@elizaos/autonomous 2.0.0-alpha.37

package/dist/packages/autonomous/src/services/signal-pairing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signal-pairing.d.ts","sourceRoot":"","sources":["../../../../../src/services/signal-pairing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,oDAAoD;AACpD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN,cAAc,GACd,gBAAgB,GAChB,WAAW,GACX,cAAc,GACd,SAAS,GACT,OAAO,CAAC;AAEZ,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,GAAG,eAAe,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC9C;AASD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,EAAE,oBAAoB;IAInC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA0F5B,IAAI,IAAI,IAAI;IAIZ,SAAS,IAAI,mBAAmB;IAIhC,OAAO,CAAC,SAAS;CAQlB;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,SAAS,SAAY,GACpB,OAAO,CAGT;AAED,wBAAgB,YAAY,CAC1B,YAAY,EAAE,MAAM,EACpB,SAAS,SAAY,GACpB,IAAI,CAGN"}

package/dist/packages/autonomous/src/services/signal-pairing.js

@@ -0,0 +1,124 @@
+/**
+ * Signal pairing service — manages device linking via QR code.
+ *
+ * Mirrors whatsapp-pairing.ts but uses @elizaos/signal-native instead of
+ * Baileys. Signal linking produces a single provisioning URL (not a refresh
+ * loop) — if it times out, restart the session.
+ */
+import fs from "node:fs";
+import path from "node:path";
+const LOG_PREFIX = "[signal-pairing]";
+const SIGNAL_NATIVE_MODULE_ID = "@elizaos/signal-native";
+/** Validate accountId to prevent path traversal. */
+export function sanitizeAccountId(raw) {
+    const cleaned = raw.replace(/[^a-zA-Z0-9_-]/g, "");
+    if (!cleaned || cleaned !== raw) {
+        throw new Error(`Invalid accountId: must only contain alphanumeric characters, dashes, and underscores`);
+    }
+    return cleaned;
+}
+export class SignalPairingSession {
+    status = "idle";
+    options;
+    aborted = false;
+    constructor(options) {
+        this.options = options;
+    }
+    async start() {
+        this.aborted = false;
+        this.setStatus("initializing");
+        let native;
+        let qrCode;
+        try {
+            native = await import(/* @vite-ignore */ SIGNAL_NATIVE_MODULE_ID);
+            const importedQrCode = await import("qrcode");
+            qrCode = (importedQrCode.default ?? importedQrCode);
+        }
+        catch (err) {
+            this.setStatus("error");
+            this.options.onEvent({
+                type: "signal-status",
+                accountId: this.options.accountId,
+                status: "error",
+                error: `Failed to load dependencies: ${err instanceof Error ? err.message : String(err)}`,
+            });
+            return;
+        }
+        fs.mkdirSync(this.options.authDir, { recursive: true });
+        try {
+            console.info(`${LOG_PREFIX} Starting device linking...`);
+            const provisioningUrl = await native.linkDevice(this.options.authDir, "Milady AI");
+            if (this.aborted)
+                return;
+            const qrDataUrl = await qrCode.toDataURL(provisioningUrl, {
+                width: 256,
+                margin: 2,
+                color: { dark: "#000000", light: "#ffffff" },
+            });
+            this.setStatus("waiting_for_qr");
+            this.options.onEvent({
+                type: "signal-qr",
+                accountId: this.options.accountId,
+                qrDataUrl,
+            });
+            console.info(`${LOG_PREFIX} QR code generated, waiting for user to scan...`);
+            await native.finishLink(this.options.authDir);
+            if (this.aborted)
+                return;
+            let uuid = "";
+            let phoneNumber = "";
+            try {
+                const profile = await native.getProfile(this.options.authDir);
+                uuid = profile.uuid;
+                phoneNumber = profile.phoneNumber ?? "";
+            }
+            catch {
+                // Profile fetch is non-critical.
+            }
+            this.setStatus("connected");
+            this.options.onEvent({
+                type: "signal-status",
+                accountId: this.options.accountId,
+                status: "connected",
+                uuid,
+                phoneNumber,
+            });
+            console.info(`${LOG_PREFIX} Device linked successfully${phoneNumber ? ` (${phoneNumber})` : ""}`);
+        }
+        catch (err) {
+            if (this.aborted)
+                return;
+            const errMsg = err instanceof Error ? err.message : String(err);
+            console.error(`${LOG_PREFIX} Linking failed:`, errMsg);
+            this.setStatus("error");
+            this.options.onEvent({
+                type: "signal-status",
+                accountId: this.options.accountId,
+                status: "error",
+                error: errMsg,
+            });
+        }
+    }
+    stop() {
+        this.aborted = true;
+    }
+    getStatus() {
+        return this.status;
+    }
+    setStatus(status) {
+        this.status = status;
+        this.options.onEvent({
+            type: "signal-status",
+            accountId: this.options.accountId,
+            status,
+        });
+    }
+}
+export function signalAuthExists(workspaceDir, accountId = "default") {
+    const authDir = path.join(workspaceDir, "signal-auth", accountId);
+    return fs.existsSync(authDir);
+}
+export function signalLogout(workspaceDir, accountId = "default") {
+    const authDir = path.join(workspaceDir, "signal-auth", accountId);
+    fs.rmSync(authDir, { recursive: true, force: true });
+}

package/dist/packages/autonomous/src/services/signing-policy.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Transaction signing policy engine.
+ * Evaluates requests against chain/contract/value/rate/method/replay rules.
+ */
+export interface SigningPolicy {
+    allowedChainIds: number[];
+    allowedContracts: string[];
+    deniedContracts: string[];
+    maxTransactionValueWei: string;
+    maxTransactionsPerHour: number;
+    maxTransactionsPerDay: number;
+    allowedMethodSelectors: string[];
+    humanConfirmationThresholdWei: string;
+    requireHumanConfirmation: boolean;
+}
+export interface SigningRequest {
+    requestId: string;
+    chainId: number;
+    to: string;
+    value: string;
+    data: string;
+    nonce?: number;
+    gasLimit?: string;
+    createdAt: number;
+}
+export type PolicyDecision = {
+    allowed: boolean;
+    reason: string;
+    requiresHumanConfirmation: boolean;
+    matchedRule: string;
+};
+export declare function createDefaultPolicy(): SigningPolicy;
+export declare class SigningPolicyEvaluator {
+    private policy;
+    private requestLog;
+    private processedRequestIds;
+    constructor(policy?: SigningPolicy);
+    updatePolicy(policy: SigningPolicy): void;
+    getPolicy(): SigningPolicy;
+    evaluate(request: SigningRequest): PolicyDecision;
+    /** Record after signing completes (for replay + rate tracking). */
+    recordRequest(requestId: string): void;
+}
+//# sourceMappingURL=signing-policy.d.ts.map

package/dist/packages/autonomous/src/services/signing-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-policy.d.ts","sourceRoot":"","sources":["../../../../../src/services/signing-policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,6BAA6B,EAAE,MAAM,CAAC;IACtC,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB,EAAE,OAAO,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAgB,mBAAmB,IAAI,aAAa,CAYnD;AAED,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAAuD;IACzE,OAAO,CAAC,mBAAmB,CAAqB;gBAEpC,MAAM,CAAC,EAAE,aAAa;IAIlC,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAIzC,SAAS,IAAI,aAAa;IAI1B,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc;IAsJjD,mEAAmE;IACnE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;CAYvC"}

package/dist/packages/autonomous/src/services/signing-policy.js

@@ -0,0 +1,165 @@
+/**
+ * Transaction signing policy engine.
+ * Evaluates requests against chain/contract/value/rate/method/replay rules.
+ */
+export function createDefaultPolicy() {
+    return {
+        allowedChainIds: [],
+        allowedContracts: [],
+        deniedContracts: [],
+        maxTransactionValueWei: "100000000000000000", // 0.1 ETH
+        maxTransactionsPerHour: 10,
+        maxTransactionsPerDay: 50,
+        allowedMethodSelectors: [],
+        humanConfirmationThresholdWei: "10000000000000000", // 0.01 ETH
+        requireHumanConfirmation: false,
+    };
+}
+export class SigningPolicyEvaluator {
+    policy;
+    requestLog = [];
+    processedRequestIds = new Set();
+    constructor(policy) {
+        this.policy = policy ?? createDefaultPolicy();
+    }
+    updatePolicy(policy) {
+        this.policy = policy;
+    }
+    getPolicy() {
+        return { ...this.policy };
+    }
+    evaluate(request) {
+        // ── Replay protection ────────────────────────────────────────────
+        if (this.processedRequestIds.has(request.requestId)) {
+            return {
+                allowed: false,
+                reason: `Replay detected: request ${request.requestId} already processed`,
+                requiresHumanConfirmation: false,
+                matchedRule: "replay_protection",
+            };
+        }
+        // ── Chain ID ─────────────────────────────────────────────────────
+        if (this.policy.allowedChainIds.length > 0 &&
+            !this.policy.allowedChainIds.includes(request.chainId)) {
+            return {
+                allowed: false,
+                reason: `Chain ${request.chainId} not in allowlist`,
+                requiresHumanConfirmation: false,
+                matchedRule: "chain_id_allowlist",
+            };
+        }
+        // ── Contract denylist ────────────────────────────────────────────
+        const normalizedTo = request.to.toLowerCase();
+        if (this.policy.deniedContracts.some((c) => c.toLowerCase() === normalizedTo)) {
+            return {
+                allowed: false,
+                reason: `Contract ${request.to} is denylisted`,
+                requiresHumanConfirmation: false,
+                matchedRule: "contract_denylist",
+            };
+        }
+        // ── Contract allowlist ───────────────────────────────────────────
+        if (this.policy.allowedContracts.length > 0 &&
+            !this.policy.allowedContracts.some((c) => c.toLowerCase() === normalizedTo)) {
+            return {
+                allowed: false,
+                reason: `Contract ${request.to} not in allowlist`,
+                requiresHumanConfirmation: false,
+                matchedRule: "contract_allowlist",
+            };
+        }
+        // ── Value cap ────────────────────────────────────────────────────
+        try {
+            const txValue = BigInt(request.value || "0");
+            const maxValue = BigInt(this.policy.maxTransactionValueWei);
+            if (txValue > maxValue) {
+                return {
+                    allowed: false,
+                    reason: `Value ${request.value} exceeds max ${this.policy.maxTransactionValueWei}`,
+                    requiresHumanConfirmation: false,
+                    matchedRule: "value_cap",
+                };
+            }
+        }
+        catch {
+            return {
+                allowed: false,
+                reason: "Invalid transaction value format",
+                requiresHumanConfirmation: false,
+                matchedRule: "value_parse_error",
+            };
+        }
+        // ── Method selector ──────────────────────────────────────────────
+        if (this.policy.allowedMethodSelectors.length > 0 &&
+            request.data &&
+            request.data.length >= 10) {
+            const selector = request.data.substring(0, 10).toLowerCase();
+            if (!this.policy.allowedMethodSelectors.some((s) => s.toLowerCase() === selector)) {
+                return {
+                    allowed: false,
+                    reason: `Method selector ${selector} not in allowlist`,
+                    requiresHumanConfirmation: false,
+                    matchedRule: "method_selector_allowlist",
+                };
+            }
+        }
+        // ── Rate limiting ────────────────────────────────────────────────
+        const now = Date.now();
+        const oneHourAgo = now - 60 * 60 * 1000;
+        const oneDayAgo = now - 24 * 60 * 60 * 1000;
+        // Prune old entries
+        this.requestLog = this.requestLog.filter((r) => r.timestamp > oneDayAgo);
+        const hourCount = this.requestLog.filter((r) => r.timestamp > oneHourAgo).length;
+        if (hourCount >= this.policy.maxTransactionsPerHour) {
+            return {
+                allowed: false,
+                reason: `Rate limit: ${hourCount}/${this.policy.maxTransactionsPerHour} per hour`,
+                requiresHumanConfirmation: false,
+                matchedRule: "rate_limit_hourly",
+            };
+        }
+        const dayCount = this.requestLog.filter((r) => r.timestamp > oneDayAgo).length;
+        if (dayCount >= this.policy.maxTransactionsPerDay) {
+            return {
+                allowed: false,
+                reason: `Rate limit: ${dayCount}/${this.policy.maxTransactionsPerDay} per day`,
+                requiresHumanConfirmation: false,
+                matchedRule: "rate_limit_daily",
+            };
+        }
+        // ── Human confirmation ───────────────────────────────────────────
+        let needsHumanConfirmation = this.policy.requireHumanConfirmation;
+        if (!needsHumanConfirmation) {
+            try {
+                const txValue = BigInt(request.value || "0");
+                const threshold = BigInt(this.policy.humanConfirmationThresholdWei);
+                if (txValue > threshold) {
+                    needsHumanConfirmation = true;
+                }
+            }
+            catch {
+                // If value parsing fails for confirmation check, require confirmation
+                needsHumanConfirmation = true;
+            }
+        }
+        // ── Allowed ──────────────────────────────────────────────────────
+        return {
+            allowed: true,
+            reason: "All policy checks passed",
+            requiresHumanConfirmation: needsHumanConfirmation,
+            matchedRule: "allowed",
+        };
+    }
+    /** Record after signing completes (for replay + rate tracking). */
+    recordRequest(requestId) {
+        this.processedRequestIds.add(requestId);
+        this.requestLog.push({ requestId, timestamp: Date.now() });
+        // Bound replay cache
+        if (this.processedRequestIds.size > 10000) {
+            const oldest = [...this.processedRequestIds].slice(0, 5000);
+            for (const id of oldest) {
+                this.processedRequestIds.delete(id);
+            }
+        }
+    }
+}

package/dist/packages/autonomous/src/services/skill-catalog-client.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Skill Catalog Client for Milady.
+ *
+ * Provides a cached skill catalog (memory -> file) sourced from the
+ * local skills/.cache/catalog.json. Supports search and browse.
+ *
+ * @module services/skill-catalog-client
+ */
+export interface CatalogSkillStats {
+    comments: number;
+    downloads: number;
+    installsAllTime: number;
+    installsCurrent: number;
+    stars: number;
+    versions: number;
+}
+export interface CatalogSkillVersion {
+    version: string;
+    createdAt: number;
+    changelog: string;
+}
+export interface CatalogSkill {
+    slug: string;
+    displayName: string;
+    summary: string | null;
+    tags: Record<string, string>;
+    stats: CatalogSkillStats;
+    createdAt: number;
+    updatedAt: number;
+    latestVersion: CatalogSkillVersion | null;
+}
+export interface CatalogSearchResult {
+    slug: string;
+    displayName: string;
+    summary: string | null;
+    score: number;
+    latestVersion: string | null;
+    downloads: number;
+    stars: number;
+    installs: number;
+}
+export declare function getCatalogSkills(): Promise<CatalogSkill[]>;
+export declare function refreshCatalog(): Promise<CatalogSkill[]>;
+export declare function getCatalogSkill(slug: string): Promise<CatalogSkill | null>;
+export declare function searchCatalogSkills(query: string, limit?: number): Promise<CatalogSearchResult[]>;
+export declare function getTrendingSkills(limit?: number): Promise<CatalogSkill[]>;
+//# sourceMappingURL=skill-catalog-client.d.ts.map

package/dist/packages/autonomous/src/services/skill-catalog-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-catalog-client.d.ts","sourceRoot":"","sources":["../../../../../src/services/skill-catalog-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoDD,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAahE;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAG9D;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAG9B;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,KAAK,SAAK,GACT,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAqDhC;AAED,wBAAsB,iBAAiB,CAAC,KAAK,SAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAQ3E"}

package/dist/packages/autonomous/src/services/skill-catalog-client.js

@@ -0,0 +1,130 @@
+/**
+ * Skill Catalog Client for Milady.
+ *
+ * Provides a cached skill catalog (memory -> file) sourced from the
+ * local skills/.cache/catalog.json. Supports search and browse.
+ *
+ * @module services/skill-catalog-client
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { logger } from "@elizaos/core";
+let memoryCache = null;
+const MEMORY_TTL_MS = 600_000;
+function findCatalogPaths() {
+    const paths = [];
+    const envPath = process.env.MILADY_SKILLS_CATALOG?.trim();
+    if (envPath)
+        return [envPath];
+    let dir = import.meta.dirname ?? path.dirname(fileURLToPath(import.meta.url));
+    for (let i = 0; i < 5; i++) {
+        paths.push(path.join(dir, "skills", ".cache", "catalog.json"));
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+    if (home) {
+        paths.push(path.join(home, ".milady", "skills", "catalog.json"));
+    }
+    return paths;
+}
+async function readCatalogFile() {
+    for (const catalogPath of findCatalogPaths()) {
+        try {
+            const raw = await fs.readFile(catalogPath, "utf-8");
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed.data) && parsed.data.length > 0) {
+                logger.debug(`[skill-catalog] Loaded ${parsed.data.length} skills from ${catalogPath}`);
+                return parsed.data;
+            }
+        }
+        catch {
+            // Try next path.
+        }
+    }
+    return null;
+}
+export async function getCatalogSkills() {
+    if (memoryCache && Date.now() - memoryCache.loadedAt < MEMORY_TTL_MS) {
+        return memoryCache.skills;
+    }
+    const skills = await readCatalogFile();
+    if (!skills) {
+        logger.warn("[skill-catalog] No catalog file found");
+        return [];
+    }
+    memoryCache = { skills, loadedAt: Date.now() };
+    return skills;
+}
+export async function refreshCatalog() {
+    memoryCache = null;
+    return getCatalogSkills();
+}
+export async function getCatalogSkill(slug) {
+    const skills = await getCatalogSkills();
+    return skills.find((s) => s.slug === slug) ?? null;
+}
+export async function searchCatalogSkills(query, limit = 30) {
+    const skills = await getCatalogSkills();
+    const lq = query.toLowerCase();
+    const terms = lq.split(/\s+/).filter((t) => t.length > 1);
+    const scored = [];
+    for (const skill of skills) {
+        const slug = skill.slug.toLowerCase();
+        const name = (skill.displayName ?? "").toLowerCase();
+        const summary = (skill.summary ?? "").toLowerCase();
+        let score = 0;
+        if (slug === lq || name === lq)
+            score += 100;
+        else if (slug.includes(lq))
+            score += 50;
+        else if (name.includes(lq))
+            score += 45;
+        if (summary.includes(lq))
+            score += 30;
+        for (const tag of Object.keys(skill.tags)) {
+            if (tag.toLowerCase().includes(lq))
+                score += 20;
+        }
+        for (const term of terms) {
+            if (slug.includes(term))
+                score += 15;
+            if (name.includes(term))
+                score += 12;
+            if (summary.includes(term))
+                score += 8;
+        }
+        if (score > 0) {
+            if (skill.stats.downloads > 50)
+                score += 3;
+            if (skill.stats.downloads > 200)
+                score += 3;
+            if (skill.stats.stars > 0)
+                score += 2;
+            if (skill.stats.installsCurrent > 0)
+                score += 2;
+            scored.push({ s: skill, score });
+        }
+    }
+    scored.sort((a, b) => b.score - a.score || b.s.stats.downloads - a.s.stats.downloads);
+    const max = scored[0]?.score || 1;
+    return scored.slice(0, limit).map(({ s, score }) => ({
+        slug: s.slug,
+        displayName: s.displayName,
+        summary: s.summary,
+        score: score / max,
+        latestVersion: s.latestVersion?.version ?? null,
+        downloads: s.stats.downloads,
+        stars: s.stats.stars,
+        installs: s.stats.installsAllTime,
+    }));
+}
+export async function getTrendingSkills(limit = 30) {
+    const skills = await getCatalogSkills();
+    return [...skills]
+        .sort((a, b) => b.stats.downloads - a.stats.downloads || b.updatedAt - a.updatedAt)
+        .slice(0, limit);
+}

package/dist/packages/autonomous/src/services/skill-marketplace.d.ts

@@ -0,0 +1,42 @@
+export interface SkillsMarketplaceSearchItem {
+    id: string;
+    slug?: string;
+    name: string;
+    description: string;
+    repository?: string;
+    githubUrl?: string;
+    path: string | null;
+    tags: string[];
+    score: number | null;
+    source: "clawhub" | "skillsmp";
+}
+export interface InstalledMarketplaceSkill {
+    id: string;
+    name: string;
+    description: string;
+    repository: string;
+    githubUrl: string;
+    path: string;
+    installPath: string;
+    installedAt: string;
+    source: "clawhub" | "skillsmp" | "manual";
+    /** Security scan status, set after installation scan */
+    scanStatus?: "clean" | "warning" | "critical" | "blocked";
+}
+export interface InstallSkillInput {
+    slug?: string;
+    githubUrl?: string;
+    repository?: string;
+    path?: string;
+    name?: string;
+    description?: string;
+    source?: "clawhub" | "skillsmp" | "manual";
+}
+export declare function searchSkillsMarketplace(query: string, opts?: {
+    limit?: number;
+    aiSearch?: boolean;
+}): Promise<SkillsMarketplaceSearchItem[]>;
+export declare function installMarketplaceSkill(workspaceDir: string, input: InstallSkillInput): Promise<InstalledMarketplaceSkill>;
+export declare function listInstalledMarketplaceSkills(workspaceDir: string): Promise<InstalledMarketplaceSkill[]>;
+export declare function uninstallMarketplaceSkill(workspaceDir: string, skillId: string): Promise<InstalledMarketplaceSkill>;
+//# sourceMappingURL=skill-marketplace.d.ts.map

package/dist/packages/autonomous/src/services/skill-marketplace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-marketplace.d.ts","sourceRoot":"","sources":["../../../../../src/services/skill-marketplace.ts"],"names":[],"mappings":"AAyKA,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;CAC3D;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;CAC5C;AA0SD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5C,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAiIxC;AAmID,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAsGpC;AAED,wBAAsB,8BAA8B,CAClD,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAKtC;AAED,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,yBAAyB,CAAC,CAwBpC"}