aimeat 2.0.0 → 2.1.0

package/dist/locales/en.json

@@ -14,6 +14,12 @@
   "inbox.quoteYou": "You",
   "inbox.replyingTo": "Replying to",
   "inbox.quoteCancel": "Cancel the quoted reply",
+  "inbox.linkPreview.label": "Previews",
+  "inbox.linkPreview.hide": "Hide this preview",
+  "inbox.linkPreview.hideAll": "Hide link previews",
+  "inbox.linkPreview.showAll": "Show link previews",
+  "inbox.thread.showAll": "Show all messages",
+  "inbox.thread.showRecent": "Show last 50",
   "inbox.attachmentRemove": "Remove attachment",
   "inbox.contactAgentSuffix": "(your agent)",
   "inbox.messageThis": "Send a message",
@@ -49,6 +55,23 @@
   "inbox.schedError": "Could not schedule.",
   "inbox.parkToNotebook": "Add to notebook for later",
   "inbox.parkedToNotebook": "Added to your notebook.",
+  "inbox.notebook.toNotebook": "Summarize to Notebook",
+  "inbox.notebook.toNotebookShort": "Notebook",
+  "inbox.notebook.modeAi": "AI summary (my key)",
+  "inbox.notebook.modeCopy": "Copy prompt",
+  "inbox.notebook.modeRaw": "Raw",
+  "inbox.notebook.hintAi": "Summarize this whole conversation with your own OpenRouter key, review it, then send it to the Notebook to file into a workspace.",
+  "inbox.notebook.hintCopy": "Copy this prompt into your own AI chat, then paste the summary back below and send it to the Notebook.",
+  "inbox.notebook.hintRaw": "Send the whole chain (text + images) to the Notebook as-is, and refine it there with classify / distribute.",
+  "inbox.notebook.genSummary": "Summarize with AI",
+  "inbox.notebook.summarizing": "Summarizing…",
+  "inbox.notebook.regen": "Regenerate",
+  "inbox.notebook.park": "Send to Notebook",
+  "inbox.notebook.parkRaw": "Send to Notebook",
+  "inbox.notebook.parked": "Sent to the Notebook.",
+  "inbox.notebook.pasteHint": "Paste the AI's summary here:",
+  "inbox.notebook.pastePh": "Paste the summary the AI gave you…",
+  "inbox.notebook.summaryEmpty": "The model returned nothing — try again.",
   "inbox.viaAgent": "via",
   "inbox.sentByAgent": "Sent by your agent",
   "inbox.viaAgentReadonly": "Sent by your agent {agent} — view only.",
@@ -148,6 +171,8 @@
   "admin.messages.detail": "Detail",
   "admin.messages.none": "No deliveries yet.",
   "inbox.attach": "Attach a file",
+  "inbox.expand": "Enlarge the editor",
+  "inbox.collapse": "Shrink the editor",
   "inbox.today": "Today",
   "inbox.yesterday": "Yesterday",
   "inbox.youPrefix": "You:",
@@ -579,7 +604,10 @@
     "loginCta": "Log in",
     "errorTitle": "Cannot grant access",
     "missing": "No authorization request.",
-    "expired": "This request has expired."
+    "expired": "This request has expired.",
+    "ownBadge": "Your app",
+    "ownIntro": "This is your own app. It still uses a scoped, revocable key — never your login session.",
+    "newScope": "new"
   },
   "common": {
     "cancel": "Cancel",
@@ -607,6 +635,7 @@
   "notif": {
     "title": "Notifications",
     "empty": "No notifications yet",
+    "clearAll": "Clear all",
     "action": {
       "reply": "Reply",
       "approve": "Approve",
@@ -2888,6 +2917,8 @@
       "operatorHiddenHint": "An operator has hidden this app from public view. Only you can still see it. Contact the operator to appeal.",
       "agentBadge": "Ships an agent",
       "agentBadgeHint": "This app ships its own agent - deploy it onto your fleet below",
+      "promotedBadge": "Promoted",
+      "promotedBadgeHint": "Promoted on your public profile — manage the pitch in the app catalog",
       "agentsLabel": "Bundled agents",
       "agentDeploy": "Deploy to my fleet",
       "agentUndeploy": "Undeploy",
@@ -4502,6 +4533,8 @@
     "completeAccountTitle": "One last step",
     "completeAccountDesc": "Add an email to finish setting up your account. We’ll send a verification code to confirm it.",
     "completeAccountDescResend": "Confirm your email to finish signing in. We’ll send a verification code — edit the address if it’s wrong.",
+    "registerEmailTitle": "Add your email",
+    "registerEmailDesc": "Enter your email to create your account. We’ll send a verification code to confirm it.",
     "sendVerificationCode": "Send Verification Code",
     "enterCodeTitle": "Enter Verification Code",
     "enterCodeDesc": "We sent a 6-digit code to your email. Enter it below to finish and sign in.",
@@ -6447,6 +6480,7 @@
       "notFound": "Portfolio not found",
       "notFoundDesc": "This user hasn't published a portfolio yet.",
       "loginToSeeMore": "Log in to see more content",
+      "promoted": "Promoted apps",
       "backToPortal": "Home",
       "fullscreen": "Fullscreen",
       "standalone": "Own address"

package/dist/locales/fi.json

@@ -14,6 +14,12 @@
   "inbox.quoteYou": "Sinä",
   "inbox.replyingTo": "Vastataan:",
   "inbox.quoteCancel": "Peru lainattu vastaus",
+  "inbox.linkPreview.label": "Esikatselut",
+  "inbox.linkPreview.hide": "Piilota tämä esikatselu",
+  "inbox.linkPreview.hideAll": "Piilota linkkien esikatselut",
+  "inbox.linkPreview.showAll": "Näytä linkkien esikatselut",
+  "inbox.thread.showAll": "Näytä kaikki viestit",
+  "inbox.thread.showRecent": "Näytä viimeiset 50",
   "inbox.attachmentRemove": "Poista liite",
   "inbox.contactAgentSuffix": "(agenttisi)",
   "inbox.messageThis": "Lähetä viesti",
@@ -49,6 +55,23 @@
   "inbox.schedError": "Ajastus epäonnistui.",
   "inbox.parkToNotebook": "Lisää muistikirjaan myöhempää varten",
   "inbox.parkedToNotebook": "Lisätty muistikirjaasi.",
+  "inbox.notebook.toNotebook": "Yhteenveto Notebookiin",
+  "inbox.notebook.toNotebookShort": "Notebook",
+  "inbox.notebook.modeAi": "AI-yhteenveto (oma avain)",
+  "inbox.notebook.modeCopy": "Kopioi prompti",
+  "inbox.notebook.modeRaw": "Raakana",
+  "inbox.notebook.hintAi": "Tiivistä koko tämä keskustelu omalla OpenRouter-avaimellasi, tarkista se, ja vie se Notebookiin arkistoitavaksi workspaceen.",
+  "inbox.notebook.hintCopy": "Kopioi tämä prompti omaan AI-chattiisi, liitä yhteenveto alle ja vie se Notebookiin.",
+  "inbox.notebook.hintRaw": "Vie koko ketju (teksti + kuvat) Notebookiin sellaisenaan, ja jalosta se siellä classify / distribute -toiminnoilla.",
+  "inbox.notebook.genSummary": "Tee yhteenveto AI:lla",
+  "inbox.notebook.summarizing": "Tiivistetään…",
+  "inbox.notebook.regen": "Uudelleen",
+  "inbox.notebook.park": "Vie Notebookiin",
+  "inbox.notebook.parkRaw": "Vie Notebookiin",
+  "inbox.notebook.parked": "Viety Notebookiin.",
+  "inbox.notebook.pasteHint": "Liitä AI:n yhteenveto tähän:",
+  "inbox.notebook.pastePh": "Liitä AI:n antama yhteenveto…",
+  "inbox.notebook.summaryEmpty": "Malli ei palauttanut mitään — yritä uudelleen.",
   "inbox.viaAgent": "via",
   "inbox.sentByAgent": "Lähettänyt agenttisi",
   "inbox.viaAgentReadonly": "Lähettänyt agenttisi {agent} — vain katselu.",
@@ -148,6 +171,8 @@
   "admin.messages.detail": "Lisätieto",
   "admin.messages.none": "Ei toimituksia vielä.",
   "inbox.attach": "Liitä tiedosto",
+  "inbox.expand": "Suurenna editori",
+  "inbox.collapse": "Pienennä editori",
   "inbox.today": "Tänään",
   "inbox.yesterday": "Eilen",
   "inbox.youPrefix": "Sinä:",
@@ -579,7 +604,10 @@
     "loginCta": "Kirjaudu",
     "errorTitle": "Pääsyä ei voida myöntää",
     "missing": "Ei valtuutuspyyntöä.",
-    "expired": "Tämä pyyntö on vanhentunut."
+    "expired": "Tämä pyyntö on vanhentunut.",
+    "ownBadge": "Oma appisi",
+    "ownIntro": "Tämä on oma appisi. Sekin käyttää rajattua, peruttavaa avainta — ei koskaan kirjautumisistuntoasi.",
+    "newScope": "uusi"
   },
   "common": {
     "cancel": "Peruuta",
@@ -607,6 +635,7 @@
   "notif": {
     "title": "Ilmoitukset",
     "empty": "Ei ilmoituksia vielä",
+    "clearAll": "Tyhjennä kaikki",
     "action": {
       "reply": "Vastaa",
       "approve": "Hyväksy",
@@ -2888,6 +2917,8 @@
       "operatorHiddenHint": "Operaattori on piilottanut tämän sovelluksen julkisesta näkymästä. Vain sinä näet sen edelleen. Ota yhteyttä operaattoriin valittaaksesi.",
       "agentBadge": "Sisältää agentin",
       "agentBadgeHint": "Tämä sovellus tuo mukanaan oman agentin - ota se käyttöön omaan laivueeseesi alta",
+      "promotedBadge": "Nostettu",
+      "promotedBadgeHint": "Nostettu julkiseen profiiliisi — hallitse myyntipuhetta sovelluskatalogissa",
       "agentsLabel": "Mukana tulevat agentit",
       "agentDeploy": "Ota käyttöön laivueeseeni",
       "agentUndeploy": "Poista käytöstä",
@@ -4502,6 +4533,8 @@
     "completeAccountTitle": "Vielä yksi vaihe",
     "completeAccountDesc": "Lisää sähköpostiosoite viimeistelläksesi tilisi. Lähetämme vahvistuskoodin sen vahvistamiseksi.",
     "completeAccountDescResend": "Vahvista sähköpostiosoitteesi kirjautuaksesi sisään. Lähetämme vahvistuskoodin — muokkaa osoitetta, jos se on väärin.",
+    "registerEmailTitle": "Lisää sähköpostiosoitteesi",
+    "registerEmailDesc": "Anna sähköpostiosoitteesi luodaksesi tilisi. Lähetämme vahvistuskoodin sen vahvistamiseksi.",
     "sendVerificationCode": "Lähetä vahvistuskoodi",
     "enterCodeTitle": "Syötä vahvistuskoodi",
     "enterCodeDesc": "Lähetimme 6-numeroisen koodin sähköpostiisi. Syötä se alle viimeistelläksesi ja kirjautuaksesi sisään.",
@@ -6447,6 +6480,7 @@
       "notFound": "Portfoliota ei löytynyt",
       "notFoundDesc": "Tämä käyttäjä ei ole julkaissut portfoliota.",
       "loginToSeeMore": "Kirjaudu sisään nähdäksesi lisää",
+      "promoted": "Nostetut sovellukset",
       "backToPortal": "Koti",
       "fullscreen": "Koko näyttö",
       "standalone": "Oma osoite"

package/dist/public/components/LinkPreview.js

@@ -0,0 +1,101 @@
+/**
+ * @file public/components/LinkPreview.js
+ * @description Rich link-preview (unfurl) cards for a pasted URL. `LinkPreview` fetches one URL's
+ *   OpenGraph metadata from the node (`/js/services/unfurl.js`) and renders a card (site · title ·
+ *   description · thumbnail); the thumbnail is pulled through the node's image proxy into a `blob:`
+ *   URL so the SPA's remote-image CSP is satisfied. `MessageLinkPreviews` extracts the URLs from a
+ *   message body and renders a card per link, each with a ✕ that hides it (persisted in localStorage,
+ *   so a dismissed card stays hidden). `extractUrls` is exported for reuse/testing.
+ * @structure extractUrls(text,max) · LinkPreview({url,onDismiss}) · MessageLinkPreviews({msg})
+ * @usage html`<${MessageLinkPreviews} msg=${msg} />`
+ * @version-history
+ *   v1.0.0 — 2026-07-21 — Initial link-preview cards (inbox message threads).
+ */
+import { h } from 'preact';
+import { useState, useEffect } from 'preact/hooks';
+import htm from 'htm';
+const html = htm.bind(h);
+import { t } from '/js/i18n.js';
+import { escHtml } from '/js/utils.js';
+import * as unfurl from '/js/services/unfurl.js';
+
+/** Pull up to `max` distinct bare http(s) URLs out of a message body, trimming trailing sentence
+ *  punctuation (mirrors the Markdown autolink trimming so the card links the same target the text does). */
+export function extractUrls(text, max = 3) {
+  const urls = [];
+  if (typeof text !== 'string') return urls;
+  const re = /(?:^|[\s(<[])(https?:\/\/[^\s<>()[\]]+)/gi;
+  let m;
+  while ((m = re.exec(text)) !== null && urls.length < max) {
+    let u = m[1].replace(/[.,;:!?'"]+$/, '');
+    if (u && !urls.includes(u)) urls.push(u);
+  }
+  return urls;
+}
+
+// Dismissed cards persist across reloads: a Set of `${messageId}::${url}` keys in localStorage (capped).
+const DISMISS_KEY = 'aimeat.inbox.linkcard.dismissed';
+function loadDismissed() {
+  try { return new Set(JSON.parse(localStorage.getItem(DISMISS_KEY) || '[]')); } catch { return new Set(); }
+}
+function saveDismissed(set) {
+  try { localStorage.setItem(DISMISS_KEY, JSON.stringify([...set].slice(-500))); } catch { /* quota */ }
+}
+
+/** One preview card. Renders nothing while loading, or if the link has no usable metadata. */
+export function LinkPreview({ url, onDismiss }) {
+  const [meta, setMeta] = useState(undefined); // undefined = loading, null = nothing to show
+  const [imgUrl, setImgUrl] = useState(null);
+
+  useEffect(() => {
+    let alive = true;
+    let objectUrl = null;
+    setMeta(undefined); setImgUrl(null);
+    (async () => {
+      const m = await unfurl.fetchPreview(url);
+      if (!alive) return;
+      // A card with no title/description/image isn't worth showing (avoid an empty box on a bare domain).
+      if (!m || (!m.title && !m.description && !m.image)) { setMeta(null); return; }
+      setMeta(m);
+      if (m.image) {
+        objectUrl = await unfurl.fetchPreviewImageUrl(m.image);
+        if (!alive) { if (objectUrl) URL.revokeObjectURL(objectUrl); return; }
+        if (objectUrl) setImgUrl(objectUrl);
+      }
+    })();
+    return () => { alive = false; if (objectUrl) URL.revokeObjectURL(objectUrl); };
+  }, [url]);
+
+  if (meta === undefined || meta === null) return null;
+  return html`
+    <div class="inbox-linkcard">
+      <a class="inbox-linkcard-main" href=${meta.resolvedUrl || url} target="_blank" rel="noopener noreferrer nofollow">
+        ${imgUrl ? html`<span class="inbox-linkcard-thumb"><img src=${imgUrl} alt="" loading="lazy" /></span>` : null}
+        <span class="inbox-linkcard-text">
+          ${meta.siteName ? html`<span class="inbox-linkcard-site">${escHtml(meta.siteName)}</span>` : null}
+          ${meta.title ? html`<span class="inbox-linkcard-title">${escHtml(meta.title)}</span>` : null}
+          ${meta.description ? html`<span class="inbox-linkcard-desc">${escHtml(meta.description)}</span>` : null}
+        </span>
+      </a>
+      <button class="inbox-linkcard-x" title=${t('inbox.linkPreview.hide')}
+        onClick=${() => onDismiss?.(url)}>✕</button>
+    </div>`;
+}
+
+/** All preview cards for one message: a card per non-dismissed URL in its body. */
+export function MessageLinkPreviews({ msg }) {
+  const urls = extractUrls(msg?.body || '');
+  const [dismissed, setDismissed] = useState(loadDismissed);
+  if (urls.length === 0) return null;
+  const visible = urls.filter(u => !dismissed.has(`${msg.id}::${u}`));
+  if (visible.length === 0) return null;
+  const dismiss = (u) => {
+    const next = new Set(dismissed);
+    next.add(`${msg.id}::${u}`);
+    setDismissed(next);
+    saveDismissed(next);
+  };
+  return html`<div class="inbox-linkcards">
+    ${visible.map(u => html`<${LinkPreview} key=${u} url=${u} onDismiss=${dismiss} />`)}
+  </div>`;
+}

package/dist/public/components/NotificationBell.js

@@ -17,6 +17,8 @@
  *     same deep-link translation as bell clicks (supports both '#hash' and '?tab=' forms).
  *   v1.2.0 — 2026-07-18 — Inline notification actions: reply box (POST /v1/messages) + api buttons
  *     (approve/deny/accept/decline/reject) that call the action endpoint with the owner's session.
+ *   v1.3.0 — 2026-07-19 — "Clear all" in the dropdown head (DELETE /v1/notifications) — deletes every
+ *     notification for the owner (not just mark-read), optimistic empty + reconcile.
  */
 import { h } from 'preact';
 import { useState, useEffect, useRef, useCallback } from 'preact/hooks';
@@ -99,11 +101,23 @@ export function NotificationBell({ t, onNavigate }) {
   const [results, setResults] = useState({});        // notifId → { ok, msg }
   const ref = useRef(null);
 
+  const [clearing, setClearing] = useState(false);
+
   const load = useCallback(async () => {
     const r = await api('/v1/notifications');
     if (r && r.data) { setItems(r.data.notifications || []); setUnread(r.data.unread || 0); }
   }, []);
 
+  // "Clear all" — delete every notification for the owner (not just mark read). Optimistic: empty the
+  // list + zero the badge immediately, then reconcile from the server response.
+  const clearAll = useCallback(async () => {
+    setClearing(true);
+    setItems([]); setUnread(0); setReplyFor(null); setResults({});
+    await api('/v1/notifications', { method: 'DELETE', body: JSON.stringify({}) });
+    setClearing(false);
+    load();
+  }, [load]);
+
   useEffect(() => {
     load();
     return onLiveUpdate(['agent-messages', 'agent-tasks', 'notifications', 'workspace-access'], () => load());
@@ -215,7 +229,10 @@ export function NotificationBell({ t, onNavigate }) {
       </button>
       ${open ? html`
         <div class="notif-dropdown">
-          <div class="notif-dropdown-head">${tr('notif.title', 'Notifications')}</div>
+          <div class="notif-dropdown-head">
+            <span>${tr('notif.title', 'Notifications')}</span>
+            ${items.length > 0 ? html`<button class="notif-clear-all" disabled=${clearing} onClick=${(e) => { e.stopPropagation(); clearAll(); }}>${clearing ? '…' : tr('notif.clearAll', 'Clear all')}</button>` : null}
+          </div>
           ${items.length === 0
             ? html`<div class="notif-empty">${tr('notif.empty', 'No notifications yet')}</div>`
             : items.map(n => renderItem(n))}

package/dist/public/css/theme.css

@@ -10,6 +10,14 @@
    @usage Loaded first in spa.html <head>; the theme is toggled by /js/theme.js
      which flips the data-theme attribute on <html>.
    @version-history
+     v1.24.0 — 2026-07-21 — App-shell scroll model: html/body no longer scroll (height:100%;
+       overflow:hidden); #app is a full-viewport (100dvh) flex column with the topnav as a fixed-height
+       row and .page-content as the sole overflow-y:auto scroll region. Removes the ~nav-height phantom
+       overscroll and stops view content sliding under the (formerly sticky, now in-frame) header. Coupled
+       offset fixes: .pf-sidebar/.adm-sidebar stick to top:0 of the region and cap at 100dvh−nav-height.
+     v1.23.1 — 2026-07-20 — Mobile: pin .notif-dropdown to fixed viewport insets under 560px (the
+       320px, right:0-anchored panel ran off the LEFT edge — the bell sits mid-right of the bar — and
+       got clipped by body{overflow-x:hidden}); long notif titles/bodies wrap (overflow-wrap:anywhere).
      v1.23.0 — 2026-07-18 — Notification bell inline actions: split .notif-item into a clickable
        .notif-item-main + an actions row; add .notif-actions/.notif-action-btn/.notif-reply*/.notif-result.
      v1.22.0 — 2026-07-17 — UI-unification foundation: extend the spacing scale (--sp-5=20/--sp-6=24/
@@ -307,15 +315,22 @@
 }
 
 /* ── Base ── */
-html { scroll-behavior: smooth; }
+html { scroll-behavior: smooth; height: 100%; }
 
 body {
   font-family: var(--font);
   background: var(--bg);
   color: var(--text);
   line-height: 1.6;
-  min-height: 100vh;
-  overflow-x: hidden;
+  height: 100%;
+  margin: 0; /* zero the UA default 8px — with the fixed app-shell frame it would push #app past the viewport */
+  /* App-shell: the page (html/body) never scrolls. The topnav is a fixed-height
+     flex row and .page-content owns the ONLY scroll region (see #app +
+     .page-content). This is what stops view content sliding under the header and
+     removes the ~nav-height phantom overscroll that body-scroll + an in-flow
+     (sticky) header produced — the content fills the space below the header and
+     scrolls within it. overflow:hidden also subsumes the old overflow-x clip. */
+  overflow: hidden;
   -webkit-font-smoothing: antialiased;
 }
 
@@ -402,14 +417,28 @@ a { color: inherit; text-decoration: none; }
 #app {
   position: relative;
   z-index: 1;
+  /* App-shell frame: a full-viewport flex column — topnav (fixed height) on top,
+     .page-content (the scroll region) filling the rest. dvh keeps the frame flush
+     with the visual viewport as mobile browser chrome shows/hides. */
+  height: 100vh;
+  height: 100dvh;
+  display: flex;
+  flex-direction: column;
 }
 
 /* ── Top Navigation ── */
 .topnav {
-  position: sticky;
-  top: 0;
+  /* App-shell: a fixed-height flex row inside #app (no longer sticky — #app
+     itself doesn't scroll, so the header stays put for free). z-index keeps the
+     header's own dropdowns (notifications, mobile menu) above .page-content. */
+  position: relative;
   z-index: 100;
+  flex: 0 0 auto;
   height: var(--nav-height);
+  /* border-box so the 1px border-bottom is INCLUDED in --nav-height — otherwise the
+     header renders 1px taller than the token and every `100dvh - var(--nav-height)`
+     scroll region (sidebars) is 1px too tall and can't stay pinned. */
+  box-sizing: border-box;
   display: flex;
   align-items: center;
   justify-content: space-between;
@@ -481,7 +510,10 @@ a { color: inherit; text-decoration: none; }
 .notif-bell-btn:hover { background: var(--bg-dim); }
 .notif-badge { position: absolute; top: -1px; right: -1px; background: var(--accent); color: #fff; border-radius: 10px; font-size: 0.6rem; font-weight: 700; min-width: 15px; height: 15px; padding: 0 3px; display: flex; align-items: center; justify-content: center; }
 .notif-dropdown { position: absolute; right: 0; top: calc(100% + 6px); width: 320px; max-height: 60vh; overflow-y: auto; background: var(--card); border: 1px solid var(--border); border-radius: 10px; box-shadow: 0 10px 30px rgba(0,0,0,0.18); z-index: 1200; }
-.notif-dropdown-head { font-weight: 700; font-size: 0.9rem; color: var(--text); padding: 0.6rem 0.85rem; border-bottom: 1px solid var(--border-subtle); position: sticky; top: 0; background: var(--card); }
+.notif-dropdown-head { display: flex; align-items: center; justify-content: space-between; gap: 0.5rem; font-weight: 700; font-size: 0.9rem; color: var(--text); padding: 0.6rem 0.85rem; border-bottom: 1px solid var(--border-subtle); position: sticky; top: 0; background: var(--card); z-index: 1; }
+.notif-clear-all { font-weight: 600; font-size: 0.78rem; color: var(--muted); background: none; border: none; padding: 0.15rem 0.35rem; border-radius: 6px; cursor: pointer; }
+.notif-clear-all:hover:not(:disabled) { color: var(--brand); background: var(--bg-dim); }
+.notif-clear-all:disabled { opacity: 0.6; cursor: default; }
 .notif-empty { padding: 1rem 0.85rem; color: var(--muted); font-size: 0.85rem; }
 .notif-item { display: block; border-bottom: 1px solid var(--border-subtle); }
 .notif-item.unread { background: var(--accent-subtle); }
@@ -499,6 +531,21 @@ a { color: inherit; text-decoration: none; }
 .notif-result { font-size: 0.76rem; padding: 0.3rem 0.85rem 0.55rem; }
 .notif-result.ok { color: var(--success, #4caf50); }
 .notif-result.err { color: var(--danger, #e0564a); }
+/* Long sender GHIIs / subjects wrap instead of forcing the panel wider than the screen. */
+.notif-item-title, .notif-item-body { overflow-wrap: anywhere; }
+/* Mobile: the 320px-wide, right:0-anchored dropdown runs off the LEFT edge (the bell sits
+   mid-right of the bar) and gets clipped by body{overflow-x:hidden}. Pin it to fixed viewport
+   insets so it spans the screen width minus small margins, regardless of the bell's position. */
+@media (max-width: 560px) {
+  .notif-dropdown {
+    position: fixed;
+    top: calc(var(--nav-height, 56px) + 4px);
+    right: 8px;
+    left: 8px;
+    width: auto;
+    max-height: 72vh;
+  }
+}
 
 .topnav-right a {
   font-size: 0.84rem;
@@ -1277,7 +1324,10 @@ select.input-field { cursor: pointer; }
 }
 
 /* ── Page entrance ── */
-.page-content { animation: pageIn 0.8s ease; }
+/* App-shell scroll region: fills the space under the topnav and owns the only
+   scroll. min-height:0 lets the flex child shrink so overflow-y actually scrolls;
+   overflow-x:hidden replaces the clip that used to live on body. */
+.page-content { flex: 1 1 auto; min-height: 0; overflow-y: auto; overflow-x: hidden; animation: pageIn 0.8s ease; }
 
 /* ── Responsive ── */
 @media (max-width: 480px) {

package/dist/public/css/views/admin.css

@@ -4,6 +4,9 @@
  *   its distinct indigo accent and a permanently-dark sidebar, but all content
  *   surfaces map to global theme.css tokens so they flip with dark/light mode.
  * @version-history
+ *   v1.10.0 — 2026-07-21 — App-shell scroll model (theme.css v1.24.0): .adm-sidebar height 100vh →
+ *     calc(100dvh − nav-height) so the sticky sidebar fills the .page-content scroll region instead of
+ *     overflowing the frame by the header's height.
  *   v1.9.0 — 2026-07-16 — Drop the dead .adm-nav-item .icon rule (nav is label-only now).
  *   v1.8.0 — 2026-06-25 — Applications tab: .adm-apps-rowactions (Hide/Restore + Delete row).
  *   v1.7.0 — 2026-06-24 — Applications moderation tab: .adm-apps-* (filters row,
@@ -53,9 +56,13 @@
   border-right: none;
   padding: 16px 0;
   flex-shrink: 0;
+  /* App-shell: sticks to the top of the .page-content scroll region; height caps
+     at that region (viewport minus the fixed header) so the sidebar's own nav
+     scrolls instead of overflowing past the frame by the header's height. */
   position: sticky;
   top: 0;
-  height: 100vh;
+  height: calc(100dvh - var(--nav-height, 56px));
+  box-sizing: border-box; /* fold the 16px vertical padding into the height so it fits the scroll region */
   overflow-y: auto;
   display: flex;
   flex-direction: column;

package/dist/public/css/views/app-grant.css

@@ -4,6 +4,7 @@
  *   screen where an owner reviews a published app's requested scopes (H-2 Phase 3).
  * @version-history
  *   v1.0.0 — 2026-06-20 — Initial (H-2 app-origin isolation, Phase 3).
+ *   v1.1.0 — 2026-07-19 — Own-app badge variant + "new" chip for newly requested scopes.
  */
 
 .agr-wrap { max-width: 540px; margin: 3rem auto; padding: 0 1.25rem; }
@@ -64,6 +65,23 @@
   padding: 0.18rem 0.6rem;
   margin-bottom: 0.6rem;
 }
+/* The signed-in owner's OWN app — reassuring, not warning */
+.agr-badge-own { color: var(--success, #3dbf6e); }
+
+/* Chip on a scope the app requests but the existing grant doesn't hold yet */
+.agr-scope-newbadge {
+  display: inline-block;
+  font-size: 0.68rem;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  color: var(--accent);
+  border: 1px solid var(--accent);
+  border-radius: 999px;
+  padding: 0 0.4rem;
+  margin-left: 0.45rem;
+  vertical-align: 0.08em;
+}
 
 /* Advanced toggle (link-style button) */
 .agr-advanced-toggle {

package/dist/public/css/views/inbox.css

@@ -5,6 +5,8 @@
  *   ticks, and a sticky composer. All colors/spacing use theme.css variables (dark-mode safe).
  *   Classes are `inbox-` prefixed. NOTE: this file must be linked in spa.html (useViewCSS is a no-op).
  * @version-history
+ *   v1.7.0 -- 2026-07-21 -- Link-preview (unfurl) cards under a pasted link (.inbox-linkcard*) + the
+ *     thread-head show/hide toggle (.inbox-linkprev-toggle).
  *   v1.6.0 -- 2026-07-18 -- TRUE full-screen mobile chat: ≤760px open panel becomes `position:fixed;inset:0`
  *     over the whole viewport (covers the app shell nav/menu/breadcrumb); body height var(--inbox-avail,
  *     100dvh) + safe-area padding under the composer. ← Back drops `.inbox--panel` → shell returns. Pairs
@@ -485,7 +487,14 @@
   font-size: 14px;
 }
 
+/* Expanded composer (the ⤢ toggle): grow the fallback/simple textarea + preview to ~60vh so a long or
+   formatted draft is fully visible. The rich Toast UI editor is resized in JS via setHeight instead. */
+.inbox-composer--tall .inbox-textarea { min-height: 60vh; }
+.inbox-composer--tall .inbox-textarea--chat { max-height: 60vh; }
+.inbox-composer--tall .inbox-md-preview { max-height: 60vh; }
+
 .inbox-composer-bar { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
+.inbox-bar-left { display: flex; align-items: center; gap: 8px; }
 .inbox-attach-btn {
   display: inline-flex;
   align-items: center;
@@ -743,3 +752,40 @@
 .inbox-sched-new { display: flex; flex-direction: column; gap: 6px; }
 .inbox-sched-new .btn-primary { align-self: flex-start; }
 .inbox-sched-desc { min-height: 38px; resize: vertical; }
+
+/* ── Link previews (unfurl cards) — a rich card under a pasted link in a message bubble. The card is a
+ *    clickable row (thumbnail · site · title · description) plus a ✕ to hide it. Theme tokens only. ── */
+.inbox-linkcards { display: flex; flex-direction: column; gap: 6px; margin-top: 8px; }
+.inbox-linkcard {
+  position: relative; display: flex; align-items: stretch;
+  border: 1px solid var(--border-subtle); border-radius: var(--radius-sm);
+  background: var(--card-bg-alt); overflow: hidden;
+}
+.inbox-linkcard-main {
+  display: flex; align-items: stretch; gap: 10px; min-width: 0; flex: 1;
+  padding: 8px 10px; text-decoration: none; color: inherit;
+}
+.inbox-linkcard-main:hover { background: var(--surface-hover); }
+.inbox-linkcard-thumb { flex: none; width: 72px; display: flex; align-items: center; justify-content: center; }
+.inbox-linkcard-thumb img {
+  width: 72px; height: 72px; object-fit: cover; border-radius: var(--radius-xs); display: block; margin: 0;
+}
+.inbox-linkcard-text { display: flex; flex-direction: column; gap: 2px; min-width: 0; justify-content: center; }
+.inbox-linkcard-site { font-size: 11px; color: var(--text-dim); text-transform: uppercase; letter-spacing: .02em; }
+.inbox-linkcard-title {
+  font-size: 13px; font-weight: 600; color: var(--text); line-height: 1.3;
+  overflow: hidden; text-overflow: ellipsis; display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical;
+}
+.inbox-linkcard-desc {
+  font-size: 12px; color: var(--text-dim); line-height: 1.35;
+  overflow: hidden; text-overflow: ellipsis; display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical;
+}
+.inbox-linkcard-x {
+  flex: none; align-self: flex-start; border: none; background: transparent; cursor: pointer;
+  color: var(--text-dim); font-size: 12px; line-height: 1; padding: 6px 8px; border-radius: var(--radius-xs);
+}
+.inbox-linkcard-x:hover { color: var(--text); background: var(--surface-hover); }
+
+/* Thread-head toggle: show/hide all link previews (persisted). --on marks the active state. */
+.inbox-linkprev-toggle { flex: none; white-space: nowrap; }
+.inbox-linkprev-toggle--on { background: var(--accent-subtle); border-color: var(--accent-border); color: var(--accent); }

package/dist/public/css/views/portfolio.css

@@ -317,6 +317,52 @@
   margin-bottom: 0.5rem;
 }
 
+/* ── Promoted apps (public profile) ── */
+.portfolio-profile-head {
+  text-align: center;
+  padding: 3rem 2rem 1rem;
+  color: var(--text-dim, #6B7280);
+}
+.portfolio-profile-head h2 { color: var(--text, #1A1A2E); margin-bottom: 0.5rem; }
+.portfolio-promoted {
+  max-width: 900px;
+  margin: 0 auto;
+  padding: 0 1.5rem 1rem;
+}
+.portfolio-promoted-title {
+  font-size: 1rem;
+  color: var(--text, #1A1A2E);
+  margin: 0 0 0.75rem;
+}
+.portfolio-promoted-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(240px, 1fr));
+  gap: 0.75rem;
+}
+.portfolio-promoted-card {
+  display: block;
+  text-decoration: none;
+  border: 1px solid var(--border, #E5E7EB);
+  border-radius: 12px;
+  padding: 0.85rem 1rem;
+  background: var(--card, #fff);
+  transition: border-color 0.15s, transform 0.15s;
+}
+.portfolio-promoted-card:hover {
+  border-color: var(--accent, #E8564A);
+  transform: translateY(-1px);
+}
+.portfolio-promoted-name {
+  font-weight: 700;
+  color: var(--text, #1A1A2E);
+  margin-bottom: 0.3rem;
+}
+.portfolio-promoted-pitch {
+  font-size: 0.85rem;
+  color: var(--text-dim, #6B7280);
+  line-height: 1.4;
+}
+
 /* ── Upload Section ── */
 .portfolio-upload-zone {
   border: 2px dashed var(--border, #E5E7EB);