aimeat 1.35.0 → 1.37.0

package/dist/public/llms-template.txt

@@ -274,6 +274,9 @@ entry: index.html
 | aimeat-social | `loadScript('/v1/libs/aimeat-social.js')` | Discussion boards |
 | aimeat-wallet | `loadScript('/v1/libs/aimeat-wallet.js')` | Morsel balance display |
 | aimeat-ai | `loadScript('/v1/libs/aimeat-ai.js')` | `AIMEAT.ai.complete/completeJson/isAvailable` — runs LLM completions using the user's own OpenRouter key (zero cost to AIMEAT, user-owned spend budget) |
+| aimeat-markdown | `loadScript('/v1/libs/aimeat-markdown.js')` | `AIMEAT.md.render(text, target)` — safe markdown INTO an element (returns an Element; never assign it to innerHTML — use the target param or `renderToString`). `await AIMEAT.md.renderRich(text, target)` adds task lists, footnotes, code highlighting, Mermaid and LIVE data embeds (an `aimeat-memory` fence naming a memory key renders as a fresh table on every open) |
+| aimeat-organism | `loadScript('/v1/libs/aimeat-organism.js')` | `AIMEAT.organism.list/workspaces/read/writeDraft/publish` — organisms & workspaces with a NORMALIZED read (published + drafts merged per item; the raw workspace GET returns them as separate maps) |
+| aimeat-editor | `loadScript('/v1/libs/aimeat-editor.js')` | `AIMEAT.editor.mount/toolbar/split` — CodeMirror 6 markdown editor with live preview (pairs with aimeat-markdown) |
 
 ### Key rules
 
@@ -470,6 +473,9 @@ The node serves browser-ready JavaScript libraries. Load them via `<script src="
 | aimeat-audio | `/v1/libs/aimeat-audio.js` | Audio: 6 instruments, custom synth, soundboard, sample loader |
 | aimeat-speech | `/v1/libs/aimeat-speech.js` | Speech: TTS, STT, voice commands, pluggable providers |
 | aimeat-ai | `/v1/libs/aimeat-ai.js` | LLM completions through the user's own OpenRouter key (`AIMEAT.ai.complete`, `completeJson`, `isAvailable`, `models`, `usage`). Server enforces daily USD budget + per-app quota; rejects with descriptive `err.code` (NO_API_KEY / QUOTA_EXHAUSTED / APP_QUOTA_EXHAUSTED / APP_NOT_ALLOWED / etc.). Pattern: **detect** with `isAvailable()`, **compose** the prompt yourself from app data, **call** with `app_id` so spend is attributable, **render** the result into an editable field so the human stays in the loop. Never bundle your own API key — use the user's. |
+| aimeat-markdown | `/v1/libs/aimeat-markdown.js` | Markdown rendering. `AIMEAT.md.render(text, target)` renders a safe dependency-free GFM subset INTO an element — it returns an Element, so never assign the result to innerHTML (that shows "[object HTMLDivElement]"); use the target param, appendChild, or `renderToString(text)`. `await AIMEAT.md.renderRich(text, target)` upgrades to full GFM (task lists, footnotes, highlighted code, Mermaid diagrams), sanitized, with automatic fallback to the safe subset when CDNs are unreachable. LIVE DATA EMBEDS: a fenced block with language `aimeat-memory` (body lines `key: <memory key>`, optional `owner: <gaii>` for public reads, `view: table/props/list/value/json`, `fields: a, b`, `title: ...`) renders the named memory key as a table/props/list — fetched at render time, so the document shows fresh agent-produced data on every open; access is the server's memory read (workspace rules + entry visibility) and denials render a placeholder. |
+| aimeat-organism | `/v1/libs/aimeat-organism.js` | Organisms & workspaces. `list()`, `workspaces(orgId)`, `read(orgId, wsId)` → `{ manifest, readmeText, spaces }` where each space's items merge published + draft per instance (`{ id, hasRealId, draft, latest, value, title, updatedAt, status }`) — the raw workspace GET returns `objects` (published) and `drafts` as SEPARATE maps; this lib does the merging, id resolution (value.id convention) and `_createdAt/_updatedAt/_version` metadata handling for you. `writeDraft`, `publish`, `revertToDraft`, `deleteObject` (needs the memory:delete scope — declare it via `<meta name="aimeat-scopes">`), `saveReadme`, `search`. Items with `hasRealId:false` cannot round-trip — render them read-only. Requires aimeat-auth. |
+| aimeat-editor | `/v1/libs/aimeat-editor.js` | Markdown editor: `AIMEAT.editor.mount(el, {value, onChange})` (CodeMirror 6 with textarea fallback), `toolbar(adapter)` for formatting buttons, `split(el, {value, onChange})` for editor + live preview rendered through aimeat-markdown. |
 
 ### Standard App Template
 
@@ -560,6 +566,278 @@ Key rules:
 - Do NOT add manual token entry fields. The auth library handles everything.
 - Do NOT modify the AIMEAT header nav bar.
 
+### Workspace App Template (app pinned to organism workspaces)
+
+A workspace app is a normal published app that WORKS ON a workspace's content. A workspace
+creator/admin pins it to the workspace (workspace Overview → Apps → Manage, or the
+`aimeat_workspace_update` MCP tool's `apps` param) and every member launches it from the
+workspace's Apps cards. Three things make it a workspace app:
+
+1. **Access = workspace access.** There is no app-side permission system: every read/write the
+   app makes runs as the signed-in user through `/v1/organisms/...` and is gated by the
+   workspace's own rules (membership, creator/admin, granted roles). If the user can read the
+   workspace they can use the app — never build your own gate.
+2. **Launch context rides the URL fragment.** The workspace launch card opens the app with
+   `#aimeat-ws={organismId}/{workspaceId}`. The fragment survives the app-origin redirect, so
+   parse `location.hash` on boot and pin the app to that workspace.
+3. **Launched bare → offer the pinned workspaces.** Without a fragment, list the workspaces the
+   user can access and prefer the ones this app is pinned to: `AIMEAT.organism.workspaces(orgId)`
+   returns `enrichment.apps` = the pinned `{owner, filename}` list.
+
+Use `aimeat-organism.js` for all content work — it does the objects/drafts merge, the `value.id`
+convention and `_meta` stripping for you (see the SDK table above).
+
+```html
+<!-- AIMEAT App Manifest
+name: workspace-notes
+version: 1.0.0
+description: Notes on a shared workspace — pin it to any workspace with a records space
+entry: index.html
+-->
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Workspace Notes</title>
+  <link href="/lib/daisyui@5.css" rel="stylesheet" type="text/css" />
+  <link href="/lib/aimeat-daisyui-bridge.css" rel="stylesheet" type="text/css" />
+  <script src="/lib/tailwindcss@4.js"></script>
+</head>
+<body class="bg-base-100 min-h-screen flex flex-col">
+  <nav class="navbar bg-base-200 shadow-sm px-4">
+    <div class="flex-1"><span class="text-lg font-bold">Workspace Notes</span>
+      <span id="ws-name" class="ml-3 text-sm opacity-70"></span></div>
+    <div class="flex-none"><span id="header-auth"></span></div>
+  </nav>
+  <div id="app" class="flex-1 p-4 max-w-2xl mx-auto w-full"><p>Loading…</p></div>
+  <script>
+    function loadScript(src) { return new Promise((res, rej) => { const s = document.createElement('script'); s.src = src; s.onload = res; s.onerror = rej; document.head.appendChild(s); }); }
+    const $app = () => document.getElementById('app');
+
+    // #aimeat-ws={organismId}/{workspaceId} — set by the workspace launch card.
+    function launchContext() {
+      const m = /[#&]aimeat-ws=([^/&]+)\/([^&]+)/.exec(location.hash || '');
+      return m ? { orgId: decodeURIComponent(m[1]), wsId: decodeURIComponent(m[2]) } : null;
+    }
+
+    // Which published app am I? Match my <title> against the public catalog — works on any
+    // origin (apex or app subdomain), no hardcoding.
+    async function discoverSelf() {
+      try {
+        const r = await fetch('/v1/apps'); const d = await r.json();
+        const me = (d?.data?.apps || []).find(a => a?.manifest?.name === document.title);
+        return me ? { owner: me.owner, filename: me.filename } : null;
+      } catch { return null; }
+    }
+
+    async function boot() {
+      await loadScript('/v1/libs/aimeat-auth.js');
+      await loadScript('/v1/libs/aimeat-organism.js');
+      AIMEAT.auth.mountLoginButton('#header-auth', { onLogin: start, onLogout: () => location.reload() });
+      // On the isolated APP ORIGIN the silent-SSO / consent-popup flows complete asynchronously and
+      // fire the 'login' EVENT (not the button's onLogin callback) — subscribe to both.
+      let started = false;
+      const startOnce = () => { if (!started) { started = true; start(); } };
+      AIMEAT.auth.on('login', startOnce);
+      const session = await AIMEAT.auth.login();
+      if (session) startOnce(); else if (!started) $app().innerHTML = '<p>Sign in to open a workspace.</p>';
+    }
+
+    async function start() {
+      const ctx = launchContext();
+      if (ctx) return openWorkspace(ctx.orgId, ctx.wsId);
+      // Launched bare: list accessible workspaces, pinned-here first.
+      const self = await discoverSelf();
+      const orgs = await AIMEAT.organism.list();
+      const rows = [];
+      for (const org of orgs) {
+        const wss = await AIMEAT.organism.workspaces(org.id).catch(() => []);
+        for (const w of wss) {
+          if (w.access === 'none') continue;
+          const pinned = !!self && (w.enrichment?.apps || []).some(a => a.owner === self.owner && a.filename === self.filename);
+          rows.push({ org, w, pinned });
+        }
+      }
+      rows.sort((a, b) => Number(b.pinned) - Number(a.pinned));
+      $app().innerHTML = '<h2 class="text-lg font-bold mb-2">Pick a workspace</h2>';
+      for (const r of rows) {
+        const btn = document.createElement('button');
+        btn.className = 'btn btn-outline btn-block justify-start mb-2';
+        btn.textContent = (r.pinned ? '📌 ' : '') + r.org.name + ' / ' + (r.w.name || r.w.id);
+        btn.onclick = () => { location.hash = '#aimeat-ws=' + encodeURIComponent(r.org.id) + '/' + encodeURIComponent(r.w.id); openWorkspace(r.org.id, r.w.id); };
+        $app().appendChild(btn);
+      }
+      if (!rows.length) $app().innerHTML += '<p>No accessible workspaces.</p>';
+    }
+
+    async function openWorkspace(orgId, wsId) {
+      const ws = await AIMEAT.organism.read(orgId, wsId);
+      document.getElementById('ws-name').textContent = ws.manifest?.name || wsId;
+      // First records-mode space is the notes home (documents work the same way).
+      const space = ws.spaces.find(s => (s.kind || 'records') !== 'document') || ws.spaces[0];
+      if (!space) { $app().innerHTML = '<p>This workspace has no spaces yet.</p>'; return; }
+      const el = $app(); el.innerHTML = '<h2 class="text-lg font-bold mb-2">' + space.name + '</h2>';
+      for (const item of space.items.sort((a, b) => b.updatedAt - a.updatedAt)) {
+        const card = document.createElement('div');
+        card.className = 'card bg-base-200 mb-2 p-3';
+        card.textContent = item.title + (item.status !== 'published' ? ' (' + item.status + ')' : '');
+        el.appendChild(card);
+      }
+      // Add form: draft + publish under the space's namespace. The server gates the write by
+      // workspace access; a gated workspace turns publish into a pending approval — show why.
+      const form = document.createElement('form'); form.className = 'mt-4 flex gap-2';
+      form.innerHTML = '<input class="input input-bordered flex-1" placeholder="New note…" required />' +
+                       '<button class="btn btn-primary">Add</button>';
+      form.onsubmit = async (e) => {
+        e.preventDefault();
+        const text = form.querySelector('input').value.trim(); if (!text) return;
+        const id = 'note-' + Date.now();
+        try {
+          await AIMEAT.organism.writeDraft(orgId, wsId, space.namespace, id, { id, title: text });
+          await AIMEAT.organism.publish(orgId, wsId, space.namespace, id);
+          openWorkspace(orgId, wsId);
+        } catch (err) { alert(err.message); }
+      };
+      el.appendChild(form);
+    }
+
+    boot();
+  </script>
+</body>
+</html>
+```
+
+Key rules for workspace apps:
+- NEVER build an app-side permission gate — the server enforces workspace access on every call.
+- Parse `#aimeat-ws=` on boot; keep the fragment when you navigate so reload stays pinned.
+- `writeDraft` + `publish` is the write loop; items with `hasRealId:false` are read-only.
+- A publish can return a pending approval when the workspace gates publishes — tell the user
+  instead of treating it as an error.
+
+### App-IAM Template (an app with its OWN users and BBS levels via aimeat-iam)
+
+Use this when the app needs its own permission system — its own user roster and levels,
+independent of workspaces. The app gets a per-app copy of the **aimeat-iam extension**: a
+server-side decision oracle whose state (roles, levels, assignments, command manifest) lives in
+the extension's own `ext:{name}` memory, sovereign and tamper-proof from the browser. The app
+never decides permissions itself — it ASKS the extension, and shows/hides UI from the answer.
+One model, two user kinds: a human GHII and an agent GAII are checked identically.
+
+**The model (BBS ordinal levels — LOWER number = MORE power):**
+- Roles carry capability lists and sit on levels: seeded `admin: 0 ['*']`,
+  `editor: 10 ['read','create','edit']`, `viewer: 20 ['read']` — all replaceable.
+- A **command manifest** maps app commands → required capability + mutation tier
+  (`read | write | irreversible`). The `irreversible` tier makes `needsConfirmation: true`,
+  so the UI knows to confirm — the manifest decides, not the UI author.
+- Unassigned users get `config.defaultRole` (seeded `viewer`).
+
+**Setup (once, by the app owner or their AI):**
+1. Install a copy of the aimeat-iam extension under your app's own name (convention:
+   `{your-app}-iam`) — via the aimeat-iam package, or `aimeat_extension_install` over MCP.
+2. `POST /v1/ext/{ext}/admin` with `{ "op": "claim" }` (records you as owner + seeds defaults),
+   then `{ "op": "setCommands", "commands": [...] }` and `{ "op": "assign", "ghii": "you@node",
+   "role": "admin" }` — claiming does NOT auto-assign a role.
+3. AI route: the `aimeat_iam_define` MCP tool validates a level schema + command manifest,
+   computes the level→command matrix, and returns ready-to-apply admin payloads
+   (`setRoles` / `setLevels` / `setCommands`).
+
+**The runtime contract (all calls need a signed-in session; `resp.data` is the answer):**
+
+```javascript
+const EXT = 'my-app-iam';   // your app's own extension instance
+const iam = async (action, body) => {
+  const r = await AIMEAT.auth.getSession().fetch('/v1/ext/' + EXT + '/' + action,
+    { method: 'POST', body: JSON.stringify(body || {}) });
+  if (r.ok === false) throw new Error(r.error?.message || action + ' failed');
+  return r.data;
+};
+
+// Gate EVERYTHING on check { command } — the decision is server-side:
+const me = await iam('check', { command: 'post' });
+// → { allowed, role, level, command, capability, tier, needsConfirmation }
+if (me.allowed) showComposer();
+if (me.needsConfirmation) askTheHumanFirst();   // irreversible tier
+
+// Owner-only user management. getState answers for ANY caller but reports isOwner —
+// gate the panel on state.isOwner (server truth, not a level guess); the mutating
+// ops (assign/revoke/set*) are enforced owner-only server-side regardless:
+const state = await iam('admin', { op: 'getState' });   // roles, levels, commands, assignments, isOwner
+await iam('admin', { op: 'assign', ghii: 'friend@node-id', role: 'editor' });
+await iam('admin', { op: 'revoke', ghii: 'friend@node-id' });
+
+// The roster doubles as a content index — assignments are PUBLIC extension memory:
+const assignments = await AIMEAT.data.getPublic('ext:' + EXT, 'iam.assignments') || {};
+// { "user@node": "role", ... } — everyone who can write is here, so read exactly
+// their public keys to aggregate shared content (each user writes their OWN key).
+```
+
+Key rules for app-IAM apps:
+- The extension is the ONLY permission truth; the app renders its answers. Never mirror the
+  rules into app JS — they would drift and can be bypassed anyway.
+- `check {permission}` (legacy role/permission mode) still works; prefer `check {command}` —
+  agents and humans then share one verb vocabulary with tiers.
+- Content pattern: each user writes their own public key (e.g. `my-app.posts`); readers
+  discover writers through `iam.assignments`. No shared-key write races, no extra backend.
+- Full working example: the "Club Board" proof app (packages/club-board in the AIMEAT repo).
+
+### Agent-Faced App Template (one app, two faces — humans use the UI, agents use MCP)
+
+Use this when AI agents should be first-class USERS of the app, working alongside humans.
+The trick: there is NO agent-specific backend. Both faces operate on the SAME workspace
+records — the human face is your app UI (the Workspace App Template above), the agent face
+is the standard MCP workspace tools (`aimeat_workspace_read` / `_write` / `_publish`) driven
+by a PROMPT your app generates. Access on both faces is the workspace's own access.
+
+Canonical example — a kanban the human fills and agents work:
+
+1. **The shared record.** One records space, contract-tagged so agents recognise it, with an
+   OPEN schema (agents may add fields without rejections):
+   ```
+   PUT /v1/organisms/{id}/workspace?ws={ws}
+   { "add_spaces": [{ "name": "task", "namespace": "shared.kanban", "mode": "records",
+                      "contract": "kanban", "description": "Tasks humans file and agents work" }],
+     "schemas": { "shared.kanban": { "type": "object", "required": ["id","title","status"],
+       "properties": { "id": {"type":"string"}, "title": {"type":"string"}, "brief": {"type":"string"},
+         "status": {"type":"string","enum":["todo","claimed","doing","done"]},
+         "assignee": {"type":"string"}, "deliverable": {"type":"string"}, "notes": {"type":"string"} } } } }
+   ```
+2. **The human face** is a normal workspace app: render columns by `status`, create tasks with
+   `status:"todo"`, let the human override any task — same `writeDraft` + `publish` loop the
+   agents use.
+3. **The agent face is a prompt, not code.** Put a "🤖 Copy agent prompt" button in the app that
+   emits the work loop with the ids baked in — the human pastes it into ANY MCP-connected agent:
+   ```
+   You work a kanban board in an AIMEAT workspace. Use your AIMEAT MCP tools.
+   Board: organism_id "<orgId>", ws "<wsId>", space "task".
+   A task is { id, title, brief, status: todo|claimed|doing|done, assignee, deliverable, notes }.
+   Work loop:
+   1. aimeat_workspace_read { organism_id, ws } — look at objects["task"].
+   2. Pick ONE task with status "todo" that matches your skills.
+   3. CLAIM: aimeat_workspace_write with the task re-written as status "claimed" +
+      assignee "<your GAII>", then aimeat_workspace_publish. Re-read after publishing —
+      if the assignee is not you, someone else won; pick another task.
+   4. Work. Record progress: status "doing" + a short note in `notes`, publish each update.
+   5. Finish: status "done" + WHERE THE RESULT LIVES in `deliverable` (a URL, a workspace
+      document id, or a memory key). Publish.
+   6. Repeat while matching "todo" tasks remain. Rules: one task at a time; keep every
+      existing field when re-writing; if a publish is gated, leave the draft for human review.
+   ```
+4. **Human control knobs come free from the workspace:** the publish gate turns every agent
+   publish into a pending human approval; workspace roles decide which members (and their
+   agents) may write at all.
+
+Key rules for agent-faced apps:
+- The claim convention (`assignee` + re-read after publish) resolves races without any
+  backend lock — first publish wins, losers stand down.
+- `deliverable` is a POINTER, never the payload — the work product lives where it belongs
+  (a document space, a memory key, a URL) and the board links to it.
+- Poll politely in the UI (the board changes while humans watch); agents poll via
+  `aimeat_workspace_read` on their own schedule.
+- Full working example: the "Agent Kanban" proof app (packages/agent-kanban in the AIMEAT
+  repo) — verified end-to-end: human files a task, an agent claims it (assignee + status),
+  progresses it, and finishes with a deliverable link the human clicks.
+
 ### Realtime / Multiplayer Template
 
 For apps that need live collaboration, multiplayer, or real-time sync.

package/dist/public/spa.html

@@ -269,6 +269,7 @@
       "/views/profile/organisms/participants-panel.js": "/views/profile/organisms/participants-panel.js",
       "/views/profile/organisms/workspace-comments.js": "/views/profile/organisms/workspace-comments.js",
       "/views/profile/organisms/sources-panel.js": "/views/profile/organisms/sources-panel.js",
+      "/views/profile/organisms/workspace-apps.js": "/views/profile/organisms/workspace-apps.js",
       "/views/profile/organisms/schema-form.js": "/views/profile/organisms/schema-form.js",
       "/views/profile/organisms/document.js": "/views/profile/organisms/document.js",
       "/views/command-palette.js": "/views/command-palette.js",
@@ -317,13 +318,32 @@
     import htm from 'htm';
     import { loadTranslations, t, getLocale, switchLocale, onLocaleChange } from '/js/i18n.js';
     import { initThemeSystem } from '/js/theme.js';
-    import { NotificationBell } from '/components/NotificationBell.js';
+    import { NotificationBell, openNotificationLink } from '/components/NotificationBell.js';
     import { CommandPalette } from '/views/command-palette.js';
     import { openAppSandboxed, isAppHtmlUrl } from '/js/app-sandbox.js';
     // generateStars no longer needed for light theme
 
     const html = htm.bind(h);
 
+    // ── Notification cold-open deep link ──
+    // A push-notification click can open '/v1/profile?tab=messages#inbox/<conversationId>' (or
+    // the bell's '#<tab>[/<rest>]' hash form) in a fresh window. Prime the landing page's
+    // sessionStorage contract ({tabId, slot} JSON — landing-page.js openView init) BEFORE the
+    // view mounts, plus the inbox thread key that inbox-tab.js consumes on mount. Overwriting the
+    // saved tab matters: landing-page prefers sessionStorage over ?tab=, so a stale value from
+    // earlier browsing would otherwise beat the deep link in a reused browser tab.
+    (() => {
+      if (location.pathname !== '/v1/profile') return;
+      const m = /^#([a-z]+)(?:\/(.+))?$/i.exec(location.hash || '');
+      const rawTab = new URLSearchParams(location.search).get('tab') || (m ? m[1] : '');
+      if (!rawTab) return;
+      const tabId = rawTab.toLowerCase() === 'inbox' ? 'messages' : rawTab;
+      try {
+        sessionStorage.setItem('aimeat-profile-tab', JSON.stringify({ tabId, slot: 'main' }));
+        if (tabId === 'messages' && m && m[2]) sessionStorage.setItem('aimeat.inbox.open', m[2]);
+      } catch { /* private mode — ?tab= still lands the tab */ }
+    })();
+
     // ── Error Boundary ──
     class ErrorBoundary extends Component {
       constructor(props) {
@@ -436,6 +456,19 @@
         }
       }, []);
 
+      // Push-notification clicks on an already-open window: the service worker (sw.js) focuses
+      // this window and posts the notification's target URL — deep-link it in place (tab switch,
+      // inbox thread) instead of a full reload.
+      useEffect(() => {
+        if (!('serviceWorker' in navigator)) return undefined;
+        const onSwMessage = (e) => {
+          if (!e.data || e.data.type !== 'aimeat-notification-click' || !e.data.url) return;
+          openNotificationLink(e.data.url, navigate);
+        };
+        navigator.serviceWorker.addEventListener('message', onSwMessage);
+        return () => navigator.serviceWorker.removeEventListener('message', onSwMessage);
+      }, [navigate]);
+
       // Initial load + popstate
       useEffect(() => {
         // Load initial route
@@ -544,6 +577,9 @@
       const [morsels, setMorsels] = useState(null);
       const [menuOpen, setMenuOpen] = useState(false);
       const [secretaryAvailable, setSecretaryAvailable] = useState(false);
+      // Node feature flags from /v1/site/header-nav (e.g. { secretary }). Empty until the fetch resolves,
+      // so optional surfaces stay hidden until we positively learn they're enabled (no flash).
+      const [features, setFeatures] = useState({});
       // Header nav config: { order, hidden }. Defaults to all visible in declared order
       // until the public /v1/site/header-nav fetch resolves (no flash of empty nav).
       const [navConfig, setNavConfig] = useState({ order: PUBLIC_NAV_LINKS.map(l => l.id), hidden: [] });
@@ -574,6 +610,7 @@
             const order = Array.isArray(d.data.order) ? d.data.order : PUBLIC_NAV_LINKS.map(l => l.id);
             const hidden = Array.isArray(d.data.hidden) ? d.data.hidden : [];
             setNavConfig({ order, hidden });
+            setFeatures(d.data.features || {});
           })
           .catch(e => console.warn('Header nav fetch failed:', e.message));
         return () => { cancelled = true; };
@@ -644,7 +681,7 @@
                   class="${link.matchActive !== false && currentPath === link.path ? 'active' : ''}">${t(link.key) || link.fallback || link.key}</a>
               `)}
               ${session && html`
-                ${secretaryAvailable && html`
+                ${secretaryAvailable && features.secretary && html`
                   <a href="/v1/secretary" class="sec-nav-link ${currentPath === '/v1/secretary' ? 'active' : ''}"
                     title=${t('nav.secretary')} onClick=${(e) => { handleNav(e, '/v1/secretary'); setMenuOpen(false); }}>
                     <span class="sec-nav-icon"><svg viewBox="0 0 24 24" aria-hidden="true">

package/dist/public/sw.js

@@ -1,34 +1,50 @@
-/* AIMEAT Push Notification Service Worker */
-
-self.addEventListener('push', (event) => {
-  if (!event.data) return;
-  try {
-    const data = event.data.json();
-    const title = data.title || 'AIMEAT';
-    const options = {
-      body: data.body || '',
-      icon: data.icon || '/icons/icon-192.png',
-      badge: data.badge || '/icons/icon-192.png',
-      tag: data.tag || 'aimeat-notification',
-      data: data.data || data,
-    };
-    if (data.url) options.data.url = data.url;
-    event.waitUntil(self.registration.showNotification(title, options));
-  } catch {
-    const text = event.data.text();
-    event.waitUntil(self.registration.showNotification('AIMEAT', { body: text }));
-  }
-});
-
-self.addEventListener('notificationclick', (event) => {
-  event.notification.close();
-  const url = event.notification.data?.url || '/v1/portal';
-  event.waitUntil(
-    clients.matchAll({ type: 'window', includeUncontrolled: true }).then((windowClients) => {
-      for (const client of windowClients) {
-        if (client.url.includes(url) && 'focus' in client) return client.focus();
-      }
-      return clients.openWindow(url);
-    })
-  );
-});
+/* AIMEAT Push Notification Service Worker
+ *
+ * Click routing: a notification payload carries `url` (or `data.url`) — a same-origin path such
+ * as '/v1/profile?tab=messages#inbox/<conversationId>' or '/v1/apps/<owner>/<file>?mode=inline'.
+ * On click we prefer an already-open window on the SAME path (focus + postMessage so the SPA can
+ * switch tabs in place — see the 'aimeat-notification-click' listener in spa.html); otherwise a
+ * new window opens the URL, and the SPA's cold-load deep-linking (?tab= / #hash) lands the view.
+ */
+
+// Take over immediately so click-routing fixes apply without waiting for every tab to close.
+self.addEventListener('install', () => self.skipWaiting());
+self.addEventListener('activate', (event) => event.waitUntil(self.clients.claim()));
+
+self.addEventListener('push', (event) => {
+  if (!event.data) return;
+  try {
+    const data = event.data.json();
+    const title = data.title || 'AIMEAT';
+    const options = {
+      body: data.body || '',
+      icon: data.icon || '/icons/icon-192.png',
+      badge: data.badge || '/icons/badge-96.png',
+      tag: data.tag || 'aimeat-notification',
+      data: data.data || data,
+    };
+    if (data.url) options.data.url = data.url;
+    event.waitUntil(self.registration.showNotification(title, options));
+  } catch {
+    const text = event.data.text();
+    event.waitUntil(self.registration.showNotification('AIMEAT', { body: text }));
+  }
+});
+
+self.addEventListener('notificationclick', (event) => {
+  event.notification.close();
+  const url = event.notification.data?.url || '/v1/profile';
+  const target = new URL(url, self.location.origin);
+  event.waitUntil(
+    clients.matchAll({ type: 'window', includeUncontrolled: true }).then((windowClients) => {
+      for (const client of windowClients) {
+        let clientUrl;
+        try { clientUrl = new URL(client.url); } catch { continue; }
+        if (clientUrl.origin !== target.origin || clientUrl.pathname !== target.pathname) continue;
+        client.postMessage({ type: 'aimeat-notification-click', url: target.pathname + target.search + target.hash });
+        return 'focus' in client ? client.focus() : undefined;
+      }
+      return clients.openWindow(target.href);
+    })
+  );
+});

package/dist/public/views/my-company.js

@@ -22,6 +22,8 @@
  *     (revenue / orders / cost-per-task / commission income + per-agent table) from GET /v1/orgs/:slug/governance.
  *   v0.7.0 — 2026-06-24 — Secretary Phase 6 (slice 1): Company model admin subtab — prompt-driven builder
  *     (describe → generate in-app / copy-prompt → review → apply) for departments/roles/people/reporting (GET/PUT /v1/orgs/:slug/model).
+ *   v0.8.0 — 2026-07-01 — Company Secretary subtab hidden unless the node enables the Secretary feature
+ *     (AIMEAT_SECRETARY_ENABLED, read from /v1/site/header-nav `features.secretary`). Governance + model unaffected.
  */
 import { h } from 'preact';
 import { useState, useEffect, useCallback } from 'preact/hooks';
@@ -760,6 +762,7 @@ export default function MyCompanyView() {
   const [newName, setNewName] = useState('');
   const [newBusinessId, setNewBusinessId] = useState('');
   const [busy, setBusy] = useState(false);
+  const [featSecretary, setFeatSecretary] = useState(false);  // node opt-in: show the company Secretary subtab
 
   async function loadOrgs() {
     setState('loading');
@@ -771,6 +774,15 @@ export default function MyCompanyView() {
     }
   }
   useEffect(() => { loadOrgs(); }, []);
+  // Company Secretary is opt-in per node (AIMEAT_SECRETARY_ENABLED); hide its admin subtab when off.
+  useEffect(() => {
+    let cancelled = false;
+    fetch('/v1/site/header-nav')
+      .then(r => r.json())
+      .then(d => { if (!cancelled && d?.ok) setFeatSecretary(!!(d.data?.features && d.data.features.secretary)); })
+      .catch(() => {});
+    return () => { cancelled = true; };
+  }, []);
 
   async function loadOrders(org) {
     try { const r = await apiGet(`/v1/orgs/${encodeURIComponent(org.slug)}/orders`); setOrdersReceived(r.data?.orders ?? []); }
@@ -872,7 +884,7 @@ export default function MyCompanyView() {
             </div>
 
             <div class="mc-subtabs">
-              ${['catalog', ...(selected.role === 'admin' ? ['orders', 'customers', 'portfolio', 'secretary', 'governance', 'model', 'settings'] : []), 'members'].map(id => html`
+              ${['catalog', ...(selected.role === 'admin' ? ['orders', 'customers', 'portfolio', ...(featSecretary ? ['secretary'] : []), 'governance', 'model', 'settings'] : []), 'members'].map(id => html`
                 <button class="mc-subtab ${subTab === id ? 'active' : ''}" key=${id} onClick=${() => setSubTab(id)}>${t('myCompany.tab' + id.charAt(0).toUpperCase() + id.slice(1))}</button>`)}
               <span class="mc-role-chip">${t('myCompany.role' + (selected.role || 'member').charAt(0).toUpperCase() + (selected.role || 'member').slice(1))}</span>
             </div>