@exulu/backend 2.0.1 → 2.2.0

package/dist/index.js

@@ -7,6 +7,9 @@ import {
   validatePythonEnvironment
 } from "./chunk-T6JVFT7L.js";
 import {
+  COMPACTION_INSUFFICIENT,
+  ContextCompactionRequiredError,
+  DEFAULT_CONTEXT_WINDOW,
   ExuluTool,
   LITELLM_UI_PATH,
   LiteLLMAdminError,
@@ -18,16 +21,19 @@ import {
   buildTags,
   checkLicense,
   checkRecordAccess,
+  contextOccupancy,
   convertExuluToolsToAiSdkTools,
   copyS3Object,
   createAgenticRetrievalTool,
-  createProjectItemsRetrievalTool,
   createTaggedFetch,
   createUppyRoutes,
   decryptOauthState,
   deleteS3Object,
+  deriveContextBudget,
   downloadKeyIntoSandbox,
   enableLiteLLMClientMode,
+  estimateMessageTokens,
+  estimateTokens,
   exchangeCodeForTokens,
   exuluApp,
   getBudgetSettings,
@@ -40,12 +46,15 @@ import {
   getTagDailyActivity,
   getToken,
   getUserBudgetView,
+  guardExtractedFileText,
   invalidateBudgetCaches,
   isLiteLLMEnabled,
   listS3ObjectsByPrefix,
   listTagsByPrefix,
+  mapStreamErrorMessage,
   oauthRegistry,
   oauthTokenStore,
+  parseResetAt,
   postgresClient,
   provisionDefaultUserBudget,
   reportSystemDependencies,
@@ -55,15 +64,17 @@ import {
   sanitizeToolName,
   setBudgetSettings,
   setLiteLLMPackageRoot,
+  sliceHistoryAtCheckpoint,
   startLiteLLMSupervisor,
   tagDelete,
   tagInfo,
+  truncateToolOutput,
   updateStatistic,
   uploadFile,
   upsertBudget,
   waitForLiteLLMReady,
   withRetry
-} from "./chunk-IJ4HNHOT.js";
+} from "./chunk-Y7JPNBFM.js";
 import {
   findLiteLLMModel
 } from "./chunk-7CCMW3IW.js";
@@ -2213,6 +2224,13 @@ var agentsSchema = {
       name: "sandbox_enabled",
       type: "boolean",
       default: false
+    },
+    {
+      // Per-turn budget for ALL tool steps on one chat message (bash, files,
+      // knowledge search, integrations). 0/null = platform default
+      // (DEFAULT_MAX_STEPS in resolve-max-steps.ts). Auto-ALTERed on boot.
+      name: "max_tool_steps",
+      type: "number"
     }
   ]
 };
@@ -4252,7 +4270,7 @@ var ExuluContext2 = class {
     embedder,
     chunker,
     processor,
-    active,
+    active: active2,
     fields,
     queryRewriter,
     resultReranker,
@@ -4283,7 +4301,7 @@ var ExuluContext2 = class {
     this.description = description;
     this.embedder = embedder;
     this.chunker = chunker;
-    this.active = active;
+    this.active = active2;
     this.queryRewriter = queryRewriter;
     this.resultReranker = resultReranker;
     this.entities = entities;
@@ -5398,14 +5416,26 @@ var addProviderFields = async (args, requestedFields, providers, result, tools,
         )
       );
       if (args.project) {
-        const projectTool = await createProjectItemsRetrievalTool({
-          projectId: args.project,
-          user,
-          role: user.role?.id,
-          contexts
-        });
-        if (projectTool) {
-          result.tools.unshift(projectTool);
+        const hasAgentic = result.tools.some(
+          (tool2) => tool2?.id === "agentic_context_search"
+        );
+        if (!hasAgentic) {
+          const instance = createAgenticRetrievalTool({
+            contexts: [],
+            user,
+            role: user.role?.id,
+            model: void 0
+          });
+          if (instance) {
+            result.tools.unshift({
+              id: instance.id,
+              name: instance.name,
+              description: instance.description,
+              category: instance.category,
+              type: instance.type,
+              config: []
+            });
+          }
         }
       }
       result.tools = result.tools.filter((tool2) => tool2 !== null);
@@ -11105,21 +11135,7 @@ function isOsJunkPath(path2) {
   const basename = path2.split("/").pop() ?? "";
   return basename === ".DS_Store" || basename === "Thumbs.db" || basename === "desktop.ini";
 }
-async function extractBundleToS3(opts) {
-  const { bytes, skillId, isZip, config } = opts;
-  if (!isZip) {
-    await uploadFile(
-      bytes,
-      `skills/${skillId}/v1/SKILL.md`,
-      config,
-      { contentType: "text/markdown" },
-      void 0,
-      void 0,
-      true
-      // global=true so the key isn't user-prefixed (skill files are shared)
-    );
-    return { filesCount: 1 };
-  }
+async function extractZipToPrefix(bytes, prefix, config) {
   let zip;
   try {
     zip = await JSZip.loadAsync(bytes);
@@ -11183,7 +11199,7 @@ async function extractBundleToS3(opts) {
   }
   let filesCount = 0;
   for (const { relPath, content } of prepared) {
-    const s3Key = `skills/${skillId}/v1/${relPath}`;
+    const s3Key = `${prefix}${relPath}`;
     await uploadFile(
       content,
       s3Key,
@@ -11192,12 +11208,76 @@ async function extractBundleToS3(opts) {
       void 0,
       void 0,
       true
-      // global=true — see SKILL.md case above
+      // global=true — skill files are shared across users
     );
     filesCount += 1;
   }
   return { filesCount };
 }
+async function extractBundleToS3(opts) {
+  const { bytes, skillId, isZip, config } = opts;
+  if (!isZip) {
+    await uploadFile(
+      bytes,
+      `skills/${skillId}/v1/SKILL.md`,
+      config,
+      { contentType: "text/markdown" },
+      void 0,
+      void 0,
+      true
+      // global=true so the key isn't user-prefixed (skill files are shared)
+    );
+    return { filesCount: 1 };
+  }
+  return extractZipToPrefix(bytes, `skills/${skillId}/v1/`, config);
+}
+async function extractBundleToVersion(opts) {
+  const { bytes, skillId, version, config } = opts;
+  return extractZipToPrefix(bytes, `skills/${skillId}/v${version}/`, config);
+}
+
+// src/skills/frontmatter.ts
+import JSZip2 from "jszip";
+function parseFrontmatter(md) {
+  const match = /^?---\r?\n([\s\S]*?)\r?\n---/.exec(md);
+  if (!match) return {};
+  const block = match[1];
+  const out = {};
+  for (const line of block.split(/\r?\n/)) {
+    const m = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(line);
+    if (!m) continue;
+    const key = m[1];
+    let v = m[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'")) {
+      v = v.slice(1, -1);
+    }
+    out[key] = v;
+  }
+  return out;
+}
+async function parseSkillFrontmatter(zipBytes) {
+  let zip;
+  try {
+    zip = await JSZip2.loadAsync(zipBytes);
+  } catch {
+    return {};
+  }
+  const paths = [];
+  zip.forEach((p, entry) => {
+    if (!entry.dir) paths.push(p);
+  });
+  const heads = new Set(paths.map((p) => p.split("/")[0]).filter(Boolean));
+  let strip = (p) => p;
+  if (heads.size === 1) {
+    const head = [...heads][0] + "/";
+    if (paths.every((p) => p.startsWith(head))) strip = (p) => p.slice(head.length);
+  }
+  const skillPath = paths.find((p) => strip(p) === "SKILL.md");
+  if (!skillPath) return {};
+  const md = await zip.file(skillPath).async("string");
+  const fm = parseFrontmatter(md);
+  return { name: fm.name, description: fm.description };
+}
 
 // src/sessions/pdf-preview-cache.ts
 import { exec } from "child_process";
@@ -11275,14 +11355,15 @@ import bodyParser from "body-parser";
 import CryptoJS4 from "crypto-js";
 import OpenAI from "openai";
 import fs2 from "fs";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 import "@opentelemetry/api";
-import JSZip2 from "jszip";
+import JSZip3 from "jszip";
 import { createIdGenerator } from "ai";
 import cookieParser from "cookie-parser";
 
 // src/exulu/resolve-max-steps.ts
-function resolveMaxStepsFromToolConfigs(toolConfigs) {
+var DEFAULT_MAX_STEPS = 10;
+function resolveRetrievalCallBudget(toolConfigs) {
   const agentic = toolConfigs?.find((t) => t.id === "agentic_context_search");
   if (!agentic?.config) return void 0;
   const entry = agentic.config.find((c) => c.name === "max_steps");
@@ -11291,15 +11372,26 @@ function resolveMaxStepsFromToolConfigs(toolConfigs) {
   const n = typeof raw === "number" ? raw : parseInt(String(raw ?? ""), 10);
   return Number.isFinite(n) && n > 0 ? Math.floor(n) : void 0;
 }
+function resolveTurnStepBudget(maxStepCount, agent) {
+  if (typeof maxStepCount === "number" && Number.isFinite(maxStepCount) && maxStepCount > 0) {
+    return Math.floor(maxStepCount);
+  }
+  const raw = agent?.max_tool_steps;
+  const n = typeof raw === "number" ? raw : parseInt(String(raw ?? ""), 10);
+  if (Number.isFinite(n) && n > 0) {
+    return Math.floor(n);
+  }
+  return DEFAULT_MAX_STEPS;
+}
 function flattenPart(part) {
   const p = part;
   if (p?.type === "text") return p.text ?? "";
   if (p?.type === "tool-call") {
-    return `[searched ${p.toolName}: ${JSON.stringify(p.input ?? {}).slice(0, 300)}]`;
+    return `Earlier, the assistant ran the "${p.toolName}" tool with input: ${JSON.stringify(p.input ?? {}).slice(0, 300)}`;
   }
   if (p?.type === "tool-result") {
     const out = p.output?.value ?? p.output;
-    return `[results from ${p.toolName}]: ${typeof out === "string" ? out : JSON.stringify(out ?? "")}`;
+    return `The "${p.toolName}" tool returned: ${typeof out === "string" ? out : JSON.stringify(out ?? "")}`;
   }
   return "";
 }
@@ -11317,7 +11409,7 @@ function flattenToolHistory(messages) {
     return m;
   });
 }
-var FINAL_ANSWER_INSTRUCTION = "Answer the user's original question now, in plain text, using only the material already retrieved above. Do not attempt any further tool calls.";
+var FINAL_ANSWER_INSTRUCTION = `This is your last step for this turn. Answer the user's original question now, in plain text, using only the information gathered above. If you could not finish the task, tell the user you reached the maximum number of tool steps, summarize what you found and did so far, and say what remains \u2014 they can ask you to continue. Do not attempt any further tool calls. Write your answer as normal prose for the user: do not output tool-call syntax, JSON commands, or bracketed lines such as "[called tool ...]" \u2014 describe anything you did or still plan to do in plain language.`;
 function finalAnswerGuard(maxSteps) {
   return ({ stepNumber, messages }) => stepNumber >= maxSteps - 1 ? {
     toolChoice: "none",
@@ -11330,6 +11422,68 @@ function finalAnswerGuard(maxSteps) {
     } : {}
   } : void 0;
 }
+function retrievalBudgetGuard(limit, agenticToolKey, allToolKeys) {
+  if (limit == null || limit <= 0 || !agenticToolKey || !allToolKeys.includes(agenticToolKey)) {
+    return () => void 0;
+  }
+  const remainingTools = allToolKeys.filter((k) => k !== agenticToolKey);
+  return ({ steps }) => {
+    const calls = (steps ?? []).flatMap((s) => s?.toolCalls ?? []).filter((c) => c?.toolName === agenticToolKey).length;
+    if (calls < limit) return void 0;
+    return { activeTools: remainingTools };
+  };
+}
+
+// src/exulu/context-guard.ts
+var KEEP_RECENT_TOOL_MESSAGES = 2;
+var COLLAPSE_KEEP_CHARS = 400;
+var COLLAPSE_MARKER = " \u2026[older tool output collapsed mid-response to fit the context window \u2014 the full output is in the session file named in the notice above, if one was saved]";
+function contextGuard(contextWindow) {
+  const budget = deriveContextBudget(contextWindow);
+  return async ({ messages }) => {
+    if (!Array.isArray(messages) || messages.length === 0) return void 0;
+    const tokens = estimateTokens(JSON.stringify(messages));
+    if (tokens < budget.usableWindow) return void 0;
+    const toolIndices = messages.map((m, i) => m?.role === "tool" ? i : -1).filter((i) => i !== -1);
+    const collapsible = new Set(toolIndices.slice(0, Math.max(0, toolIndices.length - KEEP_RECENT_TOOL_MESSAGES)));
+    if (collapsible.size === 0) return void 0;
+    let changed = false;
+    const next = messages.map((m, i) => {
+      if (!collapsible.has(i)) return m;
+      const msg = m;
+      if (!Array.isArray(msg.content)) return m;
+      const content = msg.content.map((part) => {
+        const p = part;
+        if (p?.type !== "tool-result") return part;
+        const out = p.output?.value ?? p.output;
+        const asText = typeof out === "string" ? out : JSON.stringify(out ?? "");
+        if (asText.length <= COLLAPSE_KEEP_CHARS + COLLAPSE_MARKER.length) return part;
+        changed = true;
+        return { ...part, output: { type: "text", value: asText.slice(0, COLLAPSE_KEEP_CHARS) + COLLAPSE_MARKER } };
+      });
+      return { ...m, content };
+    });
+    return changed ? { messages: next } : void 0;
+  };
+}
+function composePrepareSteps(...guards) {
+  return async (opts) => {
+    let merged;
+    let messages = opts.messages;
+    for (const guard of guards) {
+      const result = await guard({ ...opts, messages });
+      if (!result) continue;
+      merged = { ...merged ?? {}, ...result };
+      if (Array.isArray(result.messages)) {
+        messages = result.messages;
+      }
+    }
+    if (merged && messages && !("messages" in merged)) {
+      merged.messages = messages;
+    }
+    return merged;
+  };
+}
 
 // src/exulu/auto-decline-stale-approvals.ts
 var AUTO_DECLINE_REASON = "Automatically declined because the user sent a new message instead of responding to the approval request.";
@@ -11593,7 +11747,9 @@ var ExuluProvider = class {
     agent,
     instructions,
     maxStepCount,
-    onTokenUsage
+    onTokenUsage,
+    contextWindow,
+    disabledTools
   }) => {
     console.log(
       "[EXULU] Called generate sync for agent: " + this.name,
@@ -11621,9 +11777,7 @@ var ExuluProvider = class {
     if (messages && session && user) {
       const previousMessages = await getAgentMessages({
         session,
-        user: user.id,
-        limit: 50,
-        page: 1
+        user: user.id
       });
       const previousMessagesContent = previousMessages.map(
         (message) => JSON.parse(message.content)
@@ -11632,6 +11786,12 @@ var ExuluProvider = class {
         // append the new message to the previous messages:
         messages: [...previousMessagesContent, ...messages]
       });
+      const contextBudget = deriveContextBudget(contextWindow);
+      const occupancy = contextOccupancy(messages);
+      if (occupancy >= contextBudget.blockThreshold) {
+        throw new ContextCompactionRequiredError(occupancy, contextBudget);
+      }
+      messages = sliceHistoryAtCheckpoint(messages);
     }
     console.log(
       "[EXULU] Message count for agent: " + this.name,
@@ -11696,6 +11856,34 @@ var ExuluProvider = class {
     if (memoryContext) {
       system += "\n\n" + memoryContext;
     }
+    const tools = await convertExuluToolsToAiSdkTools(
+      currentTools,
+      currentSkills,
+      approvedTools,
+      allExuluTools,
+      toolConfigs,
+      providerapikey,
+      contexts,
+      user,
+      exuluConfig,
+      session,
+      req,
+      project,
+      sessionItems,
+      model,
+      agent,
+      memoryItems,
+      contextWindow,
+      disabledTools
+    );
+    const agenticEntry = currentTools?.find((t) => t.id === "agentic_context_search");
+    const agenticToolKey = agenticEntry ? sanitizeToolName(agenticEntry.name) : void 0;
+    const retrievalGuard = retrievalBudgetGuard(
+      resolveRetrievalCallBudget(toolConfigs),
+      agenticToolKey,
+      Object.keys(tools)
+    );
+    const turnBudget = resolveTurnStepBudget(maxStepCount, agent);
     const includesContextSearchTool = currentTools?.some(
       (tool2) => tool2.name.toLowerCase().includes("context_search") || tool2.id.includes("context_search") || tool2.type === "context"
     );
@@ -11708,12 +11896,12 @@ var ExuluProvider = class {
       system += `
 
 
-  
+
               When you use a context search tool, you will include references to the items
               retrieved from the tool call result inline in the response using this exact JSON format
               (all on one line, no line breaks):
               {item_name: <item_name>, item_id: <item_id>, context: <context_id>, chunk_id: <chunk_id>, chunk_index: <chunk_index>}
-  
+
               IMPORTANT formatting rules:
               - Do NOT reference just chunks like "Looking at chunk_index 5 and chunk_index 0 from the search result", always use the JSON format above.
               - Use the exact format shown above, all on ONE line
@@ -11721,9 +11909,9 @@ var ExuluProvider = class {
               - Use the context ID from the tool result
               - Include the file/item name, not the full path
               - Separate multiple citations with spaces
-  
+
               Example: {item_name: document.pdf, item_id: abc123, context: my-context-id, chunk_id: chunk_456, chunk_index: 0}
-  
+
               The citations will be rendered as interactive badges in the UI.
               `;
     }
@@ -11734,12 +11922,12 @@ var ExuluProvider = class {
               When you use a web search tool, you will include references to the results of the tool call result inline in the response using this exact JSON format
               (all on one line, no line breaks):
               {url: <url>, title: <title>, snippet: <snippet>}
-  
+
               IMPORTANT formatting rules:
               - Use the exact format shown above, all on ONE line
               - Do NOT use quotes around field names or values
               - Separate multiple results with spaces
-  
+
               Example: {url: https://www.google.com, title: Google, snippet: The result of the web search.}
               `;
     }
@@ -11772,29 +11960,12 @@ When a tool execution is not approved by the user, do not retry it unless explic
         system,
         prompt,
         maxRetries: 2,
-        tools: await convertExuluToolsToAiSdkTools(
-          currentTools,
-          currentSkills,
-          approvedTools,
-          allExuluTools,
-          toolConfigs,
-          providerapikey,
-          contexts,
-          user,
-          exuluConfig,
-          session,
-          req,
-          project,
-          sessionItems,
-          model,
-          agent,
-          memoryItems
-        ),
+        tools,
         // Stop after the image_generation tool fires — the widget IS the
         // assistant's response, no follow-up text turn is wanted (same
         // reasoning as question_ask: the UI artifact is the message).
-        prepareStep: finalAnswerGuard(maxStepCount ?? resolveMaxStepsFromToolConfigs(toolConfigs) ?? 5),
-        stopWhen: [stepCountIs(maxStepCount ?? resolveMaxStepsFromToolConfigs(toolConfigs) ?? 5), hasToolCall("image_generation")]
+        prepareStep: composePrepareSteps(contextGuard(contextWindow), retrievalGuard, finalAnswerGuard(turnBudget)),
+        stopWhen: [stepCountIs(turnBudget), hasToolCall("image_generation")]
       });
       console.log("[EXULU] Output: " + JSON.stringify(output, null, 2));
       const {
@@ -11855,26 +12026,9 @@ When a tool execution is not approved by the user, do not retry it unless explic
           ignoreIncompleteToolCalls: true
         }),
         maxRetries: 2,
-        tools: await convertExuluToolsToAiSdkTools(
-          currentTools,
-          currentSkills,
-          approvedTools,
-          allExuluTools,
-          toolConfigs,
-          providerapikey,
-          contexts,
-          user,
-          exuluConfig,
-          session,
-          req,
-          project,
-          sessionItems,
-          model,
-          agent,
-          memoryItems
-        ),
-        prepareStep: finalAnswerGuard(maxStepCount ?? resolveMaxStepsFromToolConfigs(toolConfigs) ?? 5),
-        stopWhen: [stepCountIs(maxStepCount ?? resolveMaxStepsFromToolConfigs(toolConfigs) ?? 5), hasToolCall("image_generation")]
+        tools,
+        prepareStep: composePrepareSteps(contextGuard(contextWindow), retrievalGuard, finalAnswerGuard(turnBudget)),
+        stopWhen: [stepCountIs(turnBudget), hasToolCall("image_generation")]
       });
       if (statistics) {
         await Promise.all([
@@ -11926,7 +12080,7 @@ When a tool execution is not approved by the user, do not retry it unless explic
    * - Document files (PDF, DOCX, etc.) -> text parts with extracted content using officeparser
    * - Image files -> image parts (which ARE supported by Responses API)
    */
-  async processFilePartsInMessages(messages) {
+  async processFilePartsInMessages(messages, offloadCtx) {
     const processedMessages = await Promise.all(
       messages.map(async (message) => {
         if (message.role !== "user" || !Array.isArray(message.parts)) {
@@ -11971,10 +12125,11 @@ When a tool execution is not approved by the user, do not retry it unless explic
                 outputErrorToConsole: false,
                 newlineDelimiter: "\n"
               });
+              const guardedText = await guardExtractedFileText(filename, String(extractedText), offloadCtx);
               return {
                 type: "text",
                 text: `<file file name = "${filename}" >
-${extractedText} 
+${guardedText} 
  </file>`
               };
             } catch (error) {
@@ -11990,7 +12145,6 @@ ${extractedText}
           ...message,
           parts: processedParts
         };
-        console.log("[EXULU] Result: " + JSON.stringify(result, null, 2));
         return result;
       })
     );
@@ -12013,7 +12167,9 @@ ${extractedText}
     exuluConfig,
     instructions,
     req,
-    maxStepCount
+    maxStepCount,
+    contextWindow,
+    disabledTools
   }) => {
     if (!this.config) {
       console.error("[EXULU] Config is required for streaming.");
@@ -12034,9 +12190,7 @@ ${extractedText}
       console.log("[EXULU] loading previous messages from session: " + session);
       const previousMessages2 = await getAgentMessages({
         session,
-        user: user?.id,
-        limit: 50,
-        page: 1
+        user: user?.id
       });
       previousMessagesContent = previousMessages2.map((message2) => JSON.parse(message2.content));
     }
@@ -12099,60 +12253,28 @@ ${extractedText}
     if (declined.length && session && user) {
       await saveChat({ session, user: user.id, messages: declined });
     }
-    messages = await this.processFilePartsInMessages(messages);
+    messages = await this.processFilePartsInMessages(messages, {
+      contextWindow,
+      sessionID: session,
+      user,
+      exuluConfig
+    });
+    const chronologicalMessages = messages;
+    const contextBudget = deriveContextBudget(contextWindow);
+    const occupancy = contextOccupancy(chronologicalMessages);
+    if (occupancy >= contextBudget.blockThreshold) {
+      console.warn(
+        `[EXULU] Blocking request: occupancy ${occupancy} >= blockThreshold ${contextBudget.blockThreshold} (window ${contextBudget.contextWindow}).`
+      );
+      throw new ContextCompactionRequiredError(occupancy, contextBudget);
+    }
+    messages = sliceHistoryAtCheckpoint(chronologicalMessages);
     const genericContext = "IMPORTANT: \n\n The current date is " + (/* @__PURE__ */ new Date()).toLocaleDateString() + " and the current time is " + (/* @__PURE__ */ new Date()).toLocaleTimeString() + ". If the user does not explicitly provide the current date, for examle when saying ' this weekend', you should assume they are talking with the current date in mind as a reference.";
     let system = instructions || "You are a helpful assistant. When you use a tool to answer a question do not explicitly comment on the result of the tool call unless the user has explicitly you to do something with the result.";
     if (user?.personal_system_prompt?.trim()) {
       system += "\n\nUser preferences:\n" + user.personal_system_prompt.trim();
     }
     system += "\n\n" + genericContext;
-    const includesContextSearchTool = currentTools?.some(
-      (tool2) => tool2.name.toLowerCase().includes("context_search") || tool2.id.includes("context_search") || tool2.type === "context"
-    );
-    const includesWebSearchTool = currentTools?.some(
-      (tool2) => tool2.name.toLowerCase().includes("web_search") || tool2.id.includes("web_search") || tool2.type === "web_search"
-    );
-    console.log("[EXULU] Current tools: " + currentTools?.map((tool2) => tool2.name).join("\n"));
-    console.log("[EXULU] Includes context search tool: " + includesContextSearchTool);
-    console.log("[EXULU] Includes web search tool: " + includesWebSearchTool);
-    if (includesContextSearchTool) {
-      system += `
-
-
-  
-              When you use a context search tool, you will include references to the items
-              retrieved from the tool call result inline in the response using this exact JSON format
-              (all on one line, no line breaks):
-              {item_name: <item_name>, item_id: <item_id>, context: <context_id>, chunk_id: <chunk_id>, chunk_index: <chunk_index>}
-  
-              IMPORTANT formatting rules:
-              - Use the exact format shown above, all on ONE line
-              - Do NOT use quotes around field names or values
-              - Use the context ID from the tool result
-              - Include the file/item name, not the full path
-              - Separate multiple citations with spaces
-  
-              Example: {item_name: document.pdf, item_id: abc123, context: my-context-id, chunk_id: chunk_456, chunk_index: 0}
-  
-              The citations will be rendered as interactive badges in the UI.
-              `;
-    }
-    if (includesWebSearchTool) {
-      system += `
-
-
-              When you use a web search tool, you will include references to the results of the tool call result inline in the response using this exact JSON format
-              (all on one line, no line breaks):
-              {url: <url>, title: <title>, snippet: <snippet>}
-  
-              IMPORTANT formatting rules:
-              - Use the exact format shown above, all on ONE line
-              - Do NOT use quotes around field names or values
-              - Separate multiple results with spaces
-  
-              Example: {url: https://www.google.com, title: Google, snippet: The result of the web search.}
-              `;
-    }
     if (currentSkills?.length) {
       const skillsList = currentSkills.map((skill) => {
         const description = (skill.description ?? "").trim();
@@ -12207,6 +12329,11 @@ ${skillsList}
         read them with the readFile tool. Files you produce yourself (via writeFile or via shell
         commands like \`node create_doc.js\`) live in the same place. These files are scoped to
         this single session; they are NOT visible in other sessions, projects, or knowledge bases.
+
+        Note on large outputs: oversized tool outputs and large uploaded documents are automatically
+        truncated in the conversation; the FULL content is saved as a session file (named in the
+        truncation notice, e.g. tool-output-*.txt). Use the read_session_file tool with offset/limit
+        to page through it \u2014 do not ask the user to re-upload.
       `;
     system += `
 
@@ -12230,9 +12357,66 @@ When a tool execution is not approved by the user, do not retry it unless explic
       sessionItems,
       model,
       agent,
-      memoryItems
+      memoryItems,
+      contextWindow,
+      disabledTools
     );
     console.log("[EXULU] Converted tools", Object.keys(tools));
+    const includesContextSearchTool = currentTools?.some(
+      (tool2) => tool2.name.toLowerCase().includes("context_search") || tool2.id.includes("context_search") || tool2.type === "context"
+    );
+    const includesWebSearchTool = currentTools?.some(
+      (tool2) => tool2.name.toLowerCase().includes("web_search") || tool2.id.includes("web_search") || tool2.type === "web_search"
+    );
+    console.log("[EXULU] Current tools: " + currentTools?.map((tool2) => tool2.name).join("\n"));
+    console.log("[EXULU] Includes context search tool: " + includesContextSearchTool);
+    console.log("[EXULU] Includes web search tool: " + includesWebSearchTool);
+    if (includesContextSearchTool) {
+      system += `
+
+
+
+              When you use a context search tool, you will include references to the items
+              retrieved from the tool call result inline in the response using this exact JSON format
+              (all on one line, no line breaks):
+              {item_name: <item_name>, item_id: <item_id>, context: <context_id>, chunk_id: <chunk_id>, chunk_index: <chunk_index>}
+
+              IMPORTANT formatting rules:
+              - Use the exact format shown above, all on ONE line
+              - Do NOT use quotes around field names or values
+              - Use the context ID from the tool result
+              - Include the file/item name, not the full path
+              - Separate multiple citations with spaces
+
+              Example: {item_name: document.pdf, item_id: abc123, context: my-context-id, chunk_id: chunk_456, chunk_index: 0}
+
+              The citations will be rendered as interactive badges in the UI.
+              `;
+    }
+    if (includesWebSearchTool) {
+      system += `
+
+
+              When you use a web search tool, you will include references to the results of the tool call result inline in the response using this exact JSON format
+              (all on one line, no line breaks):
+              {url: <url>, title: <title>, snippet: <snippet>}
+
+              IMPORTANT formatting rules:
+              - Use the exact format shown above, all on ONE line
+              - Do NOT use quotes around field names or values
+              - Separate multiple results with spaces
+
+              Example: {url: https://www.google.com, title: Google, snippet: The result of the web search.}
+              `;
+    }
+    const agenticEntry = currentTools?.find((t) => t.id === "agentic_context_search");
+    const agenticToolKey = agenticEntry ? sanitizeToolName(agenticEntry.name) : void 0;
+    const retrievalGuard = retrievalBudgetGuard(
+      resolveRetrievalCallBudget(toolConfigs),
+      agenticToolKey,
+      Object.keys(tools)
+    );
+    const turnBudget = resolveTurnStepBudget(maxStepCount, agent);
     const result = streamText({
       temperature: 0,
       // TODO Make this configurable
@@ -12257,10 +12441,9 @@ When a tool execution is not approved by the user, do not retry it unless explic
           `Chat stream error: ${error instanceof Error ? error.message : JSON.stringify(error)}`
         );
       },
-      // provide more loops for skills because they are more complex to execute
-      // todo allow configuring this per skill
-      prepareStep: finalAnswerGuard(maxStepCount ?? resolveMaxStepsFromToolConfigs(toolConfigs) ?? (currentSkills?.length ? 10 : 5)),
-      stopWhen: [stepCountIs(maxStepCount ?? resolveMaxStepsFromToolConfigs(toolConfigs) ?? (currentSkills?.length ? 10 : 5)), hasToolCall("image_generation")]
+      // todo allow configuring the step budget per skill
+      prepareStep: composePrepareSteps(contextGuard(contextWindow), retrievalGuard, finalAnswerGuard(turnBudget)),
+      stopWhen: [stepCountIs(turnBudget), hasToolCall("image_generation")]
     });
     return {
       stream: result,
@@ -12271,19 +12454,14 @@ When a tool execution is not approved by the user, do not retry it unless explic
 };
 var getAgentMessages = async ({
   session,
-  user,
-  limit,
-  page
+  user
 }) => {
   const { db } = await postgresClient();
-  console.log(
-    "[EXULU] getting agent messages for session: " + session + " and user: " + user + " and page: " + page
-  );
-  const query = db.from("agent_messages").where({ session, user: user || null }).limit(limit);
-  if (page > 0) {
-    query.offset((page - 1) * limit);
-  }
-  const messages = await query;
+  console.log("[EXULU] getting agent messages for session: " + session + " and user: " + user);
+  const messages = await db.from("agent_messages").where({ session, user: user || null }).orderBy([
+    { column: "createdAt", order: "asc" },
+    { column: "id", order: "asc" }
+  ]);
   return messages;
 };
 var getSession = async ({ sessionID }) => {
@@ -12386,18 +12564,163 @@ ${SUGGESTIONS_SYSTEM_PROMPT}` : SUGGESTIONS_SYSTEM_PROMPT;
   };
 };
 
-// src/exulu/transcribe.ts
-var TranscriptionError = class extends Error {
-  constructor(upstreamStatus, message) {
-    super(message);
-    this.upstreamStatus = upstreamStatus;
-    this.name = "TranscriptionError";
+// src/exulu/resolve-context-window.ts
+var resolveContextWindow = async ({
+  modelId,
+  exuluProvider
+}) => {
+  if (process.env.EXULU_USE_LITELLM === "true") {
+    const entry = await findLiteLLMModel(modelId);
+    const fromCatalog = entry?.max_input_tokens ?? entry?.max_tokens;
+    if (fromCatalog != null && fromCatalog > 0) return fromCatalog;
+  } else if (exuluProvider) {
+    try {
+      const fromProvider = exuluProvider.maxContextLength;
+      if (fromProvider != null && fromProvider > 0) return fromProvider;
+    } catch {
+    }
   }
+  console.warn(
+    `[EXULU] Unknown context window for model "${modelId}" \u2014 assuming ${DEFAULT_CONTEXT_WINDOW}. Check the LiteLLM catalog / provider template metadata.`
+  );
+  return DEFAULT_CONTEXT_WINDOW;
 };
-async function transcribeAudio(args) {
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
+
+// src/exulu/active-streams.ts
+var active = /* @__PURE__ */ new Set();
+var markStreamActive = (sessionID) => {
+  active.add(sessionID);
+};
+var clearStreamActive = (sessionID) => {
+  active.delete(sessionID);
+};
+var isStreamActive = (sessionID) => active.has(sessionID);
+
+// src/exulu/compact-session.ts
+import { randomUUID } from "crypto";
+import { generateText as generateText6, validateUIMessages as validateUIMessages2 } from "ai";
+var CompactionInsufficientError = class extends Error {
+  constructor(reason) {
+    super(JSON.stringify({ code: COMPACTION_INSUFFICIENT, message: reason }));
+    this.name = "CompactionInsufficientError";
+  }
+};
+var MIN_TAIL_MESSAGES = 2;
+var SUMMARY_TOOL_OUTPUT_SLICE = 1500;
+var SUMMARY_TOOL_INPUT_SLICE = 200;
+var SUMMARY_SYSTEM = `You compress chat histories for an AI assistant. Produce a dense, factual summary of the conversation below. Preserve:
+- the user's intent and any outstanding requests
+- key facts, decisions, and constraints
+- files, artifacts, and session files touched \u2014 ALWAYS keep exact file and item names so they stay retrievable
+- errors encountered and how they were resolved
+- pending tasks and the current state of the work
+Do not invent information. Do not include pleasantries. Write compact prose or bullet points.`;
+var splitTail = (messages, tailTokenBudget) => {
+  const minTail = Math.min(MIN_TAIL_MESSAGES, messages.length);
+  let cut = messages.length;
+  let tokens = 0;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const t = estimateMessageTokens(messages[i]);
+    const tailCount = messages.length - i;
+    if (tailCount > minTail && tokens + t > tailTokenBudget) break;
+    tokens += t;
+    cut = i;
+  }
+  return { head: messages.slice(0, cut), tail: messages.slice(cut) };
+};
+var serializeForSummary = (messages) => messages.map((m) => {
+  const parts = (m.parts ?? []).map((part) => {
+    const p = part;
+    if (p.type === "text") return p.text ?? "";
+    if (p.type === "file") return `[file: ${p.filename ?? p.url ?? "attachment"}]`;
+    if (p.type === "reasoning" || p.type === "step-start") return "";
+    if (p.type?.startsWith("tool-") || p.type === "dynamic-tool") {
+      const out = p.output?.value ?? p.output;
+      const outText = typeof out === "string" ? out : JSON.stringify(out ?? "");
+      return `[tool ${p.type}: ${JSON.stringify(p.input ?? {}).slice(0, SUMMARY_TOOL_INPUT_SLICE)}] \u2192 ${outText.slice(0, SUMMARY_TOOL_OUTPUT_SLICE)}`;
+    }
+    return "";
+  }).filter(Boolean).join("\n");
+  return `${m.role.toUpperCase()}:
+${parts}`;
+}).join("\n\n");
+var compactSession = async ({
+  sessionID,
+  user,
+  languageModel,
+  contextWindow,
+  steer,
+  modelId,
+  summarize
+}) => {
+  const budget = deriveContextBudget(contextWindow);
+  const rows = await getAgentMessages({ session: sessionID, user: user.id });
+  const all = await validateUIMessages2({ messages: rows.map((r) => JSON.parse(r.content)) });
+  const history = sliceHistoryAtCheckpoint(all);
+  const { head, tail } = splitTail(history, budget.compactionTailTokens);
+  if (head.length === 0) {
+    throw new CompactionInsufficientError(
+      "There is nothing left to compact \u2014 the recent messages already form the whole context. Start a new chat instead."
+    );
+  }
+  let corpus = serializeForSummary(head);
+  const originalTokens = estimateTokens(corpus);
+  corpus = truncateToolOutput(corpus, contextWindow, "history", 0.3, Math.floor(budget.usableWindow * 0.8) * 4);
+  const system = steer?.trim() ? `${SUMMARY_SYSTEM}
+
+Focus especially on: ${steer.trim()}` : SUMMARY_SYSTEM;
+  const doSummarize = summarize ?? (async ({ system: sys, prompt, maxOutputTokens }) => {
+    const { text } = await generateText6({
+      model: languageModel,
+      system: sys,
+      prompt,
+      temperature: 0,
+      maxRetries: 2,
+      maxOutputTokens
+    });
+    return text;
+  });
+  const summary = await doSummarize({ system, prompt: corpus, maxOutputTokens: budget.summaryBudgetTokens });
+  const summaryTokens = estimateTokens(summary);
+  let tailTokens = 0;
+  for (const m of tail) tailTokens += estimateMessageTokens(m);
+  const occupancyEstimate = summaryTokens + tailTokens;
+  if (occupancyEstimate >= budget.blockThreshold) {
+    throw new CompactionInsufficientError(
+      "Compacting cannot shrink this conversation below the context limit \u2014 a recent message or output is too large by itself. Start a new chat."
+    );
+  }
+  const compaction = {
+    coversUpTo: head[head.length - 1].id,
+    originalTokens,
+    summaryTokens,
+    occupancyEstimate,
+    ...steer?.trim() ? { steer: steer.trim() } : {}
+  };
+  const checkpoint = {
+    id: `compaction_${randomUUID()}`,
+    role: "user",
+    parts: [{ type: "text", text: `[Conversation summary \u2014 earlier messages were compacted]
+
+${summary}` }],
+    metadata: { compaction }
+  };
+  await saveChat({ session: sessionID, user: user.id, messages: [checkpoint], ...modelId ? { model: modelId } : {} });
+  return { checkpoint, occupancyEstimate, originalTokens, summaryTokens };
+};
+
+// src/exulu/transcribe.ts
+var TranscriptionError = class extends Error {
+  constructor(upstreamStatus, message) {
+    super(message);
+    this.upstreamStatus = upstreamStatus;
+    this.name = "TranscriptionError";
+  }
+};
+async function transcribeAudio(args) {
+  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
+  const port = process.env.LITELLM_PORT ?? "4000";
+  const masterKey = process.env.LITELLM_MASTER_KEY;
   const model = process.env.TRANSCRIPTION_MODEL;
   if (!masterKey) throw new Error("LITELLM_MASTER_KEY is not set");
   if (!model) throw new Error("TRANSCRIPTION_MODEL is not set");
@@ -12751,7 +13074,7 @@ function checkApiKeyScope(user, agentId) {
 import "express";
 import {
   streamText as streamText2,
-  generateText as generateText6,
+  generateText as generateText7,
   stepCountIs as stepCountIs2,
   jsonSchema
 } from "ai";
@@ -12841,7 +13164,7 @@ function transformCompletion(text, inputTokens, outputTokens, ctx) {
 }
 
 // src/exulu/openai-gateway.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import "crypto-js";
 import express from "express";
 function convertOpenAIToolsToAiSdkTools(tools) {
@@ -13155,6 +13478,10 @@ var registerOpenAIGatewayRoutes = async (app, providers, tools, contexts, config
         }
         const providerapikey = resolved.apiKey;
         const languageModel = resolved.languageModel;
+        const contextWindow = await resolveContextWindow({
+          modelId: resolved.model.id,
+          exuluProvider: isLiteLLMEnabled() ? void 0 : resolved.exuluProvider
+        });
         const disabledTools = req.body.disabledTools ?? [];
         const enabledTools = await getEnabledTools(
           agent,
@@ -13179,12 +13506,50 @@ var registerOpenAIGatewayRoutes = async (app, providers, tools, contexts, config
           project?.id,
           void 0,
           languageModel,
-          agent
+          agent,
+          void 0,
+          contextWindow,
+          disabledTools
         );
+        const gatewayAgenticEntry = enabledTools?.find((t) => t.id === "agentic_context_search");
+        const gatewayAgenticKey = gatewayAgenticEntry ? sanitizeToolName(gatewayAgenticEntry.name) : void 0;
+        const gatewayRetrievalGuard = retrievalBudgetGuard(
+          resolveRetrievalCallBudget(agent.tools),
+          gatewayAgenticKey,
+          Object.keys(convertedTools)
+        );
+        const turnBudget = resolveTurnStepBudget(void 0, agent);
         const clientTools = Array.isArray(req.body.tools) ? req.body.tools : [];
         const activeTools = clientTools.length > 0 ? convertOpenAIToolsToAiSdkTools(clientTools) : convertedTools;
         const openaiMessages = req.body.messages ?? [];
         const { systemPrompt: requestSystemPrompt, coreMessages } = convertOpenAIMessagesToModelMessages(openaiMessages);
+        const gatewayBudget = deriveContextBudget(contextWindow);
+        const IMAGE_TOKEN_ALLOWANCE = 1e3;
+        let imageCount = 0;
+        const textOnlyMessages = openaiMessages.map((m) => {
+          if (!Array.isArray(m.content)) return m;
+          return {
+            ...m,
+            content: m.content.map((p) => {
+              if (p && typeof p === "object" && "image_url" in p && p.image_url) {
+                imageCount += 1;
+                return { ...p, image_url: { url: "[image]" } };
+              }
+              return p;
+            })
+          };
+        });
+        const promptTokens = estimateTokens(JSON.stringify(textOnlyMessages)) + imageCount * IMAGE_TOKEN_ALLOWANCE;
+        if (promptTokens >= gatewayBudget.blockThreshold) {
+          res.status(400).json({
+            error: {
+              message: `This request is ~${promptTokens.toLocaleString("en-US")} tokens, which exceeds the model's usable context window (${gatewayBudget.usableWindow.toLocaleString("en-US")} tokens). Reduce the conversation history.`,
+              type: "invalid_request_error",
+              code: "context_length_exceeded"
+            }
+          });
+          return;
+        }
         const agentInstructions = agent.instructions ?? "";
         const systemParts = [
           agentInstructions ? `You are an agent named: ${agent.name}
@@ -13194,7 +13559,7 @@ ${project.description}` : ""}` : "",
           requestSystemPrompt
         ].filter(Boolean);
         const systemPrompt = systemParts.join("\n\n");
-        const completionId = `chatcmpl-${randomUUID()}`;
+        const completionId = `chatcmpl-${randomUUID2()}`;
         const created = Math.floor(Date.now() / 1e3);
         const hasTools = Object.keys(activeTools).length > 0;
         const ctx = { completionId, created, modelId };
@@ -13208,7 +13573,8 @@ ${project.description}` : ""}` : "",
             messages: coreMessages,
             tools: hasTools ? activeTools : void 0,
             maxRetries: 2,
-            stopWhen: clientTools.length > 0 ? void 0 : [stepCountIs2(5)],
+            prepareStep: clientTools.length > 0 ? void 0 : composePrepareSteps(contextGuard(contextWindow), gatewayRetrievalGuard, finalAnswerGuard(turnBudget)),
+            stopWhen: clientTools.length > 0 ? void 0 : [stepCountIs2(turnBudget)],
             onError: (error) => {
               console.error("[OPENAI GATEWAY] stream error:", error);
             }
@@ -13241,13 +13607,14 @@ ${project.description}` : ""}` : "",
           const usage = await result.usage;
           await writeStatistics(agent, project, user, usage.inputTokens ?? 0, usage.outputTokens ?? 0);
         } else {
-          const { text, usage } = await generateText6({
+          const { text, usage } = await generateText7({
             model: languageModel,
             system: systemPrompt || void 0,
             messages: coreMessages,
             tools: hasTools ? activeTools : void 0,
             maxRetries: 2,
-            stopWhen: clientTools.length > 0 ? void 0 : [stepCountIs2(5)]
+            prepareStep: clientTools.length > 0 ? void 0 : composePrepareSteps(contextGuard(contextWindow), gatewayRetrievalGuard, finalAnswerGuard(turnBudget)),
+            stopWhen: clientTools.length > 0 ? void 0 : [stepCountIs2(turnBudget)]
           });
           res.json(transformCompletion(text, usage.inputTokens ?? 0, usage.outputTokens ?? 0, ctx));
           await writeStatistics(agent, project, user, usage.inputTokens ?? 0, usage.outputTokens ?? 0);
@@ -13447,6 +13814,148 @@ var contentHeadersFor = (key, contentType, filename) => {
 };
 var getSharedArtifactByName = (db, name) => db("shared_artifacts").where({ name }).first();
 
+// src/skills/skill-access.ts
+async function resolveSkillByName(db, name) {
+  const row = await db("skills").where({ name }).first();
+  return row ?? null;
+}
+async function canAccessSkill(db, skill, action, user) {
+  const rbac = await RBACResolver(db, "skill", skill.id, skill.rights_mode || "private");
+  return checkRecordAccess({ ...skill, RBAC: rbac }, action, user);
+}
+async function filterReadableSkills(db, skills, user) {
+  const out = [];
+  for (const s of skills) {
+    if (await canAccessSkill(db, s, "read", user)) out.push(s);
+  }
+  return out;
+}
+
+// src/skills/bootstrap/clients.ts
+var CLIENT_MANIFEST = [
+  { id: "agents", dir: ".agents/skills" },
+  // cross-agent standard (symlink canonical store)
+  { id: "claude", dir: ".claude/skills" },
+  { id: "windsurf", dir: ".windsurf/skills" },
+  { id: "continue", dir: ".continue/skills" },
+  { id: "roo", dir: ".roo/skills" },
+  { id: "kilocode", dir: ".kilocode/skills" },
+  { id: "crush", dir: ".crush/skills" },
+  { id: "goose", dir: ".goose/skills" },
+  { id: "qwen", dir: ".qwen/skills" },
+  { id: "iflow", dir: ".iflow/skills" },
+  { id: "junie", dir: ".junie/skills" },
+  { id: "kiro", dir: ".kiro/skills" },
+  { id: "trae", dir: ".trae/skills" },
+  { id: "augment", dir: ".augment/skills" },
+  { id: "factory", dir: ".factory/skills" },
+  { id: "devin", dir: ".devin/skills" },
+  { id: "openhands", dir: ".openhands/skills" },
+  { id: "pi", dir: ".pi/skills" },
+  { id: "cortex", dir: ".cortex/skills" },
+  { id: "zencoder", dir: ".zencoder/skills" },
+  { id: "codebuddy", dir: ".codebuddy/skills" },
+  { id: "codestudio", dir: ".codestudio/skills" },
+  { id: "commandcode", dir: ".commandcode/skills" },
+  { id: "codemaker", dir: ".codemaker/skills" },
+  { id: "codeartsdoer", dir: ".codeartsdoer/skills" },
+  { id: "lingma", dir: ".lingma/skills" },
+  { id: "qoder", dir: ".qoder/skills" },
+  { id: "rovodev", dir: ".rovodev/skills" },
+  { id: "moxby", dir: ".moxby/skills" },
+  { id: "mux", dir: ".mux/skills" },
+  { id: "neovate", dir: ".neovate/skills" },
+  { id: "ona", dir: ".ona/skills" },
+  { id: "pochi", dir: ".pochi/skills" },
+  { id: "reasonix", dir: ".reasonix/skills" },
+  { id: "terramind", dir: ".terramind/skills" },
+  { id: "tinycloud", dir: ".tinycloud/skills" },
+  { id: "vibe", dir: ".vibe/skills" },
+  { id: "adal", dir: ".adal/skills" },
+  { id: "aider-desk", dir: ".aider-desk/skills" },
+  { id: "autohand", dir: ".autohand/skills" },
+  { id: "bob", dir: ".bob/skills" },
+  { id: "hermes", dir: ".hermes/skills" },
+  { id: "inferencesh", dir: ".inferencesh/skills" },
+  { id: "jazz", dir: ".jazz/skills" },
+  { id: "kode", dir: ".kode/skills" },
+  { id: "mcpjam", dir: ".mcpjam/skills" },
+  { id: "forge", dir: ".forge/skills" },
+  { id: "tabnine", dir: ".tabnine/agent/skills" }
+  // exception: nested under agent/
+];
+
+// src/skills/bootstrap/exulu-sh.generated.ts
+var EXULU_SH_B64 = "IyEvYmluL3NoCiMgZXh1bHUg4oCUIGhlbHBlciBmb3IgdGhlIEV4dWx1IGNlbnRyYWwgc2tpbGwgbGlicmFyeS4gVGhlIGFnZW50IGludm9rZXMgdGhpcwojIChuZXZlciByYXcgY3VybCk6IHRoZSB0b2tlbiBpcyByZWFkIGZyb20gdGhlIGNvbmZpZyBmaWxlIGhlcmUgYW5kIHNlbnQgdmlhCiMgYHgtYXBpLWtleTogQmVhcmVyYCwgc28gaXQgbmV2ZXIgZW50ZXJzIHRoZSBtb2RlbCBjb250ZXh0LiBDbGllbnQgZmFuLW91dAojIChjb3B5L3N5bWxpbmsgYWNyb3NzIGFnZW50IGNsaWVudHMpIGlzIGRldGVybWluaXN0aWMuCnNldCAtZXUKCkNPTkZJR19ESVI9IiRIT01FLy5jb25maWcvZXh1bHUiCkNPTkZJR19GSUxFPSIkQ09ORklHX0RJUi9za2lsbHMuanNvbiIKCmRpZSgpIHsgcHJpbnRmICdleHVsdTogJXNcbicgIiQqIiA+JjI7IGV4aXQgMTsgfQppbmZvKCkgeyBwcmludGYgJyVzXG4nICIkKiIgPiYyOyB9Cgpqc29uX3N0cigpIHsgIyBqc29uX3N0ciA8a2V5PiA8ZmlsZT4g4oCUIGZsYXQgImtleSI6InZhbHVlIgogIHNlZCAtbiAicy8uKlwiJDFcIltbOnNwYWNlOl1dKjpbWzpzcGFjZTpdXSpcIlxcKFteXCJdKlxcKVwiLiovXFwxL3AiICIkMiIgfCBoZWFkIC1uMQp9CgpbIC1mICIkQ09ORklHX0ZJTEUiIF0gfHwgZGllICJub3QgY29uZmlndXJlZCDigJQgcnVuOiBjdXJsIC1mc1NMIDxiYXNlX3VybD4vYXBpL3NraWxscy9pbnN0YWxsLnNoIHwgc2giCgpCQVNFX1VSTD0iJChqc29uX3N0ciBiYXNlX3VybCAiJENPTkZJR19GSUxFIikiCkJBQ0tFTkQ9IiQoanNvbl9zdHIgYmFja2VuZCAiJENPTkZJR19GSUxFIikiCkFQSV9LRVk9IiQoanNvbl9zdHIgYXBpX2tleSAiJENPTkZJR19GSUxFIikiCkxJTktfTU9ERT0iJChqc29uX3N0ciBsaW5rX21vZGUgIiRDT05GSUdfRklMRSIpIgpTQ09QRT0iJChqc29uX3N0ciBzY29wZSAiJENPTkZJR19GSUxFIikiCkNMSUVOVFM9IiQoc2VkIC1uICdzLy4qImNsaWVudHMiW1s6c3BhY2U6XV0qOltbOnNwYWNlOl1dKlxbXChbXl1dKlwpXF0uKi9cMS9wJyAiJENPTkZJR19GSUxFIiB8IHRyICcsJyAnICcgfCB0ciAtZCAnIicgfCB0ciAtcyAnICcpIgoKWyAtbiAiJENMSUVOVFMiIF0gfHwgQ0xJRU5UUz0iYWdlbnRzIgpbIC1uICIkTElOS19NT0RFIiBdIHx8IExJTktfTU9ERT0iY29weSIKWyAtbiAiJFNDT1BFIiBdIHx8IFNDT1BFPSJwcm9qZWN0IgoKaWYgWyAteiAiJEJBQ0tFTkQiIF07IHRoZW4KICBbIC1uICIkQkFTRV9VUkwiIF0gfHwgZGllICJjb25maWcgaGFzIG5vIGJhY2tlbmQgYW5kIG5vIGJhc2VfdXJsIgogIEJBQ0tFTkQ9IiQoY3VybCAtZnNTTCAiJEJBU0VfVVJML2FwaS9jb25maWciIHwgc2VkIC1uICdzLy4qImJhY2tlbmQiW1s6c3BhY2U6XV0qOltbOnNwYWNlOl1dKiJcKFteIl0qXCkiLiovXDEvcCcgfCBoZWFkIC1uMSkiCiAgWyAtbiAiJEJBQ0tFTkQiIF0gfHwgZGllICJjb3VsZCBub3QgcmVzb2x2ZSBiYWNrZW5kIGZyb20gJEJBU0VfVVJML2FwaS9jb25maWciCmZpCkJBQ0tFTkQ9IiQocHJpbnRmICclcycgIiRCQUNLRU5EIiB8IHNlZCAnczovKiQ6OicpIgoKUk9PVD0iJFBXRCIKWyAiJFNDT1BFIiA9ICJob21lIiBdICYmIFJPT1Q9IiRIT01FIgoKIyBkaXJfZm9yIENMSUVOVF9JRCAtPiByZWxhdGl2ZSBza2lsbCBkaXIgKGdlbmVyYXRlZCBmcm9tIHRoZSBtYW5pZmVzdCBpbiB0aGUKIyByZWFsIGJ1aWxkOyBhIHJlcHJlc2VudGF0aXZlIHN1YnNldCBoZXJlIGZvciBsb2NhbCB0ZXN0aW5nKS4KZGlyX2ZvcigpIHsKICBjYXNlICIkMSIgaW4KX19ESVJfRk9SX0NBU0VTX18KICAgICopIHJldHVybiAxIDs7CiAgZXNhYwp9CgphcGkoKSB7ICMgYXBpIDxNRVRIT0Q+IDxwYXRoPiBbZXh0cmEgY3VybCBhcmdzLi4uXSAtPiBib2R5IG9uIHN0ZG91dAogIG09IiQxIjsgcD0iJDIiOyBzaGlmdCAyCiAgY3VybCAtZnNTIC1YICIkbSIgIiRCQUNLRU5EJHAiIC1IICJ4LWFwaS1rZXk6IEJlYXJlciAkQVBJX0tFWSIgIiRAIgp9CgptZXRhX3ZlcnNpb24oKSB7ICMgbWV0YV92ZXJzaW9uIDxuYW1lPiAtPiBjdXJyZW50X3ZlcnNpb24gZnJvbSByZWdpc3RyeQogIGFwaSBHRVQgIi9za2lsbHMvcmVnaXN0cnkvJDEiIDI+L2Rldi9udWxsIFwKICAgIHwgc2VkIC1uICdzLy4qImN1cnJlbnRfdmVyc2lvbiJbWzpzcGFjZTpdXSo6W1s6c3BhY2U6XV0qXChbMC05XVswLTldKlwpLiovXDEvcCcgfCBoZWFkIC1uMQp9CgpfbWFuYWdlZCgpIHsgIyBfbWFuYWdlZCA8ZGlyPiAtPiAwIGlmIHNhZmUgdG8gb3ZlcndyaXRlIChvdXJzIG9yIHN5bWxpbmsgb3IgYWJzZW50KQogIGQ9IiQxIgogIGlmIFsgLWUgIiRkIiBdICYmIFsgISAtTCAiJGQiIF0gJiYgWyAhIC1mICIkZC8uZXh1bHUtc2tpbGwuanNvbiIgXTsgdGhlbgogICAgaW5mbyAic2tpcCAkZCAoZXhpc3RzLCBub3QgbWFuYWdlZCBieSBleHVsdSkiOyByZXR1cm4gMQogIGZpCiAgcmV0dXJuIDAKfQoKX3B1dF9yZWFsKCkgeyAjIF9wdXRfcmVhbCA8ZGVzdD4gPHNyY2Rpcj4gPG1hcmtlci1qc29uPgogIF9tYW5hZ2VkICIkMSIgfHwgcmV0dXJuIDAKICBybSAtcmYgIiQxIjsgbWtkaXIgLXAgIiQxIjsgY3AgLVIgIiQyLy4iICIkMS8iCiAgcHJpbnRmICclc1xuJyAiJDMiID4gIiQxLy5leHVsdS1za2lsbC5qc29uIgp9CgpwbGFjZV9za2lsbCgpIHsgIyBwbGFjZV9za2lsbCA8bmFtZT4gPHNyY2Rpcj4gPHZlcnNpb24+CiAgcG5hbWU9IiQxIjsgcHNyYz0iJDIiOyBwdmVyPSIkezM6LTF9IgogIG1hcmtlcj0neyAibmFtZSI6ICInIiRwbmFtZSInIiwgInZlcnNpb24iOiAnIiRwdmVyIicsICJzb3VyY2UiOiAiJyIkQkFDS0VORCInIiB9JwogIGNhbm9uPSIkUk9PVC8uYWdlbnRzL3NraWxscy8kcG5hbWUiCiAgWyAiJExJTktfTU9ERSIgPSAic3ltbGluayIgXSAmJiBfcHV0X3JlYWwgIiRjYW5vbiIgIiRwc3JjIiAiJG1hcmtlciIKICBmb3IgaWQgaW4gJENMSUVOVFM7IGRvCiAgICBkPSIkKGRpcl9mb3IgIiRpZCIpIiB8fCB7IGluZm8gInVua25vd24gY2xpZW50OiAkaWQiOyBjb250aW51ZTsgfQogICAgcGFyZW50PSIkUk9PVC8kZCI7IGRlc3Q9IiRwYXJlbnQvJHBuYW1lIgogICAgaWYgWyAiJExJTktfTU9ERSIgPSAic3ltbGluayIgXSAmJiBbICIkaWQiICE9ICJhZ2VudHMiIF07IHRoZW4KICAgICAgX21hbmFnZWQgIiRkZXN0IiB8fCBjb250aW51ZQogICAgICBta2RpciAtcCAiJHBhcmVudCI7IHJtIC1yZiAiJGRlc3QiCiAgICAgIGlmIGxuIC1zICIkY2Fub24iICIkZGVzdCIgMj4vZGV2L251bGw7IHRoZW4KICAgICAgICBpbmZvICJsaW5rZWQgJGRlc3QgLT4gJGNhbm9uIgogICAgICBlbHNlCiAgICAgICAgaW5mbyAic3ltbGluayB1bnN1cHBvcnRlZCBhdCAkZGVzdDsgY29weWluZyIKICAgICAgICBfcHV0X3JlYWwgIiRkZXN0IiAiJHBzcmMiICIkbWFya2VyIgogICAgICBmaQogICAgZWxpZiBbICIkTElOS19NT0RFIiA9ICJjb3B5IiBdOyB0aGVuCiAgICAgIF9wdXRfcmVhbCAiJGRlc3QiICIkcHNyYyIgIiRtYXJrZXIiCiAgICBmaQogICAgIyBzeW1saW5rICsgYWdlbnRzOiBhbHJlYWR5IHBsYWNlZCBhcyB0aGUgY2Fub25pY2FsIHN0b3JlIGFib3ZlLgogIGRvbmUKfQoKaW5zdGFsbGVkX25hbWVzKCkgeyAjIHVuaXF1ZSBza2lsbCBuYW1lcyB0aGF0IGNhcnJ5IG91ciBtYXJrZXIgdW5kZXIgUk9PVAogIHsgZmluZCAiJFJPT1QvLmFnZW50cy9za2lsbHMiIC1tYXhkZXB0aCAyIC1uYW1lIC5leHVsdS1za2lsbC5qc29uIDI+L2Rldi9udWxsCiAgICBmb3IgaWQgaW4gJENMSUVOVFM7IGRvCiAgICAgIGQ9IiQoZGlyX2ZvciAiJGlkIikiIHx8IGNvbnRpbnVlCiAgICAgIGZpbmQgIiRST09ULyRkIiAtbWF4ZGVwdGggMiAtbmFtZSAuZXh1bHUtc2tpbGwuanNvbiAyPi9kZXYvbnVsbAogICAgZG9uZQogIH0gfCB3aGlsZSByZWFkIC1yIG07IGRvIGpzb25fc3RyIG5hbWUgIiRtIjsgZG9uZSB8IHNvcnQgLXUKfQoKbWFya2VyX3ZlcnNpb24oKSB7ICMgbWFya2VyX3ZlcnNpb24gPG5hbWU+CiAgZm9yIGJhc2UgaW4gIiRST09ULy5hZ2VudHMvc2tpbGxzIjsgZG8KICAgIFsgLWYgIiRiYXNlLyQxLy5leHVsdS1za2lsbC5qc29uIiBdICYmIHsganNvbl9zdHIgdmVyc2lvbiAiJGJhc2UvJDEvLmV4dWx1LXNraWxsLmpzb24iOyByZXR1cm47IH0KICBkb25lCiAgZm9yIGlkIGluICRDTElFTlRTOyBkbwogICAgZD0iJChkaXJfZm9yICIkaWQiKSIgfHwgY29udGludWUKICAgIGY9IiRST09ULyRkLyQxLy5leHVsdS1za2lsbC5qc29uIgogICAgWyAtZiAiJGYiIF0gJiYgeyBqc29uX3N0ciB2ZXJzaW9uICIkZiI7IHJldHVybjsgfQogIGRvbmUKfQoKZG9faW5zdGFsbCgpIHsgIyBkb19pbnN0YWxsIDxuYW1lPgogIG5hbWU9IiQxIgogIFRNUD0iJChta3RlbXAgLWQpIgogIGFwaSBHRVQgIi9za2lsbHMvcmVnaXN0cnkvJG5hbWUvZG93bmxvYWQiIC0tb3V0cHV0ICIkVE1QL3NraWxsLnppcCIgXAogICAgfHwgeyBybSAtcmYgIiRUTVAiOyBkaWUgImRvd25sb2FkIGZhaWxlZCBmb3IgJyRuYW1lJyAoNDAzID0gbm8gYWNjZXNzLCA0MDQgPSB1bmtub3duKSI7IH0KICBta2RpciAtcCAiJFRNUC94IgogIHVuemlwIC1xICIkVE1QL3NraWxsLnppcCIgLWQgIiRUTVAveCIgfHwgeyBybSAtcmYgIiRUTVAiOyBkaWUgImJhZCBhcmNoaXZlIGZvciAnJG5hbWUnIjsgfQogIHNyYz0iJChmaW5kICIkVE1QL3giIC1taW5kZXB0aCAxIC1tYXhkZXB0aCAxIC10eXBlIGQgfCBoZWFkIC1uMSkiCiAgWyAtbiAiJHNyYyIgXSB8fCB7IHJtIC1yZiAiJFRNUCI7IGRpZSAidW5leHBlY3RlZCBhcmNoaXZlIGxheW91dCBmb3IgJyRuYW1lJyI7IH0KICB2ZXI9IiQobWV0YV92ZXJzaW9uICIkbmFtZSIpIgogIHBsYWNlX3NraWxsICIkbmFtZSIgIiRzcmMiICIke3ZlcjotMX0iCiAgcm0gLXJmICIkVE1QIgogIGluZm8gImluc3RhbGxlZCAkbmFtZSAodiR7dmVyOi0xfSkgWyRMSU5LX01PREVdIGludG86ICRDTElFTlRTIgp9Cgp1c2FnZSgpIHsKICBjYXQgPiYyIDw8RU9GCmV4dWx1IOKAlCBFeHVsdSBza2lsbCBsaWJyYXJ5IGhlbHBlcgogIGV4dWx1IGxpc3QgICAgICAgICAgICAgICAgIGxpc3Qgc2tpbGxzIHlvdSBjYW4gYWNjZXNzIChKU09OKQogIGV4dWx1IGdldCA8bmFtZT4gICAgICAgICAgIHNob3cgb25lIHNraWxsJ3MgbWV0YWRhdGEgKEpTT04pCiAgZXh1bHUgaW5zdGFsbCA8bmFtZT4gICAgICAgaW5zdGFsbC9yZWZyZXNoIGEgc2tpbGwgaW50byB5b3VyIGFnZW50IGNsaWVudHMKICBleHVsdSB1cGRhdGUgWzxuYW1lPl0gICAgICB1cGRhdGUgaW5zdGFsbGVkIHNraWxscyAoYWxsLCBvciBvbmUpIHRvIGxhdGVzdAogIGV4dWx1IHB1Ymxpc2ggPG5hbWU+IDxkaXI+IHB1Ymxpc2ggYSBsb2NhbCBza2lsbCBmb2xkZXIgYXMgPG5hbWU+CiAgZXh1bHUgY29uZmlnICAgICAgICAgICAgICAgc2hvdyByZXNvbHZlZCBiYWNrZW5kIC8gc2NvcGUgLyBjbGllbnRzIChubyBzZWNyZXRzKQpFT0YKfQoKY21kPSIkezE6LWhlbHB9IgpbICQjIC1ndCAwIF0gJiYgc2hpZnQgfHwgdHJ1ZQoKY2FzZSAiJGNtZCIgaW4KICBsaXN0KSBhcGkgR0VUICIvc2tpbGxzL3JlZ2lzdHJ5IiA7OwogIGdldCkgWyAkIyAtZ2UgMSBdIHx8IGRpZSAidXNhZ2U6IGV4dWx1IGdldCA8bmFtZT4iOyBhcGkgR0VUICIvc2tpbGxzL3JlZ2lzdHJ5LyQxIiA7OwogIGluc3RhbGwpIFsgJCMgLWdlIDEgXSB8fCBkaWUgInVzYWdlOiBleHVsdSBpbnN0YWxsIDxuYW1lPiI7IGRvX2luc3RhbGwgIiQxIiA7OwogIHVwZGF0ZSkKICAgIGlmIFsgJCMgLWdlIDEgXTsgdGhlbiBuYW1lcz0iJDEiOyBlbHNlIG5hbWVzPSIkKGluc3RhbGxlZF9uYW1lcykiOyBmaQogICAgWyAtbiAiJG5hbWVzIiBdIHx8IHsgaW5mbyAibm8gZXh1bHUtbWFuYWdlZCBza2lsbHMgZm91bmQgdW5kZXIgJFJPT1QiOyBleGl0IDA7IH0KICAgIGZvciBuIGluICRuYW1lczsgZG8KICAgICAgY3VyPSIkKG1hcmtlcl92ZXJzaW9uICIkbiIpIgogICAgICBsYXRlc3Q9IiQobWV0YV92ZXJzaW9uICIkbiIpIgogICAgICBbIC1uICIkbGF0ZXN0IiBdIHx8IHsgaW5mbyAic2tpcCAkbiAobm90IGluIHJlZ2lzdHJ5KSI7IGNvbnRpbnVlOyB9CiAgICAgIGlmIFsgLXogIiRjdXIiIF0gfHwgWyAiJGxhdGVzdCIgLWd0ICIkY3VyIiBdIDI+L2Rldi9udWxsOyB0aGVuCiAgICAgICAgaW5mbyAidXBkYXRpbmcgJG46IHYke2N1cjotP30gLT4gdiRsYXRlc3QiOyBkb19pbnN0YWxsICIkbiIKICAgICAgZWxzZQogICAgICAgIGluZm8gIiRuIHVwIHRvIGRhdGUgKHYkY3VyKSIKICAgICAgZmkKICAgIGRvbmUKICAgIDs7CiAgcHVibGlzaCkKICAgIFsgJCMgLWdlIDIgXSB8fCBkaWUgInVzYWdlOiBleHVsdSBwdWJsaXNoIDxuYW1lPiA8ZGlyPiIKICAgIG5hbWU9IiQxIjsgZm9sZGVyPSIkMiIKICAgIFsgLWQgIiRmb2xkZXIiIF0gfHwgZGllICJubyBzdWNoIGZvbGRlcjogJGZvbGRlciIKICAgIFsgLWYgIiRmb2xkZXIvU0tJTEwubWQiIF0gfHwgZGllICIkZm9sZGVyIGhhcyBubyBTS0lMTC5tZCBhdCBpdHMgcm9vdCIKICAgIGNvbW1hbmQgLXYgemlwID4vZGV2L251bGwgMj4mMSB8fCBkaWUgInRoZSAnemlwJyBjb21tYW5kIGlzIHJlcXVpcmVkIHRvIHB1Ymxpc2giCiAgICBUTVA9IiQobWt0ZW1wIC1kKSIKICAgICggY2QgIiQoZGlybmFtZSAiJGZvbGRlciIpIiBcCiAgICAgICYmIHppcCAtcSAtciAtWCAiJFRNUC9za2lsbC56aXAiICIkKGJhc2VuYW1lICIkZm9sZGVyIikiIFwKICAgICAgICAgICAteCAnKi8uZXh1bHUtc2tpbGwuanNvbicgJyovLmdpdC8qJyAnKi5EU19TdG9yZScgJyovX19NQUNPU1gvKicgKSBcCiAgICAgIHx8IHsgcm0gLXJmICIkVE1QIjsgZGllICJjb3VsZCBub3QgemlwICRmb2xkZXIiOyB9CiAgICBhcGkgUE9TVCAiL3NraWxscy9yZWdpc3RyeS8kbmFtZSIgLUggIkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vemlwIiBcCiAgICAgIC0tZGF0YS1iaW5hcnkgQCIkVE1QL3NraWxsLnppcCIgXAogICAgICB8fCB7IHJtIC1yZiAiJFRNUCI7IGRpZSAicHVibGlzaCBmYWlsZWQgKDQwMyA9IG5vIHdyaXRlIGFjY2VzcywgNDA5ID0gbmFtZSB0YWtlbikiOyB9CiAgICBybSAtcmYgIiRUTVAiCiAgICBpbmZvICJwdWJsaXNoZWQgJG5hbWUiCiAgICA7OwogIGNvbmZpZykKICAgIHByaW50ZiAnYmFja2VuZD0lc1xuc2NvcGU9JXNcbmxpbmtfbW9kZT0lc1xuY2xpZW50cz0lc1xuYXBpX2tleT0lc1xuJyBcCiAgICAgICIkQkFDS0VORCIgIiRTQ09QRSIgIiRMSU5LX01PREUiICIkQ0xJRU5UUyIgXAogICAgICAiJChbIC1uICIkQVBJX0tFWSIgXSAmJiBlY2hvIHNldCB8fCBlY2hvIE1JU1NJTkcpIgogICAgOzsKICBoZWxwfC0taGVscHwtaCkgdXNhZ2UgOzsKICAqKSBpbmZvICJ1bmtub3duIGNvbW1hbmQ6ICRjbWQiOyB1c2FnZTsgZXhpdCAyIDs7CmVzYWMK";
+
+// src/skills/bootstrap/exulu-skills.ts
+var BOOTSTRAP_CLIENTS_JSON = JSON.stringify(CLIENT_MANIFEST, null, 2);
+var DIR_FOR_CASES = CLIENT_MANIFEST.map(
+  (c) => `    ${c.id}) printf '%s' '${c.dir}' ;;`
+).join("\n");
+var BOOTSTRAP_EXULU_SH = Buffer.from(EXULU_SH_B64, "base64").toString("utf8").replace("__DIR_FOR_CASES__", DIR_FOR_CASES);
+var BOOTSTRAP_SKILL_MD = `---
+name: exulu-skills
+description: Install, update, and publish skills from this Exulu instance's central skill library. Use when the user asks to install a skill, get the latest version of a skill, list available skills, or publish a skill to Exulu.
+---
+
+# Exulu Skills
+
+Bridge to the Exulu central skill library. **All operations go through the
+bundled helper script \u2014 do not hand-write curl or copy files yourself.** The
+script reads the API token from config (keeping it out of this conversation) and
+handles the multi-client copy/symlink fan-out deterministically.
+
+## The helper
+
+Run the script next to this file, \`scripts/exulu\`, with \`sh\` and the absolute
+path of this skill's directory:
+
+\`\`\`
+sh "<this-skill-dir>/scripts/exulu" <command>
+\`\`\`
+
+Commands:
+- \`list\` \u2014 skills you can access (JSON on stdout)
+- \`get <name>\` \u2014 one skill's metadata (JSON)
+- \`install <name>\` \u2014 install/refresh a skill into the user's agent clients
+- \`update [<name>]\` \u2014 update every installed skill, or just \`<name>\`, to latest
+- \`publish <name> <folder>\` \u2014 publish a local skill folder as \`<name>\`
+- \`config\` \u2014 show resolved backend / scope / clients (prints no secrets)
+
+The token, backend URL, target clients, copy-vs-symlink mode, and scope all come
+from \`~/.config/exulu/skills.json\` (written by the installer). Never print the
+\`api_key\` or read it into your reply \u2014 the script uses it internally.
+
+## Requests \u2192 commands
+
+- "list / search skills" \u2192 \`exulu list\`, then filter the JSON for the user.
+- "install skill X" / "add the X skill" \u2192 \`exulu install X\`.
+- "update / get the latest version [of X]" \u2192 \`exulu update [X]\`.
+- "publish / upload this skill as X" \u2192 confirm the target name with the user; for
+  an existing skill run \`exulu get X\` first and confirm a new version is intended;
+  then \`exulu publish X <folder>\`.
+
+## Not configured yet?
+
+If \`exulu config\` reports it's not configured (or \`~/.config/exulu/skills.json\`
+is missing), tell the user to run the installer \u2014 it sets everything up
+interactively (base URL, API key, target clients, copy/symlink):
+
+\`\`\`
+curl -fsSL <base_url>/api/skills/install.sh | sh
+\`\`\`
+
+\`<base_url>\` is their Exulu frontend URL (e.g. https://ai.open.de). They can
+create an API key at \`<base_url>/token\`.
+
+## Errors
+
+- install: \`403\` = no access to that skill; \`404\` = unknown name.
+- publish: \`403\` = you can see it but lack write access; \`409\` = the name is
+  taken by a skill you can't access.
+`;
+
 // src/exulu/routes.ts
 var REQUEST_SIZE_LIMIT = "50mb";
 var getExuluVersionNumber = async () => {
@@ -13520,6 +14029,7 @@ var createExpressRoutes = async (app, providers, tools, contexts, config, evals,
     }
     next();
   });
+  const rawZip = express2.raw({ type: ["application/zip", "application/octet-stream", "application/x-zip-compressed", "application/x-zip"], limit: "50mb" });
   console.log(`
     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557  \u2588\u2588\u2557\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2557      \u2588\u2588\u2557   \u2588\u2588\u2557
     \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u255A\u2588\u2588\u2557\u2588\u2588\u2554\u255D\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551      \u2588\u2588\u2551   \u2588\u2588\u2551
@@ -13745,7 +14255,7 @@ Mood: friendly and intelligent.
       });
       return;
     }
-    const uuid = randomUUID2();
+    const uuid = randomUUID3();
     const image_url = await uploadFile(Buffer.from(image_base64, "base64"), `${uuid}.png`, config, {
       contentType: "image/png"
     }, authenticationResult.user?.id, void 0, true);
@@ -13949,6 +14459,10 @@ Mood: friendly and intelligent.
       const providerapikey = resolved.apiKey;
       const resolvedLanguageModel = resolved.languageModel;
       const resolvedModelId = resolved.model.id;
+      const contextWindow = await resolveContextWindow({
+        modelId: resolved.model.id,
+        exuluProvider: isLiteLLMEnabled() ? void 0 : resolved.exuluProvider
+      });
       if (!!headers.stream) {
         const statistics = {
           label: agent.name,
@@ -13967,27 +14481,46 @@ Mood: friendly and intelligent.
         const instructions = customInstructions ? `${agent.instructions}
 
 ${customInstructions}` : agent.instructions;
-        const result = await provider.generateStream({
-          contexts,
-          agent,
-          user,
-          instructions,
-          session: headers.session,
-          message,
-          previousMessages,
-          currentTools: enabledTools,
-          currentSkills: enabledSkills,
-          approvedTools,
-          allExuluTools: tools,
-          languageModel: resolvedLanguageModel,
-          providerapikey,
-          toolConfigs: agent.tools,
-          exuluConfig: config,
-          req
-        });
+        if (headers.session) markStreamActive(headers.session);
+        let result;
+        try {
+          result = await provider.generateStream({
+            contexts,
+            agent,
+            user,
+            instructions,
+            session: headers.session,
+            message,
+            previousMessages,
+            currentTools: enabledTools,
+            currentSkills: enabledSkills,
+            approvedTools,
+            allExuluTools: tools,
+            languageModel: resolvedLanguageModel,
+            providerapikey,
+            toolConfigs: agent.tools,
+            exuluConfig: config,
+            req,
+            contextWindow,
+            disabledTools
+          });
+        } catch (err) {
+          if (headers.session) clearStreamActive(headers.session);
+          if (err instanceof ContextCompactionRequiredError) {
+            res.status(413).send(err.message);
+            return;
+          }
+          throw err;
+        }
         result.stream.consumeStream();
         result.stream.pipeUIMessageStreamToResponse(res, {
           messageMetadata: ({ part }) => {
+            if (part.type === "finish-step") {
+              return {
+                lastStepInputTokens: part.usage.inputTokens,
+                lastStepOutputTokens: part.usage.outputTokens
+              };
+            }
             if (part.type === "finish") {
               return {
                 totalTokens: part.totalUsage.totalTokens,
@@ -14004,22 +14537,20 @@ ${customInstructions}` : agent.instructions;
           sendSources: true,
           onError: (error) => {
             console.error("[EXULU] chat response error.", error);
-            if (error == null) {
-              return "unknown error";
-            }
-            if (typeof error === "string") {
-              return error;
-            }
-            if (error instanceof Error) {
-              return error.message;
-            }
-            return JSON.stringify(error);
+            if (headers.session) clearStreamActive(headers.session);
+            let message2;
+            if (error == null) message2 = "unknown error";
+            else if (typeof error === "string") message2 = error;
+            else if (error instanceof Error) message2 = error.message;
+            else message2 = JSON.stringify(error);
+            return mapStreamErrorMessage(message2);
           },
           generateMessageId: createIdGenerator({
             prefix: "msg_",
             size: 16
           }),
           onFinish: async ({ messages, isContinuation, isAborted, responseMessage }) => {
+            if (headers.session) clearStreamActive(headers.session);
             console.log(
               "[EXULU] onFinish",
               messages?.map((msg) => msg.parts?.map((part) => part.type === "text" ? part.text : null)).join("\n")
@@ -14081,33 +14612,129 @@ ${customInstructions}` : agent.instructions;
         const instructions = customInstructions ? `${agent.instructions}
 
 ${customInstructions}` : agent.instructions;
-        const response = await provider.generateSync({
-          contexts,
-          agent,
-          user,
-          req,
-          instructions,
-          session: headers.session,
-          inputMessages: [req.body.message],
-          currentTools: enabledTools,
-          currentSkills: enabledSkills,
-          allExuluTools: tools,
-          languageModel: resolvedLanguageModel,
-          providerapikey,
-          exuluConfig: config,
-          toolConfigs: agent.tools,
-          statistics: {
-            label: agent.name,
-            trigger: "agent"
-          },
-          onTokenUsage: async ({ inputTokens, outputTokens }) => {
+        let response;
+        try {
+          response = await provider.generateSync({
+            contexts,
+            agent,
+            user,
+            req,
+            instructions,
+            session: headers.session,
+            inputMessages: [req.body.message],
+            currentTools: enabledTools,
+            currentSkills: enabledSkills,
+            allExuluTools: tools,
+            languageModel: resolvedLanguageModel,
+            providerapikey,
+            exuluConfig: config,
+            toolConfigs: agent.tools,
+            contextWindow,
+            disabledTools,
+            statistics: {
+              label: agent.name,
+              trigger: "agent"
+            },
+            onTokenUsage: async ({ inputTokens, outputTokens }) => {
+            }
+          });
+        } catch (err) {
+          if (err instanceof ContextCompactionRequiredError) {
+            res.status(413).send(err.message);
+            return;
           }
-        });
+          throw err;
+        }
         res.status(200).json(response);
         return;
       }
     });
   };
+  const registerAgentCompactRoute = (slug) => {
+    app.post(slug + "/:instance", async (req, res) => {
+      const instance = req.params.instance;
+      if (!instance) {
+        res.status(400).json({ message: "Missing instance in request." });
+        return;
+      }
+      const sessionID = req.headers["session"] || null;
+      if (!sessionID) {
+        res.status(400).json({ message: "Missing session header." });
+        return;
+      }
+      const agent = await exuluApp.get().agent(instance);
+      if (!agent) {
+        res.status(404).json({ message: "Agent with id " + instance + " not found." });
+        return;
+      }
+      const authenticationResult = await requestValidators.authenticate(req);
+      if (!authenticationResult.user?.id) {
+        res.status(authenticationResult.code || 401).json({ detail: `${authenticationResult.message}` });
+        return;
+      }
+      const user = authenticationResult.user;
+      const hasAccessToAgent = await checkRecordAccess(agent, "read", user);
+      if (!hasAccessToAgent) {
+        res.status(401).json({ message: "You don't have access to this agent." });
+        return;
+      }
+      const { db } = await postgresClient();
+      const sessionRow = await db.from("agent_sessions").where({ id: sessionID }).first();
+      if (!sessionRow) {
+        res.status(404).json({ message: "Session not found for session ID: " + sessionID });
+        return;
+      }
+      const hasAccessToSession = await checkRecordAccess(sessionRow, "write", user);
+      if (!hasAccessToSession) {
+        res.status(401).json({ message: "You don't have access to this session." });
+        return;
+      }
+      if (isStreamActive(sessionID)) {
+        res.status(409).json({ message: "A response is still streaming for this session \u2014 try again when it finishes." });
+        return;
+      }
+      const overrideModelId = req.headers["x-exulu-model-override"];
+      const modelId = overrideModelId ?? agent.model;
+      if (!modelId) {
+        res.status(400).json({ message: `Agent ${agent.name} (${agent.id}) has no model configured.` });
+        return;
+      }
+      let resolved;
+      try {
+        resolved = await resolveModel({ modelId, user, providers, agent });
+      } catch (err) {
+        if (err instanceof ResolveModelError) {
+          const status = err.code === "MODEL_FORBIDDEN" ? 403 : 400;
+          res.status(status).json({ message: err.message, code: err.code });
+          return;
+        }
+        throw err;
+      }
+      const contextWindow = await resolveContextWindow({
+        modelId: resolved.model.id,
+        exuluProvider: isLiteLLMEnabled() ? void 0 : resolved.exuluProvider
+      });
+      const steer = typeof req.body?.steer === "string" ? req.body.steer : void 0;
+      try {
+        const result = await compactSession({
+          sessionID,
+          user,
+          languageModel: resolved.languageModel,
+          contextWindow,
+          steer,
+          modelId: resolved.model.id
+        });
+        res.json(result);
+      } catch (err) {
+        if (err instanceof CompactionInsufficientError) {
+          res.status(422).send(err.message);
+          return;
+        }
+        console.error("[EXULU] compactSession failed.", err);
+        res.status(500).json({ message: err instanceof Error ? err.message : "Compaction failed." });
+      }
+    });
+  };
   providers.forEach((provider) => {
     const slug = provider.slug;
     if (!slug) return;
@@ -14116,6 +14743,14 @@ ${customInstructions}` : agent.instructions;
   if (isLiteLLMEnabled() && providers.length > 0) {
     registerAgentRunRoute("/agents/litellm/run", providers[0]);
   }
+  providers.forEach((provider) => {
+    const slug = provider.slug;
+    if (!slug) return;
+    registerAgentCompactRoute(slug.replace(/\/run$/, "/compact"));
+  });
+  if (isLiteLLMEnabled() && providers.length > 0) {
+    registerAgentCompactRoute("/agents/litellm/compact");
+  }
   app.post("/agents/suggestions/:agentId", async (req, res) => {
     const agentId = req.params.agentId;
     if (!agentId) {
@@ -14467,7 +15102,7 @@ ${customInstructions}` : agent.instructions;
     const keys = [];
     const revisedPrompts = [];
     for (const img of images) {
-      const filename = `${randomUUID2()}.${img.extension}`;
+      const filename = `${randomUUID3()}.${img.extension}`;
       const key = `sessions/${sessionId}/images/${toolCallId}/${filename}`;
       const fullKey = await uploadFile(
         img.buffer,
@@ -14755,7 +15390,7 @@ ${style.markdown}` : params.prompt;
       (d) => `- ${d.presignedUrl} (prompt: "${d.prompt}", model: ${d.model}${d.styleName ? `, style: ${d.styleName}` : ""})`
     );
     const messageText = "The user generated and selected the following image(s) in this chat:\n" + lines.join("\n");
-    const messageId = randomUUID2();
+    const messageId = randomUUID3();
     const uiMessage = {
       id: messageId,
       role: "system",
@@ -15047,7 +15682,9 @@ ${style.markdown}` : params.prompt;
     const budget_duration = String(body?.budget_duration ?? "");
     if (!Number.isFinite(max_budget) || max_budget <= 0) return null;
     if (!BUDGET_ALLOWED_DURATIONS.has(budget_duration)) return null;
-    return { max_budget, budget_duration };
+    const reset = parseResetAt(body?.budget_reset_at);
+    if (!reset.valid) return null;
+    return { max_budget, budget_duration, budget_reset_at: reset.value };
   };
   const parseBudgetSettingsBody = (body) => {
     if (!body || typeof body !== "object") return null;
@@ -15117,7 +15754,7 @@ ${style.markdown}` : params.prompt;
       }
       const body = parseBudgetBody(req.body);
       if (!body) {
-        res.status(400).json({ detail: "Invalid budget (max_budget, budget_duration)." });
+        res.status(400).json({ detail: "Invalid budget (max_budget, budget_duration, budget_reset_at)." });
         return;
       }
       const entityIds = Array.isArray(req.body?.entityIds) ? req.body.entityIds : [];
@@ -15129,7 +15766,7 @@ ${style.markdown}` : params.prompt;
       for (const id of entityIds) {
         const tag = budgetTagFor(entityType, id);
         try {
-          await upsertBudget(tag, body.max_budget, body.budget_duration);
+          await upsertBudget(tag, body.max_budget, body.budget_duration, body.budget_reset_at);
           results.push({ entityId: String(id), ok: true });
         } catch (err) {
           results.push({
@@ -15154,12 +15791,12 @@ ${style.markdown}` : params.prompt;
       }
       const body = parseBudgetBody(req.body);
       if (!body) {
-        res.status(400).json({ detail: "Invalid budget (max_budget, budget_duration)." });
+        res.status(400).json({ detail: "Invalid budget (max_budget, budget_duration, budget_reset_at)." });
         return;
       }
       const tag = budgetTagFor(entityType, req.params.entityId ?? "");
       try {
-        await upsertBudget(tag, body.max_budget, body.budget_duration);
+        await upsertBudget(tag, body.max_budget, body.budget_duration, body.budget_reset_at);
         const info = await tagInfo([tag]);
         res.status(200).json({ budget: info[tag] ?? null });
       } catch (err) {
@@ -15622,6 +16259,199 @@ ${style.markdown}` : params.prompt;
     }
     return root;
   }
+  app.get("/skills/agent/bootstrap", async (_req, res) => {
+    try {
+      const zip = new JSZip3();
+      zip.file("exulu-skills/SKILL.md", BOOTSTRAP_SKILL_MD);
+      zip.file("exulu-skills/references/clients.json", BOOTSTRAP_CLIENTS_JSON);
+      zip.file("exulu-skills/scripts/exulu", BOOTSTRAP_EXULU_SH, {
+        unixPermissions: 493
+      });
+      const buffer = await zip.generateAsync({
+        type: "nodebuffer",
+        platform: "UNIX"
+      });
+      res.setHeader("Content-Type", "application/zip");
+      res.setHeader("Content-Disposition", 'attachment; filename="exulu-skills.zip"');
+      res.send(buffer);
+    } catch (err) {
+      console.error("[SKILLS] Failed to build bootstrap zip", err);
+      res.status(500).json({ detail: "Failed to build bootstrap skill." });
+    }
+  });
+  app.get("/skills/registry", async (req, res) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code ?? 401).json({ detail: authResult.message });
+      return;
+    }
+    const { db } = await postgresClient();
+    const tag = typeof req.query.tag === "string" ? req.query.tag : void 0;
+    const all = await db("skills").select("*");
+    const readable = await filterReadableSkills(db, all, authResult.user);
+    const skills = readable.filter((s) => {
+      if (!tag) return true;
+      const tags = Array.isArray(s.tags) ? s.tags : [];
+      return tags.includes(tag);
+    }).map((s) => ({
+      name: s.name,
+      description: s.description ?? "",
+      tags: Array.isArray(s.tags) ? s.tags : [],
+      current_version: s.current_version ?? 1,
+      updated_at: s.updatedAt ?? s.updated_at ?? null
+    }));
+    res.json({ skills });
+  });
+  app.get("/skills/registry/:name/download", async (req, res) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code ?? 401).json({ detail: authResult.message });
+      return;
+    }
+    const { db } = await postgresClient();
+    const skill = await resolveSkillByName(db, req.params.name);
+    if (!skill) {
+      res.status(404).json({ detail: "Skill not found." });
+      return;
+    }
+    if (!await canAccessSkill(db, skill, "read", authResult.user)) {
+      res.status(403).json({ detail: "You don't have access to this skill." });
+      return;
+    }
+    const vQuery = req.query.version;
+    const version = !vQuery || vQuery === "latest" ? skill.current_version ?? 1 : Number(vQuery);
+    if (!Number.isFinite(version) || version < 1) {
+      res.status(400).json({ detail: "Invalid version." });
+      return;
+    }
+    const safeName = String(skill.name ?? "skill").replace(/[^a-zA-Z0-9-_]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
+    const versionPrefix = `skills/${skill.id}/v${version}/`;
+    const files = await listS3ObjectsByPrefix(versionPrefix, config);
+    if (files.length === 0) {
+      res.status(404).json({ detail: `Version v${version} has no files.` });
+      return;
+    }
+    const zip = new JSZip3();
+    for (const file of files) {
+      const idx = file.key.indexOf(versionPrefix);
+      const rel = idx >= 0 ? file.key.slice(idx + versionPrefix.length) : file.key;
+      if (!rel) continue;
+      const bytes = await getS3ObjectBytes(file.key, config);
+      zip.file(`${safeName}/${rel}`, bytes);
+    }
+    const buffer = await zip.generateAsync({ type: "nodebuffer" });
+    res.setHeader("Content-Type", "application/zip");
+    res.setHeader("Content-Disposition", `attachment; filename="${safeName}.skill"`);
+    res.send(buffer);
+  });
+  app.post("/skills/registry/:name", rawZip, async (req, res) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code ?? 401).json({ detail: authResult.message });
+      return;
+    }
+    const name = req.params.name;
+    const bytes = req.body;
+    if (!Buffer.isBuffer(bytes) || bytes.length === 0) {
+      res.status(400).json({ detail: "Empty body. Send the skill as a zip/.skill payload." });
+      return;
+    }
+    const { db } = await postgresClient();
+    const existing = await resolveSkillByName(db, name);
+    if (existing) {
+      const canWrite = await canAccessSkill(db, existing, "write", authResult.user);
+      if (canWrite) {
+        const nextVersion = (existing.current_version ?? 1) + 1;
+        try {
+          await extractBundleToVersion({ bytes, skillId: existing.id, version: nextVersion, config });
+        } catch (err) {
+          if (err instanceof BundleValidationError) {
+            res.status(400).json({ detail: err.message });
+            return;
+          }
+          console.error("[SKILLS] publish (new version) failed", err);
+          res.status(500).json({ detail: "Failed to publish new version." });
+          return;
+        }
+        const history = Array.isArray(existing.history) ? existing.history : [];
+        await db("skills").where({ id: existing.id }).update({
+          current_version: nextVersion,
+          history: JSON.stringify([
+            ...history,
+            { version: nextVersion, created_at: (/* @__PURE__ */ new Date()).toISOString(), label: "Published from agent" }
+          ])
+        });
+        res.json({ name, version: nextVersion, created: false });
+        return;
+      } else {
+        const canRead = await canAccessSkill(db, existing, "read", authResult.user);
+        if (!canRead) {
+          res.status(409).json({ detail: "That name is unavailable." });
+          return;
+        }
+        res.status(403).json({ detail: "You don't have write access to this skill." });
+        return;
+      }
+    }
+    const meta = await parseSkillFrontmatter(bytes);
+    const skillId = randomUUID3();
+    try {
+      await extractBundleToVersion({ bytes, skillId, version: 1, config });
+    } catch (err) {
+      if (err instanceof BundleValidationError) {
+        res.status(400).json({ detail: err.message });
+        return;
+      }
+      console.error("[SKILLS] publish (create) failed", err);
+      res.status(500).json({ detail: "Failed to publish skill." });
+      return;
+    }
+    try {
+      await db("skills").insert({
+        id: skillId,
+        name,
+        description: meta.description ?? "",
+        s3folder: `skills/${skillId}`,
+        tags: JSON.stringify([]),
+        usage_count: 0,
+        favorite_count: 0,
+        current_version: 1,
+        history: JSON.stringify([
+          { version: 1, created_at: (/* @__PURE__ */ new Date()).toISOString(), label: "Published from agent" }
+        ]),
+        rights_mode: "private",
+        created_by: authResult.user.id
+      });
+    } catch (err) {
+      res.status(409).json({ detail: "That name is unavailable." });
+      return;
+    }
+    res.json({ name, version: 1, created: true });
+  });
+  app.get("/skills/registry/:name", async (req, res) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code ?? 401).json({ detail: authResult.message });
+      return;
+    }
+    const { db } = await postgresClient();
+    const skill = await resolveSkillByName(db, req.params.name);
+    if (!skill) {
+      res.status(404).json({ detail: "Skill not found." });
+      return;
+    }
+    if (!await canAccessSkill(db, skill, "read", authResult.user)) {
+      res.status(403).json({ detail: "You don't have access to this skill." });
+      return;
+    }
+    res.json({
+      name: skill.name,
+      description: skill.description ?? "",
+      tags: Array.isArray(skill.tags) ? skill.tags : [],
+      current_version: skill.current_version ?? 1,
+      history: Array.isArray(skill.history) ? skill.history : []
+    });
+  });
   app.post("/skills/:skillId/init", async (req, res) => {
     const authResult = await requestValidators.authenticate(req);
     if (!authResult.user?.id) {
@@ -15669,8 +16499,8 @@ ${style.markdown}` : params.prompt;
     }
     const { skillId } = req.params;
     const { extension, contentType } = req.body ?? {};
-    if (extension !== ".zip" && extension !== ".md") {
-      res.status(400).json({ detail: 'extension must be ".zip" or ".md".' });
+    if (extension !== ".zip" && extension !== ".md" && extension !== ".skill") {
+      res.status(400).json({ detail: 'extension must be ".zip", ".md", or ".skill".' });
       return;
     }
     if (!contentType || typeof contentType !== "string") {
@@ -15683,7 +16513,7 @@ ${style.markdown}` : params.prompt;
       res.status(404).json({ detail: "Skill not found." });
       return;
     }
-    const stagingKey = `user_${authResult.user.id}/skills/_staging/${randomUUID2()}${extension}`;
+    const stagingKey = `user_${authResult.user.id}/skills/_staging/${randomUUID3()}${extension}`;
     const fullKey = config.fileUploads?.s3prefix ? `${config.fileUploads.s3prefix.replace(/\/$/, "")}/${stagingKey}` : stagingKey;
     const uploadUrl = await getS3SignedUploadUrl(fullKey, contentType, config);
     res.json({ uploadUrl, stagingKey });
@@ -15809,19 +16639,22 @@ ${style.markdown}` : params.prompt;
     }
     const versionPrefix = `skills/${skillId}/v${version}/`;
     const files = await listS3ObjectsByPrefix(versionPrefix, config);
-    const zip = new JSZip2();
+    const asSkill = req.query.format === "skill";
+    const safeName = String(skill.name ?? "skill").replace(/[^a-zA-Z0-9-_]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
+    const zip = new JSZip3();
     let fileCount = 0;
     for (const file of files) {
       const prefixIndex = file.key.indexOf(versionPrefix);
       const relativePath = prefixIndex >= 0 ? file.key.slice(prefixIndex + versionPrefix.length) : file.key;
       if (!relativePath) continue;
       const bytes = await getS3ObjectBytes(file.key, config);
-      zip.file(relativePath, bytes);
+      const archivePath = asSkill ? `${safeName}/${relativePath}` : relativePath;
+      zip.file(archivePath, bytes);
       fileCount += 1;
     }
     const exportedAt = (/* @__PURE__ */ new Date()).toISOString();
     zip.file(
-      "version.txt",
+      asSkill ? `${safeName}/version.txt` : "version.txt",
       [
         `Skill: ${skill.name ?? skillId}`,
         `Skill id: ${skillId}`,
@@ -15832,13 +16665,9 @@ ${style.markdown}` : params.prompt;
       ].join("\n")
     );
     const buffer = await zip.generateAsync({ type: "nodebuffer" });
-    const safeName = String(skill.name ?? "skill").replace(/[^a-zA-Z0-9-_]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
-    const filename = `${safeName}-v${version}.zip`;
+    const filename = asSkill ? `${safeName}.skill` : `${safeName}-v${version}.zip`;
     res.setHeader("Content-Type", "application/zip");
-    res.setHeader(
-      "Content-Disposition",
-      `attachment; filename="${filename}"`
-    );
+    res.setHeader("Content-Disposition", `attachment; filename="${filename}"`);
     res.send(buffer);
   });
   app.post("/skills/:skillId/sign", async (req, res) => {
@@ -16138,6 +16967,12 @@ ${style.markdown}` : params.prompt;
     const fullSessionPrefix = `${generalPrefix}${userSessionPrefix}`;
     return { userSessionPrefix, fullSessionPrefix };
   }
+  const loadSessionFilesAuth = async (req, res, sessionId, rights) => {
+    const authed = await loadAuthedSession(req, res, sessionId, rights);
+    if (!authed) return null;
+    const ownerId = authed.session.user ?? authed.user.id;
+    return { ...authed, ownerId, ...buildSessionPrefixes(ownerId, sessionId) };
+  };
   function sanitizeFilename(name) {
     const trimmed = name.trim();
     if (!trimmed) return "";
@@ -16146,11 +16981,6 @@ ${style.markdown}` : params.prompt;
     return trimmed.replace(/[\\/]/g, "_");
   }
   app.get("/sessions/:sessionId/files", async (req, res) => {
-    const authResult = await requestValidators.authenticate(req);
-    if (!authResult.user?.id) {
-      res.status(authResult.code ?? 401).json({ detail: authResult.message });
-      return;
-    }
     const sessionId = req.params.sessionId;
     if (!sessionId) {
       res.status(400).json({ detail: "Missing sessionId in path." });
@@ -16160,10 +16990,9 @@ ${style.markdown}` : params.prompt;
       res.status(500).json({ detail: "File uploads are not configured." });
       return;
     }
-    const { userSessionPrefix } = buildSessionPrefixes(
-      authResult.user.id,
-      sessionId
-    );
+    const authed = await loadSessionFilesAuth(req, res, sessionId, "read");
+    if (!authed) return;
+    const { userSessionPrefix } = authed;
     let objects;
     try {
       objects = await listS3ObjectsByPrefix(userSessionPrefix, config);
@@ -16193,11 +17022,6 @@ ${style.markdown}` : params.prompt;
   app.post(
     "/sessions/:sessionId/files/upload-sign",
     async (req, res) => {
-      const authResult = await requestValidators.authenticate(req);
-      if (!authResult.user?.id) {
-        res.status(authResult.code ?? 401).json({ detail: authResult.message });
-        return;
-      }
       const sessionId = req.params.sessionId;
       if (!sessionId) {
         res.status(400).json({ detail: "Missing sessionId in path." });
@@ -16207,6 +17031,8 @@ ${style.markdown}` : params.prompt;
         res.status(500).json({ detail: "File uploads are not configured." });
         return;
       }
+      const authed = await loadSessionFilesAuth(req, res, sessionId, "write");
+      if (!authed) return;
       const { filename, contentType } = req.body ?? {};
       if (!filename || typeof filename !== "string") {
         res.status(400).json({ detail: "Missing filename in request body." });
@@ -16221,11 +17047,7 @@ ${style.markdown}` : params.prompt;
         res.status(400).json({ detail: "Missing contentType in request body." });
         return;
       }
-      const { userSessionPrefix, fullSessionPrefix } = buildSessionPrefixes(
-        authResult.user.id,
-        sessionId
-      );
-      const fullKey = `${fullSessionPrefix}${safeName}`;
+      const fullKey = `${authed.fullSessionPrefix}${safeName}`;
       const uploadUrl = await getS3SignedUploadUrl(fullKey, contentType, config);
       res.json({ uploadUrl, key: fullKey });
     }
@@ -16233,11 +17055,6 @@ ${style.markdown}` : params.prompt;
   app.post(
     "/sessions/:sessionId/files/sync-to-sandbox",
     async (req, res) => {
-      const authResult = await requestValidators.authenticate(req);
-      if (!authResult.user?.id) {
-        res.status(authResult.code ?? 401).json({ detail: authResult.message });
-        return;
-      }
       const sessionId = req.params.sessionId;
       if (!sessionId) {
         res.status(400).json({ detail: "Missing sessionId in path." });
@@ -16248,18 +17065,16 @@ ${style.markdown}` : params.prompt;
         res.status(400).json({ detail: "Missing key in request body." });
         return;
       }
-      const { fullSessionPrefix } = buildSessionPrefixes(
-        authResult.user.id,
-        sessionId
-      );
-      if (!key.startsWith(fullSessionPrefix)) {
+      const authed = await loadSessionFilesAuth(req, res, sessionId, "write");
+      if (!authed) return;
+      if (!key.startsWith(authed.fullSessionPrefix)) {
         res.status(403).json({ detail: "Key does not belong to this session." });
         return;
       }
       try {
         const result = await downloadKeyIntoSandbox({
           sessionId,
-          userId: authResult.user.id,
+          userId: authed.ownerId,
           fullS3Key: key,
           config
         });
@@ -16273,11 +17088,6 @@ ${style.markdown}` : params.prompt;
   app.delete(
     "/sessions/:sessionId/files",
     async (req, res) => {
-      const authResult = await requestValidators.authenticate(req);
-      if (!authResult.user?.id) {
-        res.status(authResult.code ?? 401).json({ detail: authResult.message });
-        return;
-      }
       const sessionId = req.params.sessionId;
       if (!sessionId) {
         res.status(400).json({ detail: "Missing sessionId in path." });
@@ -16288,11 +17098,9 @@ ${style.markdown}` : params.prompt;
         res.status(400).json({ detail: "Missing or invalid 'key' query parameter." });
         return;
       }
-      const { fullSessionPrefix } = buildSessionPrefixes(
-        authResult.user.id,
-        sessionId
-      );
-      if (!key.startsWith(fullSessionPrefix)) {
+      const authed = await loadSessionFilesAuth(req, res, sessionId, "write");
+      if (!authed) return;
+      if (!key.startsWith(authed.fullSessionPrefix)) {
         res.status(403).json({ detail: "Key does not belong to this session." });
         return;
       }
@@ -16311,11 +17119,6 @@ ${style.markdown}` : params.prompt;
       if (!req.headers.authorization && typeof req.query.auth === "string") {
         req.headers.authorization = `Bearer ${req.query.auth}`;
       }
-      const authResult = await requestValidators.authenticate(req);
-      if (!authResult.user?.id) {
-        res.status(authResult.code ?? 401).json({ detail: authResult.message });
-        return;
-      }
       const sessionId = req.params.sessionId;
       if (!sessionId) {
         res.status(400).json({ detail: "Missing sessionId in path." });
@@ -16326,11 +17129,9 @@ ${style.markdown}` : params.prompt;
         res.status(400).json({ detail: "Missing or invalid 'key' query parameter." });
         return;
       }
-      const { fullSessionPrefix } = buildSessionPrefixes(
-        authResult.user.id,
-        sessionId
-      );
-      if (!key.startsWith(fullSessionPrefix)) {
+      const authed = await loadSessionFilesAuth(req, res, sessionId, "read");
+      if (!authed) return;
+      if (!key.startsWith(authed.fullSessionPrefix)) {
         res.status(403).json({ detail: "Key does not belong to this session." });
         return;
       }
@@ -16434,7 +17235,7 @@ ${style.markdown}` : params.prompt;
         `  - tracking.json         tracking events linked to the user`,
         ``
       ].join("\n");
-      const zip = new JSZip2();
+      const zip = new JSZip3();
       zip.file("README.txt", readme);
       zip.file("user_data.json", JSON.stringify(userExport, null, 2));
       zip.file("sessions.json", JSON.stringify(sessionsWithMessages, null, 2));
@@ -16714,7 +17515,7 @@ function buildUnifiedDiff(fromLines, toLines, fromLabel, toLabel) {
 
 // src/mcp/index.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import "express";
@@ -16819,7 +17620,7 @@ var ExuluMCP = class {
             throw new Error("Tool not found in converted tools array.");
           }
           const iterator = await convertedTool.execute(inputs, {
-            toolCallId: tool2.id + "_" + randomUUID3(),
+            toolCallId: tool2.id + "_" + randomUUID4(),
             messages: []
           });
           let result;
@@ -17011,7 +17812,7 @@ var ExuluMCP = class {
         transport = this.transports[sessionId];
       } else if (!sessionId && isInitializeRequest(req.body)) {
         transport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID3(),
+          sessionIdGenerator: () => randomUUID4(),
           onsessioninitialized: (sessionId2) => {
             this.transports[sessionId2] = transport;
           }
@@ -17992,7 +18793,7 @@ var ExuluEval = class {
 
 // src/templates/evals/index.ts
 import { z as z5 } from "zod";
-import { generateText as generateText7, Output as Output2 } from "ai";
+import { generateText as generateText8, Output as Output2 } from "ai";
 var llmAsJudgeEval = () => {
   if (process.env.REDIS_HOST?.length && process.env.REDIS_PORT?.length) {
     return new ExuluEval({
@@ -18037,7 +18838,7 @@ var llmAsJudgeEval = () => {
           rbacBypass: true
         });
         console.log("[EXULU] prompt", prompt);
-        const { output } = await generateText7({
+        const { output } = await generateText8({
           temperature: 0,
           model: resolved.languageModel,
           system: "",
@@ -18460,7 +19261,7 @@ After asking a question, use the Question Read tool to check if the user has ans
 
 // src/templates/tools/question/question-ask.ts
 import z7 from "zod";
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 var AnswerOptionSchema = z7.object({
   id: z7.string().describe("Unique identifier for the answer option"),
   text: z7.string().describe("The text of the answer option")
@@ -18514,15 +19315,15 @@ var QuestionAskTool = new ExuluTool({
       throw new Error("You don't have access to this session " + session.id + ".");
     }
     const answerOptionsWithIds = answerOptions.map((text) => ({
-      id: randomUUID4(),
+      id: randomUUID5(),
       text
     }));
     answerOptionsWithIds.push({
-      id: randomUUID4(),
+      id: randomUUID5(),
       text: "None of the above..."
     });
     const newQuestion = {
-      id: randomUUID4(),
+      id: randomUUID5(),
       question,
       answerOptions: answerOptionsWithIds,
       status: "pending"
@@ -21303,10 +22104,10 @@ var MarkdownChunker = class {
 // ee/python/documents/processing/doc_processor.ts
 import * as fs3 from "fs";
 import * as path from "path";
-import { generateText as generateText8, Output as Output3 } from "ai";
+import { generateText as generateText9, Output as Output3 } from "ai";
 import { z as z12 } from "zod";
 import pLimit from "p-limit";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import * as mammoth from "mammoth";
 import TurndownService from "turndown";
 import WordExtractor from "word-extractor";
@@ -21760,7 +22561,7 @@ If the page contains a flow-chart, schematic, technical drawing or control board
 
 ### 7. Only populate \`corrected_text\` when \`needs_correction\` is true. If the OCR output is accurate, return \`needs_correction: false\` and \`corrected_content: null\`.
 `;
-  const result = await generateText8({
+  const result = await generateText9({
     model,
     output: Output3.object({
       schema: z12.object({
@@ -22181,7 +22982,7 @@ var loadFile = async (file, name, tempDir) => {
   if (!fileType) {
     throw new Error("[EXULU] File name does not include extension, extension is required for document processing.");
   }
-  const UUID = randomUUID5();
+  const UUID = randomUUID6();
   let buffer;
   if (Buffer.isBuffer(file)) {
     filePath = path.join(tempDir, `${UUID}.${fileType}`);
@@ -22211,7 +23012,7 @@ async function documentProcessor({
   if (!license["advanced-document-processing"]) {
     throw new Error("Advanced document processing is an enterprise feature, please add a valid Exulu enterprise license key to use it.");
   }
-  const uuid = randomUUID5();
+  const uuid = randomUUID6();
   const tempDir = path.join(process.cwd(), "temp", uuid);
   const localFilesAndFoldersToDelete = [tempDir];
   console.log(`[EXULU] Temporary directory for processing document ${name}: ${tempDir}`);