@chibitek/chibi 0.1.170 → 0.1.171

package/dist-server/server/shared-deliverables.js

@@ -0,0 +1,109 @@
+// Shared file-link settings. This widens message downloads only, never bot tools.
+import { readFileSync } from "node:fs";
+import { realpath, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { z } from "zod";
+import { writeFileAtomic } from "./atomic.js";
+import { isRestricted } from "./bot-visibility.js";
+import { PASS } from "./routes/table.js";
+const rootsSchema = z.array(z.string().trim().min(1).max(4096).refine(path => !/[\0\r\n]/.test(path))).max(32);
+const inside = (root, path) => {
+    const suffix = relative(root, path);
+    return suffix === "" || (suffix !== ".." && !suffix.startsWith(`..${sep}`) && !isAbsolute(suffix));
+};
+export function sharedDeliverableAccess(settings, options) {
+    const { dataDir, pawRoot, store, senderId, canSeeBot, canSeeGroup } = options;
+    const botRoots = (id, cwd) => [
+        join(dataDir, "workspaces", id), join(dataDir, "task-workspaces", id), join(dataDir, "bots", id),
+        ...(cwd ? [cwd] : []), ...store.tasks(id).flatMap(task => task.cwd ? [task.cwd] : []),
+    ];
+    const personal = [join(pawRoot, "me", "personal"),
+        join(settings.home, "workspace", "PAW", "me", "personal")];
+    const protectedBots = store.bots.filter(bot => bot.personal === true || isRestricted(bot.visibility) || !canSeeBot(bot.id));
+    const protectedBotIds = new Set(protectedBots.map(bot => bot.id));
+    const protectedRooms = store.groups.filter(group => isRestricted(group.audienceFloor) ||
+        !canSeeGroup(group.id) || group.memberIds.some(id => protectedBotIds.has(id)));
+    const roomRoots = protectedRooms.flatMap(group => [group.cwd, group.pinnedCwd,
+        ...store.groupTasks(group.id).map(task => task.pinnedCwd),
+    ].filter((path) => typeof path === "string" && path.length > 0));
+    return {
+        sharedRoots: settings.current(),
+        sharedRootBoundaries: [join(settings.home, "workspace")],
+        sharedBlockedRoots: [dataDir, ...personal, ...protectedBots.flatMap(bot => botRoots(bot.id, bot.cwd)), ...roomRoots],
+        blockedRoots: [
+            ...(store.bot(senderId ?? "")?.personal === true ? [] : personal),
+            ...protectedBots.filter(bot => bot.id !== senderId).flatMap(bot => botRoots(bot.id, bot.cwd)),
+        ],
+    };
+}
+/** Email workspace members, assistants and service loopback are not the machine owner. */
+export function sharedDeliverablesOwner(auth) {
+    return auth.scopes.includes("admin") && (auth.kind === "loopback" ? auth.trust !== "service"
+        : auth.kind === "session" && !auth.session.email && !auth.session.userId);
+}
+export class SharedDeliverables {
+    file;
+    roots;
+    home;
+    constructor(dataDir, home = homedir()) {
+        this.home = home;
+        this.file = join(dataDir, "shared-deliverables.json");
+        try {
+            this.roots = rootsSchema.parse(JSON.parse(readFileSync(this.file, "utf8")));
+        }
+        catch (error) {
+            this.roots = error.code === "ENOENT"
+                ? [join(home, "workspace", "Reports"), join(home, "workspace", "Atomic")] : [];
+        }
+    }
+    current() { return [...this.roots]; }
+    async save(input, blockedRoots) {
+        const roots = rootsSchema.parse(input);
+        const canonicalBlocked = await Promise.all(blockedRoots.map(async (path) => {
+            try {
+                return await realpath(path);
+            }
+            catch {
+                return resolve(path);
+            }
+        }));
+        const workspace = await realpath(join(this.home, "workspace")).catch(() => resolve(this.home, "workspace"));
+        const next = [];
+        for (const raw of roots) {
+            const path = raw.startsWith("~/") ? join(this.home, raw.slice(2)) : raw;
+            if (!isAbsolute(path))
+                throw new Error("Use an absolute folder path.");
+            const canonical = await realpath(path);
+            if (!(await stat(canonical)).isDirectory())
+                throw new Error("Choose a folder.");
+            if (inside(canonical, workspace) || canonicalBlocked.some(root => inside(root, canonical))) {
+                throw new Error("Choose a deliverable folder, not the workspace or a private folder.");
+            }
+            next.push(canonical);
+        }
+        const unique = [...new Set(next)];
+        writeFileAtomic(this.file, JSON.stringify(unique, null, 2) + "\n", { mode: 0o600 });
+        this.roots = unique;
+    }
+}
+export function createSharedDeliverablesRoutes(settings, blockedRoots) {
+    return async ({ path, method, auth, req, res, json, readBody }) => {
+        if (path !== "/api/shared-deliverables")
+            return PASS;
+        if (!sharedDeliverablesOwner(auth))
+            return json(res, 403, { error: "Only the computer owner can manage shared deliverable folders." });
+        if (method === "GET")
+            return json(res, 200, { roots: settings.current() });
+        if (method !== "PUT")
+            return json(res, 405, { error: "Use GET or PUT." });
+        try {
+            const body = await readBody(req);
+            await settings.save(body.roots, blockedRoots());
+            return json(res, 200, { roots: settings.current() });
+        }
+        catch {
+            return json(res, 400, { error: "Choose existing deliverable folders. The whole workspace and private folders cannot be shared." });
+        }
+    };
+}

package/dist-server/server/skill-learn.js

@@ -5,6 +5,10 @@
 // There is no separate distillation engine. This module only builds the
 // prompt and recognises the slash command, so it works on every engine
 // that mounts the agents tools.
+import { expandSkillCommand } from "../shared/skill-command.js";
+export function expandSkillTurnText(text, authoring) {
+    return expandSkillCommand(authoring ? expandLearnTurnText(text) : text);
+}
 import { SAVE_RUN_AS_SKILL_LINE } from "../shared/learn-request.js";
 export const LEARN_COMMAND = "/learn";
 export const LEARN_SOURCE_PREFIX = "learn:";

package/dist-server/server/subscription-bots.js

@@ -127,9 +127,10 @@ export function hostDefaultModel(provider, candidate) {
  * the first in `ranked` (the graded models, best value first within each
  * class) of that class, else the class below, and so on, else the class
  * above; with nothing graded, the account's own default when it is the
- * provider's, else its first. Undefined when it offers none. */
+ * provider's, else its first. Undefined when it offers none it can use. */
 export function bestProviderModel(input) {
-    const models = providerModels(input.provider, input.candidate);
+    const usable = input.usable ?? (() => true);
+    const models = providerModels(input.provider, input.candidate).filter(usable);
     if (!models.length)
         return undefined;
     const order = new Map((input.ranked ?? []).map((id, index) => [id.toLowerCase(), index]));

package/dist-server/shared/provider-accounts.js

@@ -8,10 +8,10 @@ export const ACCOUNT_PROVIDERS = [
     // Kimi Code reads its whole data root (login included) from KIMI_CODE_HOME.
     { id: "kimi", kind: "signIn", label: "Kimi Code", billing: "subscription", driver: "kimiAgent", homeEnv: "KIMI_CODE_HOME", loginArgs: ["login"], signupUrl: "https://www.kimi.com/code" },
     // Droid resolves <FACTORY_HOME_OVERRIDE>/.factory, so the folder is a home, not the data root.
-    { id: "droid", kind: "signIn", label: "Factory Droid", billing: "subscription", driver: "droidAgent", homeEnv: "FACTORY_HOME_OVERRIDE", loginArgs: [], signupUrl: "https://factory.ai/pricing" },
+    { id: "droid", kind: "signIn", label: "Factory Droid", billing: "subscription", driver: "droidAgent", homeEnv: "FACTORY_HOME_OVERRIDE", loginArgs: [], signupUrl: "https://factory.com/pricing" },
     {
         id: "anthropic", kind: "apiKey", label: "Anthropic API", billing: "payPerUse", driver: "claudeAgent", envVar: "ANTHROPIC_API_KEY", icon: "anthropic",
-        config: {}, keyTest: { provider: "anthropic" }, keyUrl: "https://console.anthropic.com/settings/keys",
+        config: {}, keyTest: { provider: "anthropic" }, keyUrl: "https://platform.claude.com/settings/keys",
     },
     {
         id: "openai", kind: "apiKey", label: "OpenAI API", billing: "payPerUse", driver: "openai-compat", envVar: "OPENAI_API_KEY", icon: "openai",
@@ -28,14 +28,14 @@ export const ACCOUNT_PROVIDERS = [
         // spending a request: there is no key test.
         id: "perplexity", kind: "apiKey", label: "Perplexity API", billing: "payPerUse", driver: "openai-compat", envVar: "PERPLEXITY_API_KEY", icon: "perplexity",
         config: { url: "https://api.perplexity.ai", apiKeyEnv: "PERPLEXITY_API_KEY", model: "sonar-pro", provider: "" },
-        keyUrl: "https://www.perplexity.ai/account/api/keys",
+        keyUrl: "https://console.perplexity.ai/project/keys",
     },
     {
         // Alibaba's flat-price Qwen Coding Plan: one plan key serves Qwen, GLM, Kimi and MiniMax models.
         id: "qwenCodingPlan", kind: "apiKey", label: "Qwen Coding Plan", billing: "subscription", driver: "openai-compat", envVar: "QWEN_CODING_PLAN_API_KEY", icon: "qwen",
         config: { url: "https://coding-intl.dashscope.aliyuncs.com/v1", apiKeyEnv: "QWEN_CODING_PLAN_API_KEY", model: "qwen3.7-plus", provider: "" },
         keyTest: { provider: "openaiCompat", url: "https://coding-intl.dashscope.aliyuncs.com/v1" },
-        keyUrl: "https://modelstudio.console.alibabacloud.com/", signupUrl: "https://www.alibabacloud.com/help/en/model-studio/coding-plan",
+        keyUrl: "https://modelstudio.console.alibabacloud.com/ap-southeast-1/subscription/coding-plan", signupUrl: "https://www.alibabacloud.com/help/en/model-studio/coding-plan",
     },
     {
         // MiniMax's flat-price M Plan (formerly the Coding Plan): an `sk-cp-` plan
@@ -61,7 +61,7 @@ export const ACCOUNT_PROVIDERS = [
     {
         // OpenCode Go is a flat monthly plan used through an OpenCode key.
         id: "opencodeGo", kind: "apiKey", label: "OpenCode Go", billing: "subscription", driver: "opencodeGo", envVar: "OPENCODE_API_KEY",
-        config: {}, keyUrl: "https://opencode.ai/docs/providers/", signupUrl: "https://opencode.ai/go",
+        config: {}, keyUrl: "https://opencode.ai/go", signupUrl: "https://opencode.ai/go",
     },
 ];
 export function accountProvider(id) {

package/dist-server/shared/skill-command.js

@@ -0,0 +1,16 @@
+/** Skill commands remain ordinary user turns: they grant no extra permissions. */
+export function expandSkillCommand(text) {
+    const match = /^\/(skills|skill)(?:\s+([\s\S]*))?$/i.exec(text.trim());
+    if (!match)
+        return text;
+    const request = match[2]?.trim() ?? "";
+    if (match[1].toLowerCase() === "skills" || !request) {
+        return "List the skills actually available to you in this conversation, with their exact names and a short description. " +
+            "Use the available skill catalog or discovery tools; do not invent skills or execute one. " +
+            (request ? `Filter the list for this request: ${request}\n` : "") +
+            "Explain that /skill <name> <task> invokes a skill and /learn saves a reusable procedure.";
+    }
+    return "Use the named available skill for the following request. Read its instructions before acting. " +
+        "If the skill is missing or the name is ambiguous, explain that and offer available matches; do not invent it. " +
+        "Existing permissions and approval requirements still apply. If no task is supplied, use the current task when clear, otherwise ask what to apply it to.\n\n" + request;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chibitek/chibi",
-  "version": "0.1.170",
+  "version": "0.1.171",
   "description": "Atomic by Chibitek: run your AI team's server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",

package/dist/assets/channel-BQM13l0i.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-BbPWTT56.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/dist/assets/swimlanesDiagram-TC7HE7FX-UC0GNJzN.js

@@ -1,8 +0,0 @@
-import{c as r,s as e}from"./flowDiagram-KWPJA3E3-BthbP_HO.js";import{_ as a}from"./mermaid.core-BbPWTT56.js";import"./chunk-5VM5RSS4-D8fmZ4d8.js";import"./chunk-XXDRQBXY-DQhvP8zg.js";import"./chunk-WEXAMYUT-DKy8jAU5.js";import"./chunk-GWA4HPMP-BvL6j7pQ.js";import"./channel-BQM13l0i.js";import"./index-VagspC1z.js";var o=a(t=>`${e(t)}
-  .swimlane.cluster:not([data-color-id]) rect {
-    stroke: ${t.clusterBorder} !important;
-  }
-  [data-look="neo"].cluster rect {
-    filter: none;
-  }
-`,"getStyles"),s=o,u=r({styles:s});export{u as diagram};