aimeat 2.7.0 → 3.1.0

package/dist/src/mcp/apps-fork.js

@@ -0,0 +1,71 @@
+import { z } from 'zod';
+import { annotationsFor } from './annotations.js';
+import { descriptionFor } from './catalog/shape.js';
+import { forkApp, resolveAppOwnerScope } from '../services/app-lifecycle.js';
+import { logger } from '../utils/logger.js';
+export function registerAppForkTool(mcp, storage, config, getAgentGaii, emitResourceListChanged) {
+    // ── Tool 6: aimeat_app_fork ──
+    mcp.tool('aimeat_app_fork', descriptionFor('aimeat_app_fork'), {
+        owner: z.string().describe('Owner name of the source app'),
+        filename: z.string().describe('Filename of the source app'),
+        new_filename: z.string().describe('Filename for the fork in your catalogue. Alphanumeric, dots, hyphens, underscores. Max 100 chars.'),
+        version: z.number().optional().describe('Source version to fork (default: latest)'),
+    }, annotationsFor('aimeat_app_fork'), async ({ owner, filename, new_filename, version }) => {
+        const agentGaii = getAgentGaii();
+        const scope = await resolveAppOwnerScope(storage, config, agentGaii);
+        if (!scope) {
+            return { content: [{ type: 'text', text: 'Failed to parse agent GAII' }], isError: true };
+        }
+        const source = await storage.getAppByOwnerName(owner, filename, version);
+        if (!source || source.operatorHidden) {
+            return { content: [{ type: 'text', text: `App "${filename}" not found for owner "${owner}"${version ? ` (version ${version})` : ''}` }], isError: true };
+        }
+        const { ownerName: callerOwner, ownerGhii: callerGhii } = scope;
+        const sameOwner = callerOwner === source.ownerName;
+        // Gate 1 — derivative permission (agents are never operators here).
+        if (!sameOwner && !source.forkable) {
+            return { content: [{ type: 'text', text: 'This app is not open for forking by others. Ask the owner to enable forking.' }], isError: true };
+        }
+        // Gate 2 — a paid source's bytes must not bypass the paywall.
+        if (config.marketplaceEnabled && source.manifest.priceMorsels && source.manifest.priceMorsels > 0 && !sameOwner) {
+            const hasLicense = await storage.hasValidLicense(agentGaii, source.ownerGaii, filename);
+            if (!hasLicense) {
+                return { content: [{ type: 'text', text: `This app costs ${source.manifest.priceMorsels} morsels. Purchase it first before forking.` }], isError: true };
+            }
+        }
+        try {
+            // From here it is services/app-lifecycle.ts — the same copy POST .../fork performs,
+            // including the target-name check, the per-owner quota, the lineage event, the
+            // change log and the feed.
+            const out = await forkApp(storage, config, {
+                source,
+                callerOwner,
+                callerGhii,
+                callerGaii: agentGaii,
+                newFilename: new_filename,
+            });
+            if ('refusal' in out) {
+                return { content: [{ type: 'text', text: out.refusal.message }], isError: true };
+            }
+            logger.info(`App forked via MCP: ${owner}/${filename} → ${new_filename}`, { by: agentGaii });
+            emitResourceListChanged(agentGaii);
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            filename: out.filename,
+                            version_number: out.versionNumber,
+                            forked_from: out.forkedFrom,
+                            download_url: out.downloadUrl,
+                            inline_url: `${out.downloadUrl}?mode=inline`,
+                            note: `Forked "${filename}" into your catalogue as "${new_filename}".`,
+                        }, null, 2),
+                    }],
+            };
+        }
+        catch (err) {
+            return { content: [{ type: 'text', text: `Failed to fork app: ${err.message}` }], isError: true };
+        }
+    });
+}
+//# sourceMappingURL=apps-fork.js.map

package/dist/src/mcp/apps-fork.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps-fork.js","sourceRoot":"","sources":["../../../src/mcp/apps-fork.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,UAAU,mBAAmB,CAC/B,GAAc,EACd,OAAgB,EAChB,MAAoB,EACpB,YAA0B,EAC1B,uBAAoD;IAEpD,gCAAgC;IAChC,GAAG,CAAC,IAAI,CACJ,iBAAiB,EACjB,cAAc,CAAC,iBAAiB,CAAC,EACjC;QACI,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mGAAmG,CAAC;QACtI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;KACtF,EACD,cAAc,CAAC,iBAAiB,CAAC,EACjC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE;QACjD,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvG,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,QAAQ,QAAQ,0BAA0B,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtK,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAChE,MAAM,SAAS,GAAG,WAAW,KAAK,MAAM,CAAC,SAAS,CAAC;QAEnD,oEAAoE;QACpE,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,8EAA8E,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzJ,CAAC;QACD,8DAA8D;QAC9D,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9G,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACxF,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,kBAAkB,MAAM,CAAC,QAAQ,CAAC,YAAY,6CAA6C,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACtK,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACD,oFAAoF;YACpF,+EAA+E;YAC/E,2BAA2B;YAC3B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,MAAM;gBACN,WAAW;gBACX,UAAU;gBACV,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,YAAY;aAC5B,CAAC,CAAC;YACH,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;gBACnB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9F,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,IAAI,QAAQ,MAAM,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7F,uBAAuB,CAAC,SAAS,CAAC,CAAC;YAEnC,OAAO;gBACH,OAAO,EAAE,CAAC;wBACN,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACjB,QAAQ,EAAE,GAAG,CAAC,QAAQ;4BACtB,cAAc,EAAE,GAAG,CAAC,aAAa;4BACjC,WAAW,EAAE,GAAG,CAAC,UAAU;4BAC3B,YAAY,EAAE,GAAG,CAAC,WAAW;4BAC7B,UAAU,EAAE,GAAG,GAAG,CAAC,WAAW,cAAc;4BAC5C,IAAI,EAAE,WAAW,QAAQ,6BAA6B,YAAY,IAAI;yBACzE,EAAE,IAAI,EAAE,CAAC,CAAC;qBACd,CAAC;aACL,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,uBAAwB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1H,CAAC;IACL,CAAC,CACJ,CAAC;AACN,CAAC"}

package/dist/src/mcp/apps-ui.d.ts

@@ -0,0 +1,39 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/** The ui:// address of the app-index page. Referenced by aimeat_app_list's `_meta`. */
+export declare const APP_INDEX_UI_URI = "ui://aimeat/app-index.html";
+/** What marks a resource as an MCP App page rather than ordinary HTML. */
+export declare const APP_UI_MIME = "text/html;profile=mcp-app";
+/**
+ * The tool `_meta` that points a host at a page. BOTH keys are required.
+ *
+ * The extension's own helper (registerAppTool in @modelcontextprotocol/ext-apps) writes the
+ * nested `ui.resourceUri` and the flat `ui/resourceUri` and back-fills whichever the caller
+ * omitted, so every published example carries both and neither is documented as load-bearing.
+ * A host reads the nested form to decide the tool HAS a page (Claude groups it under
+ * "Interactive tools" on that alone) and the flat form to fetch it. With only the nested key,
+ * the frame mounts and stays empty: no request for the page is ever made, so the failure looks
+ * like a broken page rather than a missing field.
+ */
+export declare function uiToolMeta(resourceUri: string): Record<string, unknown>;
+/** The page, built once. Throws if the library bundle cannot be read or parsed. */
+export declare function appIndexHtml(): string;
+/**
+ * Whether this node can serve the page at all, decided once and cached.
+ *
+ * The page needs a browser bundle from node_modules, and a node whose deploy has yet to install
+ * the dependency does not have it. That must cost the CHAT ITS PICTURE AND NOTHING ELSE: the first
+ * version threw from the resource handler, so a missing optional asset surfaced to the person as
+ * "Unable to reach AIMEAT" and took the whole tool call with it. An enhancement that can break the
+ * thing it enhances is worse than no enhancement.
+ */
+export declare function appUiAvailable(): boolean;
+/**
+ * Serve the app-index page as an MCP resource. The host fetches it when a tool whose `_meta`
+ * names this address is called, and may fetch it earlier to have the frame ready.
+ *
+ * No `_meta.ui.csp` is declared, and that is the point: the page loads nothing from anywhere, so
+ * the host's deny-by-default policy is already the right one. A future edit that adds an external
+ * font, image or fetch has to declare its origin here and say why.
+ */
+export declare function registerAppIndexUi(mcp: McpServer): void;
+//# sourceMappingURL=apps-ui.d.ts.map

package/dist/src/mcp/apps-ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps-ui.d.ts","sourceRoot":"","sources":["../../../src/mcp/apps-ui.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,wFAAwF;AACxF,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,0EAA0E;AAC1E,eAAO,MAAM,WAAW,8BAA8B,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEvE;AAgLD,mFAAmF;AACnF,wBAAgB,YAAY,IAAI,MAAM,CAIrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAWxC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAcvD"}

package/dist/src/mcp/apps-ui.js

@@ -0,0 +1,291 @@
+/**
+ * @file apps-ui.ts
+ * @description The app index as an MCP App: an interactive card grid the host renders inside the
+ *   conversation, instead of the person reading a JSON array of their own apps. Pairs with
+ *   aimeat_app_list, whose `_meta` points here (see ./apps.ts).
+ *
+ *   Two constraints shape the page, and both cost a deploy before they were understood:
+ *
+ *   1. The host renders it in a sandboxed frame under a deny-by-default CSP, so EVERYTHING is
+ *      inline. No external stylesheet, font, image or script, and no fetch. Data arrives over
+ *      postMessage. Adding an external load means declaring an origin in `_meta.ui.csp`, which is
+ *      a decision, not a detail.
+ *   2. The postMessage side is the OFFICIAL @modelcontextprotocol/ext-apps App class, inlined,
+ *      never hand-written. Hand-writing it failed twice for reasons no document states: the tool
+ *      `_meta` needs the address under two different keys, and `ui/initialize` takes exactly three
+ *      params with additionalProperties:false, so one stray key voids the request. Both failures
+ *      look identical from outside, an empty frame with no error anywhere, and neither is
+ *      reproducible without a real host. The library is the only party that knows this dialect.
+ *
+ *   The node has no build step for browser assets outside the app-catalog, so the library's
+ *   self-contained browser bundle is read from node_modules at boot and inlined into the page.
+ *   That makes the page large (~350 kB) for one resource read per app-open, which is the price of
+ *   not maintaining a second implementation of somebody else's protocol.
+ * @structure
+ *   - APP_INDEX_UI_URI — the ui:// address aimeat_app_list points at
+ *   - APP_UI_MIME — the MIME type that marks a resource as an MCP App page
+ *   - uiToolMeta() — the tool `_meta` that points a host at a page, under BOTH required keys
+ *   - appIndexHtml() — the page; built once, cached
+ *   - registerAppIndexUi() — serves the page as an MCP resource
+ * @usage
+ *   import { registerAppIndexUi, APP_INDEX_UI_URI, uiToolMeta } from './apps-ui.js';
+ *   registerAppIndexUi(mcp);
+ * @version-history
+ *   v1.1.1 — 2026-08-09 — A node that cannot build the page offers none, instead of throwing from
+ *     the resource handler. Prod had not installed the new dependency yet, and the throw reached
+ *     the person as "Unable to reach AIMEAT": a missing picture took the whole tool call with it.
+ *     appUiAvailable() decides once; without it the tool registers with no `_meta.ui` and no
+ *     resource, so the listing works exactly as it did before this file existed.
+ *   v1.1.0 — 2026-08-09 — The page drives the official App class instead of a hand-written
+ *     postMessage client. Two hand-rolled versions failed in Claude for undocumented reasons and
+ *     neither could be reproduced without it; a bespoke implementation of another project's
+ *     dialect is not something this node should own.
+ *   v1.0.1 — 2026-08-09 — uiToolMeta: the tool `_meta` carries the FLAT `ui/resourceUri` key
+ *     alongside the nested `ui.resourceUri`. With only the nested one Claude mounted the frame and
+ *     left it empty, never requesting the page. Found by reading registerAppTool in ext-apps, which
+ *     writes both and back-fills the missing one, so every example carries both and no document
+ *     says either is required. Caught in a real client and NOT by the e2e, which asserted the
+ *     nested key because that is the one the prose names.
+ *   v1.0.0 — 2026-08-09 — Initial. First MCP App on this node; a pilot on one tool before the rest
+ *     of the catalogue is built on it.
+ */
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { logger } from '../utils/logger.js';
+/** The ui:// address of the app-index page. Referenced by aimeat_app_list's `_meta`. */
+export const APP_INDEX_UI_URI = 'ui://aimeat/app-index.html';
+/** What marks a resource as an MCP App page rather than ordinary HTML. */
+export const APP_UI_MIME = 'text/html;profile=mcp-app';
+/**
+ * The tool `_meta` that points a host at a page. BOTH keys are required.
+ *
+ * The extension's own helper (registerAppTool in @modelcontextprotocol/ext-apps) writes the
+ * nested `ui.resourceUri` and the flat `ui/resourceUri` and back-fills whichever the caller
+ * omitted, so every published example carries both and neither is documented as load-bearing.
+ * A host reads the nested form to decide the tool HAS a page (Claude groups it under
+ * "Interactive tools" on that alone) and the flat form to fetch it. With only the nested key,
+ * the frame mounts and stays empty: no request for the page is ever made, so the failure looks
+ * like a broken page rather than a missing field.
+ */
+export function uiToolMeta(resourceUri) {
+    return { ui: { resourceUri }, 'ui/resourceUri': resourceUri };
+}
+/**
+ * The library's browser bundle, rewritten so an inline module can reach its App class.
+ *
+ * The bundle is ESM and ends in one `export { … }` naming its public bindings. An inline
+ * `<script type="module">` cannot be imported from, so that statement is replaced with an
+ * assignment to a global the page's own code reads. The local name behind `App` is a minified
+ * identifier that changes between releases, which is why it is parsed out rather than assumed.
+ */
+function loadAppRuntime() {
+    const require = createRequire(import.meta.url);
+    const bundlePath = require.resolve('@modelcontextprotocol/ext-apps/app-with-deps');
+    const source = readFileSync(bundlePath, 'utf8');
+    const exportStatement = /export\s*\{([\s\S]*?)\}\s*;?\s*$/.exec(source);
+    if (!exportStatement)
+        throw new Error(`ext-apps bundle has no export statement: ${bundlePath}`);
+    const appBinding = exportStatement[1]
+        .split(',')
+        .map(pair => pair.split(/\s+as\s+/).map(s => s.trim()))
+        .find(pair => pair[1] === 'App');
+    if (!appBinding)
+        throw new Error(`ext-apps bundle exports no App: ${bundlePath}`);
+    return source.slice(0, exportStatement.index) + `\nglobalThis.__AIMEAT_MCP_APP = ${appBinding[0]};\n`;
+}
+/** Styles and markup. The script that drives them is appended in appIndexHtml(). */
+const PAGE_SHELL = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Apps</title>
+<style>
+  :root {
+    --bg: #ffffff; --fg: #1a1a1a; --muted: #666666;
+    --card: #f7f7f8; --line: #e3e3e6; --accent: #2f6f4f;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --bg: #1b1b1d; --fg: #ececee; --muted: #a0a0a6;
+      --card: #242427; --line: #34343a; --accent: #7fc9a1;
+    }
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; padding: 16px; background: var(--bg); color: var(--fg);
+    font: 14px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif;
+  }
+  h1 { font-size: 15px; margin: 0 0 12px; font-weight: 600; }
+  .count { color: var(--muted); font-weight: 400; }
+  .grid { display: grid; gap: 10px; grid-template-columns: repeat(auto-fill, minmax(min(100%, 240px), 1fr)); }
+  .card {
+    background: var(--card); border: 1px solid var(--line); border-radius: 10px;
+    padding: 12px; display: flex; flex-direction: column; gap: 6px; min-width: 0;
+  }
+  .top { display: flex; align-items: center; gap: 8px; min-width: 0; }
+  .icon { font-size: 18px; line-height: 1; flex: none; }
+  .name { font-weight: 600; overflow-wrap: anywhere; }
+  .desc { color: var(--muted); overflow-wrap: anywhere; }
+  .tags { display: flex; flex-wrap: wrap; gap: 4px; }
+  .tag {
+    font-size: 11px; color: var(--muted); border: 1px solid var(--line);
+    border-radius: 999px; padding: 1px 7px;
+  }
+  a.open { color: var(--accent); font-weight: 600; text-decoration: none; overflow-wrap: anywhere; }
+  a.open:hover { text-decoration: underline; }
+  .addr { font-size: 11px; color: var(--muted); overflow-wrap: anywhere; }
+  .empty { color: var(--muted); }
+</style>
+</head>
+<body>
+<h1>Apps <span class="count" id="count"></span></h1>
+<div class="grid" id="grid"><p class="empty" id="empty">Loading your apps…</p></div>
+`;
+/**
+ * The page's own code. Runs after the library bundle in the same module script, so `App` is
+ * already on globalThis. The handler is attached BEFORE connect(): the host may push the tool
+ * result the moment the handshake completes, and the library warns about handlers that arrive
+ * late. No backticks below this line; this is a template literal in a .ts file.
+ */
+const PAGE_SCRIPT = `
+const App = globalThis.__AIMEAT_MCP_APP;
+const grid = document.getElementById('grid');
+const empty = document.getElementById('empty');
+const countEl = document.getElementById('count');
+
+const text = (el, value) => { el.textContent = value == null ? '' : String(value); return el; };
+const make = (tag, cls) => { const el = document.createElement(tag); if (cls) el.className = cls; return el; };
+
+function render(apps) {
+  grid.textContent = '';
+  if (!apps.length) {
+    grid.appendChild(text(make('p', 'empty'), 'No apps published yet.'));
+    countEl.textContent = '';
+    return;
+  }
+  countEl.textContent = '(' + apps.length + ')';
+  for (const app of apps) {
+    const card = make('div', 'card');
+
+    const top = make('div', 'top');
+    if (app.icon) top.appendChild(text(make('span', 'icon'), app.icon));
+    top.appendChild(text(make('span', 'name'), app.name || app.filename));
+    card.appendChild(top);
+
+    if (app.description) card.appendChild(text(make('p', 'desc'), app.description));
+
+    // The category leads, then up to four tags that say something it did not. Plenty of apps
+    // tag themselves with their own category, and printing "game game board-game" reads as a
+    // bug to anyone looking at the card.
+    const rest = (app.tags || []).filter(t => t && t !== app.category).slice(0, 4);
+    const tags = app.category ? [app.category, ...rest] : rest;
+    if (tags.length) {
+      const row = make('div', 'tags');
+      for (const t of tags) row.appendChild(text(make('span', 'tag'), t));
+      card.appendChild(row);
+    }
+
+    // Opening goes through the HOST, not the frame. A plain target=_blank does nothing here:
+    // the app runs in a sandbox that refuses to navigate or open a window, which is the whole
+    // point of the sandbox. ui/open-link is the door the extension provides for exactly this,
+    // and the anchor stays as the fallback for a host that does not offer it. The address is
+    // also printed, so a person is never stuck with a button that goes nowhere.
+    if (app.url) {
+      const url = app.url;
+      const a = make('a', 'open');
+      a.href = url; a.target = '_blank'; a.rel = 'noopener noreferrer';
+      a.addEventListener('click', async (event) => {
+        event.preventDefault();
+        try {
+          const { isError } = await mcpApp.openLink({ url });
+          if (isError) window.open(url, '_blank', 'noopener');
+        } catch {
+          window.open(url, '_blank', 'noopener');
+        }
+      });
+      card.appendChild(text(a, 'Open'));
+      card.appendChild(text(make('div', 'addr'), url));
+    }
+
+    grid.appendChild(card);
+  }
+}
+
+// The tool answers with one text block holding { apps: [...], total }.
+function readToolResult(result) {
+  try {
+    const block = (result?.content || []).find(c => c.type === 'text');
+    if (!block) return null;
+    const parsed = JSON.parse(block.text);
+    return Array.isArray(parsed.apps) ? parsed.apps : null;
+  } catch { return null; }
+}
+
+const mcpApp = new App({ name: 'AIMEAT App Index', version: '1.0.0' });
+
+mcpApp.ontoolresult = (result) => {
+  const apps = readToolResult(result);
+  if (apps) render(apps);
+  else text(empty, 'No apps to show.');
+};
+
+try {
+  await mcpApp.connect();
+} catch (err) {
+  // A page that cannot start says so. The failures this replaced showed nothing at all, which
+  // is what made them cost three deploys to find.
+  text(empty, 'This view could not start: ' + (err && err.message ? err.message : String(err)));
+}
+`;
+let cachedPage = null;
+let pageUnavailable = false;
+/** The page, built once. Throws if the library bundle cannot be read or parsed. */
+export function appIndexHtml() {
+    if (cachedPage)
+        return cachedPage;
+    cachedPage = `${PAGE_SHELL}<script type="module">\n${loadAppRuntime()}\n${PAGE_SCRIPT}\n</` + `script>\n</body>\n</html>`;
+    return cachedPage;
+}
+/**
+ * Whether this node can serve the page at all, decided once and cached.
+ *
+ * The page needs a browser bundle from node_modules, and a node whose deploy has yet to install
+ * the dependency does not have it. That must cost the CHAT ITS PICTURE AND NOTHING ELSE: the first
+ * version threw from the resource handler, so a missing optional asset surfaced to the person as
+ * "Unable to reach AIMEAT" and took the whole tool call with it. An enhancement that can break the
+ * thing it enhances is worse than no enhancement.
+ */
+export function appUiAvailable() {
+    if (cachedPage)
+        return true;
+    if (pageUnavailable)
+        return false;
+    try {
+        appIndexHtml();
+        return true;
+    }
+    catch (err) {
+        pageUnavailable = true;
+        logger.warn('app-index UI unavailable; aimeat_app_list keeps working without a rendered view', { error: String(err) });
+        return false;
+    }
+}
+/**
+ * Serve the app-index page as an MCP resource. The host fetches it when a tool whose `_meta`
+ * names this address is called, and may fetch it earlier to have the frame ready.
+ *
+ * No `_meta.ui.csp` is declared, and that is the point: the page loads nothing from anywhere, so
+ * the host's deny-by-default policy is already the right one. A future edit that adds an external
+ * font, image or fetch has to declare its origin here and say why.
+ */
+export function registerAppIndexUi(mcp) {
+    // A node that cannot build the page offers no page: no resource, and (via appUiAvailable in
+    // apps.ts) no `_meta.ui` on the tool either, so a host is never pointed at something absent.
+    if (!appUiAvailable())
+        return;
+    mcp.registerResource('app-index-ui', APP_INDEX_UI_URI, {
+        mimeType: APP_UI_MIME,
+        description: 'Interactive card grid of the apps published on this node, rendered inside the conversation.',
+    }, async (uri) => ({ contents: [{ uri: uri.toString(), mimeType: APP_UI_MIME, text: appIndexHtml() }] }));
+}
+//# sourceMappingURL=apps-ui.js.map

package/dist/src/mcp/apps-ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps-ui.js","sourceRoot":"","sources":["../../../src/mcp/apps-ui.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,wFAAwF;AACxF,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC1C,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc;IACnB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEhD,MAAM,eAAe,GAAG,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,UAAU,EAAE,CAAC,CAAC;IAEhG,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC;SAChC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SACtD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,EAAE,CAAC,CAAC;IAElF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,GAAG,mCAAmC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1G,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8ClB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyFnB,CAAC;AAEF,IAAI,UAAU,GAAkB,IAAI,CAAC;AACrC,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,mFAAmF;AACnF,MAAM,UAAU,YAAY;IACxB,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,UAAU,GAAG,GAAG,UAAU,2BAA2B,cAAc,EAAE,KAAK,WAAW,MAAM,GAAG,2BAA2B,CAAC;IAC1H,OAAO,UAAU,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc;IAC1B,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,eAAe;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,iFAAiF,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvH,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAc;IAC7C,4FAA4F;IAC5F,6FAA6F;IAC7F,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO;IAE9B,GAAG,CAAC,gBAAgB,CAChB,cAAc,EACd,gBAAgB,EAChB;QACI,QAAQ,EAAE,WAAW;QACrB,WAAW,EAAE,6FAA6F;KAC7G,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,CACxG,CAAC;AACN,CAAC"}

package/dist/src/mcp/apps.d.ts

@@ -9,6 +9,33 @@
  *   import { registerAppsTools } from './apps.js';
  *   registerAppsTools(mcp, storage, config, getAgentGaii, emitResourceUpdated, emitResourceListChanged);
  * @version-history
+ *   v1.13.0 — 2026-08-11 — August 2026 audit step 8: the draft save, the draft promotion and the
+ *     delete go through services/app-lifecycle.ts, the same functions the HTTP routes call. Three
+ *     divergences went with the duplication. The delete removed ONE bucket and left the app's
+ *     screenshot in storage with no change-log line, where the route sweeps every bucket the owner
+ *     has for that filename (old publish paths left ghost rows), deletes the screenshot and logs. The
+ *     draft save defaulted a new app's category to 'tool' where every other door says 'utility'. And
+ *     all five tools composed the owner bucket as `owner@nodeId` by hand instead of resolving the
+ *     owner's canonical GHII, which is the key routes/apps.ts addresses and the key the startup
+ *     bucket-merge migration consolidates onto.
+ *   v1.12.0 — 2026-08-11 — Both publish tools take `spec_token` / `spec_ack` (carried into the token
+ *     in upload mode) and return `spec_check` + `app_hints`. A blocking artifact finding comes back
+ *     as an error carrying the findings, so the remedy survives MCP's plain-text error channel.
+ *     `buildNextSteps` moved to services/app-publish-next-steps.ts and now runs on the shared publish
+ *     path — it lived here, so the agent-face and bound-skill reminder reached MCP-inline callers
+ *     only, and never the presigned door this very tool recommends above 1 KB.
+ *   v1.11.0 — 2026-08-09 — aimeat_app_list is an MCP App: `_meta.ui.resourceUri` names the card grid
+ *     in ./apps-ui.ts, which a host that supports the extension renders inside the conversation.
+ *     Moved from mcp.tool to mcp.registerTool because only the config form carries `_meta`. First
+ *     use of the extension on this node, deliberately on ONE tool: the sandbox's deny-by-default
+ *     CSP and the absence of a portal session are the parts worth proving before the catalogue
+ *     leans on them.
+ *   v1.10.0 — 2026-08-09 — aimeat_app_list and aimeat_app_get carry `url`, the app's public
+ *     app-origin address (its own subdomain when it has one, else the shared path form). Both
+ *     served only `download_url`, a node-relative path, so an agent asked to show someone their
+ *     apps had nothing it could hand over: the address existed and the chat surface never saw it.
+ *     Resolved read-only via resolveAppUrls (one subdomain-table read for the whole page) rather
+ *     than appOriginUrl, which would mint a subdomain per app as a side effect of listing.
  *   v1.9.0 — 2026-08-01 — TARGET-058: aimeat_app_publish's UPLOAD mode mints its token through
  *     buildUploadMeta and carries `ai_provenance` / `ai_provenance_id` + `actor`. Phase 4 gave this
  *     tool the parameter and Phase 8 shared the publish, but the presigned branch still hand-wrote

package/dist/src/mcp/apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../../../src/mcp/apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAe,MAAM,yBAAyB,CAAC;AAgBpE,wBAAgB,iBAAiB,CAC7B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,MAAM,EAC1B,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,EAC7D,uBAAuB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACrD,IAAI,CA2oBN"}
+{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../../../src/mcp/apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAqBvD,wBAAgB,iBAAiB,CAC7B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,MAAM,EAC1B,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,EAC7D,uBAAuB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACrD,IAAI,CAojBN"}