aimeat 1.35.0 → 1.37.0

package/dist/public/views/profile/memory-tab.js

@@ -3,6 +3,9 @@
  * @description Profile tab for memory entries and file management — CRUD, search,
  *   visibility cycling, tag editing, sharing rules, and file upload with drag-and-drop.
  * @version-history
+ *   v2.3.0 — 2026-07-03 — 'members' visibility (readable by any logged-in node user)
+ *     selectable in all visibility pickers (popover, detail select, bulk bar,
+ *     create form, edit modal).
  *   v2.2.0 — 2026-06-13 — Render image memory values inline: a value that IS an image (a /v1/pub URL
  *     string or a { url, mime:image/* } object) shows a thumbnail above its raw JSON, via the shared
  *     ImageDeliverable renderer.
@@ -490,7 +493,7 @@ export default function MemoryTab({ session, showToast, onStats }) {
   /* Visibility is edited via an explicit select inside the EXPANDED detail (and in the
      edit modal) — the old per-row click-to-cycle pill meant one stray click in the list
      could publish a memory. The list rows show a static badge only. */
-  const VIS_OPTIONS = ['private', 'owner', 'group', 'public'];
+  const VIS_OPTIONS = ['private', 'owner', 'group', 'members', 'public'];
 
   // Quick visibility change from the expanded detail. 'group' needs a group pick,
   // so it routes to the edit modal where the group select lives.
@@ -1374,6 +1377,7 @@ function MemoryForm({ onSave, onCancel, groups }) {
           <option value="private">${t('profile.memory.visPrivate')}</option>
           <option value="shared">${t('profile.memory.visShared')}</option>
           <option value="group">${t('knowledge.visibility.group')}</option>
+          <option value="members">${t('knowledge.visibility.members')}</option>
           <option value="public">${t('profile.memory.visPublic')}</option>
         </select>
       </div>
@@ -1544,7 +1548,7 @@ function EditMemoryModal({ memKey, initialValue, initialVisibility, initialVersi
           <label class="pf-label-inline">${t('profile.memory.visLabel')}</label>
           <select class="input-field mem-vis-select" value=${vis}
             onChange=${e => { setVis(e.target.value); if (e.target.value !== 'group') setGroupId(''); }}>
-            ${['private', 'owner', 'group', 'public'].map(v => html`<option key=${v} value=${v}>${t('knowledge.visibility.' + v)}</option>`)}
+            ${['private', 'owner', 'group', 'members', 'public'].map(v => html`<option key=${v} value=${v}>${t('knowledge.visibility.' + v)}</option>`)}
           </select>
         </div>
         ${vis === 'group' && html`

package/dist/public/views/profile/notifications-tab.js

@@ -3,6 +3,8 @@
  * @description Profile tab for push notification and email notification preferences.
  * @version-history
  *   v1.0.0 — 2026-03-17 — Refactor: replace inline styles with CSS classes; use ToggleSwitch and GlassCard from shared.js
+ *   v1.1.0 — 2026-07-02 — Distinguish a browser-level permission denial from generic subscribe
+ *     failures so the user knows to unblock notifications in browser settings.
  */
 import { h } from 'preact';
 import { useState, useEffect } from 'preact/hooks';
@@ -81,6 +83,11 @@ export default function NotificationsTab({ session, showToast }) {
         setSubStatus(null);
         return;
       }
+      if (typeof Notification !== 'undefined' && Notification.permission === 'denied') {
+        showToast(t('profile.notifications.permissionDenied'), true);
+        setSubStatus(null);
+        return;
+      }
       const reg = await navigator.serviceWorker.register('/sw.js');
       await navigator.serviceWorker.ready;
 
@@ -114,7 +121,8 @@ export default function NotificationsTab({ session, showToast }) {
       showToast(t('profile.notifications.subscribeSuccess'));
     } catch (err) {
       console.error('Push subscribe failed:', err);
-      showToast(t('profile.notifications.subscribeFailed'), true);
+      const denied = typeof Notification !== 'undefined' && Notification.permission === 'denied';
+      showToast(t(denied ? 'profile.notifications.permissionDenied' : 'profile.notifications.subscribeFailed'), true);
     }
     setSubStatus(null);
   }

package/dist/public/views/profile/organisms/home.js

@@ -12,6 +12,10 @@
  *     development timeline; rename the structure overview to "table of contents" (Osa A/C/D).
  *   v1.1.1 — 2026-06-23 — Mindmap space-node click now deep-links into the workspace on that space's
  *     tab (onOpenWs gained a second `space` arg); was opening the workspace overview.
+ *   v1.2.0 — 2026-07-03 — Roster privacy: Settings → Access gains the "Member list" visibility
+ *     select (member_visibility: signed-in default / members / admins / public) with an honest
+ *     hint (hides the LIST, not content authorship); isMember now prefers `your_membership` from
+ *     GET /:id since members[] can be roster-redacted for this caller.
  */
 import { h } from 'preact';
 import { useState, useEffect, useMemo, useRef } from 'preact/hooks';
@@ -50,7 +54,10 @@ export function OrganismHome({ org, ghii, showToast, initialSettings, onOpenWs,
 
   const isCreator = org.creatorGhii === ghii;
   const isAdmin = org.admins?.includes(ghii);
-  const isMember = org.members?.includes(ghii);
+  // members[] can be roster-redacted (memberVisibility) — your_membership from GET /:id is the
+  // caller-scoped truth, with the array as fallback for orgs whose roster this caller CAN see.
+  const [yourMembership, setYourMembership] = useState(null);
+  const isMember = (yourMembership?.status === 'active') || org.members?.includes(ghii);
   const canEdit = isCreator || isAdmin;
   const typeLabel = t(`organisms.types.${org.type}`) || org.type;
 
@@ -70,6 +77,7 @@ export function OrganismHome({ org, ghii, showToast, initialSettings, onOpenWs,
       if (cancelled) return;
       setGraph(g);
       setReadme(full?.data?.readme || '');
+      setYourMembership(full?.data?.your_membership ?? null);
       setTocSeed(toc || '');
     };
     loadExtras();
@@ -112,6 +120,7 @@ export function OrganismHome({ org, ghii, showToast, initialSettings, onOpenWs,
   const baseline = useMemo(() => ({
     name: org.name || '', description: org.description || '', type: org.type || 'community',
     join_policy: org.joinPolicy || 'open', visibility: org.visibility || 'public',
+    member_visibility: org.memberVisibility || 'authenticated',
     interests: [...(org.interests || [])],
   }), [org]);
   const [form, setForm] = useState(baseline);
@@ -124,12 +133,14 @@ export function OrganismHome({ org, ghii, showToast, initialSettings, onOpenWs,
     const prev = prevBaselineRef.current;
     const untouched = form.name === prev.name && form.description === prev.description
       && form.type === prev.type && form.join_policy === prev.join_policy
-      && form.visibility === prev.visibility && form.interests.join(' ') === prev.interests.join(' ');
+      && form.visibility === prev.visibility && form.member_visibility === prev.member_visibility
+      && form.interests.join(' ') === prev.interests.join(' ');
     if (untouched) setForm(baseline);
     prevBaselineRef.current = baseline;
   }, [baseline]);  const dirty = form.name !== baseline.name || form.description !== baseline.description
     || form.type !== baseline.type || form.join_policy !== baseline.join_policy
     || form.visibility !== baseline.visibility
+    || form.member_visibility !== baseline.member_visibility
     || form.interests.join(' ') !== baseline.interests.join(' ');
   // Save doubles as the unsaved-changes indicator: enabled ⇔ something actually changed.
   const saveEdit = async () => {
@@ -138,7 +149,8 @@ export function OrganismHome({ org, ghii, showToast, initialSettings, onOpenWs,
     try {
       const result = await orgService.updateOrganism(org.id, {
         name: form.name.trim(), description: form.description.trim(),
-        type: form.type, join_policy: form.join_policy, visibility: form.visibility, interests: form.interests,
+        type: form.type, join_policy: form.join_policy, visibility: form.visibility,
+        member_visibility: form.member_visibility, interests: form.interests,
       });
       if (result?.ok !== false) { showToast(t('organisms.updated') || 'Organism updated'); onChanged?.(); }
       else showToast(result?.error?.message || (t('organisms.updateError') || 'Failed to update'));
@@ -262,8 +274,16 @@ export function OrganismHome({ org, ghii, showToast, initialSettings, onOpenWs,
               <option value="listed">${t('organisms.visListed') || 'Listed'}</option>
               <option value="private">${t('organisms.visPrivate') || 'Private'}</option>
             </select></label>
+          <label class="pj-field"><span>${t('organisms.memberVisLabel') || 'Member list'}</span>
+            <select class="input-field input-sm" value=${form.member_visibility} onChange=${(e) => setForm(f => ({ ...f, member_visibility: e.target.value }))}>
+              <option value="authenticated">${t('organisms.memberVis.authenticated') || 'Signed-in users'}</option>
+              <option value="members">${t('organisms.memberVis.members') || 'Members only'}</option>
+              <option value="admins">${t('organisms.memberVis.admins') || 'Admins only'}</option>
+              <option value="public">${t('organisms.memberVis.public') || 'Public (anyone)'}</option>
+            </select></label>
         </div>
         ${hintText ? html`<div class="pj-form-hint">${hintText}</div>` : null}
+        <div class="pj-form-hint">${t('organisms.memberVisHint') || 'Who can see who belongs here. Hides the member LIST only — content authorship (comments, records, activity) stays visible, and the creator/admins are always shown.'}</div>
 
         <div class="form-actions">
           <button class="btn-primary btn-sm" onClick=${saveEdit} disabled=${saving || !dirty || !form.name.trim()}>

package/dist/public/views/profile/organisms/participants-panel.js

@@ -7,6 +7,8 @@
  * @usage import { ParticipantsPanel } from '/views/profile/organisms/participants-panel.js';
  * @version-history
  *   v1.0.0 — 2026-06-19 — Extracted from organisms-tab.js during the module split.
+ *   v1.1.0 — 2026-07-03 — Contract engagements: active/retired lifecycle chips (Adopt writes an active
+ *     engagement, Retire flips it to retired), a legacy-agent one-click Retire, and re-adopt.
  */
 import { h } from 'preact';
 import { useState, useEffect } from 'preact/hooks';
@@ -14,6 +16,13 @@ import htm from 'htm';
 import { onLiveUpdate } from '/lib/live-updates.js';
 const html = htm.bind(h);
 import { t } from '/js/i18n.js';
+
+/** Short calendar day for a retired-since stamp (locale date, no time). '' if absent/unparseable. */
+function fmtDay(iso) {
+  if (!iso) return '';
+  const d = new Date(iso);
+  return isNaN(d.getTime()) ? '' : d.toLocaleDateString();
+}
 import * as orgService from '/js/services/organisms.js';
 import { listAgents, offersWorkspaceContract, contractNamesOf, adoptContractTask } from '/js/services/agents.js';
 import { Mermaid } from '/components/Mermaid.js';
@@ -33,24 +42,64 @@ export function ParticipantsPanel({ orgId, wsId, showToast }) {
   // straight away which of their agents can serve it.
   const [contractAgents, setContractAgents] = useState([]);
   const [adoptBusy, setAdoptBusy] = useState('');   // `${gaii}:${contract}` of the in-flight adopt
+  // Engagements = the first-class (agent × contract × workspace) bindings with an active/retired
+  // lifecycle. They drive the chips below (vs. the coarse "active here" record trace), so a contract
+  // can be adopted AND retired — a real off-switch, and retired ones stay as "used here until <date>".
+  const [engagements, setEngagements] = useState([]);
+  const [retireBusy, setRetireBusy] = useState('');
   useEffect(() => {
     listAgents().then(a => setContractAgents((a || []).filter(offersWorkspaceContract))).catch(() => {});
   }, []);
-  // One-click adoption: queue the agreed adopt-contract task (docs/agent-workspace-contracts.md
-  // §7c) — the agent provisions its contract's spaces itself and the task completion is the ack.
+  // The engagement for (agent, contract) in THIS workspace, or undefined. contract '' = bare marker.
+  const engFor = (a, contract) => engagements.find(e => e.agent === a.gaii && (e.contract || '') === (contract || ''));
+  // One-click adoption: write an ACTIVE engagement (immediately visible + the source of truth the
+  // agent's loop obeys) AND queue the agreed adopt-contract task (docs/agent-workspace-contracts.md
+  // §7c) so the agent provisions its contract's spaces itself and reports back.
   const adopt = async (a, contract) => {
     const key = `${a.gaii}:${contract || ''}`;
     setAdoptBusy(key);
     try {
+      await orgService.activateEngagement(orgId, wsId, a.gaii, contract).catch(() => {});
       const r = await adoptContractTask(a.name, { organismId: orgId, ws: wsId, contract });
       if (r?.ok === false) showToast?.(r?.error?.message || (t('organisms.adoptFailed') || 'Could not queue the adoption task'));
       else showToast?.((t('organisms.adoptQueued') || 'Adoption task queued for {agent} — it provisions the contract and reports back').replace('{agent}', a.display_name || a.name));
+      await refreshEngagements();
     } catch (e) { showToast?.((e && e.message) || (t('organisms.adoptFailed') || 'Could not queue the adoption task')); }
     finally { setAdoptBusy(''); }
   };
+  // Retire a contract engagement — the agent's loop then skips this workspace. Works even with no
+  // prior engagement (a pre-contracts agent, "active here" only from record traces): it writes a
+  // retired marker so the history reads "used here until <date>".
+  const retire = async (a, contract) => {
+    const key = `${a.gaii}:${contract || ''}`;
+    setRetireBusy(key);
+    try {
+      const r = await orgService.retireEngagement(orgId, wsId, a.gaii, contract);
+      if (r?.ok === false) showToast?.(r?.error?.message || (t('organisms.retireFailed') || 'Could not retire the contract'));
+      else showToast?.((t('organisms.retired') || '{agent} retired from this workspace').replace('{agent}', a.display_name || a.name));
+      await refreshEngagements();
+    } catch (e) { showToast?.((e && e.message) || (t('organisms.retireFailed') || 'Could not retire the contract')); }
+    finally { setRetireBusy(''); }
+  };
+  // Retire every advertised contract of an agent from this workspace (used for a "legacy" agent that
+  // is working here — trace only — with no engagement records yet, so one click stops it entirely).
+  const retireAll = async (a) => {
+    const names = contractNamesOf(a);
+    const actions = names.length ? names : [''];
+    setRetireBusy(`${a.gaii}:*`);
+    try {
+      for (const c of actions) await orgService.retireEngagement(orgId, wsId, a.gaii, c).catch(() => {});
+      showToast?.((t('organisms.retired') || '{agent} retired from this workspace').replace('{agent}', a.display_name || a.name));
+      await refreshEngagements();
+    } finally { setRetireBusy(''); }
+  };
+  const refreshEngagements = () => orgService.getWorkspaceEngagements(orgId, wsId).then(setEngagements).catch(() => {});
   useEffect(() => {
     let cancelled = false;
-    const fetchIt = () => orgService.getWorkspaceParticipants(orgId, wsId).then(d => { if (!cancelled) setData(d); }).catch(() => {});
+    const fetchIt = () => {
+      orgService.getWorkspaceParticipants(orgId, wsId).then(d => { if (!cancelled) setData(d); }).catch(() => {});
+      orgService.getWorkspaceEngagements(orgId, wsId).then(e => { if (!cancelled) setEngagements(e); }).catch(() => {});
+    };
     fetchIt();
     const off = onLiveUpdate(['organisms'], fetchIt);
     return () => { cancelled = true; off(); };
@@ -83,24 +132,47 @@ export function ParticipantsPanel({ orgId, wsId, showToast }) {
               <div class="pj-part-agents">
                 ${contractAgents.map(a => {
                   const names = contractNamesOf(a);
-                  // An agent already working in THIS workspace (it appears among the viewer's own
-                  // agents in the participants data) gets a ✓ instead of Adopt buttons — offering
-                  // adoption for an agent that is already here is noise, and the task would be a
-                  // no-op re-provision anyway.
-                  const here = owners.some(o => o.isSelf && (o.agents || []).some(ag => ag.isOwn && ag.name === a.name));
-                  // One adopt action per advertised contract (a single unnamed one falls back to
-                  // the bare marker). The agent does the rest — join, provision, complete the task.
+                  // One control per advertised contract (a single unnamed one falls back to the bare
+                  // marker). The agent does the rest — join, provision, complete the task.
                   const actions = names.length ? names : [''];
+                  // "Legacy" = the agent appears in the record traces (it has worked here) but carries
+                  // no engagement record yet — it started before contracts were first-class. Offer one
+                  // agent-level Retire so it can be stopped; new adopts get precise per-contract chips.
+                  const traceHere = owners.some(o => o.isSelf && (o.agents || []).some(ag => ag.isOwn && ag.name === a.name));
+                  const hasAnyEng = actions.some(c => engFor(a, c));
+                  const legacyActive = traceHere && !hasAnyEng;
                   return html`
                     <span class="pj-part-agent own" key=${a.gaii} title=${a.gaii}>
                       ${'📜 '}${a.display_name || a.name}
-                      ${here ? html`<span class="badge badge-success pj-mini" title=${t('organisms.contractActiveHint') || 'This agent already works in this workspace'}>${'✓ '}${t('organisms.contractActive') || 'active here'}</span>`
-                        : actions.map(c => html`
-                        <button class="btn-outline btn-sm pj-adopt-btn" key=${c} disabled=${adoptBusy === `${a.gaii}:${c}`}
-                          title=${t('organisms.adoptHint') || 'Queue a task for this agent to adopt its contract into THIS workspace (it provisions the spaces itself)'}
-                          onClick=${() => adopt(a, c)}>
-                          ${adoptBusy === `${a.gaii}:${c}` ? '…' : `${t('organisms.adoptContract') || 'Adopt'}${c ? ` ${c}` : ''}`}
-                        </button>`)}
+                      ${legacyActive ? html`
+                        <span class="badge badge-success pj-mini" title=${t('organisms.contractActiveHint') || 'This agent already works in this workspace'}>${'✓ '}${t('organisms.contractActive') || 'active here'}</span>
+                        <button class="btn-ghost btn-sm pj-retire-btn" disabled=${retireBusy === `${a.gaii}:*`}
+                          title=${t('organisms.retireHint') || 'Stop this agent from working in THIS workspace — its loop skips it and the chip becomes “retired”. Its past work stays as history.'}
+                          onClick=${() => retireAll(a)}>${retireBusy === `${a.gaii}:*` ? '…' : (t('organisms.retire') || 'Retire')}</button>`
+                        : actions.map(c => {
+                          const eng = engFor(a, c);
+                          const label = c || (t('organisms.bareContract') || 'contract');
+                          const bkey = `${a.gaii}:${c}`;
+                          if (eng?.state === 'active') return html`
+                            <span class="pj-eng" key=${c}>
+                              <span class="badge badge-success pj-mini">${'✓ '}${label}</span>
+                              <button class="btn-ghost btn-sm pj-retire-btn" disabled=${retireBusy === bkey}
+                                title=${t('organisms.retireHint') || 'Stop this agent from working in THIS workspace — its loop skips it and the chip becomes “retired”. Its past work stays as history.'}
+                                onClick=${() => retire(a, c)}>${retireBusy === bkey ? '…' : (t('organisms.retire') || 'Retire')}</button>
+                            </span>`;
+                          if (eng?.state === 'retired') return html`
+                            <span class="pj-eng" key=${c}>
+                              <span class="badge badge-muted pj-mini" title=${(t('organisms.retiredUntilHint') || 'Retired — this agent served here until this date. Its past work stays visible.')}>${label}${' · '}${t('organisms.retiredTag') || 'retired'} ${fmtDay(eng.retiredAt)}</span>
+                              <button class="btn-outline btn-sm pj-adopt-btn" disabled=${adoptBusy === bkey}
+                                onClick=${() => adopt(a, c)}>${adoptBusy === bkey ? '…' : (t('organisms.reAdopt') || 'Re-adopt')}</button>
+                            </span>`;
+                          return html`
+                            <button class="btn-outline btn-sm pj-adopt-btn" key=${c} disabled=${adoptBusy === bkey}
+                              title=${t('organisms.adoptHint') || 'Queue a task for this agent to adopt its contract into THIS workspace (it provisions the spaces itself)'}
+                              onClick=${() => adopt(a, c)}>
+                              ${adoptBusy === bkey ? '…' : `${t('organisms.adoptContract') || 'Adopt'}${c ? ` ${c}` : ''}`}
+                            </button>`;
+                        })}
                     </span>`;
                 })}
               </div>

package/dist/public/views/profile/organisms/workspace-apps.js

@@ -0,0 +1,130 @@
+/**
+ * @file workspace-apps.js
+ * @description Workspace "Apps" strip — the apps pinned to this workspace (the `…meta.apps` binding
+ *   record), rendered as launch cards like the landing wall, plus a creator/admin picker to pin/unpin
+ *   published apps. Launching passes the workspace context in the URL FRAGMENT
+ *   (#aimeat-ws={orgId}/{wsId}) — the fragment survives the app-origin redirect chain, so the app
+ *   boots pinned to this workspace no matter which origin finally serves it. Pinning is
+ *   presentation/launch-context only: workspace DATA access stays enforced server-side per call.
+ * @structure WorkspaceApps
+ * @usage import { WorkspaceApps } from '/views/profile/organisms/workspace-apps.js';
+ * @version-history
+ *   v1.0.0 — 2026-07-02 — Initial: pinned-app cards + creator/admin pin/unpin picker.
+ */
+import { h } from 'preact';
+import { useState, useEffect } from 'preact/hooks';
+import htm from 'htm';
+const html = htm.bind(h);
+import { t } from '/js/i18n.js';
+import { openAppSandboxed } from '/js/app-sandbox.js';
+import { listApps } from '/js/services/apps.js';
+import { saveWorkspaceApps } from '/js/services/organisms.js';
+
+/** The launch URL for a pinned app, carrying the workspace context in the fragment. */
+function launchHref(orgId, wsId, b) {
+  return `/v1/apps/${encodeURIComponent(b.owner)}/${encodeURIComponent(b.filename)}?mode=inline`
+    + `#aimeat-ws=${encodeURIComponent(orgId)}/${encodeURIComponent(wsId)}`;
+}
+
+export function WorkspaceApps({ orgId, wsId, apps, canEdit, showToast, onChanged }) {
+  const bound = Array.isArray(apps) ? apps : [];
+  const [catalog, setCatalog] = useState(null);   // null = not loaded yet; [] = loaded (maybe empty)
+  const [showPicker, setShowPicker] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [q, setQ] = useState('');
+
+  // The public /v1/apps catalog resolves each binding to its card (name/description/icon) and feeds
+  // the picker. Loaded lazily — only when there is something to resolve or the picker is open.
+  useEffect(() => {
+    if (bound.length === 0 && !showPicker) return undefined;
+    let cancelled = false;
+    listApps().then(a => { if (!cancelled) setCatalog(a); }).catch(() => { if (!cancelled) setCatalog([]); });
+    return () => { cancelled = true; };
+  }, [bound.length, showPicker]);
+
+  // Members with no pins and no edit rights see nothing — no empty clutter on the overview.
+  if (bound.length === 0 && !canEdit) return null;
+
+  const sameApp = (a, b) => a.owner === b.owner && a.filename === b.filename;
+  const findApp = (b) => (catalog || []).find(a => sameApp(a, b)) || null;
+  const launch = (b) => {
+    const rec = findApp(b);
+    openAppSandboxed(launchHref(orgId, wsId, b), b.label || rec?.manifest?.name || b.filename);
+  };
+
+  const save = async (next) => {
+    setBusy(true);
+    try {
+      await saveWorkspaceApps(orgId, wsId, next.map(b => ({ owner: b.owner, filename: b.filename, ...(b.label ? { label: b.label } : {}) })));
+      showToast?.(t('organisms.apps.saved') || 'Workspace apps updated', 'success');
+      onChanged?.();
+    } catch {
+      showToast?.(t('organisms.apps.saveError') || 'Could not update apps', 'error');
+    } finally { setBusy(false); }
+  };
+  const togglePin = (a) => {
+    const has = bound.some(b => sameApp(a, b));
+    save(has ? bound.filter(b => !sameApp(a, b)) : [...bound, { owner: a.owner, filename: a.filename }]);
+  };
+
+  const renderCard = (b) => {
+    const rec = findApp(b);
+    const m = rec?.manifest || {};
+    const name = b.label || m.name || b.filename;
+    const desc = (m.description || '').length > 110 ? m.description.slice(0, 110) + '…' : (m.description || '');
+    return html`
+      <div key=${b.owner + '/' + b.filename} class="pj-app-card" role="button" tabindex="0"
+        title=${t('organisms.apps.open') || 'Open'}
+        onClick=${() => launch(b)} onKeyDown=${(e) => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); launch(b); } }}>
+        <div class="pj-app-name">${m.icon ? m.icon + ' ' : ''}${name}</div>
+        ${desc ? html`<div class="pj-app-desc">${desc}</div>` : null}
+        <div class="pj-app-meta">
+          ${catalog !== null && !rec ? html`<span class="pj-app-missing">${t('organisms.apps.missing') || 'Not in the catalog (removed?)'}</span>` : (m.authorDisplay || b.owner)}
+        </div>
+      </div>`;
+  };
+
+  // Picker rows: pinned apps first, then the rest alphabetically; a search filters by name/owner.
+  const ql = q.trim().toLowerCase();
+  const pickerRows = (catalog || [])
+    .filter(a => !ql || [a.manifest?.name, a.manifest?.description, a.owner, a.filename].some(v => (v || '').toLowerCase().includes(ql)))
+    .sort((a, x) => {
+      const pa = bound.some(b => sameApp(a, b)) ? 0 : 1;
+      const px = bound.some(b => sameApp(x, b)) ? 0 : 1;
+      return pa !== px ? pa - px : String(a.manifest?.name || a.filename).localeCompare(String(x.manifest?.name || x.filename));
+    });
+
+  return html`
+    <div class="pj-apps-strip">
+      <div class="pj-apps-head">
+        <span class="pj-apps-title">${t('organisms.apps.title') || 'Apps'}</span>
+        <span class="pj-apps-hint">${t('organisms.apps.hint') || 'Pinned to this workspace — they open with it as context.'}</span>
+        ${canEdit ? html`
+          <button class="btn-outline btn-sm ${showPicker ? 'pj-org-btn-active' : ''}" onClick=${() => setShowPicker(s => !s)}>
+            ${showPicker ? (t('organisms.apps.done') || 'Done') : ('⚙ ' + (t('organisms.apps.manage') || 'Manage'))}
+          </button>` : null}
+      </div>
+      ${bound.length > 0
+        ? html`<div class="pj-apps-grid">${bound.map(renderCard)}</div>`
+        : html`<div class="pj-apps-empty">${(t('organisms.apps.none') || 'No apps pinned yet.')}${canEdit ? ' ' + (t('organisms.apps.noneHint') || 'Pin a published app so members can launch it from here.') : ''}</div>`}
+      ${showPicker ? html`
+        <div class="pj-apps-picker">
+          <div class="section-desc">${t('organisms.apps.pickerDesc') || 'Pick published apps to show in this workspace. Pinning only adds a launch card — data access follows workspace access.'}</div>
+          <input type="text" class="input-field input-sm" placeholder=${t('organisms.apps.search') || 'Search apps…'}
+            value=${q} onInput=${e => setQ(e.target.value)} />
+          ${catalog === null ? html`<div class="pj-apps-empty">…</div>`
+            : pickerRows.length === 0 ? html`<div class="pj-apps-empty">${ql ? (t('organisms.apps.noMatch') || 'No apps match.') : (t('organisms.apps.catalogEmpty') || 'No published apps on this node yet.')}</div>`
+            : pickerRows.map(a => {
+                const pinned = bound.some(b => sameApp(a, b));
+                return html`
+                  <div key=${a.owner + '/' + a.filename} class="pj-apps-picker-row">
+                    <span class="pj-apps-picker-name">${a.manifest?.icon ? a.manifest.icon + ' ' : ''}${a.manifest?.name || a.filename}</span>
+                    <span class="pj-apps-picker-owner">${a.manifest?.authorDisplay || a.owner}</span>
+                    <button class="${pinned ? 'btn-danger btn-sm' : 'btn-outline btn-sm'}" disabled=${busy} onClick=${() => togglePin(a)}>
+                      ${pinned ? (t('organisms.apps.unpin') || 'Unpin') : (t('organisms.apps.pin') || 'Pin')}
+                    </button>
+                  </div>`;
+              })}
+        </div>` : null}
+    </div>`;
+}

package/dist/public/views/profile/organisms/workspace.js

@@ -32,6 +32,8 @@
  *     (ColorPicker + TAG_PALETTE → theme tokens) lets sections, documents and records be tagged with
  *     a color (left-rail accent). Section colors persist on the section object; per-item colors in a
  *     parallel meta.colors map (getAllColors/saveColors). Colors are optional and default to none.
+ *   v1.8.0 — 2026-07-02 — Apps strip on the Overview: the apps pinned to this workspace (meta.apps
+ *     binding) render as launch cards (WorkspaceApps), with a creator/admin pin/unpin picker.
  */
 import { h } from 'preact';
 import { useState, useEffect, useCallback, useRef } from 'preact/hooks';
@@ -60,6 +62,7 @@ import { WorkspaceComments } from '/views/profile/organisms/workspace-comments.j
 import { ActivityPanel } from '/views/profile/organisms/activity-panel.js';
 import { ParticipantsPanel } from '/views/profile/organisms/participants-panel.js';
 import { SourcesPanel } from '/views/profile/organisms/sources-panel.js';
+import { WorkspaceApps } from '/views/profile/organisms/workspace-apps.js';
 
 /* ───────────────── Organism workspace (manifest-driven) ─────────────────
  * Any organism can have a governed workspace. If it has no manifest yet, offer
@@ -1375,6 +1378,8 @@ export function Workspace({ org, wsId, showToast, onBack, onBackToList, initialS
                 <span class="pj-ov-event-time">${relTime(e.at)}</span>
               </button>`)}
           </div>` : null}
+        <${WorkspaceApps} orgId=${orgId} wsId=${wsId} apps=${ws.apps || []} canEdit=${wsCanEdit}
+          showToast=${showToast} onChanged=${load} />
         ${allTypes.map(renderOvSection)}
         ${allTypes.length === 0 ? html`<${EmptyState} text=${t('organisms.noneYet') || 'none yet'} />` : null}
       </div>`;

package/dist/public/views/profile/organisms-tab.js

@@ -410,7 +410,7 @@ export default function OrganismsTab({ session, showToast, onStats }) {
         <div class="pj-org-stats">
           ${isMine && wsCounts[org.id] !== undefined ? html`
             <span class="pj-org-stat" title=${t('organisms.tabWorkspaces') || 'Workspaces'}>${'📁'} ${wsCounts[org.id]}</span>` : null}
-          <span class="pj-org-stat" title=${t('organisms.members') || 'Members'}>${'👥'} ${(org.members || []).length}</span>
+          <span class="pj-org-stat" title=${t('organisms.members') || 'Members'}>${'👥'} ${org.member_count ?? (org.members || []).length}</span>
           <span class="pj-org-stat" title=${t('organisms.attachedAgents') || 'Attached agents'}>${'🤖'} ${(org.agentGaiis || []).length}</span>
           ${org.createdAt ? html`<span class="pj-org-stat pj-org-date" title=${t('organisms.createdAt') || 'Created'}>${fmtDate(org.createdAt)}</span>` : null}
         </div>

package/dist/public/views/secretary.js

@@ -11,6 +11,9 @@
  * @structure SECRETARY_ICON · SecretaryView (default) — state, effects, handlers, layout (cards in ./secretary/cards.js + ./secretary/cards-reach.js + dashboard chrome in ./secretary/dashboard.js)
  * @usage routed at /v1/secretary by spa.html (+ portal.ts spaRoutes).
  * @version-history
+ *   v0.26.0 — 2026-07-01 — Opt-in feature: the Secretary is now gated on AIMEAT_SECRETARY_ENABLED (off by
+ *     default). The header nav link is hidden and this view redirects to /v1/profile when the node has it
+ *     disabled (flag read from /v1/site/header-nav `features.secretary`).
  *   v0.25.0 — 2026-07-01 — Light-vs-heavy seam: setup no longer cheap-authors content (that hallucinated).
  *     applyResult now CREATES the workspace structure and then proposes grounded Work Briefs (POST
  *     /v1/secretary/brief) the user hands to a Builder (a connected big AI via the appdev MCP tools). Drops
@@ -131,6 +134,16 @@ export const SECRETARY_ICON = html`
 
 export default function SecretaryView() {
   useViewCSS('/css/views/secretary.css');
+  // Secretary is opt-in per node (AIMEAT_SECRETARY_ENABLED). If it's disabled but this view is reached
+  // via a direct URL/bookmark (no nav link is rendered when off), bounce back to the profile.
+  useEffect(() => {
+    let cancelled = false;
+    fetch('/v1/site/header-nav')
+      .then(r => r.json())
+      .then(d => { if (!cancelled && d?.ok && d.data?.features && d.data.features.secretary === false) window.location.replace('/v1/profile'); })
+      .catch(() => {});
+    return () => { cancelled = true; };
+  }, []);
   const { showToast, ToastContainer } = useToast();
   const [secretary, setSecretary] = useState(undefined); // undefined=loading, null=not provisioned
   const [hasOpenRouterKey, setHasOpenRouterKey] = useState(false); // owner has an OpenRouter key configured

package/dist/scripts/archive-stale-versions.d.ts

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+/**
+ * @file archive-stale-versions.ts
+ * @description One-time, REVERSIBLE cleanup of accumulated workspace-record version bloat. Publishing a
+ *   workspace record used to append a new `.version.N` on every publish with no change-guard, so a
+ *   contract agent that re-published the same draft each poll cycle piled up dozens of byte-identical
+ *   versions per record (concentrated in request queues: mail/research/moodboard/image_requests). The
+ *   publish path is now guarded (see mcp/workspaces.ts + routes/organisms.ts), so this stops GROWING;
+ *   this script cleans up what already accrued.
+ *
+ *   It does NOT delete: it flags redundant version rows `archived = 1` (the same reversible soft-archive
+ *   the organism archive uses) under a shared `archivedRoot` so the whole batch can be restored with
+ *   --unarchive. A version row is redundant when it is byte-identical to the version immediately before
+ *   it (by N) — a pure republish that recorded no real change. Every genuine state transition, the
+ *   first version, and the highest-numbered version (so publish's next-version scan is unaffected) are
+ *   ALWAYS kept. Document/record spaces that version legitimately have no consecutive duplicates, so
+ *   nothing there is touched.
+ *
+ *   Read-only by default. `--from-export=<json>` analyses an exported memory dump with no DB at all.
+ *   Detects the storage provider from .env for the live scan / apply.
+ * @usage
+ *   pnpm versions:stats                              # live dry-run: what WOULD be archived (per namespace)
+ *   pnpm versions:stats -- --from-export=dump.json   # analyse an export JSON, no DB touched
+ *   pnpm versions:archive                            # apply the archive (asks to confirm)
+ *   pnpm versions:archive -- --force                 # apply without the prompt
+ *   pnpm versions:stats -- --unarchive               # preview restore; add --apply to restore
+ *   pnpm versions:archive -- --unarchive --force     # restore the whole archived batch
+ * @version-history
+ *   v1.0.0 -- 2026-07-01 -- Initial: reversible consecutive-identical version dedupe (sqlite + mongodb),
+ *     plus a DB-free --from-export analyser.
+ */
+export {};
+//# sourceMappingURL=archive-stale-versions.d.ts.map

package/dist/scripts/archive-stale-versions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-stale-versions.d.ts","sourceRoot":"","sources":["../../scripts/archive-stale-versions.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG"}