aimeat 1.9.5 → 1.12.0

package/README.md

@@ -26,12 +26,12 @@ An AI agent connects to an AIMEAT node and reaches full operational readiness au
 
 [![AIMEAT Agent Hello Integration](https://img.youtube.com/vi/ncBX9BaoAWM/maxresdefault.jpg)](https://youtu.be/ncBX9BaoAWM)
 
-`0:45` Device auth with automatic polling (RFC 8628) | `2:10` Skill bundle download + boot sequence | `3:40` 11-step Hello Integration | `4:30` Test task proposed, executed, completed | `5:20` Commands + config registered, agent operational
+`0:45` Device auth with automatic polling (RFC 8628) | `2:10` Skill bundle download + boot sequence | `3:40` Hello Integration | `4:30` Test task proposed, executed, completed | `5:20` Commands + config registered, agent operational
 
 <p align="center">
-  <img src="assets/screenshots/agent_hello_integration_finished.png" alt="Agent Hello Integration completed -- 11/11 steps passed, capabilities reported, commands registered" width="70%" />
+  <img src="assets/screenshots/agent_hello_integration_finished.png" alt="Agent Hello Integration completed -- all required steps passed, capabilities reported, commands registered" width="70%" />
 </p>
-<p align="center"><em>After Hello Integration: agent detail view showing connection status, platform, skill bundle version, readiness (all 11 steps passed), identity, and delivery log.</em></p>
+<p align="center"><em>After Hello Integration: agent detail view showing connection status, platform, skill bundle version, readiness (all required steps passed), identity, and delivery log. Since 1.10.0 the system also verifies that the agent has published its slash command catalogue and runtime config before declaring it complete.</em></p>
 
 ---
 
@@ -132,7 +132,26 @@ On top of the protocol sits the application layer. Apps are self-contained HTML
 
 <img src="assets/screenshots/profile-agents.png" alt="Agent connection prompt" width="600" />
 
-From your profile, copy the connection prompt and give it to any AI agent. The agent calls one endpoint, you approve, and it's connected with its own identity and scoped permissions. Claude Pro, ChatGPT Plus, and other MCP-capable AIs connect directly as MCP clients. OpenClaw, Hermes, Claude Code, and Cursor all work. Three scope presets (readonly, standard, full) control what each agent can access.
+There are two ways to connect:
+
+**1. `aimeat connect` CLI** (recommended, added in 1.10.0). Any runtime that can run a shell command can attach to a node in seconds:
+
+```bash
+npx aimeat connect --url https://your-node --owner your-handle [--agent name]
+# you approve from your profile -> Agents tab
+# the CLI stores the token, downloads the runtime-specific skill bundle,
+# and prints a paste-ready Hello Integration instruction for your agent
+```
+
+For MCP-capable runtimes (Claude Desktop, MCP-aware IDEs), run `aimeat connect serve` afterwards to attach the AIMEAT toolset over stdio. For CLI-only runtimes that cannot do stdio, every MCP tool is also reachable via `aimeat connect call <tool-name> --json '<input>'`.
+
+**Multi-agent connector.** A single `aimeat connect serve` process can serve multiple agents at once. Add more agents with `aimeat connect add --agent <name> --url ... --owner ...`; list them with `aimeat connect list`; remove with `aimeat connect remove <name>`. In multi-agent mode, MCP tools accept an optional `agent_name` parameter; when omitted, the agent marked `primary: true` in its per-agent config is used. This is the path for connecting one interactive agent (Claude Code) plus several **task-runner** agents (e.g. CrewAI crews) from one connector process -- see [docs/integrations/crewai.md](docs/integrations/crewai.md) for the task-runner pattern.
+
+**Agent modes.** Every agent declares a mode at registration: `autonomous` (continuous), `interactive` (chat/IDE, default), `task-runner` (triggered, runs one task, exits), or `coordinator` (orchestrates others). Mode picks the Hello Integration flow -- `task-runner` agents get a reduced 5-step onboarding instead of the full 13 because they have no interactive command surface. Combine modes with owner-managed **tags** (`crew:*`, `source:*`, `role:*`, `project:*`) for filtering and grouping in the profile UI. Details: [docs/coding-guidelines/agent-tags.md](docs/coding-guidelines/agent-tags.md).
+
+**2. Copy the prompt from your profile.** If you do not want to install a CLI, your profile -> Agents tab still produces a paste-ready prompt with the device-auth flow baked in -- give it to any AI agent, the agent calls one endpoint, you approve, and it is connected with its own identity and scoped permissions.
+
+Claude Pro, ChatGPT Plus, and other MCP-capable AIs connect directly as MCP clients. OpenClaw, Hermes, Claude Code, and Cursor all work. Three scope presets (readonly, standard, full) control what each agent can access.
 
 ### Build apps with AI
 
@@ -231,6 +250,19 @@ On the left: Telegram chat with the agent. The user asks it to build things ("bu
 
 The app prompts the agent with the current world state so it can make informed decisions about what to build and where. You edit the world manually (drag objects, place shapes from the toolbar) while the agent builds alongside you. Everything syncs through AIMEAT memory.
 
+### Example: Comicland, an AI comic community (full app, built from VS Code)
+
+Comicland is a community for AI-generated comics built end-to-end from VS Code with Claude Code talking directly to a live AIMEAT node. No CI, no separate deploy step -- each iteration is `aimeat_app_publish` over MCP and the new version is live on the node within seconds. The whole 5-layer AIMEAT stack (extension, cortex, app) was scaffolded by AI, then evolved through dozens of feature passes in the same workflow.
+
+<p align="center">
+  <img src="assets/screenshots/comic-land-series-view.png" alt="Comicland series detail with episodes, follow, tip, and owner-only publish/unpublish controls" width="48%" />
+  <img src="assets/screenshots/comic-land-creation-pipeline.png" alt="Comicland creation pipeline: AI interview -> script JSON -> per-page image prompts -> overlay editor -> publish" width="48%" />
+</p>
+
+What's in there: a prompt-driven creation pipeline (AI interview produces a script, the app generates per-page Nano-Banana-style image prompts with character/environment references, the user pastes the resulting images back); a 3-step episode wizard with page or panel images; a drag-and-drop speech-bubble overlay editor with language-keyed translations; multi-tenant reading where any logged-in user can read another author's published series from their own GHII namespace; characters and environments with multiple reference images and a chosen showcase; follow/tip/comment social actions; per-series public/private toggle and per-episode draft/published toggle so authors can prepare quietly and roll out when ready; full FI/EN i18n. All of it stored in AIMEAT memory + storage with proper public/private visibility, no Comicland-specific backend code beyond one sandboxed extension with eleven router-actions.
+
+The same loop works for any sufficiently rich app: open a folder, point Claude Code at the node, and iterate. The MCP tools (`aimeat_app_publish`, `aimeat_extension_install`, `aimeat_cortex_install`, `aimeat_memory_*`, `aimeat_storage_*`) cover the entire publish/install/inspect cycle.
+
 ### Calibrate prompts
 
 <img src="assets/screenshots/profile-generator.png" alt="Generator and calibrator" width="600" />
@@ -276,9 +308,13 @@ Each node runs independently with its own identity and portal. Operators customi
 Requires Node.js 24+. Runs without cloning the repo:
 
 ```bash
+# Run a node
 npx aimeat init     # interactive setup, generates .env
 npx aimeat start    # start the server
 npx aimeat seed     # seed example packages (in another terminal, server must be running)
+
+# Or just connect an agent to someone else's node
+npx aimeat connect --url https://your-node --owner your-handle
 ```
 
 ### From source
@@ -320,21 +356,25 @@ If the AI reads the docs and explains the protocol, everything works. Admin dash
 
 The `aimeat/` directory contains a full reference implementation in TypeScript (Express 5.2, Node 24). It implements the entire RFC and adds production features: GHII human identities, TOTP 2FA, V8 extensions, package marketplace, push notifications, WebRTC, and a comprehensive admin UI.
 
-Three storage backends: in-memory (fast dev), SQLite (personal nodes), MongoDB (production).
+Two storage backends: SQLite (personal nodes, local dev; can run `:memory:` for true in-RAM speed) and MongoDB (production). The legacy in-memory backend is deprecated -- SQLite `:memory:` covers the same fast-iteration role using the actual production code path.
 
 See the [Implementation Guide v3.0](docs/AIMEAT-IO-Implementation-Guide-v3.0.md) for full details.
 
 ### Testing
 
 ```bash
-pnpm test:e2e               # fastest (memory backend)
-pnpm test:e2e:sqlite
-pnpm test:e2e:mongodb
-pnpm test:playwright        # browser tests
+pnpm test:e2e:sqlite        # fast iteration default
+pnpm test:e2e:mongodb       # most realistic; run before a PR
+pnpm test:playwright:sqlite # browser tests, scoped
 pnpm test                   # unit tests
 pnpm typecheck && pnpm lint
+
+# Run a single E2E suite (preferred during iteration -- much faster than the full sweep)
+cd aimeat && pnpm exec node --env-file=.env.test.sqlite --import tsx test/run-e2e-ci.ts --test=<suite>
 ```
 
+> The legacy `pnpm test:e2e` (in-memory backend) is deprecated and produces stale failures. Use the SQLite or MongoDB commands instead.
+
 ---
 
 ## Documentation
@@ -367,7 +407,8 @@ See [CONTRIBUTING.md](CONTRIBUTING.md). Before opening a PR:
 ```bash
 pnpm typecheck
 pnpm lint
-pnpm test:e2e
+pnpm test:e2e:sqlite
+pnpm test:e2e:mongodb
 ```
 
 ## License

package/dist/.env.example

@@ -35,8 +35,39 @@ AIMEAT_PORT=40050
 # Startup logs will show the anonymous prompt URL and share prompt URL.
 # AIMEAT_ANONYMOUS=false
 # CORS: comma-separated list of allowed origins, or * for all (default: *)
+# By architecture, AIMEAT accepts requests from any origin -- the platform
+# is Bearer-token-only (OAuth 2.1), no cookies, so CORS is not the protection
+# layer. Apps published on the network attach from arbitrary browser origins.
+# Set this only if you specifically want to restrict which origins can attach.
 # AIMEAT_CORS_ALLOWED_ORIGINS=*
 # AIMEAT_CORS_ALLOWED_ORIGINS=https://portal.aimeat.fi,https://my-app.example.com
+
+# ── Operator info (REQUIRED for /v1/privacy page) ──────────────
+# These fields identify the operator of THIS node as the GDPR data controller.
+# Every AIMEAT node must fill them in -- otherwise /v1/privacy returns 503
+# "Privacy policy not configured" so the operator is forced to address it
+# before going public. Do NOT ship a deployment that names someone else.
+#
+# Privacy policy template substitution: these env vars feed {{placeholder}}
+# tokens in aimeat/public/privacy.html and privacy.fi.html at render time.
+#
+# REQUIRED:
+# AIMEAT_OPERATOR_NAME="Your Name or Company Ltd"
+# AIMEAT_OPERATOR_ADDRESS="Street, Postcode City, Country"
+# AIMEAT_OPERATOR_COUNTRY="Finland"
+# AIMEAT_OPERATOR_EMAIL="privacy@example.com"
+# AIMEAT_OPERATOR_HOSTING_NAME="Scaleway SAS"
+# AIMEAT_OPERATOR_HOSTING_LOCATION="France (EU/EEA)"
+# AIMEAT_OPERATOR_SUPERVISORY_NAME="Office of the Data Protection Ombudsman"
+# AIMEAT_OPERATOR_SUPERVISORY_URL="https://tietosuoja.fi"
+# AIMEAT_OPERATOR_EFFECTIVE_DATE="2026-05-29"
+#
+# OPTIONAL:
+# AIMEAT_OPERATOR_TYPE="natural_person"   # natural_person | company | organisation | association
+# AIMEAT_OPERATOR_SECURITY_EMAIL=""       # defaults to AIMEAT_OPERATOR_EMAIL
+# AIMEAT_OPERATOR_HOSTING_URL=""          # hyperlink to your hosting provider
+# AIMEAT_OPERATOR_POLICY_VERSION="1.0"
+
 # ── Security Limits ────────────────────────────────────────────
 # AIMEAT_LOGIN_RATE_LIMIT_MAX=15              # Max login attempts per window (default: 15)
 # AIMEAT_LOGIN_RATE_LIMIT_WINDOW_MS=60000     # Login rate limit window in ms (default: 60s)

package/dist/locales/en.json

@@ -12,7 +12,9 @@
     "noData": "No data available",
     "id": "ID",
     "name": "Name",
-    "add": "Add"
+    "add": "Add",
+    "yes": "Yes",
+    "no": "No"
   },
   "nav": {
     "try": "Try it",
@@ -365,6 +367,23 @@
         "denied": "Request denied",
         "approveError": "Failed to approve agent"
       },
+      "mode": {
+        "autonomous": "Autonomous",
+        "interactive": "Interactive",
+        "task-runner": "Task runner",
+        "coordinator": "Coordinator",
+        "tooltip": "Operational mode — affects how the agent is onboarded and how it consumes work."
+      },
+      "filter": {
+        "byTag": "Filter by tag:",
+        "groupBy": "Group by:",
+        "groupByNone": "No grouping",
+        "groupByTag": "Tag",
+        "groupByMode": "Mode",
+        "clear": "Clear",
+        "untagged": "Untagged",
+        "noMatches": "No agents match the current filter."
+      },
       "approval": {
         "credentials_ready_title": "Agent approved",
         "credentials_ready_desc": "Copy the credentials below and paste them to your agent.",
@@ -646,6 +665,12 @@
         },
         "integration": {
           "checklistTitle": "Hello Integration",
+          "postOnboardingSetup": "Post-Onboarding Setup",
+          "commandsRegistered": "Commands registered",
+          "configPublished": "Config published",
+          "sharedTagsInUse": "Shared tags in use",
+          "knowledgePackages": "Knowledge packages",
+          "notApplicable": "Not applicable",
           "progress": "Progress",
           "rerun": "Re-run Hello Integration",
           "rerunStarted": "Hello Integration re-started",
@@ -2618,6 +2643,34 @@
     "existingMerge": "Merge (keep existing, add new)",
     "existingOverwrite": "Overwrite",
     "existingCancel": "Cancel",
+    "operatorTitle": "Operator info (privacy policy)",
+    "operatorIntro": "AIMEAT renders a privacy policy at /v1/privacy with the operator's identity. This is required by GDPR for any node serving users. The next prompts collect the legal fields. If you skip them, /v1/privacy will return HTTP 503 until you fill them in via AIMEAT_OPERATOR_* env vars.",
+    "operatorPersonalAsk": "This is a personal node — set up privacy policy details now? (recommended if anyone else might use this node)",
+    "operatorName": "Legal name (the controller)",
+    "operatorNameRequired": "Operator name is required",
+    "operatorType": "Operator type",
+    "operatorTypeNaturalPerson": "Natural person (individual)",
+    "operatorTypeCompany": "Company",
+    "operatorTypeOrganisation": "Organisation",
+    "operatorTypeAssociation": "Association",
+    "operatorAddress": "Postal address (required by GDPR for the controller)",
+    "operatorAddressRequired": "Postal address is required",
+    "operatorCountry": "Country of operation",
+    "operatorCountryRequired": "Country is required",
+    "operatorEmail": "Privacy contact email",
+    "operatorEmailRequired": "Privacy email is required",
+    "operatorEmailInvalid": "Must be a valid email address",
+    "operatorSecurityEmail": "Security contact email (leave empty to reuse the privacy email)",
+    "operatorHostingName": "Hosting provider name",
+    "operatorHostingNameRequired": "Hosting provider name is required",
+    "operatorHostingUrl": "Hosting provider URL (optional, for the privacy-page link)",
+    "operatorHostingLocation": "Hosting location (e.g. France (EU/EEA))",
+    "operatorHostingLocationRequired": "Hosting location is required",
+    "operatorSupervisoryName": "Data protection supervisory authority (in your jurisdiction)",
+    "operatorSupervisoryNameRequired": "Supervisory authority name is required",
+    "operatorSupervisoryUrl": "Supervisory authority URL",
+    "operatorSupervisoryUrlRequired": "Supervisory authority URL is required",
+    "operatorEffectiveDate": "Privacy policy effective date (YYYY-MM-DD)",
     "summaryTitle": "Configuration Summary",
     "summaryChanged": "Changed from default:",
     "summaryDefault": "All other settings use defaults.",
@@ -2791,7 +2844,7 @@
     "usernamePlaceholder": "Username",
     "passwordPlaceholder": "Password (min 4 chars)",
     "displayNamePlaceholder": "Display Name (optional, for new accounts)",
-    "signInBtn": "Sign In",
+    "signInBtn": "Sign In / Register",
     "cancelBtn": "Cancel",
     "working": "Working...",
     "errUserShort": "Username must be at least 3 characters",
@@ -5426,6 +5479,8 @@
       "report_telemetry": "Report Telemetry",
       "accept_test_task": "Accept Test Task",
       "complete_test_task": "Complete Test Task",
+      "publish_commands": "Publish Slash Commands",
+      "publish_config": "Publish Runtime Config",
       "declare_services": "Declare Services"
     },
     "stepDescriptions": {
@@ -5439,6 +5494,8 @@
       "report_telemetry": "At least one telemetry event with non-zero data",
       "accept_test_task": "Agent proposes todos for the test task",
       "complete_test_task": "Agent executes and completes the test task",
+      "publish_commands": "agents.{name}.commands memory has a non-empty array of { name, description, category }",
+      "publish_config": "At least one agents.config.{name}.* memory entry exists describing this runtime",
       "declare_services": "Agent declares offered services (optional)"
     },
     "errors": {

package/dist/locales/fi.json

@@ -12,7 +12,9 @@
     "noData": "Ei tietoja saatavilla",
     "id": "ID",
     "name": "Nimi",
-    "add": "Lisää"
+    "add": "Lisää",
+    "yes": "Kyllä",
+    "no": "Ei"
   },
   "nav": {
     "try": "Kokeile",
@@ -365,6 +367,23 @@
         "denied": "Pyyntö hylätty",
         "approveError": "Agentin hyväksyminen epäonnistui"
       },
+      "mode": {
+        "autonomous": "Autonominen",
+        "interactive": "Interaktiivinen",
+        "task-runner": "Tehtäväajuri",
+        "coordinator": "Koordinaattori",
+        "tooltip": "Toimintatila — vaikuttaa siihen, miten agentti läpäisee Hello Integrationin ja kuluttaa työtä."
+      },
+      "filter": {
+        "byTag": "Suodata tagilla:",
+        "groupBy": "Ryhmittele:",
+        "groupByNone": "Ei ryhmittelyä",
+        "groupByTag": "Tagin mukaan",
+        "groupByMode": "Tilan mukaan",
+        "clear": "Tyhjennä",
+        "untagged": "Ei tageja",
+        "noMatches": "Yksikään agentti ei vastaa nykyistä suodatinta."
+      },
       "approval": {
         "credentials_ready_title": "Agentti hyväksytty",
         "credentials_ready_desc": "Kopioi alla olevat tunnistetiedot ja liitä ne agentillesi.",
@@ -646,6 +665,12 @@
         },
         "integration": {
           "checklistTitle": "Hello-integraatio",
+          "postOnboardingSetup": "Perehdytyksen jälkeiset toimet",
+          "commandsRegistered": "Komennot rekisteröity",
+          "configPublished": "Konfiguraatio julkaistu",
+          "sharedTagsInUse": "Jaetut tagit käytössä",
+          "knowledgePackages": "Tietopaketit",
+          "notApplicable": "Ei sovellu",
           "progress": "Edistyminen",
           "rerun": "Suorita Hello-integraatio uudelleen",
           "rerunStarted": "Hello-integraatio aloitettu uudelleen",
@@ -2618,6 +2643,34 @@
     "existingMerge": "Yhdistä (säilytä olemassaolevat, lisää uudet)",
     "existingOverwrite": "Korvaa",
     "existingCancel": "Peruuta",
+    "operatorTitle": "Ylläpitäjän tiedot (tietosuojaseloste)",
+    "operatorIntro": "AIMEAT renderöi tietosuojaselosteen osoitteessa /v1/privacy ylläpitäjän tiedoilla. GDPR vaatii tämän kaikilta käyttäjiä palvelevilta solmuilta. Seuraavat kysymykset keräävät lakisääteiset kentät. Jos ohitat ne, /v1/privacy palauttaa HTTP 503:n kunnes täytät ne AIMEAT_OPERATOR_*-ympäristömuuttujien kautta.",
+    "operatorPersonalAsk": "Tämä on henkilökohtainen solmu — määritä tietosuojaselosteen tiedot nyt? (suositeltavaa jos joku muu saattaa käyttää tätä solmua)",
+    "operatorName": "Virallinen nimi (rekisterinpitäjä)",
+    "operatorNameRequired": "Ylläpitäjän nimi on pakollinen",
+    "operatorType": "Ylläpitäjän tyyppi",
+    "operatorTypeNaturalPerson": "Luonnollinen henkilö (yksityishenkilö)",
+    "operatorTypeCompany": "Yritys",
+    "operatorTypeOrganisation": "Organisaatio",
+    "operatorTypeAssociation": "Yhdistys",
+    "operatorAddress": "Postiosoite (GDPR edellyttää rekisterinpitäjältä)",
+    "operatorAddressRequired": "Postiosoite on pakollinen",
+    "operatorCountry": "Toimintamaa",
+    "operatorCountryRequired": "Maa on pakollinen",
+    "operatorEmail": "Tietosuojayhteyssähköposti",
+    "operatorEmailRequired": "Tietosuojasähköposti on pakollinen",
+    "operatorEmailInvalid": "Sähköpostin pitää olla kelvollinen",
+    "operatorSecurityEmail": "Tietoturvasähköposti (tyhjä = sama kuin tietosuojasähköposti)",
+    "operatorHostingName": "Hosting-palveluntarjoaja",
+    "operatorHostingNameRequired": "Hosting-palveluntarjoajan nimi on pakollinen",
+    "operatorHostingUrl": "Hosting-palveluntarjoajan URL (valinnainen, linkkiä varten)",
+    "operatorHostingLocation": "Hosting-sijainti (esim. Ranska (EU/ETA))",
+    "operatorHostingLocationRequired": "Hosting-sijainti on pakollinen",
+    "operatorSupervisoryName": "Tietosuojaviranomainen (omalla lainkäyttöalueellasi)",
+    "operatorSupervisoryNameRequired": "Tietosuojaviranomaisen nimi on pakollinen",
+    "operatorSupervisoryUrl": "Tietosuojaviranomaisen URL",
+    "operatorSupervisoryUrlRequired": "Tietosuojaviranomaisen URL on pakollinen",
+    "operatorEffectiveDate": "Tietosuojaselosteen voimaantulopäivä (YYYY-MM-DD)",
     "summaryTitle": "Asetusten yhteenveto",
     "summaryChanged": "Muutettu oletuksesta:",
     "summaryDefault": "Kaikki muut asetukset käyttävät oletuksia.",
@@ -2791,7 +2844,7 @@
     "usernamePlaceholder": "Käyttäjänimi",
     "passwordPlaceholder": "Salasana (vähintään 4 merkkiä)",
     "displayNamePlaceholder": "Näyttönimi (valinnainen, uusille tileille)",
-    "signInBtn": "Kirjaudu",
+    "signInBtn": "Kirjaudu / Rekisteröidy",
     "cancelBtn": "Peruuta",
     "working": "Käsitellään...",
     "errUserShort": "Käyttäjänimen tulee olla vähintään 3 merkkiä",
@@ -5426,6 +5479,8 @@
       "report_telemetry": "Raportoi telemetria",
       "accept_test_task": "Hyväksy testitehtävä",
       "complete_test_task": "Suorita testitehtävä",
+      "publish_commands": "Julkaise slash-komennot",
+      "publish_config": "Julkaise runtime-konfiguraatio",
       "declare_services": "Ilmoita palvelut"
     },
     "stepDescriptions": {
@@ -5439,6 +5494,8 @@
       "report_telemetry": "Vähintään yksi telemetriatapahtuma nollasta poikkeavalla datalla",
       "accept_test_task": "Agentti ehdottaa todoja testitehtävälle",
       "complete_test_task": "Agentti suorittaa ja viimeistelee testitehtävän",
+      "publish_commands": "agents.{name}.commands -muistissa on epätyhjä { name, description, category } -taulu",
+      "publish_config": "Vähintään yksi agents.config.{name}.* -muistitietue kuvaa tätä runtimea",
       "declare_services": "Agentti ilmoittaa tarjoamansa palvelut (valinnainen)"
     },
     "errors": {