@chibitek/chibi 0.1.169 → 0.1.171

package/dist-server/server/message-file.js

@@ -343,16 +343,25 @@ function mimeFor(path) {
         default: return "application/octet-stream";
     }
 }
-/**
- * Open a message-linked file under one of the supplied roots. The returned
- * handle, not the pathname, is what the caller streams. We canonicalise both
- * before and after opening and compare the handle with the post-open path;
- * this rejects symlink escapes and directory swaps instead of checking a
- * path and then opening a potentially different file.
- */
-export async function openMessageFile(href, roots) {
+export async function openMessageFile(href, roots, access = {}) {
     const requested = referencedPath(href);
-    const canonicalRoots = (await Promise.all(roots.map(async (root) => {
+    const canonicalize = async (paths) => Promise.all(paths.map(async (path) => {
+        try {
+            return await realpath(path);
+        }
+        catch {
+            return resolve(path);
+        }
+    }));
+    const blocked = [...(access.blockedRoots ?? []), ...await canonicalize(access.blockedRoots ?? [])];
+    const sharedBlocked = [...(access.sharedBlockedRoots ?? []), ...await canonicalize(access.sharedBlockedRoots ?? [])];
+    const isBlocked = (paths, candidate) => paths.some((root) => containedBy(resolve(root), candidate));
+    // Relative links keep their original conversation-relative meaning.
+    const shared = isAbsolute(requested) ? access.sharedRoots ?? [] : [];
+    const boundaries = await canonicalize(access.sharedRootBoundaries ?? []);
+    const canonicalShared = (await canonicalize(shared)).filter(root => !boundaries.some(boundary => containedBy(root, boundary)));
+    const canonicalOrdinary = await canonicalize(roots);
+    const canonicalRoots = (await Promise.all([...roots, ...canonicalShared].map(async (root) => {
         try {
             const canonical = await realpath(root);
             return (await stat(canonical)).isDirectory() ? canonical : null;
@@ -375,7 +384,15 @@ export async function openMessageFile(href, roots) {
         catch {
             continue;
         }
-        const root = canonicalRoots.find((allowed) => containedBy(allowed, canonicalBefore));
+        const permitted = (canonical) => {
+            if (isBlocked(blocked, candidate) || isBlocked(blocked, canonical))
+                return false;
+            if (canonicalOrdinary.some((root) => containedBy(root, canonical)))
+                return true;
+            return canonicalShared.some((root) => containedBy(root, canonical))
+                && !isBlocked(sharedBlocked, candidate) && !isBlocked(sharedBlocked, canonical);
+        };
+        const root = permitted(canonicalBefore) && canonicalRoots.find((allowed) => containedBy(allowed, canonicalBefore));
         if (!root) {
             sawOutsideRoot = true;
             continue;
@@ -391,7 +408,7 @@ export async function openMessageFile(href, roots) {
                 throw statusError(413, `file exceeds ${MESSAGE_FILE_MAX_BYTES} bytes`);
             }
             const canonicalAfter = await realpath(candidate);
-            if (!containedBy(root, canonicalAfter))
+            if (!containedBy(root, canonicalAfter) || !permitted(canonicalAfter))
                 throw statusError(403, "the linked file is outside this conversation's workspace");
             const after = await stat(canonicalAfter);
             if (opened.dev !== after.dev || opened.ino !== after.ino) {

package/dist-server/server/plan-policy.js

@@ -0,0 +1,14 @@
+// Atomic Engineering, 2026-10-31. Harness-owned Plan tool policy.
+// Unknown tools, MCP annotations and shell command strings are never trusted.
+export const PLAN_READ_TOOLS = ["Read", "Glob", "Grep"];
+export const PLAN_REFUSAL = "Plan mode blocked this action. Review the plan and approve it in Atomic before making changes.";
+export function planToolAllowed(tool) {
+    return typeof tool === "string" && PLAN_READ_TOOLS.includes(tool);
+}
+export function claudePlanHook(node, helper) {
+    const quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
+    const command = process.platform === "win32"
+        ? '"%OMB_PLAN_NODE%" "%OMB_PLAN_HOOK%" || exit /b 2'
+        : `${quote(node)} ${quote(helper)} || exit 2`;
+    return [{ matcher: "", hooks: [{ type: "command", command, timeout: 5 }] }];
+}

package/dist-server/server/proxy-paths.js

@@ -44,6 +44,7 @@ export const SPAWNED_PROXIES = {
     hook: resolveProxy("hooks/omb-hook"),
     // the RTK add-on's Claude PreToolUse hook (bypassPermissions turns only)
     rtkHook: resolveProxy("hooks/rtk-hook"),
+    planHook: resolveProxy("hooks/plan-hook"),
     // Loaded by the external `pi` process via `-e`, not by this server — but
     // resolved through the same single source of truth so the packaged layout
     // check can assert it ships.

package/dist-server/server/remote-desktop.js

@@ -0,0 +1,142 @@
+// This Mac from the phone: a picture of the whole screen, and taps, keys and
+// typing sent back through the same Cua Driver the bots already use. No VNC
+// server and no second sign-in. The gates are the companion's per-device
+// remote desktop capability and the person's Take control, which pauses the
+// bot so a tap never races its next action.
+//
+// ponytail: one still frame per request (about 1 per second on a Retina Mac).
+// A streamed video path is the upgrade if watching motion ever matters.
+import { execFile } from "node:child_process";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { json, readBody } from "./harness/http.js";
+import { readCuaConnection, readCuaUnavailableReason } from "./local-computer.js";
+const run = promisify(execFile);
+const coordinate = z.number().finite().min(0).max(100_000);
+const key = z.string().regex(/^[a-z0-9]{1,12}$/i);
+const DESKTOP = { kind: "desktop", display_id: "primary" };
+export const remoteInputSchema = z.discriminatedUnion("type", [
+    z.object({
+        type: z.literal("click"),
+        x: coordinate,
+        y: coordinate,
+        button: z.enum(["left", "right"]).default("left"),
+        count: z.number().int().min(1).max(2).default(1),
+    }),
+    z.object({ type: z.literal("type"), text: z.string().min(1).max(2_000) }),
+    z.object({
+        type: z.literal("key"),
+        key,
+        modifiers: z.array(z.enum(["cmd", "shift", "option", "ctrl"])).max(4).default([]),
+    }),
+    z.object({
+        type: z.literal("scroll"),
+        x: coordinate,
+        y: coordinate,
+        direction: z.enum(["up", "down", "left", "right"]),
+        amount: z.number().int().min(1).max(20).default(3),
+    }),
+]);
+export function hostCuaCall(connection) {
+    const socket = connection.args[connection.args.indexOf("--socket") + 1];
+    if (!connection.args.includes("--socket") || !socket)
+        throw new Error("Cua Driver has no socket for this computer");
+    return async (tool, args, screenshotOut) => {
+        const { stdout } = await run(connection.command, ["call", tool, JSON.stringify(args), "--socket", socket, ...(screenshotOut ? ["--screenshot-out-file", screenshotOut] : [])], { env: { ...process.env, ...connection.env }, timeout: 15_000, maxBuffer: 4 * 1024 * 1024 });
+        return JSON.parse(stdout);
+    };
+}
+/** The whole primary display. `width`/`height` are the coordinate space
+ * clicks use; the image itself is a smaller JPEG to keep it phone-sized. */
+export async function remoteFrame(call, shrink = sipsJpeg) {
+    const dir = await mkdtemp(join(tmpdir(), "atomic-remote-"));
+    try {
+        const png = join(dir, "screen.png");
+        const state = z.object({ screenshot_width: z.number().int().positive(), screenshot_height: z.number().int().positive() })
+            .parse(await call("get_desktop_state", {}, png));
+        const jpeg = join(dir, "screen.jpg");
+        await shrink(png, jpeg);
+        return {
+            image: `data:image/jpeg;base64,${(await readFile(jpeg)).toString("base64")}`,
+            width: state.screenshot_width,
+            height: state.screenshot_height,
+        };
+    }
+    finally {
+        // The picture is the person's screen: never leave it in a temp folder.
+        await rm(dir, { recursive: true, force: true });
+    }
+}
+async function sipsJpeg(input, output) {
+    await run("/usr/bin/sips", ["-s", "format", "jpeg", "-s", "formatOptions", "60", "-Z", "1600", input, "--out", output], { timeout: 15_000 });
+}
+/** Keys and typing go to the frontmost app, the one the person last tapped. */
+async function frontmostPid(call) {
+    const { apps } = z.object({ apps: z.array(z.object({ pid: z.number().int().positive(), active: z.boolean().optional() }).passthrough()) })
+        .parse(await call("list_apps", {}));
+    const active = apps.find((app) => app.active);
+    if (!active)
+        throw Object.assign(new Error("No app is in front on this computer; tap a window first"), { status: 409 });
+    return active.pid;
+}
+export async function remoteInput(call, input) {
+    switch (input.type) {
+        case "click":
+            await call("click", { target: DESKTOP, x: input.x, y: input.y, button: input.button, count: input.count });
+            return;
+        case "scroll":
+            await call("scroll", { target: DESKTOP, x: input.x, y: input.y, direction: input.direction, amount: input.amount });
+            return;
+        case "type":
+            await call("type_text", { pid: await frontmostPid(call), text: input.text });
+            return;
+        case "key":
+            await call("press_key", { pid: await frontmostPid(call), key: input.key, modifiers: input.modifiers });
+            return;
+    }
+}
+/** `POST /api/bots/:id/computer/remote-frame|remote-input`. The companion
+ * admits these only for a device with remote desktop access; input also needs
+ * the person to hold Take control, which pauses the bot. */
+export async function remoteDesktopRoute(path, method, req, res, deps) {
+    const m = path.match(/^\/api\/bots\/([\w-]+)\/computer\/remote-(frame|input)$/);
+    if (!m || method !== "POST")
+        return false;
+    const reply = (status, body) => (json(res, status, body), true);
+    const bot = deps.store.bot(m[1]);
+    if (!bot)
+        return reply(404, { error: "no such bot" });
+    if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
+        return reply(415, { error: "content-type must be application/json" });
+    }
+    if ((deps.platform ?? process.platform) !== "darwin" || await deps.surface(bot, bot.threadId) !== "local") {
+        return reply(409, { error: "Phone remote control works for This Mac for now. Choose This Mac for this bot, or open the cloud desktop." });
+    }
+    const call = (deps.cua ?? hostCall)();
+    if (!call)
+        return reply(409, { error: readCuaUnavailableReason() ?? "CUA Driver is not ready on this computer" });
+    res.setHeader("cache-control", "private, no-store");
+    try {
+        if (m[2] === "frame")
+            return reply(200, await remoteFrame(call));
+        if (!deps.controlHeld(bot.id))
+            return reply(409, { error: "Take control before using this computer" });
+        const input = remoteInputSchema.safeParse(await readBody(req));
+        if (!input.success)
+            return reply(400, { error: "invalid remote input" });
+        await remoteInput(call, input.data);
+        return reply(200, { ok: true });
+    }
+    catch (error) {
+        if (error.status !== 409)
+            throw error;
+        return reply(409, { error: error.message });
+    }
+}
+function hostCall() {
+    const connection = readCuaConnection();
+    return connection ? hostCuaCall(connection) : null;
+}

package/dist-server/server/routes/message-file.js

@@ -0,0 +1,115 @@
+import { messageAttachmentName, messageFileDisposition, messageFileDownloadName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile } from "../message-file.js";
+import { PASS } from "./table.js";
+export function createMessageFileRoutes({ store, attachments: ATTACHMENTS_DIR, workspaceDir, access }) {
+    return async ({ req, res, url, path, method, auth, json, readBody }) => {
+        const m = path.match(/^\/api\/threads\/([\w-]+)\/messages\/([\w-]+)\/file$/);
+        const streamsMessageImage = Boolean(m && method === "GET" && url.searchParams.get("preview") === "1");
+        if (m && (method === "POST" || streamsMessageImage)) {
+            if (method === "POST" && !String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
+                return json(res, 415, { error: "content-type must be application/json" });
+            }
+            const threadId = m[1];
+            const directBot = store.botByThread(threadId);
+            const group = directBot ? undefined : store.groupByThread(threadId);
+            if (!directBot && !group)
+                return json(res, 404, { error: "no such conversation" });
+            const message = store.messagesFor(threadId).find((candidate) => candidate.id === m[2]);
+            if (!message)
+                return json(res, 404, { error: "no such message" });
+            if (message.kind !== "text") {
+                return json(res, 403, { error: "that message does not share this file" });
+            }
+            const body = method === "POST" ? await readBody(req) : null;
+            const rawReference = streamsMessageImage ? url.searchParams.get("ref") : null;
+            if (streamsMessageImage && (!rawReference || !/^\d+$/.test(rawReference))) {
+                return json(res, 400, { error: "ref must identify a rendered image" });
+            }
+            const href = method === "POST"
+                ? (typeof body.path === "string" ? body.path : "")
+                : messageImageTargetAt(message.text ?? "", Number(rawReference));
+            if (!href)
+                return json(res, 400, { error: "path is required" });
+            // Generated image paths are durable capabilities on this exact message.
+            // They do not grant access to arbitrary workspace files or Markdown refs.
+            const generatedImage = method === "POST" && message.role === "bot" &&
+                message.attachments?.some((attachment) => attachment.kind === "image" && attachment.path === href) === true;
+            let roots;
+            let downloadName;
+            if (generatedImage) {
+                roots = [ATTACHMENTS_DIR];
+            }
+            else if (message.role === "user") {
+                downloadName = messageAttachmentName(message.text ?? "", href) ?? undefined;
+                if (!downloadName) {
+                    return json(res, 403, { error: "that message does not share this file" });
+                }
+                roots = [ATTACHMENTS_DIR];
+            }
+            else {
+                if (!messageReferencesFile(message.text ?? "", href)) {
+                    return json(res, 403, { error: "that bot message does not link to this file" });
+                }
+                const senderId = directBot?.id ?? message.from?.botId;
+                // The persisted bot-role message is the author record. Membership is
+                // intentionally not consulted: removing a bot must not break files it
+                // already shared in channel history.
+                if (!senderId) {
+                    return json(res, 403, { error: "the file's bot author could not be verified" });
+                }
+                let pinnedCwd;
+                let configuredCwd;
+                if (directBot) {
+                    pinnedCwd = store.taskByThread(directBot.id, threadId)?.cwd;
+                    configuredCwd = directBot.cwd;
+                }
+                else if (group) {
+                    const task = store.groupTaskByThread(group.id, threadId);
+                    pinnedCwd = task ? task.pinnedCwd : group.threadId === threadId ? group.pinnedCwd : undefined;
+                    configuredCwd = group.cwd;
+                }
+                roots = messageFileRoots({
+                    senderWorkspace: workspaceDir(senderId),
+                    attachments: ATTACHMENTS_DIR,
+                    pinnedCwd,
+                    configuredCwd,
+                });
+            }
+            const file = await openMessageFile(href, roots, message.role === "bot" && !generatedImage
+                ? access(directBot?.id ?? message.from?.botId, auth) : {});
+            if ((streamsMessageImage || generatedImage) && !file.mime.startsWith("image/")) {
+                await file.handle.close();
+                return json(res, 415, { error: "only images can be previewed here" });
+            }
+            res.writeHead(200, {
+                "content-type": file.mime,
+                "content-length": String(file.bytes),
+                ...(streamsMessageImage
+                    ? { "content-disposition": "inline" }
+                    : { "content-disposition": messageFileDisposition(messageFileDownloadName(downloadName, file.name)) }),
+                "cache-control": streamsMessageImage ? "private, max-age=3600" : "private, no-store",
+                "cdn-cache-control": "no-store",
+                "cloudflare-cdn-cache-control": "no-store",
+                pragma: "no-cache",
+                vary: "Authorization",
+                "x-content-type-options": "nosniff",
+                ...(streamsMessageImage
+                    ? {
+                        "cross-origin-resource-policy": "same-origin",
+                        "referrer-policy": "no-referrer",
+                    }
+                    : {}),
+            });
+            if (file.bytes === 0) {
+                await file.handle.close();
+                res.end();
+                return;
+            }
+            const stream = file.handle.createReadStream({ start: 0, end: file.bytes - 1, autoClose: true });
+            stream.on("error", () => res.destroy());
+            res.on("close", () => stream.destroy());
+            stream.pipe(res);
+            return;
+        }
+        return PASS;
+    };
+}

package/dist-server/server/shared-deliverables.js

@@ -0,0 +1,109 @@
+// Shared file-link settings. This widens message downloads only, never bot tools.
+import { readFileSync } from "node:fs";
+import { realpath, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { z } from "zod";
+import { writeFileAtomic } from "./atomic.js";
+import { isRestricted } from "./bot-visibility.js";
+import { PASS } from "./routes/table.js";
+const rootsSchema = z.array(z.string().trim().min(1).max(4096).refine(path => !/[\0\r\n]/.test(path))).max(32);
+const inside = (root, path) => {
+    const suffix = relative(root, path);
+    return suffix === "" || (suffix !== ".." && !suffix.startsWith(`..${sep}`) && !isAbsolute(suffix));
+};
+export function sharedDeliverableAccess(settings, options) {
+    const { dataDir, pawRoot, store, senderId, canSeeBot, canSeeGroup } = options;
+    const botRoots = (id, cwd) => [
+        join(dataDir, "workspaces", id), join(dataDir, "task-workspaces", id), join(dataDir, "bots", id),
+        ...(cwd ? [cwd] : []), ...store.tasks(id).flatMap(task => task.cwd ? [task.cwd] : []),
+    ];
+    const personal = [join(pawRoot, "me", "personal"),
+        join(settings.home, "workspace", "PAW", "me", "personal")];
+    const protectedBots = store.bots.filter(bot => bot.personal === true || isRestricted(bot.visibility) || !canSeeBot(bot.id));
+    const protectedBotIds = new Set(protectedBots.map(bot => bot.id));
+    const protectedRooms = store.groups.filter(group => isRestricted(group.audienceFloor) ||
+        !canSeeGroup(group.id) || group.memberIds.some(id => protectedBotIds.has(id)));
+    const roomRoots = protectedRooms.flatMap(group => [group.cwd, group.pinnedCwd,
+        ...store.groupTasks(group.id).map(task => task.pinnedCwd),
+    ].filter((path) => typeof path === "string" && path.length > 0));
+    return {
+        sharedRoots: settings.current(),
+        sharedRootBoundaries: [join(settings.home, "workspace")],
+        sharedBlockedRoots: [dataDir, ...personal, ...protectedBots.flatMap(bot => botRoots(bot.id, bot.cwd)), ...roomRoots],
+        blockedRoots: [
+            ...(store.bot(senderId ?? "")?.personal === true ? [] : personal),
+            ...protectedBots.filter(bot => bot.id !== senderId).flatMap(bot => botRoots(bot.id, bot.cwd)),
+        ],
+    };
+}
+/** Email workspace members, assistants and service loopback are not the machine owner. */
+export function sharedDeliverablesOwner(auth) {
+    return auth.scopes.includes("admin") && (auth.kind === "loopback" ? auth.trust !== "service"
+        : auth.kind === "session" && !auth.session.email && !auth.session.userId);
+}
+export class SharedDeliverables {
+    file;
+    roots;
+    home;
+    constructor(dataDir, home = homedir()) {
+        this.home = home;
+        this.file = join(dataDir, "shared-deliverables.json");
+        try {
+            this.roots = rootsSchema.parse(JSON.parse(readFileSync(this.file, "utf8")));
+        }
+        catch (error) {
+            this.roots = error.code === "ENOENT"
+                ? [join(home, "workspace", "Reports"), join(home, "workspace", "Atomic")] : [];
+        }
+    }
+    current() { return [...this.roots]; }
+    async save(input, blockedRoots) {
+        const roots = rootsSchema.parse(input);
+        const canonicalBlocked = await Promise.all(blockedRoots.map(async (path) => {
+            try {
+                return await realpath(path);
+            }
+            catch {
+                return resolve(path);
+            }
+        }));
+        const workspace = await realpath(join(this.home, "workspace")).catch(() => resolve(this.home, "workspace"));
+        const next = [];
+        for (const raw of roots) {
+            const path = raw.startsWith("~/") ? join(this.home, raw.slice(2)) : raw;
+            if (!isAbsolute(path))
+                throw new Error("Use an absolute folder path.");
+            const canonical = await realpath(path);
+            if (!(await stat(canonical)).isDirectory())
+                throw new Error("Choose a folder.");
+            if (inside(canonical, workspace) || canonicalBlocked.some(root => inside(root, canonical))) {
+                throw new Error("Choose a deliverable folder, not the workspace or a private folder.");
+            }
+            next.push(canonical);
+        }
+        const unique = [...new Set(next)];
+        writeFileAtomic(this.file, JSON.stringify(unique, null, 2) + "\n", { mode: 0o600 });
+        this.roots = unique;
+    }
+}
+export function createSharedDeliverablesRoutes(settings, blockedRoots) {
+    return async ({ path, method, auth, req, res, json, readBody }) => {
+        if (path !== "/api/shared-deliverables")
+            return PASS;
+        if (!sharedDeliverablesOwner(auth))
+            return json(res, 403, { error: "Only the computer owner can manage shared deliverable folders." });
+        if (method === "GET")
+            return json(res, 200, { roots: settings.current() });
+        if (method !== "PUT")
+            return json(res, 405, { error: "Use GET or PUT." });
+        try {
+            const body = await readBody(req);
+            await settings.save(body.roots, blockedRoots());
+            return json(res, 200, { roots: settings.current() });
+        }
+        catch {
+            return json(res, 400, { error: "Choose existing deliverable folders. The whole workspace and private folders cannot be shared." });
+        }
+    };
+}

package/dist-server/server/skill-learn.js

@@ -5,6 +5,10 @@
 // There is no separate distillation engine. This module only builds the
 // prompt and recognises the slash command, so it works on every engine
 // that mounts the agents tools.
+import { expandSkillCommand } from "../shared/skill-command.js";
+export function expandSkillTurnText(text, authoring) {
+    return expandSkillCommand(authoring ? expandLearnTurnText(text) : text);
+}
 import { SAVE_RUN_AS_SKILL_LINE } from "../shared/learn-request.js";
 export const LEARN_COMMAND = "/learn";
 export const LEARN_SOURCE_PREFIX = "learn:";

package/dist-server/server/store.js

@@ -2618,16 +2618,16 @@ export class Store {
         return task;
     }
     /** One durable write: never leave only part of a bot's threads updated. */
-    setAllThreadApprovalMode(botId, mode) {
+    setAllThreadApprovalMode(botId, mode, preservePlan = false) {
         const bot = this.bot(botId);
         if (!bot)
             return null;
         const patch = { approvalMode: mode, autoApprove: false, alwaysAllow: [] };
-        const tasks = (bot.tasks ?? []).map(task => ({ ...task, ...patch }));
-        const next = { ...bot, ...patch, approvalGrant: undefined, tasks };
+        const tasks = (bot.tasks ?? []).map(task => preservePlan && approvalModeFor(this.projectBotForTask(botId, task.threadId)) === "plan" ? { ...task } : { ...task, ...patch });
+        const next = { ...bot, ...(preservePlan && approvalModeFor(bot) === "plan" ? {} : patch), approvalGrant: undefined, tasks };
         this.saveBots(this.bots.map(candidate => candidate === bot ? next : candidate));
         bot.tasks?.forEach((task, index) => Object.assign(task, tasks[index]));
-        Object.assign(bot, patch, { approvalGrant: undefined });
+        Object.assign(bot, { ...next, tasks: bot.tasks });
         this.emit({ type: "bot", botId });
         return bot;
     }

package/dist-server/server/subscription-bots.js

@@ -127,9 +127,10 @@ export function hostDefaultModel(provider, candidate) {
  * the first in `ranked` (the graded models, best value first within each
  * class) of that class, else the class below, and so on, else the class
  * above; with nothing graded, the account's own default when it is the
- * provider's, else its first. Undefined when it offers none. */
+ * provider's, else its first. Undefined when it offers none it can use. */
 export function bestProviderModel(input) {
-    const models = providerModels(input.provider, input.candidate);
+    const usable = input.usable ?? (() => true);
+    const models = providerModels(input.provider, input.candidate).filter(usable);
     if (!models.length)
         return undefined;
     const order = new Map((input.ranked ?? []).map((id, index) => [id.toLowerCase(), index]));

package/dist-server/shared/approval-mode.js

@@ -2,13 +2,15 @@
  * permission mode, passed through: OpenMausBot never decides a permission
  * itself (Full access aside, which answers residual prompts because that is
  * what the person granted). The order is the order the selector shows. */
-export const APPROVAL_MODES = ["ask", "edits", "auto", "full", "custom"];
+export const APPROVAL_MODES = ["ask", "edits", "auto", "full", "custom", "plan"];
 /** Only providers with an implemented permission mapping may expose a level.
  * `edits` (auto-accept edits) exists where the engine has such a mode:
  * Claude and Grok `acceptEdits`, Antigravity `auto_edit`, Qwen `auto-edit`,
  * Gemini `auto_edit`, Mistral Vibe `accept-edits`. Codex's Ask already runs `workspace-write`, so an edits
  * level would change nothing there. */
 export function supportsApprovalMode(driverKind, mode) {
+    if (mode === "plan")
+        return ["atomicEngine", "codex", "claudeAgent", "grok", "openai-compat", "minimax", "mistral", "ollamaCloud"].includes(driverKind ?? "");
     if (mode === "custom")
         return driverKind === "codex";
     if (mode === "edits")

package/dist-server/shared/engine-choices.js

@@ -127,7 +127,7 @@ export function engineBrand(engine) {
         const name = engine.managed?.organizationName?.trim() || (generic(engine.displayName) ? "OpenAI-compatible endpoint" : engine.displayName.trim());
         return { key: `endpoint:${name.toLowerCase()}`, name, group: "flatPlans" };
     }
-    if (engine.driverKind === "customAcp") {
+    if (["customAcp", "atomicEngine"].includes(engine.driverKind)) {
         if (engine.instanceId === ATOMIC_ENGINE_ID || /^atomic engine$/i.test(engine.displayName.trim()))
             return { key: "atomic-engine", name: "Atomic Engine", group: "atomic" };
         const name = generic(engine.displayName) ? "Custom agent" : engine.displayName.trim();

package/dist-server/shared/provider-accounts.js

@@ -8,10 +8,10 @@ export const ACCOUNT_PROVIDERS = [
     // Kimi Code reads its whole data root (login included) from KIMI_CODE_HOME.
     { id: "kimi", kind: "signIn", label: "Kimi Code", billing: "subscription", driver: "kimiAgent", homeEnv: "KIMI_CODE_HOME", loginArgs: ["login"], signupUrl: "https://www.kimi.com/code" },
     // Droid resolves <FACTORY_HOME_OVERRIDE>/.factory, so the folder is a home, not the data root.
-    { id: "droid", kind: "signIn", label: "Factory Droid", billing: "subscription", driver: "droidAgent", homeEnv: "FACTORY_HOME_OVERRIDE", loginArgs: [], signupUrl: "https://factory.ai/pricing" },
+    { id: "droid", kind: "signIn", label: "Factory Droid", billing: "subscription", driver: "droidAgent", homeEnv: "FACTORY_HOME_OVERRIDE", loginArgs: [], signupUrl: "https://factory.com/pricing" },
     {
         id: "anthropic", kind: "apiKey", label: "Anthropic API", billing: "payPerUse", driver: "claudeAgent", envVar: "ANTHROPIC_API_KEY", icon: "anthropic",
-        config: {}, keyTest: { provider: "anthropic" }, keyUrl: "https://console.anthropic.com/settings/keys",
+        config: {}, keyTest: { provider: "anthropic" }, keyUrl: "https://platform.claude.com/settings/keys",
     },
     {
         id: "openai", kind: "apiKey", label: "OpenAI API", billing: "payPerUse", driver: "openai-compat", envVar: "OPENAI_API_KEY", icon: "openai",
@@ -28,14 +28,14 @@ export const ACCOUNT_PROVIDERS = [
         // spending a request: there is no key test.
         id: "perplexity", kind: "apiKey", label: "Perplexity API", billing: "payPerUse", driver: "openai-compat", envVar: "PERPLEXITY_API_KEY", icon: "perplexity",
         config: { url: "https://api.perplexity.ai", apiKeyEnv: "PERPLEXITY_API_KEY", model: "sonar-pro", provider: "" },
-        keyUrl: "https://www.perplexity.ai/account/api/keys",
+        keyUrl: "https://console.perplexity.ai/project/keys",
     },
     {
         // Alibaba's flat-price Qwen Coding Plan: one plan key serves Qwen, GLM, Kimi and MiniMax models.
         id: "qwenCodingPlan", kind: "apiKey", label: "Qwen Coding Plan", billing: "subscription", driver: "openai-compat", envVar: "QWEN_CODING_PLAN_API_KEY", icon: "qwen",
         config: { url: "https://coding-intl.dashscope.aliyuncs.com/v1", apiKeyEnv: "QWEN_CODING_PLAN_API_KEY", model: "qwen3.7-plus", provider: "" },
         keyTest: { provider: "openaiCompat", url: "https://coding-intl.dashscope.aliyuncs.com/v1" },
-        keyUrl: "https://modelstudio.console.alibabacloud.com/", signupUrl: "https://www.alibabacloud.com/help/en/model-studio/coding-plan",
+        keyUrl: "https://modelstudio.console.alibabacloud.com/ap-southeast-1/subscription/coding-plan", signupUrl: "https://www.alibabacloud.com/help/en/model-studio/coding-plan",
     },
     {
         // MiniMax's flat-price M Plan (formerly the Coding Plan): an `sk-cp-` plan
@@ -61,7 +61,7 @@ export const ACCOUNT_PROVIDERS = [
     {
         // OpenCode Go is a flat monthly plan used through an OpenCode key.
         id: "opencodeGo", kind: "apiKey", label: "OpenCode Go", billing: "subscription", driver: "opencodeGo", envVar: "OPENCODE_API_KEY",
-        config: {}, keyUrl: "https://opencode.ai/docs/providers/", signupUrl: "https://opencode.ai/go",
+        config: {}, keyUrl: "https://opencode.ai/go", signupUrl: "https://opencode.ai/go",
     },
 ];
 export function accountProvider(id) {

package/dist-server/shared/skill-command.js

@@ -0,0 +1,16 @@
+/** Skill commands remain ordinary user turns: they grant no extra permissions. */
+export function expandSkillCommand(text) {
+    const match = /^\/(skills|skill)(?:\s+([\s\S]*))?$/i.exec(text.trim());
+    if (!match)
+        return text;
+    const request = match[2]?.trim() ?? "";
+    if (match[1].toLowerCase() === "skills" || !request) {
+        return "List the skills actually available to you in this conversation, with their exact names and a short description. " +
+            "Use the available skill catalog or discovery tools; do not invent skills or execute one. " +
+            (request ? `Filter the list for this request: ${request}\n` : "") +
+            "Explain that /skill <name> <task> invokes a skill and /learn saves a reusable procedure.";
+    }
+    return "Use the named available skill for the following request. Read its instructions before acting. " +
+        "If the skill is missing or the name is ambiguous, explain that and offer available matches; do not invent it. " +
+        "Existing permissions and approval requirements still apply. If no task is supplied, use the current task when clear, otherwise ask what to apply it to.\n\n" + request;
+}

package/dist-server/vps-container-mcp.js

@@ -17174,6 +17174,7 @@ var SPAWNED_PROXIES = {
   hook: resolveProxy("hooks/omb-hook"),
   // the RTK add-on's Claude PreToolUse hook (bypassPermissions turns only)
   rtkHook: resolveProxy("hooks/rtk-hook"),
+  planHook: resolveProxy("hooks/plan-hook"),
   // Loaded by the external `pi` process via `-e`, not by this server — but
   // resolved through the same single source of truth so the packaged layout
   // check can assert it ships.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chibitek/chibi",
-  "version": "0.1.169",
+  "version": "0.1.171",
   "description": "Atomic by Chibitek: run your AI team's server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",

package/dist/assets/channel-BZDQCBTd.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-Dm-Ny6a0.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/dist/assets/swimlanesDiagram-TC7HE7FX-CQHcTGnI.js

@@ -1,8 +0,0 @@
-import{c as r,s as e}from"./flowDiagram-KWPJA3E3-hsbvL3Ow.js";import{_ as a}from"./mermaid.core-Dm-Ny6a0.js";import"./chunk-5VM5RSS4-BFkFo_ng.js";import"./chunk-XXDRQBXY-5ThtmFbP.js";import"./chunk-WEXAMYUT-FhqQ0sO0.js";import"./chunk-GWA4HPMP-BZChfTYw.js";import"./channel-BZDQCBTd.js";import"./index-ByXr4FRl.js";var o=a(t=>`${e(t)}
-  .swimlane.cluster:not([data-color-id]) rect {
-    stroke: ${t.clusterBorder} !important;
-  }
-  [data-look="neo"].cluster rect {
-    filter: none;
-  }
-`,"getStyles"),s=o,u=r({styles:s});export{u as diagram};