aimeat 2.6.1 → 3.0.0

package/README.md

@@ -182,6 +182,60 @@ An app is also an **agent surface**: any function it exposes can be published as
 
 ## What You Can Do
 
+### Use the AI chat you like, with your node in it
+
+One command connects **Goose, Claude Code, Cursor, VS Code or Claude Desktop** to your node:
+
+```bash
+aimeat connect client goose --url https://aimeat.io --owner your-handle
+```
+
+It does three things. It authorizes an agent **of its own** for that program (you approve it from your
+profile -> Agents tab, as always). It writes the MCP settings in the shape that program expects,
+merging into whatever you already had. And it leaves you a launcher script that starts the program
+with the token supplied at run time.
+
+| Client | How it reaches the node | Config it writes |
+|---|---|---|
+| `goose` | `POST /v1/mcp` | `config.yaml` -> `extensions` |
+| `claude-code` | `POST /v1/mcp` | `claude mcp add-json`, user scope |
+| `cursor` | `POST /v1/mcp` | `~/.cursor/mcp.json` |
+| `vscode` | `POST /v1/mcp` | user `mcp.json` -> `servers` |
+| `claude-desktop` | local connector over stdio | `claude_desktop_config.json` |
+
+Options: `--agent <name>` names the agent, `--workdir <path>` decides where the program starts (an
+agent writes files where it is launched, so this keeps it out of your source repos), `--surface
+appdev` narrows the toolset to app building, `--home <path>` puts the credential somewhere else,
+`--name <server>` lets a second node live alongside the first.
+
+**Two guarantees, because this command edits files you own.** Your token is never written into a
+config file: each client is given a variable reference, a headers-helper command, or the local
+connector, and the token itself stays in the connector home. And every other MCP server you had
+configured is left exactly as it was -- the command merges, backs the file up first, and refuses to
+write at all if it cannot parse what is there.
+
+After it runs you are talking to your own memory, apps, organisms, workspaces, tasks and the
+marketplace from that window: "what do I have in my workspace", "build me an app that does X",
+"what did my agents do today".
+
+**Goose is the one to try if you want a chat that is not Claude, ChatGPT or Grok.** It is an open
+source terminal agent that takes its model from **OpenRouter**, so you pick the model and pay per
+token for exactly what you use -- a strong model for a hard build, a cheap one for everything else,
+switched in seconds:
+
+```bash
+# a model for this session only
+$env:GOOSE_MODEL = "z-ai/glm-5.2"; C:\Users\you\.aimeat-goose\launch-goose.ps1
+GOOSE_MODEL=z-ai/glm-5.2 ~/.aimeat-goose/launch-goose.sh
+
+# inside a running session
+/model deepseek/deepseek-v3.2     # switch model without restarting
+/mode auto                        # stop confirming every tool call
+```
+
+Set `OPENROUTER_API_KEY` in your environment before launching. The full toolset costs roughly 50k
+input tokens per turn; `--surface appdev` cuts that to about a third when you are only building apps.
+
 ### Connect AI agents
 
 <img src="assets/screenshots/profile-agents.png" alt="Agent connection prompt" width="600" />
@@ -452,6 +506,9 @@ npx aimeat seed     # seed example packages (in another terminal, server must be
 
 # Or just connect an agent to someone else's node
 npx aimeat connect --url https://your-node --owner your-handle
+
+# Or point your own AI chat at a node in one command (goose | claude-code | cursor | vscode | claude-desktop)
+npx aimeat connect client goose --url https://aimeat.io --owner your-handle
 ```
 
 **App thumbnails (optional).** `aimeat screenshot-worker` renders each published app and stores a

package/dist/.env.example

@@ -23,6 +23,13 @@ AIMEAT_PORT=40050
 # AIMEAT_PORTFOLIO_HOST="portfolio.your-domain.com"  # default: portfolio.<AIMEAT_BASE_URL host>, empty for localhost/IP
 # AIMEAT_PORTFOLIO_ORIGIN_ENABLED=false              # true → standalone portfolio URLs advertised + served
 
+# ── Company Origin (company-in-a-box) ─────────────────────────
+# A registered company's front page served at <slug>.co.<host> — the co family is to
+# companies what the apps family is to apps (same isolation model + infra: wildcard DNS +
+# TLS + an nginx block that sets X-Co-Origin and X-Subdomain).
+# AIMEAT_CO_HOST="co.your-domain.com"      # default: co.<AIMEAT_BASE_URL host>, empty for localhost/IP
+# AIMEAT_CO_ORIGIN_ENABLED=false           # true → company addresses advertised + served
+
 # ── Storage Backend ───────────────────────────────────────────
 # Choose storage: memory (default, data lost on restart), sqlite (file-based, zero-config),
 # or postgres-kysely (production PostgreSQL; schema migrates on boot).
@@ -146,6 +153,7 @@ AIMEAT_PORT=40050
 # AIMEAT_JSON_BODY_LIMIT_MB=5                 # Default JSON body limit (default: 5MB)
 # AIMEAT_JSON_BODY_LIMIT_LARGE_MB=15          # Large body limit for apps/extensions (default: 15MB)
 # AIMEAT_EXT_MAX_DEBIT=100                    # Max morsels per extension wallet.consume() call
+# AIMEAT_EXT_MAX_PAY_MORSELS=10000            # Ceiling on commercial.payMorsels in a manifest
 # AIMEAT_FEDERATION_AUTH_POLICY=disabled       # disabled | all_peers | specific_peers
 # AIMEAT_FEDERATION_DEFAULT_SCOPES=memory:read,catalogue:read
 
@@ -220,6 +228,21 @@ AIMEAT_PORT=40050
 # AIMEAT_AI_SUPERVISORY_NAME="Liikenne- ja viestintävirasto Traficom"
 # AIMEAT_AI_SUPERVISORY_URL="https://www.traficom.fi"
 #
+# AIMEAT_AI_COP_SECTIONS / _SIGNED_ON — which sections of the EU Code of Practice on Transparency of
+#   AI-generated Content YOUR ORGANISATION has signed, and when. Empty is the default and the only
+#   value that ships, because the signature belongs to the operator and not to this software: a
+#   value written into the source would make every node running it claim somebody else's signature,
+#   in the one document a regulator reads first. Set it only after the AI Office has confirmed your
+#   signature, and set only the sections you actually signed — GET /v1/ai-transparency then reports
+#   `code_of_practice.signatory: true` with those sections, the date, and the sections you did NOT
+#   sign together with the reason. Leave it empty and the statement says you are not a signatory.
+#   Section 1 is the provider commitment (machine-readable marking of model output), Section 2 the
+#   deployer commitment (labelling deep fakes and AI-generated or manipulated published text).
+#   Note: using the EU AI Office label icons says nothing about being a signatory, and this node
+#   never presents it as if it did.
+# AIMEAT_AI_COP_SECTIONS="2"
+# AIMEAT_AI_COP_SIGNED_ON="2026-08-01"
+#
 # Startup self-check: when the resolved profile is `public`, the node warns loudly (or refuses
 # to start) on an unsafe combination — AIMEAT_ANONYMOUS=true, AIMEAT_ALLOW_PRIVATE_EGRESS=true,
 # AIMEAT_FEDERATION_OPEN_JOIN=true, missing AIMEAT_ENCRYPTION_KEY, AIMEAT_CORS_ALLOWED_ORIGINS=*,
@@ -290,6 +313,11 @@ AIMEAT_PORT=40050
 # AIMEAT_MAX_ACTIONS_PER_AGENT=20
 # AIMEAT_MIN_TRUST_PAID_ACTIONS=10
 # AIMEAT_APP_MAX_SIZE_MB=5
+# Publish-time asset check: ask this node over loopback whether the script/stylesheet URLs a
+# published app loads actually resolve. A 404 refuses the publish, which is what stops an app
+# whose <script src> is wrong from going live broken. Safe everywhere (the request only ever goes
+# to 127.0.0.1 on this node's own port); set to false only if the node cannot reach itself.
+# AIMEAT_APP_ASSET_PROBE=true
 # AIMEAT_AGENT_PORTING_FEE=50
 # AIMEAT_MEMORY_OVERAGE_MORSELS=10
 # AIMEAT_STORAGE_OVERAGE_MORSELS=100
@@ -326,6 +354,33 @@ AIMEAT_PORT=40050
 # AIMEAT_RL_CATALOGUE=300
 # AIMEAT_RL_AUTH_CHALLENGE=300
 
+# ── The agent door: POST /v1/registration-invites ──
+# Requests per HOUR per IP (every other AIMEAT_RL_* value is per second). This endpoint is open by
+# design — an AI calling it has no identity yet — and it sends email to an address it was handed,
+# so the thing being protected is a stranger's inbox rather than the node's CPU.
+#
+# The safe PUBLIC default is 5/hour and needs no override: a person registers once. Raise it only
+# where something legitimately makes more calls than a human would (the E2E suites set 1000).
+# A second, independent cap lives in the service: one LIVE invitation per address at a time,
+# which holds even against a caller rotating IPs.
+# AIMEAT_RL_REGISTRATION_INVITES=5
+
+# ── The home's four rooms ──
+# Room 3 (monetising). OFF by default, and it stays off until someone has actually walked into it
+# on THIS node. "The app is published here" is not the same as "a person who clicks the card finds
+# something": an app served from the isolated app origin has no session for a cold arrival, so it
+# can render a permanent loading state while every automated check reports it present. A door into
+# an empty room breaks the product's own rule about empty states at the exact moment the person has
+# finally got interested, so this is a judgement an operator makes once, not an inference.
+# AIMEAT_HOME_ROOM_MONETISE=false
+
+# One friendly email to somebody nobody has been seen on for a fortnight, carrying a prompt they
+# can run straight from the message. OFF by default, and the default is the point: this is
+# unsolicited mail to real people, so turning it on is a decision somebody makes rather than
+# something a deploy does. Needs the email service enabled; honours the notification setting the
+# profile already writes, and never mails the same person twice within 60 days.
+# AIMEAT_INACTIVITY_NUDGE=false
+
 # ── Personal Nodes ───────────────────────────────────────────
 # AIMEAT_PERSONAL_NODES_ENABLED=true
 # AIMEAT_PERSONAL_NODE_MAX_SLOTS=100
@@ -353,6 +408,20 @@ AIMEAT_PORT=40050
 # AIMEAT_SMTP_REJECT_UNAUTHORIZED=false  # Set to false for STARTTLS with self-signed certs
 # AIMEAT_EMAIL_CONFIRMATION_REQUIRED=false
 
+# ── Outbound door (company-in-a-box) ─────────────────────────
+# Max sent outbound messages per owner per rolling 24 h. Safe public default; raise on a
+# private/local node if a legitimate campaign needs it.
+# AIMEAT_OUTBOUND_DAILY_LIMIT=200
+
+# ── E-invoice operator (Finvoice delivery) ───────────────────
+# '' (default) = Finvoice delivery disabled (email door still works).
+# 'mock' = in-process test double (local dev / e2e). 'rest' = generic gateway bridge:
+# POST {url}/invoices with the Finvoice XML, bearer-keyed; status from {url}/invoices/{id}.
+# The operator-specific adapter (Maventa/Apix) lands after the operator contract is chosen.
+# AIMEAT_FINVOICE_OPERATOR=
+# AIMEAT_FINVOICE_OPERATOR_URL=
+# AIMEAT_FINVOICE_OPERATOR_KEY=
+
 # ── Consent Layer (Phase 0.3) ────────────────────────────────
 # AIMEAT_CONSENT_EXPIRY_CHECK_INTERVAL_MS=60000  # How often to check for expired consents (default: 1 min)
 # AIMEAT_CONSENT_DEFAULT_SCOPE="federation"       # Default consent scope: private | dmz | federation
@@ -498,6 +567,21 @@ AIMEAT_PORT=40050
 # AIMEAT_CONNECTIONS_ENABLED=false
 # AIMEAT_CONNECT_GOOGLE_CLIENT_ID=""                           # Google Cloud → Clients → Web application
 # AIMEAT_CONNECT_GOOGLE_CLIENT_SECRET=""                       # from the same client; NOT the sign-in client
+
+# LinkedIn, for publishing to a member's own feed. Consumer tier, self-serve: create an app at
+# https://www.linkedin.com/developers/apps , add the products "Sign In with LinkedIn using OpenID
+# Connect" and "Share on LinkedIn", and set the redirect URL to AIMEAT_CONNECT_REDIRECT_URI.
+# There is no review to wait for. Empty means the provider is simply not offered.
+AIMEAT_CONNECT_LINKEDIN_CLIENT_ID=
+AIMEAT_CONNECT_LINKEDIN_CLIENT_SECRET=
+
+# X, for posting to an account's own timeline. There is no free tier for new developers since
+# 2026-02-06; it is pay-per-use with NO monthly minimum, prepaid credits and a spend cap you set
+# in the X developer console. Roughly $0.015 per post created. Create an app at
+# https://console.x.com , enable OAuth 2.0 with a CONFIDENTIAL client ("Web App, Automated App or Bot"),
+# AIMEAT_CONNECT_REDIRECT_URI. Empty means the provider is simply not offered.
+AIMEAT_CONNECT_X_CLIENT_ID=
+AIMEAT_CONNECT_X_CLIENT_SECRET=
 # AIMEAT_CONNECT_REDIRECT_URI=""                               # default: <baseUrl>/v1/connections/callback
 #   The redirect URI must match the provider's registration EXACTLY — scheme, port, no trailing
 #   slash. A mismatch surfaces only at the provider's consent screen, as redirect_uri_mismatch.
@@ -593,7 +677,7 @@ AIMEAT_STATS_ACCESS=public          # public | authenticated | operator
 # ── Ecosystem Applications (GEAI) ──────────────────────────────
 # Scope bounds for ecosystem-app (GEAI) connections, parallel to the agent knobs above.
 # Defaults lean read + deposit (ecosystem apps mostly deposit refined data into owner areas).
-# AIMEAT_DEFAULT_ECO_SCOPES="memory:read,memory:write,knowledge:contribute,organism:read"
+# AIMEAT_DEFAULT_ECO_SCOPES="memory:read,memory:write,organism:read"
 # AIMEAT_MAX_ECO_SCOPES="*"
 # GEAI credential lifetime in seconds (default 90 days, same class as agent JWTs).
 # AIMEAT_ECO_JWT_TTL=7776000
@@ -607,7 +691,7 @@ AIMEAT_METRICS_ACCESS=operator      # public | authenticated | operator
 # AIMEAT_EXTENSIONS_ENABLED=true       # Extension system (default: true)
 # AIMEAT_EXT_MAX_MEMORY_MB=64          # V8 isolate memory limit per action
 # AIMEAT_EXT_TIMEOUT_MS=5000           # V8 isolate CPU timeout per action
-# AIMEAT_EXT_MAX_API_CALLS=50          # Max AIMEAT API calls per action invocation
+# AIMEAT_EXT_MAX_API_CALLS=500         # Max AIMEAT API calls per action invocation (1-10000)
 # AIMEAT_EXT_MAX_CODE_SIZE_KB=256      # Max JS source size per action
 # AIMEAT_EXT_MAX_INSTALLED=20          # Max extensions installed on this node
 # AIMEAT_EXT_INSTALL_ROLE=operator     # Role required to install extensions: operator | owner (default: operator)

package/dist/build-stamp.json

@@ -1,10 +1,10 @@
 {
   "schema_version": 1,
-  "version": "2.6.1",
-  "commit": "ed29922b0c25cb1a4709c4f4830bcc6dd40556e9",
+  "version": "3.0.0",
+  "commit": "205571f1e95af4e84a3e434c5bf5c2fe675f75a2",
   "dirty": false,
-  "built_at": "2026-08-02T02:14:38.946Z",
-  "newest_source_mtime": 1785636773728.017,
+  "built_at": "2026-08-12T15:48:53.009Z",
+  "newest_source_mtime": 1786549296837.5881,
   "source_dirs": [
     "src",
     "bin",