@7ots/cli 0.1.7 → 0.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@7ots/cli",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "7ots.com — your AI companion with a face of its own: a desktop pet that watches over your coding agent (Claude Code and shell hooks), a personal assistant (reminders, alerts, notes, opens sites, sees your screen if allowed) and a reproducible identity (face, personality, voice) for any agent — in apuchat meet calls, Orquesta projects or your own server.",
   "homepage": "https://7ots.com",
   "repository": {

package/server/channels/agent.mjs

@@ -65,7 +65,7 @@ function systemFor(channel, { lang, identity = getIdentity, instructions = () =>
  * @param {{ llm?: {step: Function}, brain?: Function, identity?: () => object, instructions?: () => string }} deps
  *   instructions: instrucciones fijas del servidor (defecto SERVER_INSTRUCTIONS)
  */
-export function createServerAgent({ llm, brain = null, identity = getIdentity, instructions }) {
+export function createServerAgent({ llm, brain = null, identity = getIdentity, instructions, onTurn = null }) {
   if (!llm && !brain) throw new Error('createServerAgent necesita llm o brain');
   /** clave de contacto → { messages: Neutral[], at } */
   const memory = new Map();
@@ -121,6 +121,12 @@ export function createServerAgent({ llm, brain = null, identity = getIdentity, i
     final = clean(final);
     // Se recuerda solo lo conversacional (sin pasos de herramientas ni razonamiento).
     remember(key, [...history, turn[0], ...(final ? [{ role: 'assistant', content: final }] : [])]);
+    // correo y DMs quedan apuntados (las llamadas no: sus turnos son voz y avisos internos)
+    if (onTurn && channel !== 'voice') {
+      try {
+        onTurn({ key, channel, user: text, reply: final });
+      } catch {}
+    }
     return final;
   }
 

package/server/channels/index.mjs

@@ -20,9 +20,10 @@ import { apuchatConfigFromEnv, apuchatConfigured, createApuchatChannel } from '.
  * @param {Function} [deps.log]
  * @param {(ctx: { channel: 'dm'|'email', from: string, verified?: boolean }) => ({ tools: object[], run: Function }|null)} [deps.tools]
  *   extra server tools for one conversation (DMs and mails, never voice calls), decided per sender
+ * @param {(t: { key: string, channel: 'email'|'dm', user: string, reply: string }) => void} [deps.onTurn]  each answered mail / DM
  */
-export function startAgentChannels({ llm, brain, identity = getIdentity, instructions, config = {}, log = (...a) => console.log('[7ots]', ...a), tools = null }) {
-  const agent = createServerAgent({ llm, brain, identity, instructions });
+export function startAgentChannels({ llm, brain, identity = getIdentity, instructions, config = {}, log = (...a) => console.log('[7ots]', ...a), tools = null, onTurn = null }) {
+  const agent = createServerAgent({ llm, brain, identity, instructions, onTurn });
   const persona = () => personaOf(identity);
   const mailCfg = config.apumail === false ? null : { ...apumailConfigFromEnv(), ...(config.apumail || {}) };
   const chatCfg = config.apuchat === false ? null : { ...apuchatConfigFromEnv(), ...(config.apuchat || {}) };

package/server/platform/connect.mjs

@@ -35,6 +35,7 @@ import {
 } from './apuchat.mjs';
 import {
   askOt, authorizeUrl, cancelTask, disconnect, exchangeCode, listProjects, manageUrl, orquestaAccountView, orquestaUrl, otsOrquesta, parseAllow, projectUrl, saveKey, taskStatus,
+  registerOts,
 } from './orquesta.mjs';
 
 const penv = process.env;
@@ -235,7 +236,9 @@ export function createConnect({ send, readJson, originOf, save }) {
       }
       if (body.daily !== undefined) settings.ORQUESTA_DAILY = String(Math.min(200, Math.max(1, Math.floor(Number(body.daily)) || 20)));
       if (settings.ORQUESTA_TASKS && !settings.ORQUESTA_PROJECT) return send(res, 400, { error: t('platform.orquesta.pickProject') });
-      return send(res, 200, orquestaView(account, await save(ots, { settings })));
+      const saved = await save(ots, { settings });
+      registerOts(account.id, { force: true }).catch(() => null); // seeds the link in Orquesta for a first project
+      return send(res, 200, orquestaView(account, saved));
     }
     if (sub === '/orquesta/ask' && req.method === 'POST') {
       const { message, history } = await readJson(req, 128 * 1024);

package/server/platform/db.mjs

@@ -17,7 +17,8 @@
  *   sites          sites/APIs/MCPs enrolled in Prowl.world so ots know how to use them (sites.mjs)
  *   devices        computers signed in with `7ots login` (the desktop pet): a bearer token, hashed
  *   ots_vms        the machine where an ot's assistant worker runs (one per ot; vm.mjs, docs/VM-PLAN.md):
- *                  provider 'byo' (the owner's own server, enrolled by hand) or 'orquesta' (paid by 7ots, Phase 1)
+ *                  provider 'byo' (the owner's own server, enrolled by hand), 'orquesta' (in the account's Orquesta
+ *                  child org, paid through Orquesta's checkout) or 'orquesta_user' (in the owner's own Orquesta org)
  *   vm_jobs        work the desktop sends to that VM, and how it ended
  *   vm_job_events  what the worker reported while doing it (seq per job, for long-polls)
  */
@@ -197,6 +198,9 @@ CREATE TABLE IF NOT EXISTS vm_job_events (
 
 let db = null;
 
+/** Carpeta de datos de la plataforma (junto a PLATFORM_DB): ahí van también los archivos subidos. */
+export const dataDir = () => (process.env.PLATFORM_DB === ':memory:' ? resolve(ROOT, 'data') : dirname(resolve(ROOT, process.env.PLATFORM_DB || join('data', 'platform.db'))));
+
 /** Abre (y crea si hace falta) la base de datos. Idempotente. */
 export function openDb(path = process.env.PLATFORM_DB) {
   if (db) return db;
@@ -213,6 +217,10 @@ export function openDb(path = process.env.PLATFORM_DB) {
   if (!vmCols.includes('orq_status')) db.exec("ALTER TABLE ots_vms ADD COLUMN orq_status TEXT NOT NULL DEFAULT ''");
   if (!vmCols.includes('orq_checked_at')) db.exec('ALTER TABLE ots_vms ADD COLUMN orq_checked_at INTEGER');
   if (!vmCols.includes('price_cents')) db.exec('ALTER TABLE ots_vms ADD COLUMN price_cents INTEGER');
+  // One Orquesta child org per 7ots account (partner orgs): the account's org id, and the org each VM lives in
+  // ('' = the partner's own org, VMs made before child orgs). Provider 'orquesta_user' VMs live in the owner's org.
+  if (!db.prepare('PRAGMA table_info(accounts)').all().some((c) => c.name === 'orq_org_id')) db.exec("ALTER TABLE accounts ADD COLUMN orq_org_id TEXT NOT NULL DEFAULT ''");
+  if (!vmCols.includes('orq_org_id')) db.exec("ALTER TABLE ots_vms ADD COLUMN orq_org_id TEXT NOT NULL DEFAULT ''");
   return db;
 }
 

package/server/platform/device.mjs

@@ -10,6 +10,14 @@
  *   GET  /api/device/me                → { account, ots: [summary] }  (Authorization: Bearer)
  *   GET  /api/device/ots/:id           → { ots: summary, identity }   (the owner's full identity)
  *   DELETE /api/device/token           → signs this computer out
+ *   GET  /api/device/ots/:id/orquesta  → { connected, project, projectName, projects }
+ *   POST /api/device/ots/:id/orquesta/tasks { text, projectId? } · GET …/tasks/:tid
+ *        The desktop ot uses the account's Orquesta connection through here: the Orquesta token
+ *        stays sealed on 7ots.com and never reaches the computer. The device is the owner's (it
+ *        was approved from the dashboard), so it may pick any project the connection can reach.
+ *   GET  /api/device/ots/:id/inbox     → { apuchat, email, conversations: [{ channel, who, at, messages }] }
+ *        what people wrote to the ot on apuchat and email lately, and what it answered (read only;
+ *        the channels' keys stay on 7ots.com)
  *
  * From the dashboard (session cookie, X-7ots-Admin: 1, same origin; see routes.mjs):
  *   GET  /api/platform/device/:code    → { name, expiresIn }  what is asking
@@ -21,9 +29,13 @@
  */
 
 import { defineIdentity } from '../../src/identity/schema.js';
-import { getDb } from './db.mjs';
+import { createHash } from 'node:crypto';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { dataDir, getDb } from './db.mjs';
 import { newId, sha256, token } from './crypto.mjs';
-import { getOwnOts, listOts, publicAccount } from './store.mjs';
+import { getConversation, getOwnOts, listConversations, listOts, publicAccount } from './store.mjs';
+import { listProjects, orquestaAccountView, otsOrquesta, runTask, taskStatus } from './orquesta.mjs';
 
 const CODE_TTL = 10 * 60_000;
 const PREFIX = '7d_'; // so a leaked token is recognizable
@@ -52,7 +64,11 @@ export function listDevices(accountId) {
 /**
  * @param {{ send: Function, readJson: Function, base: (req) => string, rateLimit: (req) => boolean, summary: (ots) => object }} deps
  */
-export function createDevice({ send, readJson, base, rateLimit, summary }) {
+/** What the pet and 7ots.com keep in sync (the look goes only as look.character). */
+const SYNCED = ['name', 'role', 'tagline', 'bio', 'language', 'languages', 'personality'];
+const MAX_MODEL = 60 * 1024 * 1024;
+
+export function createDevice({ send, readJson, base, rateLimit, summary, save }) {
   /** Public half (/api/device/*). @returns {Promise<boolean>} */
   async function api(req, res, path) {
     res.setHeader('Cache-Control', 'no-store');
@@ -87,12 +103,93 @@ export function createDevice({ send, readJson, base, rateLimit, summary }) {
       if (m && req.method === 'GET') {
         const ots = getOwnOts(account.id, m[1]);
         if (!ots) return send(res, 404, { error: 'not found' }), true;
-        return send(res, 200, { ots: summary(ots), identity: defineIdentity(ots.identity) }), true;
+        return send(res, 200, { ots: summary(ots), identity: defineIdentity(ots.identity), updatedAt: ots.updatedAt }), true;
+      }
+      // sync with the desktop pet: the same look, personality and character sheet on both sides
+      const sm = /^\/ots\/([a-z0-9_]{4,40})\/identity$/.exec(path);
+      if (sm && req.method === 'PUT') {
+        const ots = getOwnOts(account.id, sm[1]);
+        if (!ots) return send(res, 404, { error: 'not found' }), true;
+        const inc = (await readJson(req, 512 * 1024))?.identity;
+        if (!inc || typeof inc !== 'object') return send(res, 400, { error: 'identity' }), true;
+        const patch = Object.fromEntries(SYNCED.filter((k) => k in inc).map((k) => [k, inc[k]]));
+        if (inc.look?.character) patch.look = { character: inc.look.character }; // the rest of the look (image, avatar) is the web's
+        try {
+          const next = await save(ots, { identity: defineIdentity(patch, ots.identity) });
+          return send(res, 200, { identity: defineIdentity(next.identity), updatedAt: next.updatedAt }), true;
+        } catch (e) {
+          return send(res, e.status || 500, { error: e.message }), true;
+        }
+      }
+      // a full-body model (.glb/.vrm) of a mod: content-addressed, served at /mods/<sha16>.<ext> like on the pet
+      const fm = /^\/ots\/([a-z0-9_]{4,40})\/files$/.exec(path);
+      if (fm && req.method === 'POST') {
+        if (!getOwnOts(account.id, fm[1])) return send(res, 404, { error: 'not found' }), true;
+        const ext = new URL(req.url, 'http://x').searchParams.get('ext');
+        if (!['glb', 'vrm'].includes(ext)) return send(res, 400, { error: 'ext' }), true;
+        const chunks = [];
+        let size = 0;
+        for await (const c of req) {
+          size += c.length;
+          if (size > MAX_MODEL) return send(res, 413, { error: 'too big' }), true;
+          chunks.push(c);
+        }
+        const buf = Buffer.concat(chunks);
+        if (buf.length < 20 || buf.toString('latin1', 0, 4) !== 'glTF') return send(res, 400, { error: 'not a glTF binary' }), true;
+        const h = createHash('sha256').update(buf).digest('hex').slice(0, 16);
+        mkdirSync(join(dataDir(), 'mods'), { recursive: true });
+        writeFileSync(join(dataDir(), 'mods', `${h}.${ext}`), buf);
+        return send(res, 200, { url: `/mods/${h}.${ext}` }), true;
+      }
+      const im = /^\/ots\/([a-z0-9_]{4,40})\/inbox$/.exec(path);
+      if (im && req.method === 'GET') {
+        const ots = getOwnOts(account.id, im[1]);
+        if (!ots) return send(res, 404, { error: 'not found' }), true;
+        const conversations = listConversations(ots.id, { limit: 60 })
+          .filter((c) => c.channel === 'apuchat' || c.channel === 'apumail')
+          .slice(0, 10)
+          .map((c) => ({ channel: c.channel, who: c.visitor, at: c.updatedAt, messages: (getConversation(ots.id, c.id)?.messages || []).slice(-6).map((m) => ({ role: m.role, text: m.content.slice(0, 1200), at: m.at })) }));
+        const s = ots.settings;
+        return send(res, 200, { apuchat: s.APUCHAT_AGENT_CALLSIGN || null, email: s.APUMAIL_AGENT_INBOX || null, conversations }), true;
+      }
+      const om = /^\/ots\/([a-z0-9_]{4,40})\/orquesta(\/tasks(?:\/([A-Za-z0-9_-]{4,100}))?)?$/.exec(path);
+      if (om) {
+        const ots = getOwnOts(account.id, om[1]);
+        if (!ots) return send(res, 404, { error: 'not found' }), true;
+        return orquesta(req, res, account, ots, !!om[2], om[3]);
       }
     }
     return false;
   }
 
+  /** The ot's Orquesta, used by the desktop ot with the account's connection. */
+  async function orquesta(req, res, account, ots, tasks, tid) {
+    const view = orquestaAccountView(account.id);
+    if (!tasks && req.method === 'GET') {
+      const cfg = otsOrquesta(ots);
+      let projects = [];
+      let error = view.error;
+      if (view.connected) projects = await listProjects(account.id).catch((e) => ((error = e.message), []));
+      return send(res, 200, { connected: view.connected, error, project: cfg.project, projectName: cfg.projectName, projects }), true;
+    }
+    if (!view.connected) return send(res, 409, { error: 'Orquesta is not connected on 7ots.com' }), true;
+    if (tasks && !tid && req.method === 'POST') {
+      const { text, projectId } = await readJson(req, 64 * 1024);
+      let project = otsOrquesta(ots).project;
+      if (projectId) {
+        const p = (await listProjects(account.id)).find((x) => x.id === String(projectId));
+        if (!p) return send(res, 404, { error: 'that project is not shared with 7ots' }), true;
+        project = p.id;
+      }
+      if (!project) return send(res, 400, { error: 'pick a project' }), true;
+      // the owner, from their own computer: tasks on for this one, the chosen project
+      const out = await runTask({ ...ots, settings: { ...ots.settings, ORQUESTA_TASKS: '1', ORQUESTA_PROJECT: project } }, { task: text, who: `owner ${account.email || account.id}`, channel: 'desktop' });
+      return send(res, out.ok === false && !out.id ? 400 : 200, out), true;
+    }
+    if (tid && req.method === 'GET') return send(res, 200, await taskStatus(ots, tid)), true;
+    return send(res, 405, { error: 'method' }), true;
+  }
+
   /** Dashboard half, already behind the session + same-origin checks. @returns {boolean} */
   async function dashboard(req, res, account, path) {
     const m = /^\/device\/([A-Za-z0-9]{8,40})$/.exec(path);

package/server/platform/mods.mjs

@@ -0,0 +1,222 @@
+/**
+ * Community mods: looks that people share for any ot (src/character/mods.js), with installs,
+ * 1–5 star ratings (one per account, only after installing) and reports.
+ *
+ * New mods wait for an admin (PLATFORM_ADMINS: emails, comma separated) unless an admin uploads
+ * them. A mod reported by MOD_REPORTS_HIDE accounts (default 3) is hidden until reviewed.
+ *
+ * Public (any origin):
+ *   GET  /api/mods[?sort=top|new|popular&q=…]   → { mods: [view] }   approved only
+ *   GET  /api/mods/:id                          → { mod: view }
+ * Signed in, from the dashboard (/api/platform/mods/*, session) or the pet (/api/device/mods/*, bearer):
+ *   GET    /mods/mine            → { mods: [view], admin, pending: [view] (admins) }
+ *   POST   /mods                 { mod }  → publish or update one of yours (by its id)
+ *   POST   /mods/files?ext=glb|vrm  raw body (≤ 20 MB) → { url: '/mods/<sha16>.<ext>' }
+ *   POST   /mods/:id/install     → { mod: view }   (counts once per account)
+ *   POST   /mods/:id/rate        { stars: 1..5 }
+ *   POST   /mods/:id/report      { reason }
+ *   POST   /mods/:id/review      { status: approved|rejected|hidden }   (admins)
+ *   DELETE /mods/:id             (its author or an admin)
+ */
+
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { normalizeMod } from '../../src/character/mods.js';
+import { dataDir, getDb } from './db.mjs';
+
+const MAX_FILE = 20 * 1024 * 1024;
+const MAX_MOD_JSON = 2 * 1024 * 1024;
+const STATUSES = ['pending', 'approved', 'rejected', 'hidden'];
+const MODEL = /^\/mods\/([a-f0-9]{16})\.(glb|vrm)$/;
+
+let ready = false;
+function db() {
+  const d = getDb();
+  if (!ready) {
+    d.exec(`
+CREATE TABLE IF NOT EXISTS community_mods (
+  id TEXT PRIMARY KEY,
+  account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+  author TEXT NOT NULL DEFAULT '',
+  mod TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  installs INTEGER NOT NULL DEFAULT 0,
+  stars_sum INTEGER NOT NULL DEFAULT 0,
+  stars_n INTEGER NOT NULL DEFAULT 0,
+  reports INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS community_mods_status ON community_mods(status, created_at DESC);
+CREATE TABLE IF NOT EXISTS mod_installs (mod_id TEXT NOT NULL REFERENCES community_mods(id) ON DELETE CASCADE, account_id TEXT NOT NULL, at INTEGER NOT NULL, PRIMARY KEY (mod_id, account_id));
+CREATE TABLE IF NOT EXISTS mod_ratings (mod_id TEXT NOT NULL REFERENCES community_mods(id) ON DELETE CASCADE, account_id TEXT NOT NULL, stars INTEGER NOT NULL, at INTEGER NOT NULL, PRIMARY KEY (mod_id, account_id));
+CREATE TABLE IF NOT EXISTS mod_reports (mod_id TEXT NOT NULL REFERENCES community_mods(id) ON DELETE CASCADE, account_id TEXT NOT NULL, reason TEXT NOT NULL DEFAULT '', at INTEGER NOT NULL, PRIMARY KEY (mod_id, account_id));
+`);
+    ready = true;
+  }
+  return d;
+}
+
+export const isModAdmin = (account) =>
+  !!account?.email && String(process.env.PLATFORM_ADMINS || '').toLowerCase().split(/[\s,]+/).filter(Boolean).includes(account.email.toLowerCase());
+
+const authorOf = (a) => String(a.name || (a.email || '').split('@')[0] || 'anon').slice(0, 40);
+
+function view(row, me) {
+  if (!row) return null;
+  const v = {
+    id: row.id,
+    mod: JSON.parse(row.mod),
+    author: row.author,
+    status: row.status,
+    installs: row.installs,
+    rating: row.stars_n ? Math.round((row.stars_sum / row.stars_n) * 10) / 10 : null,
+    ratings: row.stars_n,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  };
+  if (me) {
+    const d = db();
+    v.mine = row.account_id === me.id;
+    v.installed = !!d.prepare('SELECT 1 FROM mod_installs WHERE mod_id = ? AND account_id = ?').get(row.id, me.id);
+    v.myStars = d.prepare('SELECT stars FROM mod_ratings WHERE mod_id = ? AND account_id = ?').get(row.id, me.id)?.stars || null;
+    v.reported = !!d.prepare('SELECT 1 FROM mod_reports WHERE mod_id = ? AND account_id = ?').get(row.id, me.id);
+  }
+  return v;
+}
+
+const ORDER = {
+  // Bayesian average: a single 5★ does not beat many 4.5★
+  top: '(stars_sum + 3.0 * 2) / (stars_n + 2) DESC, installs DESC, created_at DESC',
+  new: 'created_at DESC',
+  popular: 'installs DESC, stars_n DESC, created_at DESC',
+};
+
+export function listMods({ sort = 'top', q = '', limit = 60 } = {}) {
+  const like = `%${String(q).toLowerCase().replace(/[%_]/g, '').slice(0, 40)}%`;
+  return db()
+    .prepare(`SELECT * FROM community_mods WHERE status = 'approved' AND (lower(id) LIKE ? OR lower(mod) LIKE ? OR lower(author) LIKE ?) ORDER BY ${ORDER[sort] || ORDER.top} LIMIT ?`)
+    .all(like, like, like, Math.min(100, Math.max(1, Number(limit) || 60)));
+}
+
+/** A model a mod points at must already be on 7ots.com (uploaded first through /mods/files). */
+function modelsMissing(mod) {
+  const urls = [mod.model?.url].filter((u) => MODEL.test(u || ''));
+  return urls.filter((u) => !existsSync(join(dataDir(), 'mods', u.slice('/mods/'.length))));
+}
+
+export function createMods({ send, readJson }) {
+  /** Public half. @returns {Promise<boolean>} */
+  async function publicApi(req, res, path) {
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    if (req.method === 'OPTIONS') return send(res, 204), true;
+    if (req.method !== 'GET') return false;
+    if (path === '' || path === '/') {
+      const u = new URL(req.url, 'http://x');
+      return send(res, 200, { mods: listMods({ sort: u.searchParams.get('sort'), q: u.searchParams.get('q') || '', limit: u.searchParams.get('limit') }).map((r) => view(r)) }), true;
+    }
+    const m = /^\/([a-z0-9-]{1,32})$/.exec(path);
+    if (m) {
+      const row = db().prepare("SELECT * FROM community_mods WHERE id = ? AND status = 'approved'").get(m[1]);
+      return row ? send(res, 200, { mod: view(row) }) : send(res, 404, { error: 'not found' }), true;
+    }
+    return false;
+  }
+
+  /** Signed-in half (account from the session or a device). path is after /mods. @returns {Promise<boolean>} */
+  async function accountApi(req, res, account, path) {
+    const d = db();
+    const admin = isModAdmin(account);
+    const now = Date.now();
+    if (path === '' && req.method === 'GET') {
+      const u = new URL(req.url, 'http://x');
+      return send(res, 200, { mods: listMods({ sort: u.searchParams.get('sort'), q: u.searchParams.get('q') || '' }).map((r) => view(r, account)) }), true;
+    }
+    if (path === '/mine' && req.method === 'GET') {
+      const mine = d.prepare('SELECT * FROM community_mods WHERE account_id = ? ORDER BY updated_at DESC').all(account.id).map((r) => view(r, account));
+      const pending = admin ? d.prepare("SELECT * FROM community_mods WHERE status IN ('pending', 'hidden') ORDER BY reports DESC, created_at").all().map((r) => ({ ...view(r, account), reports: r.reports })) : [];
+      return send(res, 200, { mods: mine, admin, pending }), true;
+    }
+    if (path === '/files' && req.method === 'POST') {
+      const ext = new URL(req.url, 'http://x').searchParams.get('ext');
+      if (!['glb', 'vrm'].includes(ext)) return send(res, 400, { error: 'ext' }), true;
+      const chunks = [];
+      let size = 0;
+      for await (const c of req) {
+        size += c.length;
+        if (size > MAX_FILE) return send(res, 413, { error: 'max 20 MB' }), true;
+        chunks.push(c);
+      }
+      const buf = Buffer.concat(chunks);
+      if (buf.length < 20 || buf.toString('latin1', 0, 4) !== 'glTF') return send(res, 400, { error: 'not a glTF binary (.glb/.vrm)' }), true;
+      const h = createHash('sha256').update(buf).digest('hex').slice(0, 16);
+      mkdirSync(join(dataDir(), 'mods'), { recursive: true });
+      writeFileSync(join(dataDir(), 'mods', `${h}.${ext}`), buf);
+      return send(res, 200, { url: `/mods/${h}.${ext}` }), true;
+    }
+    if (path === '' && req.method === 'POST') {
+      const body = await readJson(req, MAX_MOD_JSON + 4096);
+      const mod = normalizeMod(body?.mod);
+      if (!mod) return send(res, 400, { error: 'mod' }), true;
+      if (!mod.model && !mod.parts.length && !Object.keys(mod.character).length) return send(res, 400, { error: 'empty mod' }), true;
+      const missing = modelsMissing(mod);
+      if (missing.length) return send(res, 409, { error: 'upload the model first', missing }), true;
+      const prev = d.prepare('SELECT account_id FROM community_mods WHERE id = ?').get(mod.id);
+      if (prev && prev.account_id !== account.id) return send(res, 409, { error: 'id taken' }), true;
+      const json = JSON.stringify({ ...mod, by: mod.by || authorOf(account) });
+      if (prev) d.prepare("UPDATE community_mods SET mod = ?, status = ?, updated_at = ? WHERE id = ?").run(json, admin ? 'approved' : 'pending', now, mod.id);
+      else d.prepare('INSERT INTO community_mods (id, account_id, author, mod, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)').run(mod.id, account.id, authorOf(account), json, admin ? 'approved' : 'pending', now, now);
+      return send(res, prev ? 200 : 201, { mod: view(d.prepare('SELECT * FROM community_mods WHERE id = ?').get(mod.id), account) }), true;
+    }
+    const m = /^\/([a-z0-9-]{1,32})(\/(install|rate|report|review))?$/.exec(path);
+    if (!m) return false;
+    const row = d.prepare('SELECT * FROM community_mods WHERE id = ?').get(m[1]);
+    // authors and admins see their mod whatever its status; everyone else only approved ones
+    if (!row || (row.status !== 'approved' && row.account_id !== account.id && !admin)) return send(res, 404, { error: 'not found' }), true;
+    const action = m[3];
+    if (!action && req.method === 'GET') return send(res, 200, { mod: view(row, account) }), true;
+    if (!action && req.method === 'DELETE') {
+      if (row.account_id !== account.id && !admin) return send(res, 403, { error: 'not yours' }), true;
+      d.prepare('DELETE FROM community_mods WHERE id = ?').run(row.id);
+      return send(res, 200, { ok: true }), true;
+    }
+    if (req.method !== 'POST') return send(res, 405, { error: 'method' }), true;
+    if (action === 'install') {
+      const r = d.prepare('INSERT OR IGNORE INTO mod_installs (mod_id, account_id, at) VALUES (?, ?, ?)').run(row.id, account.id, now);
+      if (r.changes) d.prepare('UPDATE community_mods SET installs = installs + 1 WHERE id = ?').run(row.id);
+      return send(res, 200, { mod: view(d.prepare('SELECT * FROM community_mods WHERE id = ?').get(row.id), account) }), true;
+    }
+    if (action === 'rate') {
+      const stars = Math.round(Number((await readJson(req, 1024))?.stars));
+      if (!(stars >= 1 && stars <= 5)) return send(res, 400, { error: 'stars 1-5' }), true;
+      if (row.account_id === account.id) return send(res, 403, { error: 'own mod' }), true;
+      if (!d.prepare('SELECT 1 FROM mod_installs WHERE mod_id = ? AND account_id = ?').get(row.id, account.id)) return send(res, 403, { error: 'install it first' }), true;
+      const old = d.prepare('SELECT stars FROM mod_ratings WHERE mod_id = ? AND account_id = ?').get(row.id, account.id);
+      d.prepare('INSERT INTO mod_ratings (mod_id, account_id, stars, at) VALUES (?, ?, ?, ?) ON CONFLICT(mod_id, account_id) DO UPDATE SET stars = excluded.stars, at = excluded.at').run(row.id, account.id, stars, now);
+      d.prepare('UPDATE community_mods SET stars_sum = stars_sum + ?, stars_n = stars_n + ? WHERE id = ?').run(stars - (old?.stars || 0), old ? 0 : 1, row.id);
+      return send(res, 200, { mod: view(d.prepare('SELECT * FROM community_mods WHERE id = ?').get(row.id), account) }), true;
+    }
+    if (action === 'report') {
+      const reason = String((await readJson(req, 4096))?.reason || '').replace(/[\u0000-\u001f]/g, ' ').trim().slice(0, 300);
+      const r = d.prepare('INSERT OR IGNORE INTO mod_reports (mod_id, account_id, reason, at) VALUES (?, ?, ?, ?)').run(row.id, account.id, reason, now);
+      if (r.changes) {
+        d.prepare('UPDATE community_mods SET reports = reports + 1 WHERE id = ?').run(row.id);
+        const hide = Number(process.env.MOD_REPORTS_HIDE || 3);
+        d.prepare("UPDATE community_mods SET status = 'hidden' WHERE id = ? AND status = 'approved' AND reports >= ?").run(row.id, hide);
+      }
+      return send(res, 200, { ok: true }), true;
+    }
+    if (action === 'review') {
+      if (!admin) return send(res, 403, { error: 'admins only' }), true;
+      const status = (await readJson(req, 1024))?.status;
+      if (!STATUSES.includes(status)) return send(res, 400, { error: 'status' }), true;
+      d.prepare('UPDATE community_mods SET status = ?, reports = CASE WHEN ? = \'approved\' THEN 0 ELSE reports END, updated_at = ? WHERE id = ?').run(status, status, now, row.id);
+      if (status === 'approved') d.prepare('DELETE FROM mod_reports WHERE mod_id = ?').run(row.id);
+      return send(res, 200, { mod: view(d.prepare('SELECT * FROM community_mods WHERE id = ?').get(row.id), account) }), true;
+    }
+    return false;
+  }
+
+  return { publicApi, accountApi };
+}

package/server/platform/orquesta.mjs

@@ -32,7 +32,7 @@ import { createHash, randomBytes } from 'node:crypto';
 import { resolveLocale, translator } from '../../src/i18n/index.js';
 import { identityPrompt } from '../identity.mjs';
 import { i18nError } from '../i18n.mjs';
-import { TASK_FINAL, addTask, getIntegration, getPlatformState, getTask, openTasks, setIntegration, setPlatformState, tasksLastDay, updateTask } from './store.mjs';
+import { TASK_FINAL, addTask, getIntegration, getPlatformState, getTask, listOts, openTasks, setIntegration, setPlatformState, tasksLastDay, updateTask } from './store.mjs';
 
 const penv = process.env;
 const ORQ = (penv.ORQUESTA_URL || 'https://getorquesta.com').replace(/\/+$/, '');
@@ -201,16 +201,21 @@ async function bearer(accountId) {
   return s.access;
 }
 
-/** Orquesta API as the account (a 401 with OAuth renews the token once). */
-async function orq(accountId, method, path, body) {
-  let r = await http(ORQ + path, { method, body, headers: { Authorization: `Bearer ${await bearer(accountId)}` } });
+/**
+ * Orquesta API as the account (a 401 with OAuth renews the token once). With `ots`, the request acts
+ * for that ot: Orquesta narrows it to the projects linked to the ot (project → Identity → Connected
+ * ots) and to the scopes of each link (read / run / deploy) — never more than the account itself.
+ */
+async function orq(accountId, method, path, body, timeoutMs, ots = null) {
+  const as = ots ? { 'X-Orquesta-External-Agent': `7ots/${ots.id}` } : {};
+  let r = await http(ORQ + path, { method, body, timeoutMs, headers: { Authorization: `Bearer ${await bearer(accountId)}`, ...as } });
   if (r.status === 401) {
     const s = getIntegration(accountId, 'orquesta');
     if (s?.kind !== 'oauth') {
       if (s) setIntegration(accountId, 'orquesta', { ...s, error: 'refused' });
       throw i18nError(409, 'platform.orquesta.reconnect');
     }
-    r = await http(ORQ + path, { method, body, headers: { Authorization: `Bearer ${await refresh(accountId)}` } });
+    r = await http(ORQ + path, { method, body, timeoutMs, headers: { Authorization: `Bearer ${await refresh(accountId)}`, ...as } });
     if (r.status === 401) {
       setIntegration(accountId, 'orquesta', { ...getIntegration(accountId, 'orquesta'), error: 'refused' });
       throw i18nError(409, 'platform.orquesta.reconnect');
@@ -219,12 +224,69 @@ async function orq(accountId, method, path, body) {
   return r;
 }
 
+// ───────────────────────────── the account's own VMs (vm.mjs, provider 'orquesta_user') ─────────────────────────────
+
+/**
+ * Whether the connected account can create servers in its own Orquesta org. Orquesta's infrastructure
+ * routes (POST /api/v1/projects, /api/v1/projects/:id/vm, /api/v1/vms) accept only org API keys (oak_)
+ * with projects:write + vms:write, never OAuth tokens; a key's scopes are only known when Orquesta
+ * answers (403 → 'scopes').
+ */
+export function orquestaVmAccess(accountId) {
+  const s = getIntegration(accountId, 'orquesta');
+  if (!s) return { connected: false, usable: false, reason: 'notConnected' };
+  if (s.error) return { connected: false, usable: false, reason: 'reconnect' };
+  if (s.kind !== 'key') return { connected: true, usable: false, reason: 'needsKey' };
+  return { connected: true, usable: true, reason: null };
+}
+
+/**
+ * Orquesta's infrastructure API as the account → { ok, status, data }. The account's credential stays
+ * sealed here and only ever goes to ORQUESTA_URL; vm.mjs never sees it.
+ */
+export async function orquestaInfra(accountId, method, path, body, timeoutMs = 20_000) {
+  if (!/^\/api\/v1\/(projects|vms)(\/|$)/.test(path)) throw new Error('orquestaInfra: path not allowed');
+  return orq(accountId, method, path, body, timeoutMs);
+}
+
 export async function listProjects(accountId) {
   const r = await orq(accountId, 'GET', '/api/v1/projects');
   if (!r.ok) throw i18nError(424, 'platform.orquesta.failed', { status: r.status });
   return (r.data.projects || []).slice(0, 200).map((p) => ({ id: String(p.id), name: String(p.name || p.slug || p.id).slice(0, 120), online: !!p.agentOnline, lastSeen: p.agentLastSeen || null }));
 }
 
+/**
+ * Tells Orquesta which ots this account has (name + face), so a project admin can connect them to
+ * projects there. An ot with no link yet is seeded with the project chosen in its 7ots panel (read,
+ * plus run when tasks are on) — Orquesta ignores the seed once the ot has any link, and never seeds
+ * `deploy`. Re-sent when the list changes or hourly; failures only log (older Orquesta: 404).
+ */
+const registered = new Map();
+export async function registerOts(accountId, { force = false } = {}) {
+  const ots = listOts(accountId).filter((o) => /^[A-Za-z0-9._:-]{1,128}$/.test(o.id));
+  const agents = ots.map((o) => {
+    const cfg = otsOrquesta(o);
+    return { id: o.id, name: String(o.name || '').slice(0, 80), ...(cfg.project ? { seed: { projectId: cfg.project, scopes: cfg.tasks ? ['read', 'run'] : ['read'] } } : {}) };
+  });
+  const sig = JSON.stringify(agents);
+  const prev = registered.get(accountId);
+  if (!force && prev && prev.sig === sig && Date.now() - prev.at < 3600_000) return prev.agents;
+  const r = await orq(accountId, 'PUT', '/api/v1/external-agents', { provider: '7ots', agents });
+  if (!r.ok) {
+    console.warn(`[7ots] orquesta: registering ots → ${r.status}`);
+    return null;
+  }
+  registered.set(accountId, { sig, at: Date.now(), agents: r.data.agents || [] });
+  return r.data.agents || [];
+}
+
+/** The projects Orquesta lets this ot reach, with the scopes of each link ([] when unknown). */
+export async function otLinks(ots) {
+  const agents = await registerOts(ots.accountId).catch(() => null);
+  const me = (agents || []).find((a) => a.id === ots.id);
+  return (me?.projects || []).map((p) => ({ id: String(p.projectId), name: String(p.projectName || p.projectId), scopes: (p.scopes || []).map(String) }));
+}
+
 // ───────────────────────────── per-ot settings ─────────────────────────────
 
 /** Panel settings of an ot. */
@@ -298,19 +360,19 @@ function promptContent(ots, { task, who, channel }) {
   ].join('\n');
 }
 
-async function fetchPrompt(accountId, id) {
-  const r = await orq(accountId, 'GET', `/api/v1/prompts/${encodeURIComponent(id)}`);
+async function fetchPrompt(accountId, id, ots) {
+  const r = await orq(accountId, 'GET', `/api/v1/prompts/${encodeURIComponent(id)}`, undefined, undefined, ots);
   if (!r.ok) throw i18nError(424, 'platform.orquesta.failed', { status: r.status });
   return r.data.prompt || {};
 }
 
 /** Text the agent produced: `result` when Orquesta has it, else the 'output' log lines. */
-async function outputOf(accountId, id, prompt) {
+async function outputOf(accountId, id, prompt, ots) {
   if (typeof prompt.result === 'string' && prompt.result.trim()) return prompt.result.trim().slice(0, 20000);
   const out = [];
   let after = null;
   for (let page = 0; page < 5; page++) {
-    const r = await orq(accountId, 'GET', `/api/v1/logs?${new URLSearchParams({ promptId: id, ...(after != null ? { afterSequence: String(after) } : {}) })}`);
+    const r = await orq(accountId, 'GET', `/api/v1/logs?${new URLSearchParams({ promptId: id, ...(after != null ? { afterSequence: String(after) } : {}) })}`, undefined, undefined, ots);
     if (!r.ok) break;
     const logs = r.data.logs || [];
     for (const l of logs) if (l.category === 'output' && l.message) out.push(String(l.message));
@@ -323,10 +385,10 @@ async function outputOf(accountId, id, prompt) {
 /** Refreshes a stored task from Orquesta (only while it isn't finished). */
 async function refreshTask(ots, task) {
   if (TASK_FINAL.includes(task.status)) return task;
-  const p = await fetchPrompt(ots.accountId, task.id);
+  const p = await fetchPrompt(ots.accountId, task.id, ots);
   const status = ['pending', 'running', 'completed', 'failed', 'cancelled'].includes(p.status) ? p.status : task.status;
   const patch = { status, error: p.error ? String(p.error) : undefined };
-  if (TASK_FINAL.includes(status)) patch.result = await outputOf(ots.accountId, task.id, p).catch(() => '');
+  if (TASK_FINAL.includes(status)) patch.result = await outputOf(ots.accountId, task.id, p, ots).catch(() => '');
   updateTask(task.id, patch);
   return getTask(ots.id, task.id);
 }
@@ -362,17 +424,19 @@ export async function runTask(ots, { task, who, channel }) {
       if (!TASK_FINAL.includes(cur.status) && Date.now() - cur.createdAt < 24 * 3600_000) return { ok: false, error: t('platform.orquesta.busy', { id: cur.id }) };
     }
     offline = (await listProjects(ots.accountId).catch(() => [])).some((p) => p.id === cfg.project && !p.online);
+    await registerOts(ots.accountId).catch(() => null);
     const r = await orq(ots.accountId, 'POST', '/api/v1/prompts', {
       projectId: cfg.project,
       content: promptContent(ots, { task: text, who, channel }),
       context: `7ots ot "${ots.name}" · ${channel} · ${who}`.slice(0, 500),
       tags: ['7ots', channel],
       source: 'api',
-    });
+    }, undefined, ots);
     if (!r.ok) {
       const code = String(r.data.code || r.data.error || '');
       if (/AGENT_NOT_CONFIGURED/i.test(code)) return { ok: false, error: t('platform.orquesta.noAgent', { url: projectUrl(cfg.project) }), project_url: projectUrl(cfg.project) };
-      if (r.status === 404) return { ok: false, error: t('platform.orquesta.noProject') };
+      // the ot acts with its own links: not connected to that project, or connected without `run`
+      if (r.status === 404 || /EXTERNAL_AGENT_NOT_ALLOWED/.test(code)) return { ok: false, error: t('platform.orquesta.notLinked', { url: projectUrl(cfg.project) }), project_url: projectUrl(cfg.project) };
       if (r.status === 429) return { ok: false, error: t('platform.orquesta.rateLimited') };
       return { ok: false, error: t('platform.orquesta.submitFailed', { status: r.status }) };
     }
@@ -414,7 +478,7 @@ export async function cancelTask(ots, id) {
   const row = getTask(ots.id, id);
   if (!row) return null;
   if (TASK_FINAL.includes(row.status)) return row;
-  const r = await orq(ots.accountId, 'POST', `/api/v1/prompts/${encodeURIComponent(row.id)}/cancel`);
+  const r = await orq(ots.accountId, 'POST', `/api/v1/prompts/${encodeURIComponent(row.id)}/cancel`, undefined, undefined, ots);
   if (!r.ok) throw i18nError(424, 'platform.orquesta.failed', { status: r.status });
   updateTask(row.id, { status: r.data.status || 'cancelled' });
   return getTask(ots.id, row.id);