aimeat 2.0.0 → 2.1.0

package/dist/public/css/views/profile.css

@@ -4,6 +4,13 @@
  *   wallet, memory, agents, extensions, packages, knowledge, generator, and
  *   edit panels. Consumes theme.css tokens so it flips with dark/light mode.
  * @version-history
+ *   v2.16.2 — 2026-07-21 — App-shell scroll model (theme.css v1.24.0): .pf-sidebar sticks to top:0 of
+ *     the new .page-content scroll region (was top:var(--nav-height) against the window) and caps at
+ *     calc(100dvh − nav-height) so its nav list scrolls without a header-height gap.
+ *   v2.16.1 — 2026-07-20 — Mobile home-dashboard overflow fix: .pf-home-card (and the spend/quota
+ *     tiles, chips, and long app-name row) get min-width:0 so unbreakable inner content no longer
+ *     forces a card — and the whole home grid — wider than a narrow phone (content ran off the right
+ *     edge, clipped by body{overflow-x:hidden}). .pf-usage-head wraps a very long quota value.
  *   v2.16.0 — 2026-07-19 — AppDev tab (pf-adk-*): prompt cards, learned-pitfall rows,
  *     chips (model/shared/tier/proof), severity badges (AppDev KB UI phase).
  *   v2.15.0 — 2026-07-16 — Drop the dead .pf-side-ico rule (sidebar nav is label-only now).
@@ -2239,8 +2246,15 @@
 
 .pf-sidebar {
   width: 240px; flex: 0 0 240px;
-  position: sticky; top: var(--nav-height, 56px);
-  max-height: calc(100vh - var(--nav-height, 56px));
+  /* App-shell: the scroll region is now .page-content (the header lives OUTSIDE
+     it), so the sidebar sticks to the top of that region (top:0), not below the
+     header. Height caps at the region's height so its own nav list scrolls.
+     border-box folds the vertical padding INTO max-height — without it the padding
+     stacks on top, making the sidebar taller than the scroll region so sticky can't
+     hold it (it drifts up and the identity slides under the header when you scroll). */
+  position: sticky; top: 0;
+  box-sizing: border-box;
+  max-height: calc(100dvh - var(--nav-height, 56px));
   overflow-y: auto;
   padding: 0.75rem 0.5rem 2rem;
   border-right: 1px solid var(--border);
@@ -2977,7 +2991,11 @@
 .pf-waiting-where { color: var(--muted); }
 .pf-home-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 1rem; margin: 1rem 0; }
 @media (max-width: 760px) { .pf-home-grid { grid-template-columns: 1fr; } }
-.pf-home-card { border: 1px solid var(--border); border-radius: 12px; background: var(--card); padding: 0.8rem 1rem; }
+/* min-width:0 is load-bearing: grid/flex items default to min-width:auto and refuse to shrink
+   below their content's intrinsic width. Without it, a card with unbreakable inner content (long
+   app names, the 3-col number grid, the chart canvas) forces its grid column — and thus the whole
+   home dashboard — wider than a narrow phone, overflowing the right edge. */
+.pf-home-card { border: 1px solid var(--border); border-radius: 12px; background: var(--card); padding: 0.8rem 1rem; min-width: 0; }
 .pf-home-card-title { font-size: 0.78rem; font-weight: 700; letter-spacing: 0.06em; text-transform: uppercase; color: var(--text-dim); margin-bottom: 0.5rem; background: none; border: none; padding: 0; text-align: left; }
 .pf-home-card-link { cursor: pointer; }
 .pf-home-card-link:hover { color: var(--text); }
@@ -3017,7 +3035,14 @@
 .pf-ai-apps-head { font-size: 0.75rem; font-weight: 600; color: var(--muted); margin-bottom: 0.35rem; }
 .pf-ai-app-row { display: flex; align-items: center; gap: 0.5rem; padding: 0.2rem 0; font-size: 0.82rem; }
 .pf-ai-app-dot { width: 10px; height: 10px; border-radius: 3px; flex: none; }
-.pf-ai-app-name { flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; color: var(--text); }
+/* min-width:0 lets the flex:1 item actually shrink so the ellipsis engages on a long app name
+   (a bare flex:1 keeps min-width:auto and would overflow the card on a narrow screen instead). */
+.pf-ai-app-name { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; color: var(--text); }
+/* Let the spend tiles / quota chips shrink to their column on a narrow screen (tabular numbers
+   otherwise hold an intrinsic min-width and push the card past the viewport). */
+.pf-ai-win, .pf-usage-chip { min-width: 0; }
+/* A very long quota value wraps under its label instead of forcing the row wider than the screen. */
+.pf-usage-head { flex-wrap: wrap; }
 .pf-ai-app-cost { color: var(--text); font-variant-numeric: tabular-nums; }
 .pf-ai-app-pct { width: 3ch; text-align: right; color: var(--muted); font-variant-numeric: tabular-nums; }
 .pf-ai-app-meta { color: var(--muted); font-size: 0.72rem; white-space: nowrap; font-variant-numeric: tabular-nums; }

package/dist/public/js/services/apps.js

@@ -12,6 +12,8 @@
  *     crew-defs an app declares (manifest.cortex.agents) onto YOUR OWN fleet + read liveness
  *
  * @version-history
+ *   v1.2.0 — 2026-07-21 — listApps() paginates through ALL apps (was capped at the server
+ *     default of 50, silently truncating the Apps tab / gallery).
  *   v1.1.0 — 2026-07-16 — Agent-Bundled Apps Slice 1: deploy/undeploy/status service calls
  *   v1.0.0 — 2026-07-13 — Header added; file pre-dates header standard
  */
@@ -19,10 +21,24 @@ import { apiGet, apiDelete, apiPatch, api } from '/js/api.js';
 
 /** List apps. Returns array. The server decides visibility from who is
  *  authenticated: the owner sees their own parked/operator-hidden apps (the latter
- *  flagged operator_hidden so the UI can badge them); everyone else does not. */
+ *  flagged operator_hidden so the UI can badge them); everyone else does not.
+ *
+ *  Paginates through EVERY app: a single /v1/apps request caps at the server default
+ *  (50), so this loops by offset (200/page) until it has the server-reported `total`.
+ *  Otherwise the Apps tab / gallery silently stopped at 50. A guard bounds the loop. */
 export async function listApps() {
-  const data = await apiGet('/v1/apps');
-  return data?.data?.apps || [];
+  const LIMIT = 200;
+  let all = [];
+  let offset = 0;
+  for (let page = 0; page < 100; page++) {   // guard: ≤ 100 pages (20k apps)
+    const data = await apiGet(`/v1/apps?limit=${LIMIT}&offset=${offset}`);
+    const apps = data?.data?.apps || [];
+    all = all.concat(apps);
+    const total = typeof data?.data?.total === 'number' ? data.data.total : all.length;
+    if (apps.length < LIMIT || all.length >= total) break;
+    offset += LIMIT;
+  }
+  return all;
 }
 
 /** Upload an app (HTML file + optional screenshot). */

package/dist/public/js/services/messages-ai-prompts.js

@@ -19,6 +19,8 @@
  *   - handleOf(id) / peerLabel(id) — short label helpers (mirrors inbox-tab peerName)
  *   - buildConversationReplyPrompt({ peerGhii, subject, conversationId, thread }, mode)
  *   - buildMessageReplyPrompt({ peerGhii, subject, conversationId, message }, mode)
+ *   - buildConversationSummaryPrompt({ peerGhii, subject, thread, peerName }) — distill a whole thread
+ *     into a filo-ready note (summary/decisions/open-questions/actions/ideas) for the Notebook capture.
  * @usage
  *   import { buildConversationReplyPrompt, MODES } from '/js/services/messages-ai-prompts.js';
  *   const text = buildConversationReplyPrompt({ peerGhii, subject, conversationId, thread }, MODES.COPY);
@@ -31,6 +33,9 @@
  *   v1.2.0 -- 2026-07-12 -- MCP mode sends AS THE OWNER via aimeat_dm_send_as_owner (consent-gated
  *     delegation, scope messages:send-as-owner), landing the reply in the owner's thread from the owner.
  *     Graceful fallback to "hand me the reply" when the scope isn't granted; still never aimeat_dm_send.
+ *   v1.3.0 -- 2026-07-19 -- buildConversationSummaryPrompt: distill a whole thread into a knowledge note
+ *     (summary/decisions/open-questions/actions/ideas). One prompt, two deliveries — the server-side
+ *     /v1/ai/complete summary AND the copy-paste "run it in my own chat" mode of the Notebook capture.
  */
 
 export const MODES = { COPY: 'copy', MCP: 'mcp' };
@@ -165,6 +170,39 @@ export function buildConversationReplyPrompt({ peerGhii, subject, conversationId
   ].join('\n');
 }
 
+/**
+ * Distill a whole conversation into a self-contained knowledge note — the prompt behind the Inbox
+ * "→ Notebook" capture. Used two ways with the SAME text: sent to /v1/ai/complete (server-side, the
+ * owner's own key) and shown for copy-paste into the owner's own AI chat. English framing (house rule);
+ * the model answers in the conversation's language.
+ * @param {ConversationSource} [src]
+ */
+export function buildConversationSummaryPrompt({ peerGhii, subject, thread, peerName } = {}) {
+  const them = peerLabel(peerGhii, peerName);
+  const topic = subject ? ` (topic: "${subject}")` : '';
+  const convo = transcript(thread, peerGhii, peerName || handleOf(peerGhii));
+  return [
+    '# Summarize this conversation for my knowledge base',
+    '',
+    `This is my AIMEAT conversation with **${them}**${topic}. Distill it into a clean, self-contained`,
+    'Markdown note I can file into my workspace. Write in the SAME language as the conversation.',
+    '',
+    '## Produce these sections (drop a heading only when it would be genuinely empty)',
+    '1. **Summary** — 2-4 sentences on what this conversation was about.',
+    '2. **Decisions** — concrete decisions that were made (bullet list).',
+    '3. **Open questions** — anything still unresolved or awaiting an answer.',
+    '4. **Action items** — who does what next, if stated (name the owner when known).',
+    '5. **Ideas worth keeping** — proposals, concepts, or directions raised that are worth revisiting.',
+    '',
+    'Stay faithful to what was actually said — do not invent decisions or facts. Images shown as',
+    '`![name](url)` were shared but you cannot see them — reference them by name, never guess their',
+    'contents. Start the note with a single H1 title line.',
+    '',
+    '## The conversation',
+    convo,
+  ].join('\n');
+}
+
 /**
  * Single-message reply prompt — scoped to one message the user pointed at.
  * @param {MessageSource} [src]

package/dist/public/js/services/messages.js

@@ -13,6 +13,8 @@
  *   v1.1.0 -- 2026-06-23 -- send() carries the optional `interactive` payload (federated AskUserQuestion).
  *   v1.1.1 -- 2026-07-17 -- uploadAttachment: add a random suffix to the storage key so same-named files
  *     uploaded in the same millisecond (two clipboard "image.png" pastes) don't overwrite each other.
+ *   v1.2.0 -- 2026-07-21 -- getConversation(…, all): default loads the newest 50 (server page); all=true
+ *     walks every page (per_page=200) so long threads show their FULL history instead of only the last 50.
  */
 import { api, apiGet } from '/js/api.js';
 
@@ -54,10 +56,30 @@ export async function listConversations() {
   return r?.data?.conversations || [];
 }
 
-export async function getConversation(conversationId, viaAgent) {
-  const q = viaAgent ? `?agent=${enc(viaAgent)}` : '';
-  const r = await apiGet(`/v1/messages/conversations/${enc(conversationId)}${q}`);
-  return r?.data?.messages || [];
+/**
+ * Fetch a conversation thread. Default = the newest page (server default 50). Pass all=true to load the
+ * ENTIRE history: it walks every page (per_page=200) so long threads are never truncated — no message is
+ * hidden, only paged. Returns the messages array newest-first (the caller reverses for chat display);
+ * dedupes by id so a message arriving mid-walk can't double-render.
+ */
+export async function getConversation(conversationId, viaAgent, all = false) {
+  const base = `/v1/messages/conversations/${enc(conversationId)}`;
+  const agent = viaAgent ? `&agent=${enc(viaAgent)}` : '';
+  const perPage = all ? 200 : 50;
+  const first = await apiGet(`${base}?per_page=${perPage}&page=1${agent}`);
+  const data = first?.data || {};
+  let messages = data.messages || [];
+  const total = Number(data.total) || messages.length;
+  if (all && total > messages.length) {
+    const pages = Math.ceil(total / perPage);
+    for (let p = 2; p <= pages; p++) {
+      const r = await apiGet(`${base}?per_page=${perPage}&page=${p}${agent}`);
+      messages = messages.concat(r?.data?.messages || []);
+    }
+    const seen = new Set();
+    messages = messages.filter(m => m && m.id && !seen.has(m.id) && seen.add(m.id));
+  }
+  return messages;
 }
 
 export async function markConversationRead(conversationId) {

package/dist/public/js/services/notebook.js

@@ -11,6 +11,9 @@
  *   - distributeNote(text) — POST /v1/librarian/distribute (split into placed chunks)
  *   - materializeDocument(plan) — resolve/create org → ws → document space → draft→publish doc → drop source
  *   - distributeChunks(chunks, sourceKey, onProgress) — materialize each chunk to its home
+ *   - parkMessageToNotebook(msg) — park ONE inbox message for later processing
+ *   - parkConversationToNotebook({conv,thread,peerName,summary,images}) — park a WHOLE thread (transcript +
+ *     inline image embeds, optional AI/pasted summary) as one entry, ready for classify/distribute
  *   - getNotebookSettings/saveNotebookSettings — the per-owner trust toggles (notebook.settings)
  * @version-history
  *   v1.0.0 — 2026-06-19 — Initial: classify + materialize-document orchestration (slice B).
@@ -21,10 +24,13 @@
  *   v1.3.0 — 2026-06-23 — materializeDocument now writes via writeDraft + publishDraft (was a raw
  *     `.latest` memory write) so notebook documents get version history and appear in the workspace
  *     activity log/heatmap — the document-path counterpart to the v1.2.0 record fix.
+ *   v1.4.0 — 2026-07-19 — parkConversationToNotebook: capture a whole inbox thread (transcript + inline
+ *     image embeds, optional summary) as one notebook entry for the "→ Notebook" conversation capture.
  */
 import { api, apiPost } from '/js/api.js';
 import { createMemory, getMemory, deleteMemory } from '/js/services/memory.js';
 import { createOrganism, saveManifest, listWorkspaces, saveWorkspaceRegistry, wsRoot, writeDraft, publishDraft } from '/js/services/organisms.js';
+import { handleOf } from '/js/services/messages-ai-prompts.js';
 
 const DOC_SPACE = 'pages';
 
@@ -82,6 +88,76 @@ export async function parkMessageToNotebook(msg, opts = {}) {
   return { key };
 }
 
+/** A short, stable UTC timestamp for a transcript line (locale-independent so the note is reproducible). */
+function nbStamp(iso) {
+  if (!iso) return '';
+  const d = new Date(iso);
+  return Number.isFinite(d.getTime()) ? d.toISOString().replace('T', ' ').slice(0, 16) + ' UTC' : '';
+}
+
+/** Render a whole thread as a Markdown transcript, embedding each message's image attachments inline
+ *  (by url) so they survive into the materialized workspace document. `images` groups by messageId. */
+function renderConversationMarkdown(thread, peerGhii, peerName, images) {
+  const them = peerName || handleOf(peerGhii);
+  const byMsg = {};
+  for (const im of (images || [])) (byMsg[im.messageId] || (byMsg[im.messageId] = [])).push(im);
+  return (thread || []).map((m) => {
+    const who = m.direction === 'outbound' ? 'Me' : them;
+    const when = nbStamp(m.createdAt);
+    const body = String(m.body || '').trim();
+    const imgs = (byMsg[m.id] || []).map((im) => `\n\n![${im.name || 'image'}](${im.url})`).join('');
+    return `**${who}**${when ? ` — ${when}` : ''}\n\n${body}${imgs}`;
+  }).join('\n\n---\n\n');
+}
+
+/** Pull an H1/first line out of a summary to use as the note title, or null. */
+function summaryTitle(summary) {
+  const first = String(summary || '').split('\n').map((l) => l.trim()).find(Boolean);
+  if (!first) return null;
+  return first.replace(/^#+\s*/, '').slice(0, 120) || null;
+}
+
+/**
+ * Park a WHOLE conversation into the notebook as one entry (text + inline image embeds), ready for the
+ * existing classify/distribute enrichment. The three inbox capture modes all land here:
+ *   - a server-side / pasted AI summary → stored above a "Full transcript" section, or
+ *   - raw (no summary) → just the transcript.
+ * @param {object} [args]
+ * @param {{ conversationId?:string, peerGhii?:string, subject?:string }} [args.conv]
+ * @param {Array} [args.thread]   The loaded thread messages.
+ * @param {string} [args.peerName]
+ * @param {string} [args.summary]  An AI (server or pasted) summary markdown; omit for a raw capture.
+ * @param {Array<{messageId:string,id:string,name?:string,url:string}>} [args.images]  Image attachments.
+ */
+export async function parkConversationToNotebook({ conv, thread, peerName, summary, images } = {}) {
+  const peerGhii = conv?.peerGhii || '';
+  const transcriptMd = renderConversationMarkdown(thread, peerGhii, peerName, images);
+  const sum = (summary || '').trim();
+  const text = sum
+    ? `${sum}\n\n---\n\n## Full transcript\n\n${transcriptMd}`
+    : transcriptMd;
+  const title = summaryTitle(sum) || `Conversation with ${peerName || handleOf(peerGhii)}`;
+  const key = 'notebook.inbox.' + Date.now();
+  const value = {
+    text,
+    title,
+    capturedAt: new Date().toISOString(),
+    source: {
+      kind: 'conversation',
+      conversationId: conv?.conversationId,
+      peerGhii,
+      originNodeId: (peerGhii.split('@')[1] || ''),
+      messageCount: (thread || []).length,
+      attachments: (images || []).map((im) => ({ messageId: im.messageId, id: im.id, name: im.name, url: im.url })),
+    },
+    // A summarized thread is a knowledge capture, not an unanswered message — it owes no reply.
+    trackedResponseIntent: { owes: false, mode: 'approve' },
+  };
+  const resp = await createMemory(key, value, 'private');
+  if (resp?.ok === false) throw new Error(resp.error?.message || 'Could not park conversation to notebook');
+  return { key };
+}
+
 /** The per-owner notebook trust toggles ({ autoDetectIntent, autoRunPlan, autoDistribute }). */
 export async function getNotebookSettings() {
   try { const r = await getMemory('notebook.settings'); return (r?.data?.value) || {}; }

package/dist/public/js/services/unfurl.js

@@ -0,0 +1,43 @@
+/**
+ * @file public/js/services/unfurl.js
+ * @description Frontend service for link previews (unfurls). `fetchPreview(url)` asks the node for a
+ *   pasted link's OpenGraph/Twitter-card metadata; `fetchPreviewImageUrl(imageUrl)` pulls the preview
+ *   image THROUGH the node (same-origin, auth'd) into a `blob:` object URL — the SPA's CSP forbids remote
+ *   image hosts, so a direct <img src="https://…"> would be blocked. Both back the inbox message cards.
+ * @structure fetchPreview / fetchPreviewImageUrl
+ * @usage import * as unfurl from '/js/services/unfurl.js';
+ * @version-history
+ *   v1.0.0 — 2026-07-21 — Initial link-preview service (inbox message link cards).
+ */
+import { apiGet } from '/js/api.js';
+
+const enc = encodeURIComponent;
+
+/** Fetch OG/Twitter-card metadata for one URL. Returns { url, resolvedUrl, title, description, image,
+ *  siteName } or null if the node couldn't unfurl it (blocked/failed fetch, non-HTML, etc.). */
+export async function fetchPreview(url) {
+  try {
+    const r = await apiGet(`/v1/unfurl?url=${enc(url)}`);
+    return r?.data || null;
+  } catch {
+    return null;   // a preview is best-effort — a link that won't unfurl just shows no card
+  }
+}
+
+/** Fetch a preview image through the node's proxy and return a blob: object URL (CSP-safe, auth'd via
+ *  the session JWT — an <img> tag can't send an Authorization header, so we fetch the bytes ourselves).
+ *  Returns null on any failure. The CALLER owns the returned URL and must URL.revokeObjectURL it. */
+export async function fetchPreviewImageUrl(imageUrl) {
+  try {
+    const headers = /** @type {Record<string, string>} */ ({});
+    const session = window.AIMEAT?.auth?.getSession?.();
+    if (session?.jwt) headers['Authorization'] = 'Bearer ' + session.jwt;
+    const resp = await fetch(`/v1/unfurl/image?url=${enc(imageUrl)}`, { headers });
+    if (!resp.ok) return null;
+    const blob = await resp.blob();
+    if (!blob.type.startsWith('image/')) return null;
+    return URL.createObjectURL(blob);
+  } catch {
+    return null;
+  }
+}

package/dist/public/lib/samples/LICENSE.md

@@ -37,5 +37,16 @@ tom-high=D3/50, clap=Eb2/39, cowbell=Ab3/56)
 - Source: https://github.com/dave4mpls/midi-js-soundfonts-with-drums (gleitz
   fork that adds the GM percussion renders missing upstream)
 
+## Strings (strings/), Organ (organ/), E-piano (epiano/), Trumpet (trumpet/)
+
+**MusyngKite soundfont** pre-rendered per-note MP3s (string_ensemble_1,
+drawbar_organ, electric_piano_1, trumpet)
+- License: MIT — https://github.com/gleitz/midi-js-soundfonts (MusyngKite/)
+- Added 2026-07-19 (Band Jam feedback round 2)
+
+Note (2026-07-19, feedback round 2): bass swapped MusyngKite → **FluidR3
+electric_bass_finger** (MusyngKite render sustained like a church organ) and
+guitar-steel swapped MusyngKite → **FluidR3 acoustic_guitar_steel**.
+
 All note subsets match `SAMPLE_NOTES` in aimeat-audio.js exactly (nearest-sample
 pitch shift covers the gaps).

package/dist/public/spa.html

@@ -154,6 +154,7 @@
       "/js/services/work.js": "/js/services/work.js",
       "/js/services/messages.js": "/js/services/messages.js",
       "/js/services/messages-ai-prompts.js": "/js/services/messages-ai-prompts.js",
+      "/js/services/unfurl.js": "/js/services/unfurl.js",
       "/js/services/tracked-responses.js": "/js/services/tracked-responses.js",
       "/js/services/presence.js": "/js/services/presence.js",
       "/js/presence-store.js": "/js/presence-store.js",
@@ -163,6 +164,7 @@
       "/components/Modal.js": "/components/Modal.js",
       "/components/useViewCSS.js": "/components/useViewCSS.js",
       "/components/Markdown.js": "/components/Markdown.js",
+      "/components/LinkPreview.js": "/components/LinkPreview.js",
       "/components/InboxLink.js": "/components/InboxLink.js",
       "/components/JsonView.js": "/components/JsonView.js",
       "/components/ImageDeliverable.js": "/components/ImageDeliverable.js",

package/dist/public/views/app-grant.js

@@ -17,6 +17,11 @@
  *   v1.0.0 — 2026-06-20 — Initial (H-2 app-origin isolation, Phase 3: consent page).
  *   v1.1.0 — 2026-06-20 — Popup (web_message) delivery + "trust this app" reframe + Advanced
  *     per-scope subset selection (consent flow wired to apps via the SDK).
+ *   v1.2.0 — 2026-07-19 — Own-app + scope-upgrade fixes (Band Jam findings): the signed-in owner's
+ *     OWN app (server-verified origin_bound + app_owner) auto-approves like the silent bridge and
+ *     shows "Your app" instead of "not yours"; manage mode pre-checks the UNION of granted +
+ *     requested scopes and badges newly requested ones "new" (they used to come unchecked, so
+ *     users silently kept the old grant after an app added a scope).
  */
 import { h } from 'preact';
 import { useState, useEffect } from 'preact/hooks';
@@ -34,6 +39,7 @@ export default function AppGrant() {
   const [advanced, setAdvanced] = useState(false);
   const [selected, setSelected] = useState(() => new Set());
   const [existingGrant, setExistingGrant] = useState(null); // the grant this app already holds (manage mode)
+  const [ownApp, setOwnApp] = useState(false); // server-verified: origin-bound request for the signed-in owner's own app
 
   const requestId = new URLSearchParams(window.location.search).get('req') || '';
   const [authed, setAuthed] = useState(() => !!window.AIMEAT?.auth?.hasSession);
@@ -67,9 +73,19 @@ export default function AppGrant() {
         } catch { /* ignore */ }
         if (!live) return;
         const reqScopes = (res.data.scopes || []).map((s) => s.scope);
-        const granted = grant ? grant.scopes : reqScopes;
+        // The owner's OWN app (server-verified: the redirect origin is bound to exactly this app):
+        // same auto-approve policy as the silent bridge — their own app never needs the trust prompt.
+        // The server computes `own` independently at consent time, so this is UX, not the gate.
+        const myOwner = (window.AIMEAT?.auth?.storedGhii || '').split('@')[0];
+        const own = !!(res.data.origin_bound && res.data.app_owner && myOwner && myOwner === res.data.app_owner);
+        // Pre-check the UNION of already-granted and now-requested scopes: an app update that added
+        // a scope must surface it CHECKED — presenting it unchecked made users keep the old grant
+        // without noticing (the Band Jam scope-upgrade trap).
+        const granted = grant ? [...new Set([...grant.scopes, ...reqScopes])] : reqScopes;
         setExistingGrant(grant);
         setSelected(new Set(granted));
+        setOwnApp(own);
+        if (own && !res.data.manage) { setState({ status: 'autoapprove', request: res.data }); return; }
         // Pass-through: when NOT explicitly managing (the gear) and the app already holds a grant that
         // covers what it's asking for, just approve silently — no second prompt for an app you trust.
         const covers = grant && reqScopes.every((s) => grant.scopes.includes(s));
@@ -170,13 +186,15 @@ export default function AppGrant() {
   return html`
     <div class="agr-wrap">
       <div class="agr-card">
-        <span class="agr-badge">${tr('appGrant.externalBadge', 'External app')}</span>
+        <span class="agr-badge ${ownApp ? 'agr-badge-own' : ''}">${ownApp ? tr('appGrant.ownBadge', 'Your app') : tr('appGrant.externalBadge', 'External app')}</span>
         <h1 class="agr-title">${existingGrant ? tr('appGrant.manageTitle', 'Manage this app’s access') : tr('appGrant.trustTitle', 'Trust this app?')}</h1>
         <div class="agr-app">
           <div class="agr-app-name">${escHtml(req.app_name)}</div>
           <div class="agr-app-origin">${escHtml(req.app_origin)}</div>
         </div>
-        <p class="agr-muted">${tr('appGrant.trustIntro', 'This app is not yours. It gets its OWN scoped, revocable key — never your login session. You can revoke it anytime in Profile › Access.')}</p>
+        <p class="agr-muted">${ownApp
+          ? tr('appGrant.ownIntro', 'This is your own app. It still uses a scoped, revocable key — never your login session.')
+          : tr('appGrant.trustIntro', 'This app is not yours. It gets its OWN scoped, revocable key — never your login session. You can revoke it anytime in Profile › Access.')}</p>
 
         <div class="agr-scopes-label">${tr('appGrant.needsLabel', 'This app needs:')}</div>
         <ul class="agr-scopes">
@@ -186,7 +204,9 @@ export default function AppGrant() {
                 <input type="checkbox" class="agr-scope-check" checked=${selected.has(s.scope)}
                   onChange=${() => toggle(s.scope)} aria-label=${s.scope} />`}
               <span class="agr-scope-text">
-                <span class="agr-scope-desc">${escHtml(s.description || s.scope)}</span>
+                <span class="agr-scope-desc">${escHtml(s.description || s.scope)}
+                  ${existingGrant && !existingGrant.scopes.includes(s.scope) && html`<span class="agr-scope-newbadge">${tr('appGrant.newScope', 'new')}</span>`}
+                </span>
                 <span class="agr-scope-name">${escHtml(s.scope)}</span>
               </span>
             </li>`)}