button>
+        </div>
+      `}
+    <//>
+
+    <${Modal} open=${!!deleting} onClose=${() => setDeleting(null)} title=${t('admin.apps.deleteTitle')}>
+      ${deleting && html`
+        <p>${t('admin.apps.deleteConfirm')} <strong>${escHtml(deleting.name)}</strong> (<span class="mono">${escHtml(deleting.owner)}</span>)?</p>
+        <p class="adm-text-sm adm-text-error">${t('admin.apps.deleteWarn')}</p>
+        <label class="adm-text-sm adm-mb-half">${t('admin.apps.deleteTypeLabel', { filename: deleting.filename })}</label>
+        <input class="adm-input adm-input-full mono" value=${deleting.typed}
+          placeholder=${deleting.filename}
+          onInput=${e => setDeleting({ ...deleting, typed: e.target.value })} />
+        <div class="adm-flex adm-mt-md adm-apps-modal-actions">
+          <button class="btn-ghost" onClick=${() => setDeleting(null)}>${t('common.cancel')}</button>
+          <button class="btn-danger-solid" disabled=${busy || deleting.typed !== deleting.filename} onClick=${doDelete}>${t('admin.apps.delete')}</button>
+        </div>
+      `}
+    <//>
+  `;
+}

package/dist/public/views/admin.js

@@ -6,6 +6,7 @@
  * @version-history
  *   v1.1.0 — 2026-06-18 — Debounce + silence SSE-driven refresh so busy nodes don't flicker "Loading…".
  *   v1.1.1 — 2026-06-19 — JSDoc type annotations for frontend type-checking
+ *   v1.2.0 — 2026-06-24 — Add Applications moderation tab (operator hide/restore apps).
  */
 import { h } from 'preact';
 import { useState, useEffect, useCallback, useRef } from 'preact/hooks';
@@ -59,6 +60,7 @@ import AgentTasksAdminTab from './admin/agent-tasks-tab.js';
 import SharingGroupsAdminTab from './admin/sharing-groups-tab.js';
 import AgentIntegrationAdminTab from './admin/agent-integration-tab.js';
 import SubdomainsAdminTab from './admin/subdomains-tab.js';
+import AppsAdminTab        from './admin/apps-tab.js';
 
 // ── Sidebar nav structure ──
 const NAV_GROUPS = [
@@ -92,6 +94,7 @@ const NAV_GROUPS = [
     { id: 'agent-tasks',  icon: '\u{1F4CB}',  key: 'dashboard.agentTasksTab', component: AgentTasksAdminTab },
     { id: 'sharing-groups', icon: '\u{1F465}', key: 'dashboard.sharingGroupsTab', component: SharingGroupsAdminTab },
     { id: 'capabilities', icon: '⚡',     key: 'capabilities.adminTitle', component: CapabilitiesAdminTab },
+    { id: 'apps',         icon: '\u{1F4F1}', key: 'admin.apps.title',        component: AppsAdminTab },
   ]},
   { key: 'dashboard.navInfrastructure', items: [
     { id: 'email',  icon: '\u2709',     key: 'dashboard.email',  component: EmailTab },