aimeat 2.7.0 → 3.1.0

package/dist/src/utils/reserved-keys.d.ts

@@ -4,27 +4,81 @@
  *   behavior, plus the write gate that stops a scoped H-2 app-grant principal (role 'app') from
  *   poisoning them. An app-grant token's `sub` is the OWNER's GHII, so its `memory:write` lands in the
  *   owner's own namespace — the same namespace the server reads for: the AI-provider URL a decrypted
- *   key is sent to (`openrouter.*`), the daily AI-spend cap (`ai-usage.*`), and the public directory /
- *   matchmaking inputs (`profile.*`). A granted app must never write these; the owner manages them via
- *   the dedicated owner-only routes (`/v1/openrouter/settings`, `/v1/ghii`). Mirrors the ecosystem
- *   path's `ecoMayWriteKey` (services/ecosystem-access.ts). See
+ *   key is sent to (`openrouter.*`), the daily AI-spend cap (`ai-usage.*`), the public directory /
+ *   matchmaking inputs (`profile.*`), who may read another owner's whole finance area
+ *   (`finance.*`), and the seller's payout address and PSP secret (`commerce.*`). A granted app must
+ *   never write these; the owner manages them via the dedicated owner-only routes
+ *   (`/v1/openrouter/settings`, `/v1/ghii`, `/v1/finance/accountants`, `/v1/commerce/payout/*`), and
+ *   an agent through the named commerce tools. Mirrors the ecosystem path's `ecoMayWriteKey`
+ *   (services/ecosystem-access.ts). See
  *   docs/coding-guidelines/security-development-dna.md invariant #2.
- * @structure RESERVED_OWNER_KEY_PREFIXES · isReservedServerKey(key) · appMayWriteKey(roles, key)
+ * @structure RESERVED_OWNER_KEY_PREFIXES · isReservedServerKey(key) ·
+ *   appMayWriteKey(roles, key, delegatedOwnerWrite?, reservedAllowed?)
  * @usage import { appMayWriteKey } from '../utils/reserved-keys.js';
  * @version-history
+ *   v1.3.0 — 2026-08-11 — `finance.` and `commerce.` join the list (August 2026 audit H-6, H-23).
+ *     Both became server-trusted after the list was written and neither was added.
+ *     `finance.accountants` is the CROSS-OWNER authorization list for the whole finance area:
+ *     services/finance/accountant-access.ts hands another owner the invoices, vouchers, VAT report,
+ *     P&L and the CSV / Finvoice exports on the strength of that record's contents alone, so an app
+ *     that appended itself read the books. `commerce.psp` holds the seller's payout address, Stripe
+ *     secret and webhook secret, read as fact by commerce/x402.ts and
+ *     commerce/sellable-resolvers.ts.
+ *     The prefixes are deliberately BROAD rather than the two exact keys: `commerce.order.*`,
+ *     `commerce.hold.*`, `commerce.payable.*` and `commerce.benefit.*` are the money ledger the
+ *     books read back as fact, and a forged entry there is the same class of lie as a forged payout
+ *     address. Nothing legitimate writes either prefix through the memory API — the owner routes
+ *     and the settlement code call storage directly, and the agent-facing door is the commerce MCP
+ *     tools, which go through services/memory-write.ts and are gated on `commerce:psp` /
+ *     `commerce:sell` instead.
+ *   v1.1.0 — 2026-08-08 — The gate keys off the TARGET namespace, not only the role: an agent with
+ *     `memory:write-as-owner` reaches the same keys an app grant does, and would otherwise have
+ *     bypassed a guard written for that exact attack.
+ *   v1.2.0 — 2026-08-08 — `reservedAllowed`: the owner may hand even the reserved keys to one named
+ *     agent (`memory:write-reserved`), for an agent that administers the account. Deliberately NOT
+ *     in the '*' bundle: '*' is one click in the UI and nobody picking it is deciding that an agent
+ *     may redirect a decrypted AI key.
  *   v1.0.0 — 2026-07-10 — Created to close the app-grant reserved-key write hole (the C-2 class:
  *     OpenRouter key exfiltration via openrouter.settings.baseUrl, ai-usage budget-cap reset, and
  *     profile/directory poisoning — all via a granted app's memory:write into the owner namespace).
  */
-/** Owner-namespace key prefixes the server reads and trusts for behavior — never app-writable. */
-export declare const RESERVED_OWNER_KEY_PREFIXES: readonly ["openrouter.", "ai-usage.", "profile."];
+/**
+ * Owner-namespace key prefixes the server reads and trusts for behavior — never app-writable.
+ *
+ * The test for membership is not "is this sensitive" but **"does the server change what it DOES
+ * because of what it finds here"**: the URL a decrypted AI key is posted to, the spend cap it
+ * checks before billing, the directory entry it publishes, the list it consults before showing one
+ * owner's books to another, the address it pays out to. User data the server only hands back
+ * belongs nowhere near this list, because every prefix here costs a granted app a capability.
+ *
+ * Adding one is a behaviour change for principals that already exist. Measure it first: a prefix
+ * refuses role 'app' and delegated owner writes on every memory door, so anything that legitimately
+ * writes it through the memory API stops. The safe shapes are an owner-only route or a server-side
+ * write that never passes through this gate, which is what the openrouter, finance and commerce
+ * keys all use.
+ */
+export declare const RESERVED_OWNER_KEY_PREFIXES: readonly ["openrouter.", "ai-usage.", "profile.", "finance.", "commerce."];
 /** True iff `key` falls under a reserved, server-trusted owner-namespace prefix. */
 export declare function isReservedServerKey(key: string): boolean;
 /**
- * May a principal with these `roles` write `key`? Denies ONLY a role-'app' (H-2 app grant) principal
- * writing a reserved server-trusted key — because an app grant resolves to the OWNER's GHII namespace,
- * unlike an agent/ecosystem principal which writes to its own GAII/`eco:` namespace. All non-'app'
- * principals (owner, agent, ecosystem) are unaffected.
+ * May a principal with these `roles` write `key`?
+ *
+ * The real question is NOT "which role is this" but **"does this write land in the owner's GHII
+ * namespace"** — that is where the server reads the keys it trusts. Role 'app' always does, which is
+ * why the original gate could key off the role alone.
+ *
+ * `delegatedOwnerWrite` exists because role 'app' stopped being the only way in: an agent holding
+ * `memory:write-as-owner` and asking for it explicitly also writes there. Without this parameter that
+ * agent would walk straight through a gate built for exactly this attack — writing
+ * `openrouter.settings.baseUrl` to redirect a decrypted AI key, resetting `ai-usage.*` to clear the
+ * spend cap, poisoning `profile.*`, adding itself to `finance.accountants` to read another owner's
+ * books, or pointing `commerce.psp` at its own payout address. Same namespace, same danger, so the
+ * same refusal.
+ *
+ * **It means DELEGATED, not "the namespace happens to be the owner's".** The account holder writing
+ * their own keys is the whole point of those keys; passing `true` for an owner session locks the
+ * owner out of their own record, which is what happened the first time this parameter was added and
+ * what test/e2e-app-grants.ts ("guard is app-scoped") exists to catch.
  */
-export declare function appMayWriteKey(roles: string[], key: string): boolean;
+export declare function appMayWriteKey(roles: string[], key: string, delegatedOwnerWrite?: boolean, reservedAllowed?: boolean): boolean;
 //# sourceMappingURL=reserved-keys.d.ts.map

package/dist/src/utils/reserved-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reserved-keys.d.ts","sourceRoot":"","sources":["../../../src/utils/reserved-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,kGAAkG;AAClG,eAAO,MAAM,2BAA2B,mDAAoD,CAAC;AAE7F,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAGpE"}
+{"version":3,"file":"reserved-keys.d.ts","sourceRoot":"","sources":["../../../src/utils/reserved-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,4EAE9B,CAAC;AAEX,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,mBAAmB,UAAQ,EAAE,eAAe,UAAQ,GACjF,OAAO,CAQT"}

package/dist/src/utils/reserved-keys.js

@@ -4,32 +4,95 @@
  *   behavior, plus the write gate that stops a scoped H-2 app-grant principal (role 'app') from
  *   poisoning them. An app-grant token's `sub` is the OWNER's GHII, so its `memory:write` lands in the
  *   owner's own namespace — the same namespace the server reads for: the AI-provider URL a decrypted
- *   key is sent to (`openrouter.*`), the daily AI-spend cap (`ai-usage.*`), and the public directory /
- *   matchmaking inputs (`profile.*`). A granted app must never write these; the owner manages them via
- *   the dedicated owner-only routes (`/v1/openrouter/settings`, `/v1/ghii`). Mirrors the ecosystem
- *   path's `ecoMayWriteKey` (services/ecosystem-access.ts). See
+ *   key is sent to (`openrouter.*`), the daily AI-spend cap (`ai-usage.*`), the public directory /
+ *   matchmaking inputs (`profile.*`), who may read another owner's whole finance area
+ *   (`finance.*`), and the seller's payout address and PSP secret (`commerce.*`). A granted app must
+ *   never write these; the owner manages them via the dedicated owner-only routes
+ *   (`/v1/openrouter/settings`, `/v1/ghii`, `/v1/finance/accountants`, `/v1/commerce/payout/*`), and
+ *   an agent through the named commerce tools. Mirrors the ecosystem path's `ecoMayWriteKey`
+ *   (services/ecosystem-access.ts). See
  *   docs/coding-guidelines/security-development-dna.md invariant #2.
- * @structure RESERVED_OWNER_KEY_PREFIXES · isReservedServerKey(key) · appMayWriteKey(roles, key)
+ * @structure RESERVED_OWNER_KEY_PREFIXES · isReservedServerKey(key) ·
+ *   appMayWriteKey(roles, key, delegatedOwnerWrite?, reservedAllowed?)
  * @usage import { appMayWriteKey } from '../utils/reserved-keys.js';
  * @version-history
+ *   v1.3.0 — 2026-08-11 — `finance.` and `commerce.` join the list (August 2026 audit H-6, H-23).
+ *     Both became server-trusted after the list was written and neither was added.
+ *     `finance.accountants` is the CROSS-OWNER authorization list for the whole finance area:
+ *     services/finance/accountant-access.ts hands another owner the invoices, vouchers, VAT report,
+ *     P&L and the CSV / Finvoice exports on the strength of that record's contents alone, so an app
+ *     that appended itself read the books. `commerce.psp` holds the seller's payout address, Stripe
+ *     secret and webhook secret, read as fact by commerce/x402.ts and
+ *     commerce/sellable-resolvers.ts.
+ *     The prefixes are deliberately BROAD rather than the two exact keys: `commerce.order.*`,
+ *     `commerce.hold.*`, `commerce.payable.*` and `commerce.benefit.*` are the money ledger the
+ *     books read back as fact, and a forged entry there is the same class of lie as a forged payout
+ *     address. Nothing legitimate writes either prefix through the memory API — the owner routes
+ *     and the settlement code call storage directly, and the agent-facing door is the commerce MCP
+ *     tools, which go through services/memory-write.ts and are gated on `commerce:psp` /
+ *     `commerce:sell` instead.
+ *   v1.1.0 — 2026-08-08 — The gate keys off the TARGET namespace, not only the role: an agent with
+ *     `memory:write-as-owner` reaches the same keys an app grant does, and would otherwise have
+ *     bypassed a guard written for that exact attack.
+ *   v1.2.0 — 2026-08-08 — `reservedAllowed`: the owner may hand even the reserved keys to one named
+ *     agent (`memory:write-reserved`), for an agent that administers the account. Deliberately NOT
+ *     in the '*' bundle: '*' is one click in the UI and nobody picking it is deciding that an agent
+ *     may redirect a decrypted AI key.
  *   v1.0.0 — 2026-07-10 — Created to close the app-grant reserved-key write hole (the C-2 class:
  *     OpenRouter key exfiltration via openrouter.settings.baseUrl, ai-usage budget-cap reset, and
  *     profile/directory poisoning — all via a granted app's memory:write into the owner namespace).
  */
-/** Owner-namespace key prefixes the server reads and trusts for behavior — never app-writable. */
-export const RESERVED_OWNER_KEY_PREFIXES = ['openrouter.', 'ai-usage.', 'profile.'];
+/**
+ * Owner-namespace key prefixes the server reads and trusts for behavior — never app-writable.
+ *
+ * The test for membership is not "is this sensitive" but **"does the server change what it DOES
+ * because of what it finds here"**: the URL a decrypted AI key is posted to, the spend cap it
+ * checks before billing, the directory entry it publishes, the list it consults before showing one
+ * owner's books to another, the address it pays out to. User data the server only hands back
+ * belongs nowhere near this list, because every prefix here costs a granted app a capability.
+ *
+ * Adding one is a behaviour change for principals that already exist. Measure it first: a prefix
+ * refuses role 'app' and delegated owner writes on every memory door, so anything that legitimately
+ * writes it through the memory API stops. The safe shapes are an owner-only route or a server-side
+ * write that never passes through this gate, which is what the openrouter, finance and commerce
+ * keys all use.
+ */
+export const RESERVED_OWNER_KEY_PREFIXES = [
+    'openrouter.', 'ai-usage.', 'profile.', 'finance.', 'commerce.',
+];
 /** True iff `key` falls under a reserved, server-trusted owner-namespace prefix. */
 export function isReservedServerKey(key) {
     return RESERVED_OWNER_KEY_PREFIXES.some((prefix) => key.startsWith(prefix));
 }
 /**
- * May a principal with these `roles` write `key`? Denies ONLY a role-'app' (H-2 app grant) principal
- * writing a reserved server-trusted key — because an app grant resolves to the OWNER's GHII namespace,
- * unlike an agent/ecosystem principal which writes to its own GAII/`eco:` namespace. All non-'app'
- * principals (owner, agent, ecosystem) are unaffected.
+ * May a principal with these `roles` write `key`?
+ *
+ * The real question is NOT "which role is this" but **"does this write land in the owner's GHII
+ * namespace"** — that is where the server reads the keys it trusts. Role 'app' always does, which is
+ * why the original gate could key off the role alone.
+ *
+ * `delegatedOwnerWrite` exists because role 'app' stopped being the only way in: an agent holding
+ * `memory:write-as-owner` and asking for it explicitly also writes there. Without this parameter that
+ * agent would walk straight through a gate built for exactly this attack — writing
+ * `openrouter.settings.baseUrl` to redirect a decrypted AI key, resetting `ai-usage.*` to clear the
+ * spend cap, poisoning `profile.*`, adding itself to `finance.accountants` to read another owner's
+ * books, or pointing `commerce.psp` at its own payout address. Same namespace, same danger, so the
+ * same refusal.
+ *
+ * **It means DELEGATED, not "the namespace happens to be the owner's".** The account holder writing
+ * their own keys is the whole point of those keys; passing `true` for an owner session locks the
+ * owner out of their own record, which is what happened the first time this parameter was added and
+ * what test/e2e-app-grants.ts ("guard is app-scoped") exists to catch.
  */
-export function appMayWriteKey(roles, key) {
-    if (!roles.includes('app'))
+export function appMayWriteKey(roles, key, delegatedOwnerWrite = false, reservedAllowed = false) {
+    const isOwnerSession = roles.includes('owner') && !roles.includes('agent') && !roles.includes('ecosystem');
+    if (isOwnerSession)
+        return true;
+    if (!roles.includes('app') && !delegatedOwnerWrite)
+        return true;
+    // The owner can hand even these over, deliberately and per agent — see WRITE_RESERVED_SCOPE in
+    // routes/memory/owner-target.ts for why that grant is NOT part of the '*' bundle.
+    if (reservedAllowed)
         return true;
     return !isReservedServerKey(key);
 }

package/dist/src/utils/reserved-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"reserved-keys.js","sourceRoot":"","sources":["../../../src/utils/reserved-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,UAAU,CAAU,CAAC;AAE7F,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAe,EAAE,GAAW;IACzD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"reserved-keys.js","sourceRoot":"","sources":["../../../src/utils/reserved-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW;CACvD,CAAC;AAEX,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAe,EAAE,GAAW,EAAE,mBAAmB,GAAG,KAAK,EAAE,eAAe,GAAG,KAAK;IAElF,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3G,IAAI,cAAc;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAChE,+FAA+F;IAC/F,kFAAkF;IAClF,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC"}

package/dist/src/utils/scope-coverage.d.ts

@@ -0,0 +1,72 @@
+/**
+ * @file src/utils/scope-coverage.ts
+ * @description "Does this principal already hold that scope?" — the one place that answers it,
+ *   including the scopes a wildcard deliberately does NOT carry.
+ *
+ *   `requireScope` treats `*` and `{domain}:*` as covering everything beneath them, and for almost
+ *   every scope that is right. `memory:write-reserved` is the exception: it hands over the keys the
+ *   server itself trusts (the AI-provider URL a decrypted key is sent to, the spend cap, the public
+ *   profile), so `hasWriteReserved` tests the EXACT string — "Full access" is one click and nobody
+ *   clicking it is deciding that.
+ *
+ *   That exception only holds if every gate agrees about it. Two did not, and both were reachable
+ *   by an agent with no owner involved at all:
+ *
+ *   - `aimeat_operator_agent_configure` skipped its narrow-only check entirely when the TARGET held
+ *     `*` (`added.length > 0 && !granted.has('*')`), on the reasoning that a `*` agent cannot gain
+ *     anything. That reasoning was true until exactly one scope stopped being covered by `*`. An
+ *     agent proposed `['*','memory:write-reserved']` for itself, minted the confirm token and
+ *     consumed it in the next call — the token binds to the caller, so the "show this to the owner"
+ *     step is instruction text, not a gate.
+ *   - the device-auth same-owner auto-approve skipped its escalation filter for a `*` approver, and
+ *     its coverage test read `memory:*` as covering `memory:write-reserved`.
+ *
+ *   Neither was an escalation before this scope existed. Both were, the moment it did.
+ * @structure SCOPES_OUTSIDE_WILDCARD · scopeIsCovered(held, scope) · uncoveredScopes(held, wanted)
+ * @usage
+ *   import { uncoveredScopes } from '../utils/scope-coverage.js';
+ *   const added = uncoveredScopes(agent.defaultScopes ?? [], proposed.scopes);
+ *   if (added.length > 0) return err(`…${added.join(', ')}`);
+ * @version-history
+ *   v1.1.0 — 2026-08-11 — ACCOUNT_SECURITY_SCOPE. Out of the wildcard from the day it exists,
+ *     because the narrow-only check on the agent-configure surface asks THIS file whether a scope
+ *     is already covered: a '*' agent would have been told yes and could have written the word
+ *     onto itself, which is the exact path the two cases above describe.
+ *   v1.0.0 — 2026-08-08 — Initial, closing the two paths that let an agent grant itself
+ *     memory:write-reserved without the owner's tick.
+ */
+/** The scope an owner grants an agent to write into the owner's own namespace. */
+export declare const WRITE_AS_OWNER_SCOPE = "memory:write-as-owner";
+/**
+ * The stronger grant on top of it: also the RESERVED, server-trusted keys — `openrouter.*` (the URL
+ * a decrypted AI key is sent to), `ai-usage.*` (the spend cap) and `profile.*` (the public
+ * directory). For an agent that administers the account on the owner's behalf.
+ */
+export declare const WRITE_RESERVED_SCOPE = "memory:write-reserved";
+/**
+ * The doors that decide who can get back INTO the account: the password, the recovery address, the
+ * second factor, the identity proof, and deleting or exporting everything. Enforced by
+ * requireOwnerPrincipal() in auth/middleware.ts, which admits an owner principal outright and any
+ * other principal only on this exact word.
+ *
+ * It is out of every wildcard for the same reason the reserved-write scope is, only sharper: an
+ * agent that can set the password can become the person. Nobody was grandfathered onto it either
+ * (services/scope-vocabulary-migration.ts), so an agent holding it was ticked by hand.
+ */
+export declare const ACCOUNT_SECURITY_SCOPE = "account:security";
+export declare const SCOPES_OUTSIDE_WILDCARD: readonly string[];
+/** True when `scope` is one of the scopes only an exact grant can confer. */
+export declare function isOutsideWildcard(scope: string): boolean;
+/**
+ * Does a principal holding `held` already have `scope`?
+ *
+ * Same rules as requireScope — the global wildcard, the domain wildcard, or the exact string — with
+ * the one deliberate exception above, where only the exact string counts.
+ */
+export declare function scopeIsCovered(held: readonly string[], scope: string): boolean;
+/**
+ * Which of `wanted` this principal does NOT already hold. Empty means the request grants nothing
+ * new, which is what a narrow-only surface requires before it applies anything.
+ */
+export declare function uncoveredScopes(held: readonly string[], wanted: readonly string[]): string[];
+//# sourceMappingURL=scope-coverage.d.ts.map

package/dist/src/utils/scope-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-coverage.d.ts","sourceRoot":"","sources":["../../../src/utils/scope-coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAiCzD,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EACiB,CAAC;AAEvE,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAM9E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAE5F"}

package/dist/src/utils/scope-coverage.js

@@ -0,0 +1,115 @@
+/**
+ * @file src/utils/scope-coverage.ts
+ * @description "Does this principal already hold that scope?" — the one place that answers it,
+ *   including the scopes a wildcard deliberately does NOT carry.
+ *
+ *   `requireScope` treats `*` and `{domain}:*` as covering everything beneath them, and for almost
+ *   every scope that is right. `memory:write-reserved` is the exception: it hands over the keys the
+ *   server itself trusts (the AI-provider URL a decrypted key is sent to, the spend cap, the public
+ *   profile), so `hasWriteReserved` tests the EXACT string — "Full access" is one click and nobody
+ *   clicking it is deciding that.
+ *
+ *   That exception only holds if every gate agrees about it. Two did not, and both were reachable
+ *   by an agent with no owner involved at all:
+ *
+ *   - `aimeat_operator_agent_configure` skipped its narrow-only check entirely when the TARGET held
+ *     `*` (`added.length > 0 && !granted.has('*')`), on the reasoning that a `*` agent cannot gain
+ *     anything. That reasoning was true until exactly one scope stopped being covered by `*`. An
+ *     agent proposed `['*','memory:write-reserved']` for itself, minted the confirm token and
+ *     consumed it in the next call — the token binds to the caller, so the "show this to the owner"
+ *     step is instruction text, not a gate.
+ *   - the device-auth same-owner auto-approve skipped its escalation filter for a `*` approver, and
+ *     its coverage test read `memory:*` as covering `memory:write-reserved`.
+ *
+ *   Neither was an escalation before this scope existed. Both were, the moment it did.
+ * @structure SCOPES_OUTSIDE_WILDCARD · scopeIsCovered(held, scope) · uncoveredScopes(held, wanted)
+ * @usage
+ *   import { uncoveredScopes } from '../utils/scope-coverage.js';
+ *   const added = uncoveredScopes(agent.defaultScopes ?? [], proposed.scopes);
+ *   if (added.length > 0) return err(`…${added.join(', ')}`);
+ * @version-history
+ *   v1.1.0 — 2026-08-11 — ACCOUNT_SECURITY_SCOPE. Out of the wildcard from the day it exists,
+ *     because the narrow-only check on the agent-configure surface asks THIS file whether a scope
+ *     is already covered: a '*' agent would have been told yes and could have written the word
+ *     onto itself, which is the exact path the two cases above describe.
+ *   v1.0.0 — 2026-08-08 — Initial, closing the two paths that let an agent grant itself
+ *     memory:write-reserved without the owner's tick.
+ */
+/** The scope an owner grants an agent to write into the owner's own namespace. */
+export const WRITE_AS_OWNER_SCOPE = 'memory:write-as-owner';
+/**
+ * The stronger grant on top of it: also the RESERVED, server-trusted keys — `openrouter.*` (the URL
+ * a decrypted AI key is sent to), `ai-usage.*` (the spend cap) and `profile.*` (the public
+ * directory). For an agent that administers the account on the owner's behalf.
+ */
+export const WRITE_RESERVED_SCOPE = 'memory:write-reserved';
+/**
+ * The doors that decide who can get back INTO the account: the password, the recovery address, the
+ * second factor, the identity proof, and deleting or exporting everything. Enforced by
+ * requireOwnerPrincipal() in auth/middleware.ts, which admits an owner principal outright and any
+ * other principal only on this exact word.
+ *
+ * It is out of every wildcard for the same reason the reserved-write scope is, only sharper: an
+ * agent that can set the password can become the person. Nobody was grandfathered onto it either
+ * (services/scope-vocabulary-migration.ts), so an agent holding it was ticked by hand.
+ */
+export const ACCOUNT_SECURITY_SCOPE = 'account:security';
+/**
+ * Scopes no wildcard carries — neither `*` nor `{domain}:*`. Only the exact string counts, anywhere
+ * a scope is checked, proposed, or approved.
+ *
+ * The frontend mirror is NOT_IN_WILDCARD in public/views/profile/agents/scope-model.js; the two are
+ * asserted to agree in test/unit/agent-scope-model.test.ts. Adding an entry here without adding it
+ * there produces a checkbox that lies about what it granted.
+ */
+/**
+ * Eight tool calls the HTTP door reserves to an owner session and the tool surface let an agent
+ * make on an ordinary permission. Each is either the owner's money or who else sees the owner's
+ * data: the seller's Stripe credentials, the AI budget and the models it routes to, rewriting an
+ * agent's own permissions, the sharing groups that decide who reads memory, the roster of a shared
+ * board, and recording a beneficiary as payable.
+ *
+ * The answer is not to shut the agent out — an agent should be able to do what a person can. It is
+ * that each of these costs its own tick, and no wildcard carries it. "Full access" is one click,
+ * and nobody clicking it is deciding that an agent may repoint their payouts.
+ *
+ * Every agent that could already reach one of these tools was handed the new word at boot, once, by
+ * services/scope-vocabulary-migration.ts, so nothing lost a capability it had.
+ */
+const OWN_TICK_SCOPES = [
+    'commerce:psp', // write or destroy the seller's payment credentials
+    'commerce:beneficiary-verify', // record a beneficiary as verified, i.e. as payable
+    'agent:permissions', // rewrite an agent's granted permissions
+    'consent:groups', // create a sharing group, add or remove who is in it
+    'share:manage', // hand another account a standing right to read part of the owner's memory
+    'social:members', // change who may read a shared board
+];
+export const SCOPES_OUTSIDE_WILDCARD = [WRITE_RESERVED_SCOPE, ACCOUNT_SECURITY_SCOPE, ...OWN_TICK_SCOPES];
+/** True when `scope` is one of the scopes only an exact grant can confer. */
+export function isOutsideWildcard(scope) {
+    return SCOPES_OUTSIDE_WILDCARD.includes(scope);
+}
+/**
+ * Does a principal holding `held` already have `scope`?
+ *
+ * Same rules as requireScope — the global wildcard, the domain wildcard, or the exact string — with
+ * the one deliberate exception above, where only the exact string counts.
+ */
+export function scopeIsCovered(held, scope) {
+    if (held.includes(scope))
+        return true;
+    if (isOutsideWildcard(scope))
+        return false;
+    if (held.includes('*'))
+        return true;
+    const domain = scope.split(':')[0];
+    return !!domain && held.includes(`${domain}:*`);
+}
+/**
+ * Which of `wanted` this principal does NOT already hold. Empty means the request grants nothing
+ * new, which is what a narrow-only surface requires before it applies anything.
+ */
+export function uncoveredScopes(held, wanted) {
+    return wanted.filter(s => !scopeIsCovered(held, s));
+}
+//# sourceMappingURL=scope-coverage.js.map

package/dist/src/utils/scope-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-coverage.js","sourceRoot":"","sources":["../../../src/utils/scope-coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD;;;;;;;GAOG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,eAAe,GAAG;IACpB,cAAc,EAAa,oDAAoD;IAC/E,6BAA6B,EAAE,oDAAoD;IACnF,mBAAmB,EAAQ,yCAAyC;IACpE,gBAAgB,EAAW,qDAAqD;IAChF,cAAc,EAAa,2EAA2E;IACtG,gBAAgB,EAAW,qCAAqC;CAC1D,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAChC,CAAC,oBAAoB,EAAE,sBAAsB,EAAE,GAAG,eAAe,CAAC,CAAC;AAEvE,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC3C,OAAO,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAuB,EAAE,KAAa;IACjE,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,MAAyB;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/static/app-catalog/js/favorites.js

@@ -28,7 +28,7 @@ export function loadFavorites() {
   var token = getCortexOwnerToken();
   var b = base();
   if (!token || !b) { favSet = new Set(); return Promise.resolve(); }
-  return fetch(b + '/v1/memory/' + encodeURIComponent(KEY), { headers: { 'Authorization': 'Bearer ' + token } })
+  return fetch(b + '/v1/memory/' + encodeURIComponent(KEY) + '?soft=1', { headers: { 'Authorization': 'Bearer ' + token } })
     .then(function (r) { return r.ok ? r.json() : null; })
     .then(function (j) {
       var refs = (j && j.data && j.data.value && Array.isArray(j.data.value.refs)) ? j.data.value.refs : [];

package/dist/static/app-catalog/js/i18n-data.js

@@ -63,7 +63,7 @@ export const I18N = {
       'view.community': '🌍 Community',
       'view.communityEmpty': 'No community apps on this node yet.',
       'view.communityHint': 'Community apps are apps other people on this node have published. When someone publishes one, it shows up here.',
-      'sec.parked': '🅿️ Parked Apps',
+      'sec.parked': 'Unlisted apps',
       'sec.parkedBlurb': 'Only you can see and use these — they stay usable but are hidden from the public catalogue. Press Publish to move one back to Published Apps.',
       'sec.recent': '🕒 Recently Opened',
       'sec.local': '📚 Your apps',
@@ -134,7 +134,7 @@ export const I18N = {
       'publish.descriptionHint': 'Shown in the catalogue and on the landing wall. Required for a new app.',
       'publish.accessCode': 'Access Code (optional)',
       'publish.accessCodePh': 'Leave empty for public',
-      'publish.accessCodeHint': '4-64 chars. If set, only people with the code can download.',
+      'publish.accessCodeHint': '4-64 chars. If set, the app only opens or downloads with the code. You, the owner, never need it.',
       'publish.submit': 'Publish',
       'publish.loginRequired': 'Sign in to publish to AIMEAT. Anonymous publishing is disabled — use the Sign in button in the top bar.',
       'publish.savedUnlisted': 'Saved — your app is on the server as unlisted. Open it and press List when you want it public.',
@@ -675,7 +675,7 @@ export const I18N = {
       'view.community': '🌍 Yhteisö',
       'view.communityEmpty': 'Tällä nodella ei ole vielä yhteisön sovelluksia.',
       'view.communityHint': 'Yhteisön sovellukset ovat sovelluksia, joita muut tämän noden käyttäjät ovat julkaisseet. Kun joku julkaisee sellaisen, se näkyy täällä.',
-      'sec.parked': '🅿️ Parkissa olevat sovellukset',
+      'sec.parked': 'Listaamattomat sovellukset',
       'sec.parkedBlurb': 'Vain sinä näet ja voit käyttää näitä — ne pysyvät käytettävissä mutta eivät näy julkisessa katalogissa. Paina Julkaise siirtääksesi takaisin julkaistuihin.',
       'sec.recent': '🕒 Viimeksi avatut',
       'sec.local': '📚 Sinun sovelluksesi',
@@ -746,7 +746,7 @@ export const I18N = {
       'publish.descriptionHint': 'Näytetään katalogissa ja aloitusseinällä. Pakollinen uudelle sovellukselle.',
       'publish.accessCode': 'Pääsykoodi (valinnainen)',
       'publish.accessCodePh': 'Jätä tyhjäksi julkiseksi',
-      'publish.accessCodeHint': '4–64 merkkiä. Jos asetettu, vain koodin tietävät voivat ladata.',
+      'publish.accessCodeHint': '4–64 merkkiä. Jos asetettu, sovellus aukeaa ja latautuu vain koodilla. Sinä omistajana et koskaan tarvitse sitä.',
       'publish.submit': 'Julkaise',
       'publish.loginRequired': 'Kirjaudu sisään julkaistaksesi AIMEATiin. Anonyymi julkaisu on poistettu käytöstä — käytä yläpalkin Kirjaudu-painiketta.',
       'publish.savedUnlisted': 'Tallennettu — sovelluksesi on palvelimella ei-listalla. Avaa se ja paina Listaa kun haluat sen julkiseksi.',

package/dist/static/app-catalog/js/promote.js

@@ -29,7 +29,7 @@ export function loadPromoted() {
   var token = getCortexOwnerToken();
   var b = base();
   if (!token || !b) { promoted = {}; return Promise.resolve(); }
-  return fetch(b + '/v1/memory/' + encodeURIComponent(KEY), { headers: { 'Authorization': 'Bearer ' + token } })
+  return fetch(b + '/v1/memory/' + encodeURIComponent(KEY) + '?soft=1', { headers: { 'Authorization': 'Bearer ' + token } })
     .then(function (r) { return r.ok ? r.json() : null; })
     .then(function (j) {
       var items = (j && j.data && j.data.value && Array.isArray(j.data.value.items)) ? j.data.value.items : [];

package/dist/static/app-catalog/js/render.js

@@ -123,7 +123,21 @@ function launchInTab(app) {
 // View a published app: open it TOP-LEVEL in a new tab (clean full page, no toolbar/X). The
 // url is the apex ?mode=inline URL; the server serves it inline (session inherited) when the
 // app origin is OFF, or 301s it to the isolated app origin when ON.
+// The viewer's OWN protected app gets its access code appended (a plain navigation carries no
+// Bearer, so without the code the owner would land on the unlock page for their own app).
 function viewPublished(url, name) {
+  try {
+    var u = new URL(url, window.location.origin);
+    var parts = u.pathname.split('/'); // ['', 'v1', 'apps', owner, filename]
+    if (parts[1] === 'v1' && parts[2] === 'apps' && parts[3] && parts[4]) {
+      var key = decodeURIComponent(parts[3]) + '/' + decodeURIComponent(parts[4]);
+      var codeVal = ownAppAccessCodes[key];
+      if (codeVal && !u.searchParams.has('code')) {
+        url += (url.indexOf('?') >= 0 ? '&' : '?') + 'code=' + encodeURIComponent(codeVal);
+      }
+    }
+  // eslint-disable-next-line aimeat/no-silent-catch -- an unparseable url just opens as-is; the server still answers with the unlock page
+  } catch (err) { void err; }
   window.open(url, '_blank', 'noopener');
 }
 
@@ -176,6 +190,10 @@ export let serverStateByFilename = {};
 // filename -> current protection object, populated here as own cards render; the detail module
 // (copy-protection modal) reads it via the injected getOwnProtection() getter.
 export let ownAppProtection = {};
+// "owner/filename" -> the ACCESS CODE of the viewer's OWN protected app. The listing exposes the
+// code only to the app's owner; viewPublished appends it so the owner's own Open never lands on
+// the unlock page (UX-remake v3, P6). Other people's apps are never in this map.
+export let ownAppAccessCodes = {};
 export let serverAppManifests = {}; // moved out of server-io: SSOT for the owner-app manifest cache (detail reads via getServerManifests)
 
 /**
@@ -309,6 +327,7 @@ function buildLibraryEntries(localApps, serverApps) {
         accessCode: !!sa.protected
       };
       ownAppProtection[fn] = prot;
+      if (sa.access_code) ownAppAccessCodes[(sa.owner || '') + '/' + fn] = sa.access_code;
     }
   }
   return entries;

package/dist/static/app-catalog/js/server-io.js

@@ -800,6 +800,10 @@ function loadPublishedApps() {
         currentOwner = JSON.parse(stored).owner || null;
       }
     }
+    // The token is the authority the rest of this file uses. Without one there is no owner,
+    // whatever a leftover localStorage blob says — reading that stale blob kept "Your apps (1)"
+    // on screen after a logout (UX-remake v3, measured).
+    if (!getCortexOwnerToken()) currentOwner = null;
   } catch(e) {}
 
   // Load the owner's favourites alongside the app list so the ⭐ group + stars match the current

package/dist/static/app-catalog/js/settings.js

@@ -132,7 +132,7 @@ function loadConfigFromServer() {
       if (!token) return;
       var gaii = auth.data.gaii || auth.data.sub || '';
       if (!gaii) return;
-      return fetch(url + '/v1/memory/app-launcher%2Fconfig', {
+      return fetch(url + '/v1/memory/app-launcher%2Fconfig?soft=1', {
         headers: { 'Authorization': 'Bearer ' + token }
       }).then(function (r) {
         if (!r.ok) return null;