aimeat 2.0.0 → 2.2.0

package/dist/.env.example

@@ -315,10 +315,15 @@ AIMEAT_PORT=40050
 # AIMEAT_VAT_RATE_PERCENT=25.5             # Default ALV/VAT rate for money-sale bookings (Finland standard 25.5%); overridable per company.
 # AIMEAT_PLATFORM_STRIPE_KEY=              # Legacy alias for AIMEAT_STRIPE_SECRET_KEY (only used if the latter is unset).
 
-# ── x402 stablecoin settlement (TARGET-042) — NON-CUSTODIAL USDC on a USD price ──
-# AIMEAT_X402_ENABLED=false               # Register the x402 USDC PaymentHandler (settles money/USD sessions via the exact scheme + facilitator). OFF by default: advertise the exact scheme only when the node can settle it.
-# AIMEAT_X402_NETWORK=base-sepolia        # Network id in the accepts[] exact scheme: base-sepolia (testnet) | base (mainnet). A parameter, not hardcoded — Solana etc. drop in via the network registry (src/commerce/x402-facilitator.ts).
-# AIMEAT_X402_FACILITATOR_URL=https://x402.org/facilitator  # Facilitator /verify + /settle base URL (all calls go through safeFetch). Coinbase CDP facilitator in prod; the public x402.org one covers Base Sepolia.
+# ── x402 stablecoin settlement (TARGET-042) — NON-CUSTODIAL stablecoin on a fiat price ──
+# The token follows the price: a USD session settles in USDC, a EUR session in EURC. One seller payout
+# address receives both. The currencies the node advertises are DERIVED from the assets the configured
+# network has, so a currency is never offered unless it can really settle.
+# AIMEAT_PACING_TOLL_DEFAULT=0           # Morsels burned per METERED call when the capability declares no toll of its own. Morsels replenish daily with a hard ceiling, so a non-zero value puts an absolute RATE floor under every capability - including money-priced ones, whose only other brake is the buyer's total budget. Applies on every metered path (app tools, exchange runs, agent work, raw extension invokes). 0 = off (existing billing unchanged).
+# AIMEAT_X402_ENABLED=false               # Register the x402 PaymentHandler (settles money sessions via the exact scheme + facilitator). OFF by default: advertise the exact scheme only when the node can settle it.
+# AIMEAT_X402_NETWORK=base-sepolia        # Network id in the accepts[] exact scheme: base-sepolia (testnet) | base (mainnet). Both carry USDC + EURC. A parameter, not hardcoded — Solana etc. drop in via the network registry (src/commerce/x402-facilitator.ts).
+# AIMEAT_X402_FACILITATOR_URL=https://x402.org/facilitator  # Facilitator /verify + /settle base URL (all calls go through safeFetch). The public x402.org one covers Base Sepolia (USDC and EURC alike) but NOT Base mainnet — mainnet needs a facilitator that serves it, e.g. Coinbase CDP.
+# AIMEAT_X402_RPC_URL=                    # OPTIONAL read-only JSON-RPC (e.g. https://mainnet.base.org). Used ONLY to check that a seller's payout address is an account, not a contract, before it is saved. Empty = check skipped; a payout setting must not depend on a third party being up.
 # AIMEAT_X402_TEST_FACILITATOR=false      # TEST ONLY: an off-chain facilitator double so the x402 chain is E2E-provable without a testnet wallet. NEVER in prod (real settlement = the real facilitator).
 
 # ── Crawlers / Content Signals / Web Bot Auth ──────────────────

package/dist/locales/en.json

@@ -10,10 +10,18 @@
   "inbox.sending": "Sending…",
   "inbox.reply": "Reply",
   "inbox.quoteReply": "Reply to this message",
+  "inbox.copyMessage": "Copy this message to the clipboard",
+  "inbox.copied": "Copied",
   "inbox.quoteJump": "Show the original message",
   "inbox.quoteYou": "You",
   "inbox.replyingTo": "Replying to",
   "inbox.quoteCancel": "Cancel the quoted reply",
+  "inbox.linkPreview.label": "Previews",
+  "inbox.linkPreview.hide": "Hide this preview",
+  "inbox.linkPreview.hideAll": "Hide link previews",
+  "inbox.linkPreview.showAll": "Show link previews",
+  "inbox.thread.showAll": "Show all messages",
+  "inbox.thread.showRecent": "Show last 50",
   "inbox.attachmentRemove": "Remove attachment",
   "inbox.contactAgentSuffix": "(your agent)",
   "inbox.messageThis": "Send a message",
@@ -49,6 +57,23 @@
   "inbox.schedError": "Could not schedule.",
   "inbox.parkToNotebook": "Add to notebook for later",
   "inbox.parkedToNotebook": "Added to your notebook.",
+  "inbox.notebook.toNotebook": "Summarize to Notebook",
+  "inbox.notebook.toNotebookShort": "Notebook",
+  "inbox.notebook.modeAi": "AI summary (my key)",
+  "inbox.notebook.modeCopy": "Copy prompt",
+  "inbox.notebook.modeRaw": "Raw",
+  "inbox.notebook.hintAi": "Summarize this whole conversation with your own OpenRouter key, review it, then send it to the Notebook to file into a workspace.",
+  "inbox.notebook.hintCopy": "Copy this prompt into your own AI chat, then paste the summary back below and send it to the Notebook.",
+  "inbox.notebook.hintRaw": "Send the whole chain (text + images) to the Notebook as-is, and refine it there with classify / distribute.",
+  "inbox.notebook.genSummary": "Summarize with AI",
+  "inbox.notebook.summarizing": "Summarizing…",
+  "inbox.notebook.regen": "Regenerate",
+  "inbox.notebook.park": "Send to Notebook",
+  "inbox.notebook.parkRaw": "Send to Notebook",
+  "inbox.notebook.parked": "Sent to the Notebook.",
+  "inbox.notebook.pasteHint": "Paste the AI's summary here:",
+  "inbox.notebook.pastePh": "Paste the summary the AI gave you…",
+  "inbox.notebook.summaryEmpty": "The model returned nothing — try again.",
   "inbox.viaAgent": "via",
   "inbox.sentByAgent": "Sent by your agent",
   "inbox.viaAgentReadonly": "Sent by your agent {agent} — view only.",
@@ -148,6 +173,8 @@
   "admin.messages.detail": "Detail",
   "admin.messages.none": "No deliveries yet.",
   "inbox.attach": "Attach a file",
+  "inbox.expand": "Enlarge the editor",
+  "inbox.collapse": "Shrink the editor",
   "inbox.today": "Today",
   "inbox.yesterday": "Yesterday",
   "inbox.youPrefix": "You:",
@@ -579,7 +606,10 @@
     "loginCta": "Log in",
     "errorTitle": "Cannot grant access",
     "missing": "No authorization request.",
-    "expired": "This request has expired."
+    "expired": "This request has expired.",
+    "ownBadge": "Your app",
+    "ownIntro": "This is your own app. It still uses a scoped, revocable key — never your login session.",
+    "newScope": "new"
   },
   "common": {
     "cancel": "Cancel",
@@ -607,6 +637,7 @@
   "notif": {
     "title": "Notifications",
     "empty": "No notifications yet",
+    "clearAll": "Clear all",
     "action": {
       "reply": "Reply",
       "approve": "Approve",
@@ -2509,6 +2540,16 @@
       "pspRemove": "Remove",
       "pspSaved": "Payment key saved",
       "pspRemoved": "Payment key removed",
+      "x402Title": "Stablecoin payouts (x402)",
+      "x402Desc": "A different rail from Stripe: a buyer signs a stablecoin payment and the facilitator settles it on-chain straight to this address. The token follows the price — a dollar price settles in USDC, a euro price in EURC — and the same address receives both. Non-custodial: the node holds no key and no funds. Without an address, a stablecoin sale of yours fails.",
+      "x402Configured": "Payout address set",
+      "x402Missing": "No payout address",
+      "x402Save": "Save address",
+      "x402Remove": "Remove",
+      "x402Saved": "Payout address saved",
+      "x402Removed": "Payout address removed. Card and invoice settlement is unaffected.",
+      "x402Invalid": "An address is 0x followed by 40 hex characters.",
+      "x402Testnet": "test network",
       "moneyTitle": "Money purchases & sales",
       "moneyDesc": "Real-money (EUR/USD) checkout activity — separate from morsels. Funds move through the seller's own payment provider, never the node.",
       "moneyPurchases": "Purchases",
@@ -2888,6 +2929,8 @@
       "operatorHiddenHint": "An operator has hidden this app from public view. Only you can still see it. Contact the operator to appeal.",
       "agentBadge": "Ships an agent",
       "agentBadgeHint": "This app ships its own agent - deploy it onto your fleet below",
+      "promotedBadge": "Promoted",
+      "promotedBadgeHint": "Promoted on your public profile — manage the pitch in the app catalog",
       "agentsLabel": "Bundled agents",
       "agentDeploy": "Deploy to my fleet",
       "agentUndeploy": "Undeploy",
@@ -3004,6 +3047,12 @@
       "agConfirmRevoke": "Revoke access for \"{name}\"? It loses access immediately.",
       "agRevoked": "App access revoked",
       "agRevoke": "Revoke",
+      "agScopesToggle": "Show or hide the granted permissions",
+      "agUnusedNote": "{count} of these have not been used in over {days} days.",
+      "agRevokeUnused": "Revoke {count} unused",
+      "agConfirmRevokeUnused": "Revoke access for {count} apps unused for over {days} days? They lose access immediately.",
+      "agRevokedCount": "{count} app grants revoked",
+      "agRevokedSome": "{done} revoked, {failed} failed",
       "patTitle": "Agent Access Tokens",
       "patDesc": "Create a revocable token an agent can use (as a Bearer header) to log in and test your apps. One token can be shared across all your agents.",
       "patLabelRequired": "Give the token a name",
@@ -3354,6 +3403,11 @@
         "frontier": "Frontier-safe — a version-drift trap for weaker models; they must read its doc",
         "needs-doc": "AIMEAT-authored wrapper — the AI must fetch its doc to use it (no priors)"
       },
+      "tierLabel": {
+        "any": "ANY MODEL",
+        "frontier": "VERSION TRAP",
+        "needs-doc": "READ THE DOC"
+      },
       "heroDesc": "Get more done with less. AI Chat can handle bigger apps when you hand it ready-made cortex building blocks — reusable UI libraries, schemas, and prompts. Use the same cortex across multiple apps.",
       "visibility": {
         "private": "Private",
@@ -4476,6 +4530,11 @@
     "errFederatedLogin": "Could not reach home node {remoteNode} for federated login.",
     "loggedIn": "logged in",
     "logoutBtn": "Logout",
+    "switchLanguage": "Language",
+    "themeLabel": "Theme",
+    "lightMode": "Light mode",
+    "darkMode": "Dark mode",
+    "chooseLook": "Choose look",
     "usernameLabel": "Username",
     "passwordLabel": "Password",
     "displayNameLabel": "Display Name",
@@ -4502,6 +4561,8 @@
     "completeAccountTitle": "One last step",
     "completeAccountDesc": "Add an email to finish setting up your account. We’ll send a verification code to confirm it.",
     "completeAccountDescResend": "Confirm your email to finish signing in. We’ll send a verification code — edit the address if it’s wrong.",
+    "registerEmailTitle": "Add your email",
+    "registerEmailDesc": "Enter your email to create your account. We’ll send a verification code to confirm it.",
     "sendVerificationCode": "Send Verification Code",
     "enterCodeTitle": "Enter Verification Code",
     "enterCodeDesc": "We sent a 6-digit code to your email. Enter it below to finish and sign in.",
@@ -6447,6 +6508,7 @@
       "notFound": "Portfolio not found",
       "notFoundDesc": "This user hasn't published a portfolio yet.",
       "loginToSeeMore": "Log in to see more content",
+      "promoted": "Promoted apps",
       "backToPortal": "Home",
       "fullscreen": "Fullscreen",
       "standalone": "Own address"

package/dist/locales/fi.json

@@ -10,10 +10,18 @@
   "inbox.sending": "Lähetetään…",
   "inbox.reply": "Vastaa",
   "inbox.quoteReply": "Vastaa tähän viestiin",
+  "inbox.copyMessage": "Kopioi tämä viesti leikepöydälle",
+  "inbox.copied": "Kopioitu",
   "inbox.quoteJump": "Näytä alkuperäinen viesti",
   "inbox.quoteYou": "Sinä",
   "inbox.replyingTo": "Vastataan:",
   "inbox.quoteCancel": "Peru lainattu vastaus",
+  "inbox.linkPreview.label": "Esikatselut",
+  "inbox.linkPreview.hide": "Piilota tämä esikatselu",
+  "inbox.linkPreview.hideAll": "Piilota linkkien esikatselut",
+  "inbox.linkPreview.showAll": "Näytä linkkien esikatselut",
+  "inbox.thread.showAll": "Näytä kaikki viestit",
+  "inbox.thread.showRecent": "Näytä viimeiset 50",
   "inbox.attachmentRemove": "Poista liite",
   "inbox.contactAgentSuffix": "(agenttisi)",
   "inbox.messageThis": "Lähetä viesti",
@@ -49,6 +57,23 @@
   "inbox.schedError": "Ajastus epäonnistui.",
   "inbox.parkToNotebook": "Lisää muistikirjaan myöhempää varten",
   "inbox.parkedToNotebook": "Lisätty muistikirjaasi.",
+  "inbox.notebook.toNotebook": "Yhteenveto Notebookiin",
+  "inbox.notebook.toNotebookShort": "Notebook",
+  "inbox.notebook.modeAi": "AI-yhteenveto (oma avain)",
+  "inbox.notebook.modeCopy": "Kopioi prompti",
+  "inbox.notebook.modeRaw": "Raakana",
+  "inbox.notebook.hintAi": "Tiivistä koko tämä keskustelu omalla OpenRouter-avaimellasi, tarkista se, ja vie se Notebookiin arkistoitavaksi workspaceen.",
+  "inbox.notebook.hintCopy": "Kopioi tämä prompti omaan AI-chattiisi, liitä yhteenveto alle ja vie se Notebookiin.",
+  "inbox.notebook.hintRaw": "Vie koko ketju (teksti + kuvat) Notebookiin sellaisenaan, ja jalosta se siellä classify / distribute -toiminnoilla.",
+  "inbox.notebook.genSummary": "Tee yhteenveto AI:lla",
+  "inbox.notebook.summarizing": "Tiivistetään…",
+  "inbox.notebook.regen": "Uudelleen",
+  "inbox.notebook.park": "Vie Notebookiin",
+  "inbox.notebook.parkRaw": "Vie Notebookiin",
+  "inbox.notebook.parked": "Viety Notebookiin.",
+  "inbox.notebook.pasteHint": "Liitä AI:n yhteenveto tähän:",
+  "inbox.notebook.pastePh": "Liitä AI:n antama yhteenveto…",
+  "inbox.notebook.summaryEmpty": "Malli ei palauttanut mitään — yritä uudelleen.",
   "inbox.viaAgent": "via",
   "inbox.sentByAgent": "Lähettänyt agenttisi",
   "inbox.viaAgentReadonly": "Lähettänyt agenttisi {agent} — vain katselu.",
@@ -148,6 +173,8 @@
   "admin.messages.detail": "Lisätieto",
   "admin.messages.none": "Ei toimituksia vielä.",
   "inbox.attach": "Liitä tiedosto",
+  "inbox.expand": "Suurenna editori",
+  "inbox.collapse": "Pienennä editori",
   "inbox.today": "Tänään",
   "inbox.yesterday": "Eilen",
   "inbox.youPrefix": "Sinä:",
@@ -579,7 +606,10 @@
     "loginCta": "Kirjaudu",
     "errorTitle": "Pääsyä ei voida myöntää",
     "missing": "Ei valtuutuspyyntöä.",
-    "expired": "Tämä pyyntö on vanhentunut."
+    "expired": "Tämä pyyntö on vanhentunut.",
+    "ownBadge": "Oma appisi",
+    "ownIntro": "Tämä on oma appisi. Sekin käyttää rajattua, peruttavaa avainta — ei koskaan kirjautumisistuntoasi.",
+    "newScope": "uusi"
   },
   "common": {
     "cancel": "Peruuta",
@@ -607,6 +637,7 @@
   "notif": {
     "title": "Ilmoitukset",
     "empty": "Ei ilmoituksia vielä",
+    "clearAll": "Tyhjennä kaikki",
     "action": {
       "reply": "Vastaa",
       "approve": "Hyväksy",
@@ -2509,6 +2540,16 @@
       "pspRemove": "Poista",
       "pspSaved": "Maksuavain tallennettu",
       "pspRemoved": "Maksuavain poistettu",
+      "x402Title": "Stablecoin-tilitykset (x402)",
+      "x402Desc": "Eri raide kuin Stripe: ostaja allekirjoittaa stablecoin-maksun ja fasilitaattori tilittää sen ketjussa suoraan tähän osoitteeseen. Rahake määräytyy hinnan mukaan: dollarihinta tilittyy USDC:nä ja eurohinta EURC:nä, ja sama osoite ottaa vastaan molemmat. Ei-säilytyksellinen: noodi ei pidä avainta eikä varoja. Ilman osoitetta stablecoin-myyntisi kaatuu.",
+      "x402Configured": "Tilitysosoite asetettu",
+      "x402Missing": "Ei tilitysosoitetta",
+      "x402Save": "Tallenna osoite",
+      "x402Remove": "Poista",
+      "x402Saved": "Tilitysosoite tallennettu",
+      "x402Removed": "Tilitysosoite poistettu. Kortti- ja laskutilitys ei muutu.",
+      "x402Invalid": "Osoite on 0x ja 40 heksamerkkiä.",
+      "x402Testnet": "testiverkko",
       "moneyTitle": "Rahaostot ja -myynnit",
       "moneyDesc": "Rahamaksut (EUR/USD) — erillään murusista. Varat liikkuvat myyjän oman maksupalvelun kautta, ei koskaan noodin.",
       "moneyPurchases": "Ostot",
@@ -2888,6 +2929,8 @@
       "operatorHiddenHint": "Operaattori on piilottanut tämän sovelluksen julkisesta näkymästä. Vain sinä näet sen edelleen. Ota yhteyttä operaattoriin valittaaksesi.",
       "agentBadge": "Sisältää agentin",
       "agentBadgeHint": "Tämä sovellus tuo mukanaan oman agentin - ota se käyttöön omaan laivueeseesi alta",
+      "promotedBadge": "Nostettu",
+      "promotedBadgeHint": "Nostettu julkiseen profiiliisi — hallitse myyntipuhetta sovelluskatalogissa",
       "agentsLabel": "Mukana tulevat agentit",
       "agentDeploy": "Ota käyttöön laivueeseeni",
       "agentUndeploy": "Poista käytöstä",
@@ -3004,6 +3047,12 @@
       "agConfirmRevoke": "Peruutetaanko sovelluksen \"{name}\" pääsy? Se menettää pääsyn välittömästi.",
       "agRevoked": "Sovelluksen pääsy peruutettu",
       "agRevoke": "Peruuta",
+      "agScopesToggle": "Näytä tai piilota myönnetyt oikeudet",
+      "agUnusedNote": "Näistä {count} on ollut käyttämättä yli {days} päivää.",
+      "agRevokeUnused": "Peruuta {count} käyttämätöntä",
+      "agConfirmRevokeUnused": "Peruutetaanko pääsy {count} sovellukselta, joita ei ole käytetty yli {days} päivään? Ne menettävät pääsyn välittömästi.",
+      "agRevokedCount": "{count} sovelluksen pääsy peruutettu",
+      "agRevokedSome": "{done} peruutettu, {failed} epäonnistui",
       "patTitle": "Agenttien käyttötokenit",
       "patDesc": "Luo peruutettava token, jota agentti voi käyttää (Bearer-headerina) kirjautuakseen ja testatakseen appejasi. Yhtä tokenia voi jakaa kaikille agenteillesi.",
       "patLabelRequired": "Anna tokenille nimi",
@@ -3354,6 +3403,11 @@
         "frontier": "Vahvoille malleille turvallinen — versioansa heikommille; niiden on luettava dokumentaatio",
         "needs-doc": "AIMEAT:n oma wrapper — tekoälyn on haettava dokumentaatio käyttääkseen sitä (ei ennakkotietoa)"
       },
+      "tierLabel": {
+        "any": "KAIKILLE MALLEILLE",
+        "frontier": "VERSIOANSA",
+        "needs-doc": "LUE DOKUMENTTI"
+      },
       "heroDesc": "Cortexeilla saat enemmän aikaiseksi vähemmällä. AI Chat suoriutuu isommista sovelluksista kun annat sille valmiita cortex-rakennuspalikoita — uudelleenkäytettäviä UI-kirjastoja, skeemoja ja prompteja. Voit käyttää samaa cortexia useassa sovelluksessa.",
       "visibility": {
         "private": "Yksityinen",
@@ -4476,6 +4530,11 @@
     "errFederatedLogin": "Kotisolmuun {remoteNode} ei saatu yhteyttä federoitua kirjautumista varten.",
     "loggedIn": "kirjautuneena",
     "logoutBtn": "Kirjaudu ulos",
+    "switchLanguage": "Kieli",
+    "themeLabel": "Teema",
+    "lightMode": "Vaalea tila",
+    "darkMode": "Tumma tila",
+    "chooseLook": "Valitse tyyli",
     "usernameLabel": "Käyttäjänimi",
     "passwordLabel": "Salasana",
     "displayNameLabel": "Näyttönimi",
@@ -4502,6 +4561,8 @@
     "completeAccountTitle": "Vielä yksi vaihe",
     "completeAccountDesc": "Lisää sähköpostiosoite viimeistelläksesi tilisi. Lähetämme vahvistuskoodin sen vahvistamiseksi.",
     "completeAccountDescResend": "Vahvista sähköpostiosoitteesi kirjautuaksesi sisään. Lähetämme vahvistuskoodin — muokkaa osoitetta, jos se on väärin.",
+    "registerEmailTitle": "Lisää sähköpostiosoitteesi",
+    "registerEmailDesc": "Anna sähköpostiosoitteesi luodaksesi tilisi. Lähetämme vahvistuskoodin sen vahvistamiseksi.",
     "sendVerificationCode": "Lähetä vahvistuskoodi",
     "enterCodeTitle": "Syötä vahvistuskoodi",
     "enterCodeDesc": "Lähetimme 6-numeroisen koodin sähköpostiisi. Syötä se alle viimeistelläksesi ja kirjautuaksesi sisään.",
@@ -6447,6 +6508,7 @@
       "notFound": "Portfoliota ei löytynyt",
       "notFoundDesc": "Tämä käyttäjä ei ole julkaissut portfoliota.",
       "loginToSeeMore": "Kirjaudu sisään nähdäksesi lisää",
+      "promoted": "Nostetut sovellukset",
       "backToPortal": "Koti",
       "fullscreen": "Koko näyttö",
       "standalone": "Oma osoite"

package/dist/public/components/LinkPreview.js

@@ -0,0 +1,101 @@
+/**
+ * @file public/components/LinkPreview.js
+ * @description Rich link-preview (unfurl) cards for a pasted URL. `LinkPreview` fetches one URL's
+ *   OpenGraph metadata from the node (`/js/services/unfurl.js`) and renders a card (site · title ·
+ *   description · thumbnail); the thumbnail is pulled through the node's image proxy into a `blob:`
+ *   URL so the SPA's remote-image CSP is satisfied. `MessageLinkPreviews` extracts the URLs from a
+ *   message body and renders a card per link, each with a ✕ that hides it (persisted in localStorage,
+ *   so a dismissed card stays hidden). `extractUrls` is exported for reuse/testing.
+ * @structure extractUrls(text,max) · LinkPreview({url,onDismiss}) · MessageLinkPreviews({msg})
+ * @usage html`<${MessageLinkPreviews} msg=${msg} />`
+ * @version-history
+ *   v1.0.0 — 2026-07-21 — Initial link-preview cards (inbox message threads).
+ */
+import { h } from 'preact';
+import { useState, useEffect } from 'preact/hooks';
+import htm from 'htm';
+const html = htm.bind(h);
+import { t } from '/js/i18n.js';
+import { escHtml } from '/js/utils.js';
+import * as unfurl from '/js/services/unfurl.js';
+
+/** Pull up to `max` distinct bare http(s) URLs out of a message body, trimming trailing sentence
+ *  punctuation (mirrors the Markdown autolink trimming so the card links the same target the text does). */
+export function extractUrls(text, max = 3) {
+  const urls = [];
+  if (typeof text !== 'string') return urls;
+  const re = /(?:^|[\s(<[])(https?:\/\/[^\s<>()[\]]+)/gi;
+  let m;
+  while ((m = re.exec(text)) !== null && urls.length < max) {
+    let u = m[1].replace(/[.,;:!?'"]+$/, '');
+    if (u && !urls.includes(u)) urls.push(u);
+  }
+  return urls;
+}
+
+// Dismissed cards persist across reloads: a Set of `${messageId}::${url}` keys in localStorage (capped).
+const DISMISS_KEY = 'aimeat.inbox.linkcard.dismissed';
+function loadDismissed() {
+  try { return new Set(JSON.parse(localStorage.getItem(DISMISS_KEY) || '[]')); } catch { return new Set(); }
+}
+function saveDismissed(set) {
+  try { localStorage.setItem(DISMISS_KEY, JSON.stringify([...set].slice(-500))); } catch { /* quota */ }
+}
+
+/** One preview card. Renders nothing while loading, or if the link has no usable metadata. */
+export function LinkPreview({ url, onDismiss }) {
+  const [meta, setMeta] = useState(undefined); // undefined = loading, null = nothing to show
+  const [imgUrl, setImgUrl] = useState(null);
+
+  useEffect(() => {
+    let alive = true;
+    let objectUrl = null;
+    setMeta(undefined); setImgUrl(null);
+    (async () => {
+      const m = await unfurl.fetchPreview(url);
+      if (!alive) return;
+      // A card with no title/description/image isn't worth showing (avoid an empty box on a bare domain).
+      if (!m || (!m.title && !m.description && !m.image)) { setMeta(null); return; }
+      setMeta(m);
+      if (m.image) {
+        objectUrl = await unfurl.fetchPreviewImageUrl(m.image);
+        if (!alive) { if (objectUrl) URL.revokeObjectURL(objectUrl); return; }
+        if (objectUrl) setImgUrl(objectUrl);
+      }
+    })();
+    return () => { alive = false; if (objectUrl) URL.revokeObjectURL(objectUrl); };
+  }, [url]);
+
+  if (meta === undefined || meta === null) return null;
+  return html`
+    <div class="inbox-linkcard">
+      <a class="inbox-linkcard-main" href=${meta.resolvedUrl || url} target="_blank" rel="noopener noreferrer nofollow">
+        ${imgUrl ? html`<span class="inbox-linkcard-thumb"><img src=${imgUrl} alt="" loading="lazy" /></span>` : null}
+        <span class="inbox-linkcard-text">
+          ${meta.siteName ? html`<span class="inbox-linkcard-site">${escHtml(meta.siteName)}</span>` : null}
+          ${meta.title ? html`<span class="inbox-linkcard-title">${escHtml(meta.title)}</span>` : null}
+          ${meta.description ? html`<span class="inbox-linkcard-desc">${escHtml(meta.description)}</span>` : null}
+        </span>
+      </a>
+      <button class="inbox-linkcard-x" title=${t('inbox.linkPreview.hide')}
+        onClick=${() => onDismiss?.(url)}>✕</button>
+    </div>`;
+}
+
+/** All preview cards for one message: a card per non-dismissed URL in its body. */
+export function MessageLinkPreviews({ msg }) {
+  const urls = extractUrls(msg?.body || '');
+  const [dismissed, setDismissed] = useState(loadDismissed);
+  if (urls.length === 0) return null;
+  const visible = urls.filter(u => !dismissed.has(`${msg.id}::${u}`));
+  if (visible.length === 0) return null;
+  const dismiss = (u) => {
+    const next = new Set(dismissed);
+    next.add(`${msg.id}::${u}`);
+    setDismissed(next);
+    saveDismissed(next);
+  };
+  return html`<div class="inbox-linkcards">
+    ${visible.map(u => html`<${LinkPreview} key=${u} url=${u} onDismiss=${dismiss} />`)}
+  </div>`;
+}

package/dist/public/components/NotificationBell.js

@@ -17,6 +17,8 @@
  *     same deep-link translation as bell clicks (supports both '#hash' and '?tab=' forms).
  *   v1.2.0 — 2026-07-18 — Inline notification actions: reply box (POST /v1/messages) + api buttons
  *     (approve/deny/accept/decline/reject) that call the action endpoint with the owner's session.
+ *   v1.3.0 — 2026-07-19 — "Clear all" in the dropdown head (DELETE /v1/notifications) — deletes every
+ *     notification for the owner (not just mark-read), optimistic empty + reconcile.
  */
 import { h } from 'preact';
 import { useState, useEffect, useRef, useCallback } from 'preact/hooks';
@@ -99,11 +101,23 @@ export function NotificationBell({ t, onNavigate }) {
   const [results, setResults] = useState({});        // notifId → { ok, msg }
   const ref = useRef(null);
 
+  const [clearing, setClearing] = useState(false);
+
   const load = useCallback(async () => {
     const r = await api('/v1/notifications');
     if (r && r.data) { setItems(r.data.notifications || []); setUnread(r.data.unread || 0); }
   }, []);
 
+  // "Clear all" — delete every notification for the owner (not just mark read). Optimistic: empty the
+  // list + zero the badge immediately, then reconcile from the server response.
+  const clearAll = useCallback(async () => {
+    setClearing(true);
+    setItems([]); setUnread(0); setReplyFor(null); setResults({});
+    await api('/v1/notifications', { method: 'DELETE', body: JSON.stringify({}) });
+    setClearing(false);
+    load();
+  }, [load]);
+
   useEffect(() => {
     load();
     return onLiveUpdate(['agent-messages', 'agent-tasks', 'notifications', 'workspace-access'], () => load());
@@ -215,7 +229,10 @@ export function NotificationBell({ t, onNavigate }) {
       </button>
       ${open ? html`
         <div class="notif-dropdown">
-          <div class="notif-dropdown-head">${tr('notif.title', 'Notifications')}</div>
+          <div class="notif-dropdown-head">
+            <span>${tr('notif.title', 'Notifications')}</span>
+            ${items.length > 0 ? html`<button class="notif-clear-all" disabled=${clearing} onClick=${(e) => { e.stopPropagation(); clearAll(); }}>${clearing ? '…' : tr('notif.clearAll', 'Clear all')}</button>` : null}
+          </div>
           ${items.length === 0
             ? html`<div class="notif-empty">${tr('notif.empty', 'No notifications yet')}</div>`
             : items.map(n => renderItem(n))}