@chibitek/chibi 0.1.174 → 0.1.175

package/dist-server/openmausbot.js

@@ -20900,6 +20900,7 @@ var init_config = __esm({
       icm: external_exports.object({
         enabled: external_exports.boolean().optional(),
         aboutMePrefilled: external_exports.boolean().optional(),
+        // no longer read (About me syncs with PAW); kept so older configs parse
         path: external_exports.string().trim().max(4096).refine(
           (value) => !["\r", "\n", "\0"].some((character) => value.includes(character)),
           "Use a folder path without control characters"

package/dist-server/pair-cli.js

@@ -20900,6 +20900,7 @@ var init_config = __esm({
       icm: external_exports.object({
         enabled: external_exports.boolean().optional(),
         aboutMePrefilled: external_exports.boolean().optional(),
+        // no longer read (About me syncs with PAW); kept so older configs parse
         path: external_exports.string().trim().max(4096).refine(
           (value) => !["\r", "\n", "\0"].some((character) => value.includes(character)),
           "Use a folder path without control characters"

package/dist-server/server/about-me-sync.js

@@ -0,0 +1,172 @@
+// About me lives in up to three places: Atomic's profile (every bot, cloud
+// runs too), PAW me/about-me.md (local bots and CLI tools) and the person's
+// Nexus about_me (every AI signed in to Nexus). This keeps them the same:
+// an empty side is filled, an edit on one side reaches the others, and two
+// sides that disagree wait for the person to pick one in Settings > About me.
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { writeFileAtomic } from "./atomic.js";
+export const ABOUT_ME_SIDES = ["atomic", "paw", "nexus"];
+const norm = (text) => text.replace(/\r\n?/g, "\n").trim();
+/** One pass. `now` holds each reachable side's text (a side left out is
+ * skipped and caught up later); `seen` is what each side held after the
+ * last pass. A side whose text moved since then was edited, and a single
+ * edit reaches every other side. Two different edits, or a side seen for
+ * the first time that disagrees with the rest, are a conflict: nothing is
+ * written. `legacy` (an ICM "Who I am") fills everything when all sides are
+ * empty, and a profile still holding it counts as empty. */
+export function reconcileAboutMe(now, seen, legacy = "") {
+    const sides = ABOUT_ME_SIDES.filter((side) => now[side] !== undefined);
+    const text = (side) => (side === "atomic" && norm(legacy) && norm(now.atomic) === norm(legacy) ? "" : norm(now[side]));
+    const filled = sides.filter((side) => text(side));
+    const edited = filled.filter((side) => text(side) !== norm(seen[side] ?? ""));
+    const kept = filled.filter((side) => !edited.includes(side));
+    const firstContact = edited.some((side) => seen[side] === undefined) && kept.some((side) => text(side) !== text(edited[0]));
+    if (new Set(edited.map(text)).size > 1 || firstContact)
+        return { writes: {}, seen, conflict: filled };
+    const source = edited[0] ?? kept[0];
+    const target = source ? now[source] : legacy;
+    if (!norm(target))
+        return { writes: {}, seen, conflict: [] };
+    const writes = {};
+    for (const side of sides)
+        if (norm(now[side]) !== norm(target))
+            writes[side] = target;
+    return { writes, seen: { ...seen, ...Object.fromEntries(sides.map((side) => [side, norm(target)])) }, conflict: [] };
+}
+/** The person's About me in Nexus (about_me_get / about_me_set). */
+export function nexusAboutMe(client) {
+    if (!client)
+        return null;
+    return {
+        get: async () => {
+            const body = await client.call("about_me_get", {});
+            return typeof body.about_me === "string" ? body.about_me : "";
+        },
+        set: async (content) => { await client.call("about_me_set", { content }); },
+    };
+}
+/** How often a config read looks at Nexus again. */
+const NEXUS_EVERY_MS = 5 * 60_000;
+export class AboutMeSync {
+    deps;
+    path;
+    seen;
+    conflicts = {};
+    nexusAt = 0;
+    running = null;
+    constructor(deps) {
+        this.deps = deps;
+        this.path = join(deps.dataDir, "about-me-sync.json");
+        try {
+            const raw = JSON.parse(readFileSync(this.path, "utf8"));
+            this.seen = Object.fromEntries(ABOUT_ME_SIDES.filter((side) => typeof raw[side] === "string").map((side) => [side, raw[side]]));
+        }
+        catch {
+            this.seen = {};
+        }
+    }
+    /** The texts that disagree, by side, for Settings > About me. Empty when they agree. */
+    conflict() {
+        return { ...this.conflicts };
+    }
+    /** Atomic and PAW now, then Nexus; the app hears each time About me changes. */
+    sync(maxAgeMs) {
+        if (this.local())
+            this.deps.changed();
+        void this.all(maxAgeMs).then((changed) => changed && this.deps.changed());
+    }
+    /** Atomic and PAW, now. True when Atomic's About me changed. Never throws. */
+    local() {
+        const before = this.deps.profile.get();
+        try {
+            this.pass({ atomic: before, ...(this.deps.paw() ? { paw: this.deps.paw().get() } : {}) });
+        }
+        catch (error) {
+            console.warn(`[about-me] could not sync with PAW: ${error.message}`);
+        }
+        return this.deps.profile.get() !== before;
+    }
+    /** Every side, Nexus included. A config read passes the default and looks
+     * at Nexus at most every five minutes; a save passes 0. Never throws. */
+    async all(maxAgeMs = NEXUS_EVERY_MS) {
+        const clock = this.deps.now ?? Date.now;
+        if (this.running)
+            return this.running;
+        if (!this.deps.nexus() || clock() - this.nexusAt < maxAgeMs)
+            return this.local();
+        this.nexusAt = clock();
+        this.running = (async () => {
+            const nexus = this.deps.nexus();
+            const before = this.deps.profile.get();
+            let text;
+            try {
+                text = await nexus.get();
+            }
+            catch (error) {
+                console.warn(`[about-me] could not read Nexus: ${error.message}`);
+                this.local();
+                return this.deps.profile.get() !== before;
+            }
+            try {
+                const write = this.pass({ atomic: before, ...(this.deps.paw() ? { paw: this.deps.paw().get() } : {}), nexus: text });
+                if (write !== undefined) {
+                    await nexus.set(write);
+                    this.save({ ...this.seen, nexus: norm(write) });
+                }
+            }
+            catch (error) {
+                console.warn(`[about-me] could not sync with Nexus: ${error.message}`);
+            }
+            return this.deps.profile.get() !== before;
+        })().finally(() => { this.running = null; });
+        return this.running;
+    }
+    /** The person picked `side` in a conflict: its text goes everywhere.
+     * False when `side` is not one of the texts that disagree. */
+    async resolve(side) {
+        const text = ABOUT_ME_SIDES.includes(side) ? this.conflicts[side] : undefined;
+        if (text === undefined)
+            return false;
+        this.conflicts = {};
+        const paw = this.deps.paw();
+        if (norm(this.deps.profile.get()) !== norm(text))
+            this.deps.profile.set(text);
+        if (paw && norm(paw.get()) !== norm(text))
+            paw.set(text);
+        this.save({ ...this.seen, atomic: norm(text), ...(paw ? { paw: norm(text) } : {}) });
+        const nexus = this.deps.nexus();
+        if (nexus) {
+            await nexus.set(text);
+            this.save({ ...this.seen, nexus: norm(text) });
+        }
+        this.deps.changed();
+        return true;
+    }
+    /** Writes Atomic and PAW; returns the text Nexus should get, if any. */
+    pass(now) {
+        const result = reconcileAboutMe(now, this.seen, this.deps.legacy());
+        // a pass that could not see Nexus keeps a Nexus conflict on screen
+        this.conflicts = result.conflict.length || now.nexus !== undefined || !this.conflicts.nexus
+            ? Object.fromEntries(result.conflict.map((side) => [side, now[side]]))
+            : this.conflicts;
+        if (result.writes.paw !== undefined)
+            this.deps.paw()?.set(result.writes.paw);
+        if (result.writes.atomic !== undefined)
+            this.deps.profile.set(result.writes.atomic);
+        // Nexus counts as seen only once the write lands
+        this.save(result.writes.nexus === undefined ? result.seen : { ...result.seen, nexus: this.seen.nexus });
+        return result.writes.nexus;
+    }
+    save(next) {
+        if (JSON.stringify(next) === JSON.stringify(this.seen))
+            return;
+        this.seen = next;
+        try {
+            writeFileAtomic(this.path, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+        }
+        catch (error) {
+            console.warn(`[about-me] could not save sync state: ${error.message}`);
+        }
+    }
+}

package/dist-server/server/config.js

@@ -470,7 +470,7 @@ const appConfigSchema = z.object({
      * On unless `enabled` is false; an empty or absent path is ~/workspace/ICM. */
     icm: z.object({
         enabled: z.boolean().optional(),
-        aboutMePrefilled: z.boolean().optional(),
+        aboutMePrefilled: z.boolean().optional(), // no longer read (About me syncs with PAW); kept so older configs parse
         path: z.string().trim().max(4096).refine((value) => !["\r", "\n", "\0"].some((character) => value.includes(character)), "Use a folder path without control characters").optional(),
     }).strict().optional(),
     /** Settings > Memory (server/nexus-memory): always write session outcomes,

package/dist-server/server/icm-context.js

@@ -145,25 +145,3 @@ export function icmAboutMeSummary(folder) {
     }
     return "";
 }
-/** The one-time config patch that fills an empty About me from Layer 0, or
- * null when there is nothing to do. An About me the person already wrote is
- * never replaced: the patch then only records that the check happened, so a
- * later edit, or clearing the field on purpose, is never refilled. */
-export function icmAboutMePrefill(cfg, home = homedir()) {
-    if (!icmEnabled(cfg) || cfg.icm?.aboutMePrefilled)
-        return null;
-    const folder = resolveIcmPath(cfg, home);
-    if (!icmFolderPresent(folder))
-        return null;
-    if (cfg.profile?.aboutMe?.trim())
-        return { icm: { aboutMePrefilled: true } };
-    const aboutMe = icmAboutMeSummary(folder);
-    return aboutMe ? { profile: { aboutMe }, icm: { aboutMePrefilled: true } } : null;
-}
-/** About me still holds exactly what was filled in from ICM. */
-export function aboutMeFromIcm(cfg, home = homedir()) {
-    const current = cfg.profile?.aboutMe?.trim();
-    if (!cfg.icm?.aboutMePrefilled || !current)
-        return false;
-    return current === icmAboutMeSummary(resolveIcmPath(cfg, home));
-}

package/dist-server/server/index.js

@@ -214,7 +214,8 @@ import { RTK_LAUNCHER_PATH, rtkLocalStatus } from "./rtk.js";
 import { withoutRtkLauncher } from "./rtk-rewrite.js";
 import { loadAddonSkillLibraries } from "./skill-addons.js";
 import { browserSkillCapabilities, loadBundledSkills, loadUserSkills, mergeSkills, renderSkillInstructions, selectBundledSkills } from "./skill-library.js";
-import { aboutMeFromIcm, icmAboutMePrefill, icmStatus, icmSystemPrompt } from "./icm-context.js";
+import { AboutMeSync, nexusAboutMe } from "./about-me-sync.js";
+import { icmAboutMeSummary, icmEnabled, icmStatus, icmSystemPrompt, resolveIcmPath } from "./icm-context.js";
 import { PawService } from "./paw/service.js";
 import { chibiFilingPrompt, parseFiledTaskId } from "./paw/change-requests.js";
 import { installedPlaybookInstructions } from "./installed-playbooks.js";
@@ -506,22 +507,6 @@ ensureNodeShim();
 // Extract the bundled npm (Resources/npm/npm-<version>.tgz) once, soon after
 // boot, so the first "Connect Claude" does not wait for it. It never throws.
 setTimeout(() => void bundledNpmCli(), 2_000).unref?.();
-/** Fill an empty About me from ICM Layer 0, once. True when config changed. */
-function prefillAboutMeFromIcm() {
-    const patch = icmAboutMePrefill(cfg);
-    if (!patch)
-        return false;
-    try {
-        saveConfig(patch);
-        Object.assign(cfg, loadConfig());
-        return true;
-    }
-    catch (error) {
-        console.warn(`[icm] could not fill About me: ${error.message}`);
-        return false;
-    }
-}
-prefillAboutMeFromIcm();
 // Who asked for the turn running (or last run) on each thread, read by the
 // usage ledger when it settles. It is set when a turn is ADMITTED, from the
 // message that started it — never when a message merely queues behind a
@@ -2468,9 +2453,15 @@ try {
 catch (error) {
     console.warn(`[paw] could not create the workspace: ${error.message}`);
 }
-function pawConfigStatus() {
-    return paw.summary();
-}
+const aboutMe = new AboutMeSync({
+    dataDir: DATA_DIR,
+    profile: { get: () => cfg.profile?.aboutMe ?? "", set: (text) => { saveConfig({ profile: { aboutMe: text.slice(0, 24_000) } }); Object.assign(cfg, loadConfig()); } },
+    paw: () => (paw.exists() ? { get: () => paw.aboutMe(), set: (text) => paw.setAboutMe(text) } : null),
+    nexus: () => nexusAboutMe(nexusMemory.getClient()),
+    legacy: () => (icmEnabled(cfg) ? icmAboutMeSummary(resolveIcmPath(cfg)) : ""),
+    changed: () => broadcast({ kind: "config", ...configStatus() }),
+});
+void aboutMe.all(0);
 /** The PAW section of a turn's system prompt. A cloud run cannot reach the
  * folder, so it gets none. */
 function pawPrompt(bot, request, runOn) {
@@ -14458,11 +14449,11 @@ function configStatus() {
         imageGen: avatarImageStatus(cfg),
         // not a secret — the sidebar shows it
         workspaceName: cfg.workspaceName ?? "",
-        profile: { name: cfg.profile?.name ?? "", email: cfg.profile?.email ?? "", aboutMe: cfg.profile?.aboutMe ?? "" },
+        profile: { name: cfg.profile?.name ?? "", email: cfg.profile?.email ?? "", aboutMe: cfg.profile?.aboutMe ?? "", aboutMeConflict: aboutMe.conflict() },
         // a folder path and whether it is there; nothing from inside it
-        icm: { ...icmStatus(cfg), aboutMeFromIcm: aboutMeFromIcm(cfg) },
+        icm: icmStatus(cfg),
         // where PAW lives and whether the interview ran; the files stay on disk
-        paw: pawConfigStatus(),
+        paw: paw.summary(),
         // the enrolled organisation's read-only desktop policy; null when not enrolled
         managedPolicy: managedPolicy.summary(),
         // whether this person sees Watch-Along (server/watch-along/access.ts)
@@ -14533,7 +14524,7 @@ function configForAccess(status, admin) {
         signIn: { admins: [], members: [] },
         vps: { configured: status.vps.configured, sshAlias: "" },
         profile: { name: status.profile.name, email: "" },
-        icm: { enabled: status.icm.enabled, found: status.icm.found, exists: status.icm.exists, path: "", defaultPath: "", aboutMeFromIcm: false },
+        icm: { enabled: status.icm.enabled, found: status.icm.found, exists: status.icm.exists, path: "", defaultPath: "" },
         paw: { ...status.paw, root: "" },
         browserProfiles: status.browserProfiles.map((profile) => Object.fromEntries(Object.entries(profile).filter(([key]) => key !== "partitionId"))),
     };
@@ -24245,6 +24236,7 @@ const handleRequest = async (req, res) => {
                     name: field("name", 80), role: field("role", 120), department: field("department", 80), company: field("company", 120),
                     goals: field("goals", 2_000), workingStyle: field("workingStyle", 2_000),
                 }, { chibitek: body?.chibitek === true });
+                aboutMe.sync(0);
                 broadcast({ kind: "config", ...configStatus() });
                 return json(res, 200, { ...status, aboutMe: paw.aboutMe() });
             }
@@ -24255,8 +24247,13 @@ const handleRequest = async (req, res) => {
                 if (!paw.exists())
                     await paw.ensure({ chibitek: cfg.onboarding?.setup?.chibitek === true });
                 paw.setAboutMe(body.text);
+                aboutMe.sync(0);
                 return json(res, 200, { ...paw.status(), aboutMe: paw.aboutMe() });
             }
+            if (method === "POST" && path === "/api/paw/about-me/resolve") {
+                const side = (await readBody(req))?.side;
+                return await aboutMe.resolve(String(side)) ? json(res, 200, { ok: true }) : json(res, 409, { error: "Nothing to choose: About me already agrees." });
+            }
             // Bot settings > Memory > Workspace knowledge
             if (method === "GET" && path === "/api/paw/suggestable") {
                 return json(res, 200, { files: paw.suggestable() });
@@ -24289,10 +24286,8 @@ const handleRequest = async (req, res) => {
             return json(res, 404, { error: "not found" });
         }
         if (method === "GET" && path === "/api/config") {
-            // an ICM folder created while the server runs (the setup chat) fills an
-            // empty About me the next time Settings or the app asks
-            if (prefillAboutMeFromIcm())
-                broadcast({ kind: "config", ...configStatus() });
+            // a me/about-me.md or Nexus edit, or a new ICM folder, reaches About me on a read
+            aboutMe.sync();
             return json(res, 200, configForAccess(configStatus(), auth.scopes.includes("admin")));
         }
         if ((method === "PUT" || method === "PATCH") && path === "/api/config") {
@@ -24698,9 +24693,9 @@ const handleRequest = async (req, res) => {
                         syncCredentialEnv(patch);
                         Object.assign(cfg, loadConfig());
                     }
-                    // a newly chosen or re-enabled ICM folder can fill an empty About me
-                    if (patch.icm)
-                        prefillAboutMeFromIcm();
+                    // an About me edit reaches PAW; a newly chosen ICM folder can fill an empty one
+                    if (patch.icm || patch.profile?.aboutMe !== undefined)
+                        aboutMe.sync(0);
                 }
                 catch (error) {
                     if (configWriteCommitted) {

package/dist-server/server/paw/service.js

@@ -89,7 +89,8 @@ export class PawService {
                 this.store.setBaseline(path, readText(this.root, path) ?? "");
             this.state = { ...this.state, template: "chibitek" };
         }
-        const result = applyInterview(this.root, { ...answers, name: answers.name || this.options.person().name }, { personEmail: this.options.person().email });
+        // an About me already there (written by hand, or filled from Nexus) is kept
+        const result = applyInterview(this.root, { ...answers, name: answers.name || this.options.person().name }, { personEmail: this.options.person().email, keepAboutMe: Boolean(this.aboutMe().trim()) });
         this.saveState({ ...this.state, departments: result.departments, interviewedAt: Date.now() });
         return this.status();
     }

package/dist-server/server/paw/workspace.js

@@ -187,7 +187,8 @@ export function applyInterview(root, answers, options = {}) {
         }
     }
     const aboutMe = aboutMeMarkdown(answers, department?.name ?? "", options.now);
-    writeText(root, "me/about-me.md", aboutMe);
+    if (!options.keepAboutMe)
+        writeText(root, "me/about-me.md", aboutMe);
     applyLocks(root, manifest, options.personEmail ?? "");
     return { departments, aboutMe };
 }

package/dist-server/server/vault/routes.js

@@ -1,4 +1,5 @@
 import { PASS } from "../routes/table.js";
+import { VaultCsvError, vaultLoginsFromCsv } from "../../shared/vault-csv.js";
 import { VaultError } from "./store.js";
 /** The owner is supplied by the authenticated host, never from request JSON.
  * Authorization runs on reads too, and is checked again after reading a body. */
@@ -13,6 +14,25 @@ export function createVaultRoutes(deps) {
         const store = deps.store();
         if (!store)
             return json(res, 503, { error: "Vault encryption is unavailable. Unlock the secure store and try again." });
+        if (path === "/api/vault/import") {
+            if (method !== "POST")
+                return json(res, 405, { error: "Method not allowed." });
+            const body = await readBody(req, 8_000_000).catch(() => null);
+            if (deps.owner(req, auth) !== ownerId || deps.store() !== store)
+                return json(res, 403, { error: "Vault access changed. Try again." });
+            if (typeof body?.csv !== "string")
+                return json(res, 400, { error: "Choose a CSV file exported from your password manager." });
+            try {
+                const { logins, skipped } = vaultLoginsFromCsv(body.csv);
+                return json(res, 200, { ...store.importLogins(ownerId, logins), skipped });
+            }
+            catch (error) {
+                // Neither message echoes anything from a row.
+                if (error instanceof VaultError || error instanceof VaultCsvError)
+                    return json(res, 400, { error: error.message });
+                return json(res, 503, { error: "Vault could not complete the request." });
+            }
+        }
         const item = /^\/api\/vault\/([0-9a-f-]{36})$/.exec(path);
         if (path !== "/api/vault" && !item)
             return json(res, 404, { error: "Vault item is unavailable." });

package/dist-server/server/vault/store.js

@@ -143,6 +143,30 @@ export class VaultStore {
             return vaultMetadata(item);
         });
     }
+    /** Adds logins in one write. A login already saved for the same website
+     * and username is left as it is and counted in `duplicates`. */
+    importLogins(ownerId, logins) {
+        owner(ownerId);
+        const parsed = logins.map((input) => vaultInputSchema.safeParse(input));
+        if (parsed.some((result) => !result.success))
+            throw new VaultError("Invalid Vault item.");
+        return this.mutate((items) => {
+            const key = (item) => item.kind === "login" ? `${item.website}\n${item.username}` : "";
+            const seen = new Set(items.filter((item) => item.ownerId === ownerId).map(key));
+            const now = Date.now();
+            let added = 0;
+            for (const { data } of parsed) {
+                if (seen.has(key(data)))
+                    continue;
+                seen.add(key(data));
+                items.push({ ...data, id: randomUUID(), ownerId, createdAt: now, updatedAt: now });
+                added++;
+            }
+            if (items.length > MAX_ITEMS)
+                throw new VaultError(`Vault holds up to ${MAX_ITEMS} items. This import would go over that.`);
+            return { added, duplicates: logins.length - added };
+        });
+    }
     update(ownerId, id, input) {
         owner(ownerId);
         if (!input || typeof input !== "object" || Array.isArray(input))

package/dist-server/shared/vault-csv.js

@@ -0,0 +1,94 @@
+import { vaultOrigin } from "./vault.js";
+export class VaultCsvError extends Error {
+}
+/** RFC 4180: quoted fields, doubled quotes, commas and newlines inside quotes. */
+export function parseCsv(text) {
+    const rows = [];
+    let row = [];
+    let field = "";
+    let quoted = false;
+    const s = text.replace(/^/, "");
+    for (let i = 0; i < s.length; i++) {
+        const c = s[i];
+        if (quoted) {
+            if (c === '"' && s[i + 1] === '"') {
+                field += '"';
+                i++;
+            }
+            else if (c === '"')
+                quoted = false;
+            else
+                field += c;
+        }
+        else if (c === '"')
+            quoted = true;
+        else if (c === ",") {
+            row.push(field);
+            field = "";
+        }
+        else if (c === "\n" || c === "\r") {
+            if (c === "\r" && s[i + 1] === "\n")
+                i++;
+            row.push(field);
+            rows.push(row);
+            row = [];
+            field = "";
+        }
+        else
+            field += c;
+    }
+    if (field || row.length) {
+        row.push(field);
+        rows.push(row);
+    }
+    return rows.filter((r) => r.some((cell) => cell.trim()));
+}
+// Header names used by Chrome, Edge, Safari/Apple Passwords, Firefox,
+// 1Password, Bitwarden, LastPass, Dashlane, Proton Pass, NordPass, RoboForm.
+// Earlier names win, so a "username" column beats an "email" column.
+const COLUMNS = {
+    url: ["url", "login_uri", "website", "web site", "uri", "login url"],
+    username: ["username", "login_username", "user name", "login", "user", "login name", "email", "e-mail"],
+    password: ["password", "login_password", "pwd", "pass"],
+    name: ["name", "title", "account"],
+    type: ["type"],
+};
+/** Logins from a password manager's CSV export. Notes, TOTP seeds and custom
+ * fields are dropped: they can hold secrets and hints are not secret. Rows
+ * without a website, username and password, or that are not logins, are
+ * counted in `skipped`. Imported items are private to the person (no bots). */
+export function vaultLoginsFromCsv(text) {
+    const [header, ...rows] = parseCsv(text);
+    if (!header)
+        return { logins: [], skipped: 0 };
+    const names = header.map((cell) => cell.trim().toLowerCase());
+    const col = (key) => {
+        for (const name of COLUMNS[key]) {
+            const index = names.indexOf(name);
+            if (index >= 0)
+                return index;
+        }
+        return -1;
+    };
+    const at = { url: col("url"), username: col("username"), password: col("password"), name: col("name"), type: col("type") };
+    if (at.url < 0 || at.password < 0 || at.username < 0)
+        throw new VaultCsvError("This CSV has no website, username and password columns.");
+    const logins = [];
+    let skipped = 0;
+    for (const row of rows) {
+        const cell = (index) => (index >= 0 ? row[index] ?? "" : "").trim();
+        const type = cell(at.type).toLowerCase();
+        const raw = cell(at.url).split(/[\s,]+/)[0] ?? "";
+        // Old entries saved as http:// or a bare domain are filled over HTTPS.
+        const website = vaultOrigin(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) ? raw.replace(/^http:\/\//i, "https://") : `https://${raw}`);
+        const username = cell(at.username);
+        const password = row[at.password] ?? "";
+        if ((type && type !== "login") || !raw || !website || !username || !password || username.length > 320 || password.length > 4096) {
+            skipped++;
+            continue;
+        }
+        const label = (cell(at.name) || new URL(website).hostname).slice(0, 200);
+        logins.push({ kind: "login", label, hints: "", botIds: [], expiresAt: null, website, username, password });
+    }
+    return { logins, skipped };
+}

package/dist-server/vps-container-mcp.js

@@ -17055,6 +17055,7 @@ var appConfigSchema = external_exports.object({
   icm: external_exports.object({
     enabled: external_exports.boolean().optional(),
     aboutMePrefilled: external_exports.boolean().optional(),
+    // no longer read (About me syncs with PAW); kept so older configs parse
     path: external_exports.string().trim().max(4096).refine(
       (value) => !["\r", "\n", "\0"].some((character) => value.includes(character)),
       "Use a folder path without control characters"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chibitek/chibi",
-  "version": "0.1.174",
+  "version": "0.1.175",
   "description": "Atomic by Chibitek: run your AI team's server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",

package/dist/assets/channel-TratrwmM.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-BPlfZpqv.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};