aimeat 2.7.0 → 3.0.0

package/dist/public/css/views/start.css

@@ -9,6 +9,7 @@
  *   v1.0.1 — 2026-06-12 — Scope print rules to body.st-active: view CSS is global (spa.html
  *     preload), so the unscoped `body * { visibility: hidden }` blanked printing on every view
  *     (e.g. the public workspace viewer printed 14 empty pages).
+ *   v1.1.0 — 2026-08-08 — .st-pb-copy deleted — flex:none on a copy button is the shared .btn-copy-inline modifier.
  */
 
 .st { max-width: 760px; margin: 0 auto; padding: 2rem 1.25rem 3rem; color: var(--text); }
@@ -61,7 +62,6 @@
 .st-pb-quote, .st-pb-prompt blockquote { margin: .3rem 0; padding: .6rem .9rem; border-left: 3px solid var(--accent); background: var(--bg-surface, var(--bg-dim)); border-radius: 6px; font-size: .92rem; }
 .st-pb-code { display: flex; gap: .6rem; align-items: flex-start; margin-top: .4rem; }
 .st-pb-code pre { flex: 1; margin: 0; padding: .65rem .9rem; border: 1px solid var(--border); border-radius: 8px; background: var(--bg-surface, var(--bg-dim)); font-size: .82rem; overflow-x: auto; white-space: pre-wrap; word-break: break-all; }
-.st-pb-copy { flex: none; }
 .st-pb-prompt { margin-top: .4rem; }
 .st-pb-prompt .btn-primary { margin-top: .5rem; }
 .st-pb-link { color: var(--accent); font-weight: 700; text-decoration: none; font-size: .92rem; }

package/dist/public/js/api.js

@@ -11,7 +11,9 @@
  *
  * @version-history
  *   v1.0.0 — 2026-07-13 — Header added; file pre-dates header standard
+ *   v1.1.0 — 2026-08-07 — Reads the session through /js/services/auth.js (single session source)
  */
+import { getSession } from '/js/services/auth.js';
 
 /**
  * Make an authenticated API call.
@@ -26,20 +28,18 @@ export async function api(path, opts = {}) {
   const headers = { 'Content-Type': 'application/json', ...opts.headers };
 
   // Attach auth token — refresh if expired
-  if (window.AIMEAT?.auth?.hasSession) {
-    const session = window.AIMEAT.auth.getSession();
-    if (session?.jwt) {
-      // If session has refresh() and token looks expired, refresh first
-      if (typeof session.refresh === 'function') {
-        try {
-          const payload = parseJwtPayload(session.jwt);
-          if (payload?.exp && Date.now() / 1000 > payload.exp - 60) {
-            await session.refresh();
-          }
-        } catch (e) { console.warn('JWT parse/refresh failed, proceeding:', e.message); }
-      }
-      headers['Authorization'] = 'Bearer ' + session.jwt;
+  const session = getSession();
+  if (session?.jwt) {
+    // If session has refresh() and token looks expired, refresh first
+    if (typeof session.refresh === 'function') {
+      try {
+        const payload = parseJwtPayload(session.jwt);
+        if (payload?.exp && Date.now() / 1000 > payload.exp - 60) {
+          await session.refresh();
+        }
+      } catch (e) { console.warn('JWT parse/refresh failed, proceeding:', e.message); }
     }
+    headers['Authorization'] = 'Bearer ' + session.jwt;
   }
 
   // Per-call timeout override (ms) — default 30s; long-running calls (e.g. AI completion on a
@@ -57,11 +57,11 @@ export async function api(path, opts = {}) {
 
       // On 401, try refreshing token once and retry
       if (resp.status === 401 && attempt === 0) {
-        const session = window.AIMEAT?.auth?.getSession?.();
-        if (session?.refresh) {
+        const live = getSession();
+        if (live?.refresh) {
           try {
-            await session.refresh();
-            headers['Authorization'] = 'Bearer ' + session.jwt;
+            await live.refresh();
+            headers['Authorization'] = 'Bearer ' + live.jwt;
             continue;
           } catch (e) { console.warn('Token refresh failed:', e.message); }
         }

package/dist/public/js/components/auth-image.js

@@ -13,6 +13,7 @@ import { h } from 'preact';
 import { useState, useEffect, useRef } from 'preact/hooks';
 import htm from 'htm';
 import { swallowed } from '/js/swallowed.js';
+import { authHeaders } from '/js/services/auth.js';
 const html = htm.bind(h);
 
 export default function AuthImage({ src, alt, ...props }) {
@@ -23,14 +24,7 @@ export default function AuthImage({ src, alt, ...props }) {
     if (!src) return;
 
     let cancelled = false;
-    const headers = /** @type {Record<string,string>} */ ({});
-
-    if (window.AIMEAT?.auth?.hasSession) {
-      const session = window.AIMEAT.auth.getSession();
-      if (session?.jwt) {
-        headers['Authorization'] = 'Bearer ' + session.jwt;
-      }
-    }
+    const headers = /** @type {Record<string,string>} */ ({ ...authHeaders() });
 
     fetch(src, { headers })
       .then(r => {

package/dist/public/js/services/admin.js

@@ -54,14 +54,6 @@ export const getAdminWork    = ()       => apiGet('/v1/admin/work');
 // ── Direct-message delivery telemetry ──
 export const getMessageStats = ()       => apiGet('/v1/admin/messages/stats');
 
-// ── Node Feedback Channel (platform feedback → operator) ──
-export const getFeedback = (params = {}) => {
-    const qs = new URLSearchParams(Object.entries(params).filter(([, v]) => v)).toString();
-    return apiGet(`/v1/admin/feedback${qs ? '?' + qs : ''}`);
-};
-export const replyFeedback      = (id, body)   => apiPost(`/v1/feedback/${encodeURIComponent(id)}/reply`, { body });
-export const setFeedbackStatus  = (id, status) => apiPatch(`/v1/admin/feedback/${encodeURIComponent(id)}`, { status });
-
 // ── Maintenance ──
 export const getMaintenance  = ()       => apiGet('/v1/admin/maintenance');
 export const setMaintenance  = (enabled, message) => apiPost('/v1/admin/maintenance', { enabled, message });

package/dist/public/js/services/auth.js

@@ -1,79 +1,261 @@
-/**
- * @file public/js/services/auth.js
- * @description Centralized frontend auth/session service wrapping window.AIMEAT.auth —
- *   provides session lookups, profile read/update, password change, and auth-change subscription.
- *
- * @structure
- *   - getSession/hasSession/getOwner/getGhii/getNodeUrl: read the active session
- *   - getProfile/updateProfile: fetch and PUT the current user's GHII profile
- *   - changePassword: POST a password change for the logged-in owner
- *   - onAuthChange: subscribe to aimeat-auth-change events, returns unsubscribe
- *
- * @version-history
- *   v1.0.0 — 2026-07-13 — Header added; file pre-dates header standard
- */
-
-/**
- * AIMEAT Auth Service
- * Centralized session/auth access — replaces direct window.AIMEAT.auth usage.
- */
-
-/** Get current auth session, or null if not logged in. */
-export function getSession() {
-  const a = window.AIMEAT?.auth;
-  if (!a || typeof a.getSession !== 'function') return null;
-  const s = a.getSession();
-  return (s && s.jwt) ? s : null;
-}
-
-/** Check if a session is active. */
-export function hasSession() {
-  return getSession() !== null;
-}
-
-/** Get owner name from session. */
-export function getOwner() {
-  return getSession()?.owner || null;
-}
-
-/** Get GHII from session. */
-export function getGhii() {
-  const s = getSession();
-  return s?.ghii || (s?.owner ? s.owner + '@unknown' : null);
-}
-
-/** Get the node URL (current origin). */
-export function getNodeUrl() {
-  return typeof window !== 'undefined' ? window.location.origin : '';
-}
-
-/** Fetch the current user's own profile (includes private fields like email). */
-export async function getProfile() {
-  const s = getSession();
-  if (!s) return null;
-  return s.fetch('/v1/ghii/me');
-}
-
-/** Update the current user's profile via PUT /v1/ghii. */
-export async function updateProfile(fields) {
-  const s = getSession();
-  if (!s) throw new Error('Not logged in');
-  return s.fetch('/v1/ghii', { method: 'PUT', body: JSON.stringify(fields) });
-}
-
-/** Change the current user's password via POST /v1/ghii/password/change. */
-export async function changePassword(currentPassword, newPassword) {
-  const s = getSession();
-  if (!s) throw new Error('Not logged in');
-  return s.fetch('/v1/ghii/password/change', {
-    method: 'POST',
-    body: JSON.stringify({ current_password: currentPassword, new_password: newPassword }),
-  });
-}
-
-/** Listen for auth state changes. Returns unsubscribe function. */
-export function onAuthChange(callback) {
-  const handler = () => callback(getSession());
-  window.addEventListener('aimeat-auth-change', handler);
-  return () => window.removeEventListener('aimeat-auth-change', handler);
-}
+/**
+ * @file public/js/services/auth.js
+ * @description THE frontend session source of truth. Every read of "who is signed in" and every
+ *   subscription to that changing goes through this module — nothing in public/ touches
+ *   window.AIMEAT.auth directly (enforced by the `aimeat/no-direct-auth` lint rule, which allows
+ *   exactly this file).
+ *
+ *   Why it is a module and not a convention. Session state lived in three places that nothing kept
+ *   in agreement: localStorage, the auth lib's `currentSession`, and a private `useState` copy in
+ *   every view, synchronised by a payload-less `aimeat-auth-change` window event with no ordering
+ *   guarantee. On 2026-08-07 that produced a header rendering the notification bell and the "Me"
+ *   menu next to a "Sign In / Register" button: the login pill called its host's onLogout callback
+ *   synchronously, before the un-awaited async logout() had cleared anything, so every listener
+ *   re-read the OLD session and re-rendered a signed-in header. The same race had already been
+ *   found once and worked around inside a single view (portfolio.js) instead of at the source.
+ *
+ *   Two properties make that class of bug unrepresentable here:
+ *     1. Subscribers are driven by the auth lib's OWN 'login'/'logout'/'session-updated' events,
+ *        which fire after the state has changed — not by a caller remembering to announce it.
+ *        The legacy window event is accepted too, so no existing emitter has to be found and fixed.
+ *     2. Every notification re-reads the session and is deduped by signature, so an early or
+ *        duplicated event can neither deliver a stale session nor cause a redundant re-render.
+ *
+ *   The auth lib loads asynchronously (spa.html injects /v1/libs/aimeat-auth.js during boot), so
+ *   wiring retries until it appears rather than assuming it is there at import time.
+ *
+ * @structure
+ *   - getSession/hasSession/getOwner/getGhii/getJwt/getNodeUrl/getStoredGhii: read the session
+ *   - authHeaders: Authorization header for a raw fetch (empty object when signed out)
+ *   - onAuthChange: subscribe to real session changes, returns unsubscribe
+ *   - logout/showLoginModal/updateSessionMeta: the lifecycle actions a view may trigger
+ *   - getProfile/updateProfile/changePassword: the current user's GHII profile
+ *
+ * @usage
+ *   import { getSession, onAuthChange } from '/js/services/auth.js';
+ *   // In a Preact view prefer the hook: import { useSession } from '/js/use-session.js';
+ *
+ * @version-history
+ *   v1.0.0 — 2026-07-13 — Header added; file pre-dates header standard
+ *   v2.0.0 — 2026-08-07 — Becomes the single session source: subscribes to the auth lib's own
+ *     post-change events (killing the stale-session race for every consumer at once), dedupes by
+ *     signature, and absorbs the lifecycle + jwt/header surface that views were reaching past it for.
+ */
+
+/* eslint-disable aimeat/no-direct-auth -- THIS is the module the rule points everything else to;
+   it is the one place allowed to touch the auth lib. */
+
+/** The auth lib object, or null until /v1/libs/aimeat-auth.js has loaded. */
+function lib() {
+  return (typeof window !== 'undefined' && window.AIMEAT && window.AIMEAT.auth) || null;
+}
+
+// ── Reads ───────────────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Get the current auth session, or null if not logged in.
+ * A session without a jwt is treated as no session — that is the only definition of "signed in"
+ * the whole frontend uses, so a half-populated object can never render as a logged-in state.
+ * @returns {any}
+ */
+export function getSession() {
+  const a = lib();
+  if (!a || typeof a.getSession !== 'function') return null;
+  const s = a.getSession();
+  return (s && s.jwt) ? s : null;
+}
+
+/** Check if a session is active. @returns {boolean} */
+export function hasSession() {
+  return getSession() !== null;
+}
+
+/** Get owner name from session. @returns {string|null} */
+export function getOwner() {
+  return getSession()?.owner || null;
+}
+
+/** Get GHII from session. @returns {string|null} */
+export function getGhii() {
+  const s = getSession();
+  return s?.ghii || (s?.owner ? s.owner + '@unknown' : null);
+}
+
+/**
+ * The raw JWT of the active session, or '' when signed out. Returning '' (never null/undefined)
+ * keeps the common `Authorization: 'Bearer ' + getJwt()` call sites free of guards.
+ * @returns {string}
+ */
+export function getJwt() {
+  return getSession()?.jwt || '';
+}
+
+/**
+ * Authorization header for a raw fetch — `{}` when signed out, so it always spreads safely:
+ * `headers: { 'Content-Type': 'application/json', ...authHeaders() }`.
+ * @returns {Record<string, string>}
+ */
+export function authHeaders() {
+  const jwt = getJwt();
+  return jwt ? { Authorization: 'Bearer ' + jwt } : {};
+}
+
+/** Get the node URL (current origin). @returns {string} */
+export function getNodeUrl() {
+  return typeof window !== 'undefined' ? window.location.origin : '';
+}
+
+/** The node id the auth lib was built against (used to compose a GHII when the session lacks one). */
+export function getNodeId() {
+  return lib()?.nodeId || '';
+}
+
+/**
+ * The GHII persisted in localStorage, readable WITHOUT an active session — the one legitimate
+ * "who was here last" read (an invite/grant screen showing which account a stale link belongs to).
+ * @returns {string|null}
+ */
+export function getStoredGhii() {
+  return lib()?.storedGhii || null;
+}
+
+/** True when the page is a published app on its isolated origin rather than the apex. */
+export function isAppOrigin() {
+  const a = lib();
+  return !!(a && typeof a.isAppOrigin === 'function' && a.isAppOrigin());
+}
+
+// ── Lifecycle ───────────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Sign out. Resolves once the session is gone locally; the server-side revoke completes in the
+ * background. Subscribers are notified by the auth lib's 'logout' event, so callers do NOT need
+ * to announce it — announcing it by hand, before this resolved, is what caused the header bug.
+ * @returns {Promise<void>}
+ */
+export async function logout() {
+  const a = lib();
+  if (a && typeof a.logout === 'function') await a.logout();
+}
+
+/**
+ * Open the sign-in modal. Sign-in notifies subscribers through the auth lib's 'login' event, so a
+ * caller does not pass an onLogin callback — it subscribes (or uses useSession) like everything else.
+ * Returns false when the auth lib has not loaded and no modal could be shown, so a caller can fall
+ * back to a full-page sign-in route instead of leaving the user with a dead button.
+ * @param {object} [opts]
+ * @returns {boolean}
+ */
+export function showLoginModal(opts) {
+  const a = lib();
+  if (!a || typeof a.showLoginModal !== 'function') return false;
+  a.showLoginModal(opts || {});
+  return true;
+}
+
+/**
+ * Patch mutable, non-secret session metadata (e.g. displayName after a profile edit) and let every
+ * subscriber re-render — no page reload.
+ * @param {Record<string, unknown>} patch
+ */
+export function updateSessionMeta(patch) {
+  const a = lib();
+  if (a && typeof a.updateSessionMeta === 'function') a.updateSessionMeta(patch);
+}
+
+// ── Change notification ─────────────────────────────────────────────────────────────────────────
+
+/** @type {Set<(session: any) => void>} */
+const subscribers = new Set();
+/** Signature of the session subscribers were last told about — the dedupe key. */
+let lastSignature = signatureOf(null);
+let wired = false;
+/** @type {any} */ let wireTimer = null;
+
+/**
+ * Identity of a session for change detection. jwt alone is not enough: a display-name edit keeps
+ * the same token but must still re-render, and a token refresh rotates the jwt without being a
+ * change of WHO is signed in — including all three keeps both cases correct.
+ * @param {any} s
+ */
+function signatureOf(s) {
+  if (!s) return '-';
+  return (s.ghii || s.owner || '') + '|' + (s.displayName || '') + '|' + (s.jwt || '');
+}
+
+/** Re-read the session and notify subscribers, but only when it actually differs. */
+function publish() {
+  const s = getSession();
+  const sig = signatureOf(s);
+  if (sig === lastSignature) return;
+  lastSignature = sig;
+  for (const cb of Array.from(subscribers)) {
+    try { cb(s); } catch (err) { console.error('[aimeat] auth subscriber failed:', err); }
+  }
+}
+
+/**
+ * Attach to the auth lib's own events. The lib is injected during boot, so this retries until it
+ * exists instead of silently doing nothing when the module happens to import first.
+ */
+function ensureWired() {
+  if (wired || typeof window === 'undefined') return;
+  const a = lib();
+  if (!a || typeof a.on !== 'function') {
+    if (wireTimer === null) wireTimer = setInterval(() => { ensureWired(); }, 50);
+    return;
+  }
+  wired = true;
+  if (wireTimer !== null) { clearInterval(wireTimer); wireTimer = null; }
+  // These three fire AFTER the lib's state changed — the property the whole module rests on.
+  a.on('login', publish);
+  a.on('logout', publish);
+  a.on('session-updated', publish);
+  publish(); // the lib may have restored a session before we attached
+}
+
+if (typeof window !== 'undefined') {
+  // The legacy channel: hosts that announce auth changes by hand (spa.html boot, the session-expiry
+  // handler). Kept so no emitter has to be hunted down — publish() re-reads and dedupes, so an
+  // early or duplicate announcement is harmless rather than a stale render.
+  window.addEventListener('aimeat-auth-change', publish);
+  ensureWired();
+}
+
+/**
+ * Listen for auth state changes. The callback receives the new session (or null) and fires only on
+ * a real change. Returns an unsubscribe function.
+ * @param {(session: any) => void} callback
+ * @returns {() => void}
+ */
+export function onAuthChange(callback) {
+  ensureWired();
+  subscribers.add(callback);
+  return () => { subscribers.delete(callback); };
+}
+
+// ── Profile ─────────────────────────────────────────────────────────────────────────────────────
+
+/** Fetch the current user's own profile (includes private fields like email). */
+export async function getProfile() {
+  const s = getSession();
+  if (!s) return null;
+  return s.fetch('/v1/ghii/me');
+}
+
+/** Update the current user's profile via PUT /v1/ghii. */
+export async function updateProfile(fields) {
+  const s = getSession();
+  if (!s) throw new Error('Not logged in');
+  return s.fetch('/v1/ghii', { method: 'PUT', body: JSON.stringify(fields) });
+}
+
+/** Change the current user's password via POST /v1/ghii/password/change. */
+export async function changePassword(currentPassword, newPassword) {
+  const s = getSession();
+  if (!s) throw new Error('Not logged in');
+  return s.fetch('/v1/ghii/password/change', {
+    method: 'POST',
+    body: JSON.stringify({ current_password: currentPassword, new_password: newPassword }),
+  });
+}

package/dist/public/js/services/memory.js

@@ -14,6 +14,7 @@
 import { api, apiGet, apiPost, apiDelete } from '/js/api.js';
 import { swallowed } from '/js/swallowed.js';
 import { t } from '/js/i18n.js';
+import { authHeaders } from '/js/services/auth.js';
 
 /** List all memory entries. Returns array. Optional agentGaii to view another agent's memory. */
 export async function listMemories(agentGaii, opts) {
@@ -105,11 +106,7 @@ export async function importMemory(entries, mode, agentGaii) {
  * @returns {Promise<Blob>} the ZIP blob (throws on a non-2xx response).
  */
 export async function bundleCollection(items) {
-  const headers = { 'Content-Type': 'application/json' };
-  if (window.AIMEAT?.auth?.hasSession) {
-    const s = window.AIMEAT.auth.getSession();
-    if (s?.jwt) headers['Authorization'] = 'Bearer ' + s.jwt;
-  }
+  const headers = { 'Content-Type': 'application/json', ...authHeaders() };
   const base = typeof window !== 'undefined' ? window.location.origin : '';
   const resp = await fetch(`${base}/v1/memory/bundle`, { method: 'POST', headers, body: JSON.stringify({ items }) });
   if (!resp.ok) {

package/dist/public/js/services/offers.js

@@ -183,6 +183,27 @@ function scheduleIdOf(offer) {
  *   { kind: 'task', taskId, agent }                    — task-runner/autonomous → created a queued task
  *   { kind: 'prompt', copied: true, prompt }           — interactive/workstation → copied a paste-ready prompt
  */
+/**
+ * Which way an agent takes work: a queue it drains itself, or a prompt a person carries.
+ *
+ * The branch `ask()` has always made, named so a second caller can make the SAME one rather than
+ * inventing a parallel rule. The intent pool's "give this to an agent" needs exactly this decision
+ * and nothing else about offers — and two places deciding "can this agent be handed work" by
+ * different tests is how one of them ends up offering a graveyard.
+ *
+ * A schedule-born offer is `ask()`'s own special case and stays there; it has no meaning for an
+ * intent, which is a piece of work rather than a published capability.
+ */
+export function dispatchMode(agentEntry) {
+  const mode = agentEntry?.mode || 'interactive';
+  return (mode === 'task-runner' || mode === 'autonomous') ? 'task' : 'prompt';
+}
+
+/** True when this agent can be handed work without a person carrying it. */
+export function takesTasks(agentEntry) {
+  return dispatchMode(agentEntry) === 'task';
+}
+
 export async function ask(agentEntry, offer, inputs) {
   const scheduleId = scheduleIdOf(offer);
   if (scheduleId) {
@@ -190,8 +211,7 @@ export async function ask(agentEntry, offer, inputs) {
     return { kind: 'triggered', ok: r?.ok !== false, error: r?.error };
   }
 
-  const mode = agentEntry.mode || 'interactive';
-  if (mode === 'task-runner' || mode === 'autonomous') {
+  if (dispatchMode(agentEntry) === 'task') {
     // The agent ALREADY owns the offer (it published it). Do NOT restuff offer.ask/example into the
     // task — that makes the agent treat its own boilerplate as the request (e.g. jokes ABOUT four
     // comedians instead of jokes on the topic). The task carries ONLY the user's request as title +

package/dist/public/js/services/open-items.js

@@ -0,0 +1,116 @@
+/**
+ * @file public/js/services/open-items.js
+ * @description Client for open items — the one list of what you are going to do here.
+ *
+ *   Thin over /v1/open-items. The one piece of logic it owns is handing an item to an agent, which
+ *   uses the SAME branch `offers.js` uses to decide whether an agent takes queued work
+ *   (`takesTasks`), because two surfaces answering "can this agent be handed something" differently
+ *   is how one of them ends up offering a name that never does anything.
+ *
+ *   Switching an item OFF is `switchOff`, not a status change. On the list and off the list are the
+ *   two positions of one control, and the API says the same: DELETE.
+ * @structure listOpenItems · openItemsCount · addOpenItem · patchOpenItem · switchOff ·
+ *   reachableAgents · handToAgent
+ * @usage
+ *   import { addOpenItem } from '/js/services/open-items.js';
+ *   await addOpenItem({ title, prompt_ref: 'build-app', origin: 'home.rooms.create' });
+ * @version-history
+ *   v1.0.0 — 2026-08-09 — Replaces services/intents.js. One key on the server, a flipped state
+ *     instead of open→done, and a count endpoint the header can poll cheaply.
+ */
+import { apiGet, apiPost, apiPatch, apiDelete } from '/js/api.js';
+import { createTask } from '/js/services/agent-tasks.js';
+import { takesTasks } from '/js/services/offers.js';
+
+/**
+ * Tell every surface showing this data that it changed.
+ *
+ * The list and the header count are two components that never meet, and the server's SSE frame is
+ * the wrong thing to wait for after YOUR OWN click: measured in the browser, switching an item off
+ * dropped it from the list while the header went on saying 3. Announcing it locally makes both
+ * follow the same action; SSE still covers the changes somebody else made, which is what it is for.
+ */
+function announce() {
+  window.dispatchEvent(new CustomEvent('aimeat-live-update', { detail: { domain: 'open-items' } }));
+}
+
+/** What is switched on. Satisfied suggestions are already dropped by the server. */
+export async function listOpenItems() {
+  const r = await apiGet('/v1/open-items');
+  return r?.data?.items ?? [];
+}
+
+/** Just the number, for the header. One key read on the server; safe to call on every page. */
+export async function openItemsCount() {
+  const r = await apiGet('/v1/open-items/count');
+  return Number(r?.data?.count ?? 0);
+}
+
+/**
+ * @param {{ title: string, kind?: string, prompt_ref?: string, prompt_args?: object,
+ *   origin?: string, object?: { type: string, id: string }, closes_when?: { check: string } }} input
+ */
+export async function addOpenItem(input) {
+  const r = await apiPost('/v1/open-items', input);
+  const item = r?.data?.item ?? null;
+  if (item) announce();
+  return item;
+}
+
+export async function patchOpenItem(id, patch) {
+  const r = await apiPatch(`/v1/open-items/${encodeURIComponent(id)}`, patch);
+  const item = r?.data?.item ?? null;
+  if (item) announce();
+  return item;
+}
+
+/** Switch it off. The same control that switched it on, the other way. */
+export async function switchOff(id) {
+  const r = await apiDelete(`/v1/open-items/${encodeURIComponent(id)}`);
+  const ok = r?.ok !== false;
+  if (ok) announce();
+  return ok;
+}
+
+/**
+ * The agents this list can actually hand something to.
+ *
+ * An interactive agent has no queue it drains by itself, so a task addressed to one waits for a
+ * human to go and start it. Offering that name is a graveyard, not a feature.
+ */
+export async function reachableAgents() {
+  const r = await apiGet('/v1/agents');
+  return (r?.data?.agents ?? []).filter(a => takesTasks(a) && a?.health?.state !== 'problem');
+}
+
+/**
+ * Hand an item to an agent: a real task through the normal route, and the link BOTH ways.
+ *
+ * `resources.memoryKeys` carries `open-items.list#<id>`. The key is one and the items are many, so
+ * the id rides in a fragment; an agent reading the key gets the list and finds its own item by the
+ * id it was handed. The item is NOT switched off here: it goes off when the task completes, on the
+ * server, which is the only writer that can be trusted to know.
+ */
+export async function handToAgent(item, agentEntry) {
+  const created = await createTask(agentEntry.agent ?? agentEntry.name, {
+    title: item.title,
+    description: item.prompt_ref
+      ? `From your open items. The prompt for this is served at /v1/prompts/${item.prompt_ref}.`
+      : 'From your open items.',
+    status: 'queued',
+    // snake_case: the route reads body.resources.memory_keys (routes/agent-tasks/create-read.ts).
+    resources: { memory_keys: [`open-items.list#${item.id}`] },
+    scope: [
+      { name: 'kind', value: 'open-item', type: 'text' },
+      { name: 'item_id', value: item.id, type: 'text' },
+      ...(item.prompt_ref ? [{ name: 'prompt_ref', value: item.prompt_ref, type: 'text' }] : []),
+    ],
+  });
+  const taskId = created?.data?.task?.id || created?.data?.id || null;
+  if (!taskId) return { ok: false, error: created?.error };
+  const updated = await patchOpenItem(item.id, {
+    status: 'working',
+    agent: agentEntry.gaii ?? agentEntry.agent ?? null,
+  });
+  return { ok: true, taskId, item: updated };
+}

package/dist/public/js/services/organisms.images.js

@@ -8,6 +8,7 @@
  *   v1.0.0 — 2026-07-13 — Extracted from organisms.js (max-file-lines)
  */
 import { apiGet, apiPost, apiPatch } from '/js/api.js';
+import { authHeaders } from '/js/services/auth.js';
 
 /** ── Document images (stored in /v1/storage, fetched with the session for display) ── */
 function blobToBase64(blob) {
@@ -55,8 +56,7 @@ export async function uploadFile(orgId, file) {
 
 /** Fetch a /v1/storage file with the session token and return an object URL (for <img>). */
 export async function fetchStorageObjectUrl(url) {
-  const jwt = window.AIMEAT?.auth?.getSession?.()?.jwt;
-  const resp = await fetch(url, { headers: jwt ? { Authorization: 'Bearer ' + jwt } : {} });
+  const resp = await fetch(url, { headers: authHeaders() });
   if (!resp.ok) throw new Error('image fetch failed: ' + resp.status);
   return URL.createObjectURL(await resp.blob());
 }