spectoflow 0.28.0 → 0.30.0

package/lib/dashboard/handlers.js

@@ -20,6 +20,33 @@ function body(req) { return new Promise((r) => { let b = ''; req.on('data', (c)
 
 const { ROUTES, findRoute } = require('./routes');
 
+// Is this request really the user, on this machine, in a dashboard tab of this hub? The hub is reachable
+// from the local network; a tunnel or reverse proxy on the same machine (ngrok, Caddy) arrives from
+// loopback; and a web page can rebind its own domain to 127.0.0.1 (DNS rebinding) or post cross-site. So
+// all three must hold: a loopback socket, a local Host, and — when the browser sends one — an Origin that is
+// this very host. Anything else is treated like a request through the online relay: it can't touch the
+// second brain (ops refuse it) and a run it starts can't write into it.
+const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]']);
+const isLoopback = (addr) => !!addr && (LOOPBACK.has(addr) || addr.startsWith('127.') || addr.startsWith('::ffff:127.'));
+// allowNavigation: the hub's own gate lets a top-level GET navigation from another site through (a link to
+// the dashboard clicked elsewhere) — the linking page can't read what it opens. Ops never allow it.
+function isLocalRequest(req, { allowNavigation = false } = {}) {
+  if (!isLoopback(req.socket && req.socket.remoteAddress)) return false;
+  const host = String(req.headers.host || '');
+  let hostname;
+  try { hostname = new URL(`http://${host}`).hostname; } catch { return false; }
+  if (!LOCAL_HOSTNAMES.has(hostname)) return false;
+  const site = req.headers['sec-fetch-site'];
+  if (site === 'cross-site' || site === 'same-site') {
+    const navigation = req.headers['sec-fetch-mode'] === 'navigate' && (req.method === 'GET' || req.method === 'HEAD');
+    if (!(allowNavigation && navigation)) return false;
+  }
+  const origin = req.headers.origin;
+  if (origin === undefined) return true;
+  try { return new URL(origin).host === host; } catch { return false; }
+}
+
 function createHandlers(root) {
   async function handleApi(req, res, u, emit) {
     const p = u.pathname;
@@ -28,7 +55,7 @@ function createHandlers(root) {
     const [, , opName, args] = route;
     const b = req.method === 'GET' ? {} : await body(req);
     try {
-      const result = await ops[opName](root, args(u, b, p), { emit });
+      const result = await ops[opName](root, args(u, b, p), { emit, remote: !isLocalRequest(req) });
       sendJSON(res, 200, result);
     } catch (e) {
       if (e instanceof OpError) sendJSON(res, e.status, { error: e.message });
@@ -50,4 +77,4 @@ function createHandlers(root) {
   };
 }
 
-module.exports = { createHandlers, ROUTES };
+module.exports = { createHandlers, ROUTES, isLoopback, isLocalRequest };

package/lib/dashboard/hub-server.js

@@ -23,6 +23,7 @@ const os = require('os');
 const path = require('path');
 const registry = require('../registry');
 const workspace = require('../workspace');
+const brain = require('../brain');
 const { createHandlers } = require('./handlers');
 const store = require('../store');
 const { createConnector } = require('./connector');
@@ -74,7 +75,7 @@ async function execOp(localId, op, args) {
   const proj = getProject(localId);
   if (!proj) throw new OpError(404, projectErrorMessage(localId));
   if (!Object.prototype.hasOwnProperty.call(ops, op)) throw new OpError(404, `Unknown operation "${op}".`);
-  return ops[op](proj.root, args || {}, { emit: proj.emit });
+  return ops[op](proj.root, args || {}, { emit: proj.emit, remote: true });
 }
 function startConnector() {
   if (connector) { connector.stop(); connector = null; }
@@ -282,7 +283,16 @@ function clearLock(){ try{ const l=JSON.parse(fs.readFileSync(LOCK,'utf8')); if(
 process.on('exit', clearLock);
 ['SIGINT','SIGTERM'].forEach((s)=> process.on(s, ()=>{ if (connector) connector.stop(); clearLock(); process.exit(0); }));
 
+const { isLocalRequest } = require('./handlers');
 const server = http.createServer(async (req, res) => {
+  // This machine only (D74). The hub runs agents and writes project files: it listens on the loopback
+  // interfaces only, and still refuses a request whose Host isn't local (DNS rebinding, a tunnel or proxy
+  // on this machine) or that another site sent (cross-site fetch/POST). Reaching a project from elsewhere
+  // is what the online dashboard (server/) is for.
+  if (!isLocalRequest(req, { allowNavigation: true })) {
+    res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
+    return res.end(`spectoflow: this dashboard only answers this machine — open http://localhost:${PORT}`);
+  }
   const u = new URL(req.url, `http://localhost:${PORT}`);
   const p = u.pathname;
   try {
@@ -338,4 +348,27 @@ const server = http.createServer(async (req, res) => {
   } catch (e) { sendJSON(res, 500, { error: String(e && e.message || e) }); }
 });
 
-server.listen(PORT, () => { writeLock(); console.log(`spectoflow · hub → http://localhost:${PORT}${migrated.movedRegistry ? '  (moved your project list into the workspace)' : ''}`); startConnector(); });
+// The second brain (~/.spectoflow/brain.md) is written by the page, by any agent's `spectoflow mcp`
+// server process, and by `::spectoflow learn` run lines. Tell every open LOCAL tab it changed — never
+// the connector: the brain is not a project's and stays off the relay, even as a content-free event.
+function watchBrain() {
+  const file = brain.brainPath();
+  try { fs.mkdirSync(path.dirname(file), { recursive: true }); } catch (_) { return; }
+  let timer = null;
+  try {
+    fs.watch(path.dirname(file), (_ev, name) => {
+      if (name && name !== path.basename(file)) return;
+      clearTimeout(timer);
+      timer = setTimeout(() => {
+        const line = 'data: ' + JSON.stringify({ type: 'brain' }) + '\n\n';
+        for (const proj of projects.values()) for (const res of proj.clients) res.write(line);
+      }, 100);
+    });
+  } catch (_) {}
+}
+
+// IPv6 loopback too, best effort: `localhost` may resolve to ::1 first. No ::1 on this machine → IPv4 only.
+const server6 = http.createServer((req, res) => server.emit('request', req, res));
+server6.on('error', () => {});
+server.on('listening', () => server6.listen(PORT, '::1'));
+server.listen(PORT, '127.0.0.1', () => { watchBrain(); writeLock(); console.log(`spectoflow · hub → http://localhost:${PORT}${migrated.movedRegistry ? '  (moved your project list into the workspace)' : ''}`); startConnector(); });

package/lib/dashboard/ops.js

@@ -17,6 +17,9 @@ const { runMeetingGenerate, todayLocal } = require('./meeting');
 const orchestrator = require('./orchestrator');
 const adapters = require('../adapters');
 const detect = require('../detect');
+const brain = require('../brain');
+const brainSetup = require('../brain-setup');
+const globalConfig = require('../global-config');
 
 const PKG_VERSION = require('../../package.json').version;
 
@@ -55,7 +58,7 @@ const KANBAN_STATUSES = ['todo', 'in_progress', 'to_validate', 'to_analyze', 'do
 // registered 'notes'; Task 3 registers 'meeting' — the Daily meeting tab — into it), mirroring
 // app.js's ROUTES array exactly — the one server-side source of truth for "what's a real native tab
 // id".
-const NATIVE_TABS = ['board', 'chat', 'requests', 'attention', 'backlog', 'workflow', 'team', 'files', 'notes', 'meeting', 'info', 'docs', 'personalize'];
+const NATIVE_TABS = ['board', 'chat', 'requests', 'attention', 'backlog', 'workflow', 'team', 'files', 'notes', 'meeting', 'info', 'docs', 'brain', 'personalize'];
 function writeConfig(root, patch, detectOpts) {
   const cp = path.join(root, '.spectoflow', 'config.json');
   const cfg = JSON.parse(fs.readFileSync(cp, 'utf8'));
@@ -138,6 +141,15 @@ function writeConfig(root, patch, detectOpts) {
 const filesResult = (r) => { if (r.error) bad(r.error); return r; };
 const changed = (ctx, result) => { ctx.emit({ type: 'change' }); return result; };
 
+// The second brain is the user's own and lives outside every project: never reachable through the
+// online relay. relay.js already refuses these ops (absent from its OP_PERMISSIONS); ctx.remote — set
+// for ops arriving through the connector, or from another machine on the network — is the second lock. No emit here: the hub
+// watches ~/.spectoflow/brain.md and tells local tabs only, whoever wrote it (page, MCP, run line).
+function brainOp(ctx, fn) {
+  if (ctx && ctx.remote) throw new OpError(404, 'Unknown operation.');
+  try { return fn(); } catch (e) { if (e.status && !(e instanceof OpError)) throw new OpError(e.status, e.message); throw e; }
+}
+
 const ops = {
   'project.read': async (root) => {
     const p = store.readProject(root);
@@ -190,7 +202,7 @@ const ops = {
 
   'run.start': async (root, { prompt, agent, display }, ctx) => {
     text(prompt, 'Empty request.');
-    const r = startRun(root, { prompt, agent, display }, ctx.emit);
+    const r = startRun(root, { prompt, agent, display, learn: !ctx.remote }, ctx.emit);
     if (r.error) bad(r.error);
     return { runId: r.runId };
   },
@@ -213,7 +225,7 @@ const ops = {
     const active = store.readRuntime(root).orchestration;
     if (active && ['running', 'awaiting_approval'].includes(active.status)) throw new OpError(409, 'An orchestration is already active.');
     const mode = store.readConfig(root).mode || 'semi';
-    orchestrator.runOrchestration({ root, request: req, mode, runStep: orchestrator.defaultRunStep, confirm: orchestrator.defaultConfirm }, ctx.emit)
+    orchestrator.runOrchestration({ root, request: req, mode, runStep: orchestrator.defaultRunStep, confirm: orchestrator.defaultConfirm, learn: !ctx.remote }, ctx.emit)
       .catch((e) => ctx.emit({ type: 'message', message: { role: 'orchestrator', kind: 'status', text: 'orchestration error: ' + e.message } }));
     const o = store.readRuntime(root).orchestration;
     return { orchestrationId: o && o.id };
@@ -248,6 +260,16 @@ const ops = {
     store.writeRuntime(root, rt);
     return changed(ctx, { item: it });
   },
+  'brain.read': async (_root, _args, ctx) => brainOp(ctx, () => ({ ...brain.read(), path: brain.brainPath(), agents: brainSetup.status() })),
+  'brain.add': async (_root, { category, text: body }, ctx) => brainOp(ctx, () => brain.add({ category, text: body, by: 'user' })),
+  'brain.update': async (_root, { id, patch }, ctx) => brainOp(ctx, () => ({ entry: brain.update(id, patch || {}) })),
+  'brain.remove': async (_root, { id }, ctx) => brainOp(ctx, () => brain.remove(id)),
+  'brain.confirm': async (_root, { id }, ctx) => brainOp(ctx, () => ({ entry: brain.confirm(id) })),
+  'brain.settings': async (_root, { autoAdd }, ctx) => brainOp(ctx, () => {
+    if (typeof autoAdd !== 'boolean') bad('autoAdd must be true or false.');
+    return { autoAdd: globalConfig.set('brain.autoAdd', autoAdd) };
+  }),
+
   'attention.remove': async (root, { id }, ctx) => {
     const rt = store.readRuntime(root); rt.attention = (rt.attention || []).filter((x) => x.id !== id); store.writeRuntime(root, rt);
     return changed(ctx, { ok: true });

package/lib/dashboard/orchestrator.js

@@ -25,7 +25,7 @@ function post(root, role, kind, text, emit) {
   emit({ type: 'message', message: m });
 }
 
-async function runOrchestration({ root, request, mode, runStep, confirm, resume }, emit) {
+async function runOrchestration({ root, request, mode, runStep, confirm, resume, learn = true }, emit) {
   const enabled = store.readWorkflow(root).filter((s) => s.enabled);
   let o, startAt = 0;
   if (resume) {
@@ -62,7 +62,7 @@ async function runOrchestration({ root, request, mode, runStep, confirm, resume
 
     st.status = 'running'; saveState(root, o, emit);
     post(root, 'orchestrator', 'status', `→ ${step.name} (${r.agent})`, emit);
-    const exit = await runStep({ root, step, agent: r.agent, skill: r.skill, request }, emit);
+    const exit = await runStep({ root, step, agent: r.agent, skill: r.skill, request, learn }, emit);
     if (exit !== 0) { st.status = 'failed'; o.status = 'failed'; saveState(root, o, emit); post(root, 'orchestrator', 'status', `⚠ ${step.name} failed (exit ${exit})`, emit); return o; }
     st.status = 'done'; saveState(root, o, emit);
   }
@@ -83,13 +83,13 @@ function buildPrompt({ step, agent, skill, request }) {
   ].join('\n');
 }
 
-function defaultRunStep({ root, step, agent, skill, request }, emit) {
+function defaultRunStep({ root, step, agent, skill, request, learn = true }, emit) {
   return new Promise((resolve) => {
     const prompt = buildPrompt({ step, agent, skill, request });
     const tool = store.readConfig(root).agent;
     // logPrompt:false — the orchestrator already posts a clean "→ step (agent)" line; the raw
     // priming prompt would otherwise show as a noisy user bubble.
-    const r = startRun(root, { prompt, agent: tool, logPrompt: false }, (e) => { emit(e); if (e.type === 'run-end') resolve(e.code); });
+    const r = startRun(root, { prompt, agent: tool, logPrompt: false, learn }, (e) => { emit(e); if (e.type === 'run-end') resolve(e.code); });
     if (r.error) { emit({ type: 'message', message: { role: 'orchestrator', kind: 'status', text: r.error } }); resolve(1); }
   });
 }

package/lib/dashboard/public/app.js

@@ -13,14 +13,14 @@ let filter = { status: 'all', q: '' }; // board filter state — client-side onl
 // old localStorage-absent fallback used, then is reconciled from P.config the first time it loads
 // (see syncSettingsFromServer(), called once from load()) — after that they're local state mutated
 // only by user actions, exactly like the old localStorage-backed vars were.
-// The 13 native tab ids, mirroring ops.js's NATIVE_TABS exactly — the client's own source of truth
+// The 14 native tab ids, mirroring ops.js's NATIVE_TABS exactly — the client's own source of truth
 // for "what's a real native tab id" (used to validate P.config.navTabs before trusting it, same
 // defensive stance as ROUTES further down). Task 1 shipped the original 11, all default-enabled; Task
 // 2 (Sous-projet C) registered 'notes' — the Bloc note scratchpad — as the first tab that must start
 // OFF by default (an opt-in feature, per the user's explicit request); Task 3 registers 'meeting' —
 // the Daily meeting tab — the same way, so DEFAULT_OFF_TABS exists rather than a blanket "every
 // native tab defaults to enabled" the way Task 1 assumed.
-const NATIVE_TABS = ['board', 'chat', 'requests', 'attention', 'backlog', 'workflow', 'team', 'files', 'notes', 'meeting', 'info', 'docs', 'personalize'];
+const NATIVE_TABS = ['board', 'chat', 'requests', 'attention', 'backlog', 'workflow', 'team', 'files', 'notes', 'meeting', 'info', 'docs', 'brain', 'personalize'];
 const DEFAULT_OFF_TABS = new Set(['notes', 'meeting']);
 function defaultNavTabs() { return NATIVE_TABS.map((id) => ({ id, enabled: !DEFAULT_OFF_TABS.has(id) })); }
 let boardView = 'list'; // 'list' | 'kanban'
@@ -72,7 +72,11 @@ window.fetch=(url,opts)=>{
   if(OFFLINE&&method!=='GET'&&String(url).startsWith('/api/')) return Promise.resolve(new Response(JSON.stringify({error:t('offline.readonly')}),{status:503,headers:{'Content-Type':'application/json'}}));
   return _fetch(url,opts);
 };
+// Served by the online relay? Its project.read always carries `online`; the local hub's never does.
+// Online, the Second brain tab is hidden: the brain is the machine owner's, never a project's.
+let REMOTE=false;
 function setOffline(p){
+  REMOTE=typeof p.online==='boolean';
   OFFLINE=p.online===false;
   document.body.classList.toggle('is-offline',OFFLINE);
   const bar=$('#offlineBar'); if(!bar) return;
@@ -157,14 +161,14 @@ function applyNavTabs() {
   list.forEach((entry) => {
     const btn = nav.querySelector('.tab[data-tab="' + entry.id + '"]');
     if (!btn) return;
-    btn.hidden = !entry.enabled;
+    btn.hidden = !entry.enabled || (entry.id === 'brain' && REMOTE);
     nav.insertBefore(btn, anchor);
   });
   // If the currently active NATIVE tab just became disabled (e.g. the user disabled the tab they're
   // viewing, or another viewer did and this tab just reloaded), navigate to a sensible fallback
   // instead of leaving a hidden/disabled panel showing.
   const activeEntry = list.find((e) => e.id === activeTab);
-  if (activeEntry && !activeEntry.enabled) {
+  if (activeEntry && (!activeEntry.enabled || (activeEntry.id === 'brain' && REMOTE))) {
     const fallback = list.find((e) => e.id === 'board' && e.enabled) || list.find((e) => e.enabled);
     if (fallback) navigateTab(fallback.id);
   }
@@ -295,7 +299,9 @@ const runtimeTests=(id)=> (P.runtime&&P.runtime.tests&&P.runtime.tests[id])||nul
 async function load(){
   const r = await fetch(withProject('/api/project')); P = await r.json();
   syncSettingsFromServer();
+  REMOTE=typeof P.online==='boolean'; // known before the first paint: the brain tab is hidden online
   render(); setOffline(P);
+  if(!REMOTE && !brainData) loadBrain();
   if(openTaskId) openDrawer(openTaskId,true);
 }
 // Coalesce bursts of SSE 'change'/'message' events into one reload so the board doesn't
@@ -308,6 +314,7 @@ function connect(){
   es.onmessage = (ev)=>{
     let m; try{ m=JSON.parse(ev.data); }catch{ return; }
     if(m.type==='change'||m.type==='message') return scheduleLoad(); // messages live from runtime.messages
+    if(m.type==='brain') return loadBrain();                    // ~/.spectoflow/brain.md changed (page, MCP, run line)
     if(m.type==='run-start'||m.type==='run-end') { chatState.forEach(st=>{ st.rawBlock=null; }); sseBusy=(m.type==='run-start'); updateChatBusyUI(); return; }
     if(m.type==='run-line') return appendRaw(m.chunk);          // raw output is ephemeral (not logged)
   };
@@ -534,7 +541,7 @@ function render(){
   kanbanExpanded.clear(); // a full SSE-driven reload always collapses any "show more" a viewer had open
   renderOverview(); renderBoard(); renderBacklog(); renderWorkflow(); renderTeam();
   renderChatLog($('#chatLog')); renderChatLog($('#chatTabLog'));
-  renderSidebar(); renderRequests(); renderAttention(); renderInfo(); renderDocs(); renderSettings(); renderFiles(); renderNotes(); renderMeeting(); applySideHidden(); updateChatBusyUI();
+  renderSidebar(); renderRequests(); renderAttention(); renderInfo(); renderDocs(); renderSettings(); renderFiles(); renderNotes(); renderMeeting(); renderBrain(); applySideHidden(); updateChatBusyUI();
   renderCustomDashboards(); // adds/removes nav tabs + panels before applyActiveTab() below reads them
   applyNavTabs(); // hide/reorder native tabs per config.navTabs (may itself navigate away from a just-disabled active tab)
   applyActiveTab(); // re-apply the current tab so an SSE-driven re-render never resets to Board
@@ -1425,7 +1432,7 @@ async function czSubmit(kind,description,agent){
 // A custom dashboard (Customize page) gets its own tab id "custom:<id>" and its own URL shape
 // /custom/<id> — kept out of ROUTES (a fixed list) since the set of custom ids is dynamic; recognized
 // by a dedicated branch in tabFromPath()/navigateTab() instead.
-const ROUTES=['board','requests','attention','backlog','workflow','team','files','notes','meeting','chat','info','docs','personalize'];
+const ROUTES=['board','requests','attention','backlog','workflow','team','files','notes','meeting','chat','info','docs','brain','personalize'];
 // the tab used to be named/routed "settings" — old bookmarks and any localStorage value saved
 // under that name still land on the Personalize tab instead of a blank panel.
 function normalizeTab(t){ return t==='settings'?'personalize':t; }
@@ -1451,6 +1458,7 @@ function navigateTab(tabId,push){
   // was scrolled to last (only on an actual switch INTO the tab — applyActiveTab() alone runs on
   // every SSE render tick too, and re-scrolling/re-focusing there would fight the user's typing).
   if(tabId==='chat') setTimeout(()=>{ scrollChat($('#chatTabLog')); $('#tabRunPrompt').focus(); },60);
+  if(tabId==='brain'){ renderBrain(); if(!brainData) loadBrain(); }
   if(tabId==='files') renderFiles(); // the tree is fetched lazily — only load it on an actual switch in
 }
 function closeNav(){ document.body.classList.remove('nav-open'); const nt=$('#navToggle'); if(nt) nt.setAttribute('aria-expanded','false'); }
@@ -2027,6 +2035,159 @@ function notesSetStatus(state){
   } else { tip.textContent=t('files.saveError'); tip.className='note-status is-error'; }
 }
 
+// ---- Second brain ------------------------------------------------------------------------------
+// What spectoflow has learned about the user: ~/.spectoflow/brain.md, shared by all their projects —
+// NOT this project's, so it is fetched on its own (/api/brain), never part of /api/project. The hub
+// pushes a 'brain' SSE event whenever the file changes, whoever wrote it (this page, an agent through
+// `spectoflow mcp`, or a `::spectoflow learn` run line).
+const BRAIN_CATEGORIES=['profile','preferences','workflow','avoid'];
+const BRAIN_SOFT_LIMIT=60;
+let brainData=null, brainError=null, brainActionError=null;
+async function loadBrain(){
+  if(REMOTE) return;
+  try{
+    const r=await fetch(withProject('/api/brain'));
+    const d=await r.json().catch(()=>({}));
+    if(!r.ok) throw new Error(d.error||'error');
+    brainData=d; brainError=null;
+  }catch(err){ brainError=err.message||'error'; }
+  renderBrain();
+}
+async function brainCall(method,url,body){
+  flash();
+  const r=await fetch(withProject(url),{method,headers:{'Content-Type':'application/json'},body:body===undefined?undefined:JSON.stringify(body)});
+  const d=await r.json().catch(()=>({}));
+  if(!r.ok) throw new Error(d.error||t('brain.error'));
+  return d;
+}
+// A re-render (SSE tick, another tab's write) must never wipe what the user is typing.
+function brainIsEditing(){
+  const a=document.activeElement;
+  return !!(a && (a.tagName==='INPUT'||a.tagName==='TEXTAREA') && a.closest('#brainGrid, #brainPending'));
+}
+function renderBrain(){
+  const badge=$('#brainBadge');
+  const pendingN=brainData ? brainData.pending.length : 0;
+  if(badge){ badge.textContent=pendingN; badge.hidden=pendingN===0; }
+  if(activeTab!=='brain' || brainIsEditing()) return;
+  const grid=$('#brainGrid'); if(!grid) return;
+  if(brainError && !brainData){ grid.innerHTML=''; grid.append(el('div','empty',t('brain.error'))); return; }
+  if(!brainData){ grid.innerHTML=''; grid.append(el('div','empty',t('drawer.loading'))); return; }
+  const d=brainData;
+  $('#brainCount').textContent=d.entries.length;
+  const auto=$('#brainAutoAdd'); auto.checked=!!d.autoAdd;
+  $('#brainAutoHint').textContent=d.autoAdd ? t('brain.autoAddOn') : t('brain.autoAddOff');
+  renderBrainAgents(d.agents||[]);
+  const notice=$('#brainNotice');
+  const noticeText=brainActionError || (d.entries.length>BRAIN_SOFT_LIMIT ? t('brain.tooMany',{n:d.entries.length}) : '');
+  notice.hidden=!noticeText; notice.textContent=noticeText;
+  notice.classList.toggle('is-error',!!brainActionError);
+  renderBrainPending(d.pending);
+  grid.innerHTML='';
+  if(!d.entries.length && !d.pending.length) grid.append(el('div','brain-empty',t('brain.empty')));
+  BRAIN_CATEGORIES.forEach(cat=> grid.append(brainCard(cat, d.entries.filter(e=>e.category===cat))));
+  $('#brainPath').textContent=t('brain.path',{path:d.path||'~/.spectoflow/brain.md'});
+}
+function renderBrainAgents(agents){
+  const box=$('#brainAgents'); box.innerHTML='';
+  if(!agents.length){ box.append(el('span','brain-agents-none',t('brain.noAgents'))); return; }
+  box.append(el('span','brain-agents-label',t('brain.agents')));
+  agents.forEach(a=>{
+    const chip=el('span','brain-agent'+(a.wired?' is-wired':''), (a.wired?'● ':'○ ')+a.label);
+    chip.title=a.wired?t('brain.agentWired'):t('brain.agentNotWired');
+    box.append(chip);
+  });
+  if(agents.some(a=>!a.wired)){
+    const hint=el('span','brain-agents-hint'); const parts=t('brain.setupHint').split('{cmd}');
+    hint.append(parts[0]||'', el('code',null,'spectoflow brain setup'), parts[1]||'');
+    box.append(hint);
+  }
+}
+function brainMeta(e){
+  const who=e.by==='agent' ? t('brain.byAgent') : t('brain.byYou');
+  return e.at ? `${who} · ${e.at}` : who;
+}
+function renderBrainPending(pending){
+  const box=$('#brainPending'); box.innerHTML='';
+  box.hidden=!pending.length; if(!pending.length) return;
+  const head=el('div','brain-pending-head');
+  head.append(el('h3','brain-pending-title',t('brain.toConfirm')));
+  const all=el('button','btn primary',t('brain.confirmAll'));
+  all.addEventListener('click',async()=>{ all.disabled=true; try{ for(const e of pending) await brainCall('POST',`/api/brain/${encodeURIComponent(e.id)}/confirm`,{}); }catch(err){} loadBrain(); });
+  head.append(all); box.append(head);
+  pending.forEach(e=>{
+    const row=el('div','brain-row is-pending');
+    row.append(el('span','brain-cat-chip',t('brain.cat.'+e.category)));
+    const txt=el('div','brain-text',e.text); row.append(txt);
+    row.append(el('div','brain-meta',brainMeta(e)));
+    const acts=el('div','brain-actions');
+    const ok=el('button','btn primary',t('brain.confirm')); ok.addEventListener('click',()=>brainAct(()=>brainCall('POST',`/api/brain/${encodeURIComponent(e.id)}/confirm`,{})));
+    const ed=el('button','btn',t('action.edit')); ed.addEventListener('click',()=>brainEdit(e,txt));
+    const no=el('button','btn danger',t('brain.reject')); no.addEventListener('click',()=>brainAct(()=>brainCall('DELETE',`/api/brain/${encodeURIComponent(e.id)}`)));
+    acts.append(ok,ed,no); row.append(acts);
+    box.append(row);
+  });
+}
+function brainCard(cat, entries){
+  const card=el('div','brain-card');
+  const head=el('div','brain-card-head');
+  head.append(el('h3','brain-card-title',t('brain.cat.'+cat)), el('span','count',String(entries.length)));
+  card.append(head, el('p','brain-card-hint',t('brain.catHint.'+cat)));
+  const list=el('div','brain-list');
+  if(!entries.length) list.append(el('div','empty brain-card-empty',t('brain.catEmpty')));
+  entries.forEach(e=>{
+    const row=el('div','brain-row'+(e.by==='agent'?' from-agent':''));
+    const txt=el('div','brain-text',e.text); row.append(txt);
+    const foot=el('div','brain-row-foot');
+    foot.append(el('span','brain-meta',brainMeta(e)));
+    const acts=el('span','brain-actions');
+    const ed=el('button','btn btn-xs',t('action.edit')); ed.addEventListener('click',()=>brainEdit(e,txt));
+    const del=el('button','btn btn-xs danger',t('action.delete')); del.addEventListener('click',()=>brainAct(()=>brainCall('DELETE',`/api/brain/${encodeURIComponent(e.id)}`)));
+    acts.append(ed,del); foot.append(acts); row.append(foot);
+    list.append(row);
+  });
+  card.append(list);
+  const add=el('form','brain-add');
+  const input=el('input','brain-add-input'); input.type='text'; input.maxLength=500; input.placeholder=t('brain.addPlaceholder');
+  const btn=el('button','btn',t('action.add')); btn.type='submit';
+  const err=el('div','brain-add-error'); err.hidden=true;
+  add.append(input,btn,err);
+  add.addEventListener('submit',async(ev)=>{
+    ev.preventDefault();
+    const text=input.value.trim(); if(!text){ input.focus(); return; }
+    btn.disabled=true; err.hidden=true;
+    try{
+      const r=await brainCall('POST','/api/brain',{category:cat,text});
+      input.value=''; input.blur();
+      if(r.duplicate){ err.textContent=t('brain.duplicate'); err.hidden=false; }
+    }catch(e){ err.textContent=e.message; err.hidden=false; }
+    btn.disabled=false; loadBrain();
+  });
+  card.append(add);
+  return card;
+}
+async function brainAct(fn){
+  try{ await fn(); brainActionError=null; }catch(err){ brainActionError=err.message; }
+  loadBrain();
+}
+// Inline edit, same interaction as the Attention tab: blur or Ctrl/Cmd+Enter saves, Escape cancels.
+function brainEdit(e, txtNode){
+  const ta=el('textarea','brain-edit'); ta.value=e.text; ta.maxLength=500; txtNode.replaceWith(ta); ta.focus();
+  let done=false;
+  const finish=async(save)=>{
+    if(done) return; done=true;
+    const v=ta.value.trim();
+    ta.blur();
+    if(save && v && v!==e.text) await brainAct(()=>brainCall('PATCH',`/api/brain/${encodeURIComponent(e.id)}`,{text:v}));
+    else renderBrain();
+  };
+  ta.addEventListener('blur',()=>finish(true));
+  ta.addEventListener('keydown',ev=>{
+    if((ev.metaKey||ev.ctrlKey)&&ev.key==='Enter'){ ev.preventDefault(); finish(true); }
+    if(ev.key==='Escape'){ ev.preventDefault(); finish(false); }
+  });
+}
+
 // ---- Daily meeting (Sous-projet C, Task 3) ------------------------------------------------------
 // One dated Markdown note per day, .spectoflow/meetings/<date>.md. MANUAL editing reuses the exact
 // same files.read/files.write ops + filesCodeEditor() component as Bloc note above (700ms debounced
@@ -2397,6 +2558,7 @@ $('#blAddCancel').addEventListener('click', closeBacklogAddForm);
 $('#blAddSubmit').addEventListener('click', submitBacklogAdd);
 $('#blAddTitle').addEventListener('keydown', e=>{ if(e.key==='Enter') submitBacklogAdd(); });
 // attention tab: add a note + filter chips
+$('#brainAutoAdd').addEventListener('change',(e)=>brainAct(()=>brainCall('POST','/api/brain/settings',{autoAdd:e.target.checked})));
 $('#attnAddBtn').addEventListener('click',()=>{ const t=$('#attnInput'); const v=t.value.trim(); if(v){ addAttn(v); t.value=''; } });
 $('#attnInput').addEventListener('keydown',e=>{ if((e.metaKey||e.ctrlKey)&&e.key==='Enter'){ const v=e.target.value.trim(); if(v){ addAttn(v); e.target.value=''; } } });
 $$('.attn-filters .fchip').forEach(b=> b.addEventListener('click',()=>{ attnFilter=b.dataset.attn; renderAttention(); }));