@exulu/backend 2.1.0 → 2.2.0

package/dist/index.js

@@ -54,6 +54,7 @@ import {
   mapStreamErrorMessage,
   oauthRegistry,
   oauthTokenStore,
+  parseResetAt,
   postgresClient,
   provisionDefaultUserBudget,
   reportSystemDependencies,
@@ -73,7 +74,7 @@ import {
   upsertBudget,
   waitForLiteLLMReady,
   withRetry
-} from "./chunk-RVZWZNWG.js";
+} from "./chunk-Y7JPNBFM.js";
 import {
   findLiteLLMModel
 } from "./chunk-7CCMW3IW.js";
@@ -11134,21 +11135,7 @@ function isOsJunkPath(path2) {
   const basename = path2.split("/").pop() ?? "";
   return basename === ".DS_Store" || basename === "Thumbs.db" || basename === "desktop.ini";
 }
-async function extractBundleToS3(opts) {
-  const { bytes, skillId, isZip, config } = opts;
-  if (!isZip) {
-    await uploadFile(
-      bytes,
-      `skills/${skillId}/v1/SKILL.md`,
-      config,
-      { contentType: "text/markdown" },
-      void 0,
-      void 0,
-      true
-      // global=true so the key isn't user-prefixed (skill files are shared)
-    );
-    return { filesCount: 1 };
-  }
+async function extractZipToPrefix(bytes, prefix, config) {
   let zip;
   try {
     zip = await JSZip.loadAsync(bytes);
@@ -11212,7 +11199,7 @@ async function extractBundleToS3(opts) {
   }
   let filesCount = 0;
   for (const { relPath, content } of prepared) {
-    const s3Key = `skills/${skillId}/v1/${relPath}`;
+    const s3Key = `${prefix}${relPath}`;
     await uploadFile(
       content,
       s3Key,
@@ -11221,12 +11208,76 @@ async function extractBundleToS3(opts) {
       void 0,
       void 0,
       true
-      // global=true — see SKILL.md case above
+      // global=true — skill files are shared across users
     );
     filesCount += 1;
   }
   return { filesCount };
 }
+async function extractBundleToS3(opts) {
+  const { bytes, skillId, isZip, config } = opts;
+  if (!isZip) {
+    await uploadFile(
+      bytes,
+      `skills/${skillId}/v1/SKILL.md`,
+      config,
+      { contentType: "text/markdown" },
+      void 0,
+      void 0,
+      true
+      // global=true so the key isn't user-prefixed (skill files are shared)
+    );
+    return { filesCount: 1 };
+  }
+  return extractZipToPrefix(bytes, `skills/${skillId}/v1/`, config);
+}
+async function extractBundleToVersion(opts) {
+  const { bytes, skillId, version, config } = opts;
+  return extractZipToPrefix(bytes, `skills/${skillId}/v${version}/`, config);
+}
+
+// src/skills/frontmatter.ts
+import JSZip2 from "jszip";
+function parseFrontmatter(md) {
+  const match = /^?---\r?\n([\s\S]*?)\r?\n---/.exec(md);
+  if (!match) return {};
+  const block = match[1];
+  const out = {};
+  for (const line of block.split(/\r?\n/)) {
+    const m = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(line);
+    if (!m) continue;
+    const key = m[1];
+    let v = m[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'")) {
+      v = v.slice(1, -1);
+    }
+    out[key] = v;
+  }
+  return out;
+}
+async function parseSkillFrontmatter(zipBytes) {
+  let zip;
+  try {
+    zip = await JSZip2.loadAsync(zipBytes);
+  } catch {
+    return {};
+  }
+  const paths = [];
+  zip.forEach((p, entry) => {
+    if (!entry.dir) paths.push(p);
+  });
+  const heads = new Set(paths.map((p) => p.split("/")[0]).filter(Boolean));
+  let strip = (p) => p;
+  if (heads.size === 1) {
+    const head = [...heads][0] + "/";
+    if (paths.every((p) => p.startsWith(head))) strip = (p) => p.slice(head.length);
+  }
+  const skillPath = paths.find((p) => strip(p) === "SKILL.md");
+  if (!skillPath) return {};
+  const md = await zip.file(skillPath).async("string");
+  const fm = parseFrontmatter(md);
+  return { name: fm.name, description: fm.description };
+}
 
 // src/sessions/pdf-preview-cache.ts
 import { exec } from "child_process";
@@ -11306,7 +11357,7 @@ import OpenAI from "openai";
 import fs2 from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
 import "@opentelemetry/api";
-import JSZip2 from "jszip";
+import JSZip3 from "jszip";
 import { createIdGenerator } from "ai";
 import cookieParser from "cookie-parser";
 
@@ -13763,6 +13814,148 @@ var contentHeadersFor = (key, contentType, filename) => {
 };
 var getSharedArtifactByName = (db, name) => db("shared_artifacts").where({ name }).first();
 
+// src/skills/skill-access.ts
+async function resolveSkillByName(db, name) {
+  const row = await db("skills").where({ name }).first();
+  return row ?? null;
+}
+async function canAccessSkill(db, skill, action, user) {
+  const rbac = await RBACResolver(db, "skill", skill.id, skill.rights_mode || "private");
+  return checkRecordAccess({ ...skill, RBAC: rbac }, action, user);
+}
+async function filterReadableSkills(db, skills, user) {
+  const out = [];
+  for (const s of skills) {
+    if (await canAccessSkill(db, s, "read", user)) out.push(s);
+  }
+  return out;
+}
+
+// src/skills/bootstrap/clients.ts
+var CLIENT_MANIFEST = [
+  { id: "agents", dir: ".agents/skills" },
+  // cross-agent standard (symlink canonical store)
+  { id: "claude", dir: ".claude/skills" },
+  { id: "windsurf", dir: ".windsurf/skills" },
+  { id: "continue", dir: ".continue/skills" },
+  { id: "roo", dir: ".roo/skills" },
+  { id: "kilocode", dir: ".kilocode/skills" },
+  { id: "crush", dir: ".crush/skills" },
+  { id: "goose", dir: ".goose/skills" },
+  { id: "qwen", dir: ".qwen/skills" },
+  { id: "iflow", dir: ".iflow/skills" },
+  { id: "junie", dir: ".junie/skills" },
+  { id: "kiro", dir: ".kiro/skills" },
+  { id: "trae", dir: ".trae/skills" },
+  { id: "augment", dir: ".augment/skills" },
+  { id: "factory", dir: ".factory/skills" },
+  { id: "devin", dir: ".devin/skills" },
+  { id: "openhands", dir: ".openhands/skills" },
+  { id: "pi", dir: ".pi/skills" },
+  { id: "cortex", dir: ".cortex/skills" },
+  { id: "zencoder", dir: ".zencoder/skills" },
+  { id: "codebuddy", dir: ".codebuddy/skills" },
+  { id: "codestudio", dir: ".codestudio/skills" },
+  { id: "commandcode", dir: ".commandcode/skills" },
+  { id: "codemaker", dir: ".codemaker/skills" },
+  { id: "codeartsdoer", dir: ".codeartsdoer/skills" },
+  { id: "lingma", dir: ".lingma/skills" },
+  { id: "qoder", dir: ".qoder/skills" },
+  { id: "rovodev", dir: ".rovodev/skills" },
+  { id: "moxby", dir: ".moxby/skills" },
+  { id: "mux", dir: ".mux/skills" },
+  { id: "neovate", dir: ".neovate/skills" },
+  { id: "ona", dir: ".ona/skills" },
+  { id: "pochi", dir: ".pochi/skills" },
+  { id: "reasonix", dir: ".reasonix/skills" },
+  { id: "terramind", dir: ".terramind/skills" },
+  { id: "tinycloud", dir: ".tinycloud/skills" },
+  { id: "vibe", dir: ".vibe/skills" },
+  { id: "adal", dir: ".adal/skills" },
+  { id: "aider-desk", dir: ".aider-desk/skills" },
+  { id: "autohand", dir: ".autohand/skills" },
+  { id: "bob", dir: ".bob/skills" },
+  { id: "hermes", dir: ".hermes/skills" },
+  { id: "inferencesh", dir: ".inferencesh/skills" },
+  { id: "jazz", dir: ".jazz/skills" },
+  { id: "kode", dir: ".kode/skills" },
+  { id: "mcpjam", dir: ".mcpjam/skills" },
+  { id: "forge", dir: ".forge/skills" },
+  { id: "tabnine", dir: ".tabnine/agent/skills" }
+  // exception: nested under agent/
+];
+
+// src/skills/bootstrap/exulu-sh.generated.ts
+var EXULU_SH_B64 = "IyEvYmluL3NoCiMgZXh1bHUg4oCUIGhlbHBlciBmb3IgdGhlIEV4dWx1IGNlbnRyYWwgc2tpbGwgbGlicmFyeS4gVGhlIGFnZW50IGludm9rZXMgdGhpcwojIChuZXZlciByYXcgY3VybCk6IHRoZSB0b2tlbiBpcyByZWFkIGZyb20gdGhlIGNvbmZpZyBmaWxlIGhlcmUgYW5kIHNlbnQgdmlhCiMgYHgtYXBpLWtleTogQmVhcmVyYCwgc28gaXQgbmV2ZXIgZW50ZXJzIHRoZSBtb2RlbCBjb250ZXh0LiBDbGllbnQgZmFuLW91dAojIChjb3B5L3N5bWxpbmsgYWNyb3NzIGFnZW50IGNsaWVudHMpIGlzIGRldGVybWluaXN0aWMuCnNldCAtZXUKCkNPTkZJR19ESVI9IiRIT01FLy5jb25maWcvZXh1bHUiCkNPTkZJR19GSUxFPSIkQ09ORklHX0RJUi9za2lsbHMuanNvbiIKCmRpZSgpIHsgcHJpbnRmICdleHVsdTogJXNcbicgIiQqIiA+JjI7IGV4aXQgMTsgfQppbmZvKCkgeyBwcmludGYgJyVzXG4nICIkKiIgPiYyOyB9Cgpqc29uX3N0cigpIHsgIyBqc29uX3N0ciA8a2V5PiA8ZmlsZT4g4oCUIGZsYXQgImtleSI6InZhbHVlIgogIHNlZCAtbiAicy8uKlwiJDFcIltbOnNwYWNlOl1dKjpbWzpzcGFjZTpdXSpcIlxcKFteXCJdKlxcKVwiLiovXFwxL3AiICIkMiIgfCBoZWFkIC1uMQp9CgpbIC1mICIkQ09ORklHX0ZJTEUiIF0gfHwgZGllICJub3QgY29uZmlndXJlZCDigJQgcnVuOiBjdXJsIC1mc1NMIDxiYXNlX3VybD4vYXBpL3NraWxscy9pbnN0YWxsLnNoIHwgc2giCgpCQVNFX1VSTD0iJChqc29uX3N0ciBiYXNlX3VybCAiJENPTkZJR19GSUxFIikiCkJBQ0tFTkQ9IiQoanNvbl9zdHIgYmFja2VuZCAiJENPTkZJR19GSUxFIikiCkFQSV9LRVk9IiQoanNvbl9zdHIgYXBpX2tleSAiJENPTkZJR19GSUxFIikiCkxJTktfTU9ERT0iJChqc29uX3N0ciBsaW5rX21vZGUgIiRDT05GSUdfRklMRSIpIgpTQ09QRT0iJChqc29uX3N0ciBzY29wZSAiJENPTkZJR19GSUxFIikiCkNMSUVOVFM9IiQoc2VkIC1uICdzLy4qImNsaWVudHMiW1s6c3BhY2U6XV0qOltbOnNwYWNlOl1dKlxbXChbXl1dKlwpXF0uKi9cMS9wJyAiJENPTkZJR19GSUxFIiB8IHRyICcsJyAnICcgfCB0ciAtZCAnIicgfCB0ciAtcyAnICcpIgoKWyAtbiAiJENMSUVOVFMiIF0gfHwgQ0xJRU5UUz0iYWdlbnRzIgpbIC1uICIkTElOS19NT0RFIiBdIHx8IExJTktfTU9ERT0iY29weSIKWyAtbiAiJFNDT1BFIiBdIHx8IFNDT1BFPSJwcm9qZWN0IgoKaWYgWyAteiAiJEJBQ0tFTkQiIF07IHRoZW4KICBbIC1uICIkQkFTRV9VUkwiIF0gfHwgZGllICJjb25maWcgaGFzIG5vIGJhY2tlbmQgYW5kIG5vIGJhc2VfdXJsIgogIEJBQ0tFTkQ9IiQoY3VybCAtZnNTTCAiJEJBU0VfVVJML2FwaS9jb25maWciIHwgc2VkIC1uICdzLy4qImJhY2tlbmQiW1s6c3BhY2U6XV0qOltbOnNwYWNlOl1dKiJcKFteIl0qXCkiLiovXDEvcCcgfCBoZWFkIC1uMSkiCiAgWyAtbiAiJEJBQ0tFTkQiIF0gfHwgZGllICJjb3VsZCBub3QgcmVzb2x2ZSBiYWNrZW5kIGZyb20gJEJBU0VfVVJML2FwaS9jb25maWciCmZpCkJBQ0tFTkQ9IiQocHJpbnRmICclcycgIiRCQUNLRU5EIiB8IHNlZCAnczovKiQ6OicpIgoKUk9PVD0iJFBXRCIKWyAiJFNDT1BFIiA9ICJob21lIiBdICYmIFJPT1Q9IiRIT01FIgoKIyBkaXJfZm9yIENMSUVOVF9JRCAtPiByZWxhdGl2ZSBza2lsbCBkaXIgKGdlbmVyYXRlZCBmcm9tIHRoZSBtYW5pZmVzdCBpbiB0aGUKIyByZWFsIGJ1aWxkOyBhIHJlcHJlc2VudGF0aXZlIHN1YnNldCBoZXJlIGZvciBsb2NhbCB0ZXN0aW5nKS4KZGlyX2ZvcigpIHsKICBjYXNlICIkMSIgaW4KX19ESVJfRk9SX0NBU0VTX18KICAgICopIHJldHVybiAxIDs7CiAgZXNhYwp9CgphcGkoKSB7ICMgYXBpIDxNRVRIT0Q+IDxwYXRoPiBbZXh0cmEgY3VybCBhcmdzLi4uXSAtPiBib2R5IG9uIHN0ZG91dAogIG09IiQxIjsgcD0iJDIiOyBzaGlmdCAyCiAgY3VybCAtZnNTIC1YICIkbSIgIiRCQUNLRU5EJHAiIC1IICJ4LWFwaS1rZXk6IEJlYXJlciAkQVBJX0tFWSIgIiRAIgp9CgptZXRhX3ZlcnNpb24oKSB7ICMgbWV0YV92ZXJzaW9uIDxuYW1lPiAtPiBjdXJyZW50X3ZlcnNpb24gZnJvbSByZWdpc3RyeQogIGFwaSBHRVQgIi9za2lsbHMvcmVnaXN0cnkvJDEiIDI+L2Rldi9udWxsIFwKICAgIHwgc2VkIC1uICdzLy4qImN1cnJlbnRfdmVyc2lvbiJbWzpzcGFjZTpdXSo6W1s6c3BhY2U6XV0qXChbMC05XVswLTldKlwpLiovXDEvcCcgfCBoZWFkIC1uMQp9CgpfbWFuYWdlZCgpIHsgIyBfbWFuYWdlZCA8ZGlyPiAtPiAwIGlmIHNhZmUgdG8gb3ZlcndyaXRlIChvdXJzIG9yIHN5bWxpbmsgb3IgYWJzZW50KQogIGQ9IiQxIgogIGlmIFsgLWUgIiRkIiBdICYmIFsgISAtTCAiJGQiIF0gJiYgWyAhIC1mICIkZC8uZXh1bHUtc2tpbGwuanNvbiIgXTsgdGhlbgogICAgaW5mbyAic2tpcCAkZCAoZXhpc3RzLCBub3QgbWFuYWdlZCBieSBleHVsdSkiOyByZXR1cm4gMQogIGZpCiAgcmV0dXJuIDAKfQoKX3B1dF9yZWFsKCkgeyAjIF9wdXRfcmVhbCA8ZGVzdD4gPHNyY2Rpcj4gPG1hcmtlci1qc29uPgogIF9tYW5hZ2VkICIkMSIgfHwgcmV0dXJuIDAKICBybSAtcmYgIiQxIjsgbWtkaXIgLXAgIiQxIjsgY3AgLVIgIiQyLy4iICIkMS8iCiAgcHJpbnRmICclc1xuJyAiJDMiID4gIiQxLy5leHVsdS1za2lsbC5qc29uIgp9CgpwbGFjZV9za2lsbCgpIHsgIyBwbGFjZV9za2lsbCA8bmFtZT4gPHNyY2Rpcj4gPHZlcnNpb24+CiAgcG5hbWU9IiQxIjsgcHNyYz0iJDIiOyBwdmVyPSIkezM6LTF9IgogIG1hcmtlcj0neyAibmFtZSI6ICInIiRwbmFtZSInIiwgInZlcnNpb24iOiAnIiRwdmVyIicsICJzb3VyY2UiOiAiJyIkQkFDS0VORCInIiB9JwogIGNhbm9uPSIkUk9PVC8uYWdlbnRzL3NraWxscy8kcG5hbWUiCiAgWyAiJExJTktfTU9ERSIgPSAic3ltbGluayIgXSAmJiBfcHV0X3JlYWwgIiRjYW5vbiIgIiRwc3JjIiAiJG1hcmtlciIKICBmb3IgaWQgaW4gJENMSUVOVFM7IGRvCiAgICBkPSIkKGRpcl9mb3IgIiRpZCIpIiB8fCB7IGluZm8gInVua25vd24gY2xpZW50OiAkaWQiOyBjb250aW51ZTsgfQogICAgcGFyZW50PSIkUk9PVC8kZCI7IGRlc3Q9IiRwYXJlbnQvJHBuYW1lIgogICAgaWYgWyAiJExJTktfTU9ERSIgPSAic3ltbGluayIgXSAmJiBbICIkaWQiICE9ICJhZ2VudHMiIF07IHRoZW4KICAgICAgX21hbmFnZWQgIiRkZXN0IiB8fCBjb250aW51ZQogICAgICBta2RpciAtcCAiJHBhcmVudCI7IHJtIC1yZiAiJGRlc3QiCiAgICAgIGlmIGxuIC1zICIkY2Fub24iICIkZGVzdCIgMj4vZGV2L251bGw7IHRoZW4KICAgICAgICBpbmZvICJsaW5rZWQgJGRlc3QgLT4gJGNhbm9uIgogICAgICBlbHNlCiAgICAgICAgaW5mbyAic3ltbGluayB1bnN1cHBvcnRlZCBhdCAkZGVzdDsgY29weWluZyIKICAgICAgICBfcHV0X3JlYWwgIiRkZXN0IiAiJHBzcmMiICIkbWFya2VyIgogICAgICBmaQogICAgZWxpZiBbICIkTElOS19NT0RFIiA9ICJjb3B5IiBdOyB0aGVuCiAgICAgIF9wdXRfcmVhbCAiJGRlc3QiICIkcHNyYyIgIiRtYXJrZXIiCiAgICBmaQogICAgIyBzeW1saW5rICsgYWdlbnRzOiBhbHJlYWR5IHBsYWNlZCBhcyB0aGUgY2Fub25pY2FsIHN0b3JlIGFib3ZlLgogIGRvbmUKfQoKaW5zdGFsbGVkX25hbWVzKCkgeyAjIHVuaXF1ZSBza2lsbCBuYW1lcyB0aGF0IGNhcnJ5IG91ciBtYXJrZXIgdW5kZXIgUk9PVAogIHsgZmluZCAiJFJPT1QvLmFnZW50cy9za2lsbHMiIC1tYXhkZXB0aCAyIC1uYW1lIC5leHVsdS1za2lsbC5qc29uIDI+L2Rldi9udWxsCiAgICBmb3IgaWQgaW4gJENMSUVOVFM7IGRvCiAgICAgIGQ9IiQoZGlyX2ZvciAiJGlkIikiIHx8IGNvbnRpbnVlCiAgICAgIGZpbmQgIiRST09ULyRkIiAtbWF4ZGVwdGggMiAtbmFtZSAuZXh1bHUtc2tpbGwuanNvbiAyPi9kZXYvbnVsbAogICAgZG9uZQogIH0gfCB3aGlsZSByZWFkIC1yIG07IGRvIGpzb25fc3RyIG5hbWUgIiRtIjsgZG9uZSB8IHNvcnQgLXUKfQoKbWFya2VyX3ZlcnNpb24oKSB7ICMgbWFya2VyX3ZlcnNpb24gPG5hbWU+CiAgZm9yIGJhc2UgaW4gIiRST09ULy5hZ2VudHMvc2tpbGxzIjsgZG8KICAgIFsgLWYgIiRiYXNlLyQxLy5leHVsdS1za2lsbC5qc29uIiBdICYmIHsganNvbl9zdHIgdmVyc2lvbiAiJGJhc2UvJDEvLmV4dWx1LXNraWxsLmpzb24iOyByZXR1cm47IH0KICBkb25lCiAgZm9yIGlkIGluICRDTElFTlRTOyBkbwogICAgZD0iJChkaXJfZm9yICIkaWQiKSIgfHwgY29udGludWUKICAgIGY9IiRST09ULyRkLyQxLy5leHVsdS1za2lsbC5qc29uIgogICAgWyAtZiAiJGYiIF0gJiYgeyBqc29uX3N0ciB2ZXJzaW9uICIkZiI7IHJldHVybjsgfQogIGRvbmUKfQoKZG9faW5zdGFsbCgpIHsgIyBkb19pbnN0YWxsIDxuYW1lPgogIG5hbWU9IiQxIgogIFRNUD0iJChta3RlbXAgLWQpIgogIGFwaSBHRVQgIi9za2lsbHMvcmVnaXN0cnkvJG5hbWUvZG93bmxvYWQiIC0tb3V0cHV0ICIkVE1QL3NraWxsLnppcCIgXAogICAgfHwgeyBybSAtcmYgIiRUTVAiOyBkaWUgImRvd25sb2FkIGZhaWxlZCBmb3IgJyRuYW1lJyAoNDAzID0gbm8gYWNjZXNzLCA0MDQgPSB1bmtub3duKSI7IH0KICBta2RpciAtcCAiJFRNUC94IgogIHVuemlwIC1xICIkVE1QL3NraWxsLnppcCIgLWQgIiRUTVAveCIgfHwgeyBybSAtcmYgIiRUTVAiOyBkaWUgImJhZCBhcmNoaXZlIGZvciAnJG5hbWUnIjsgfQogIHNyYz0iJChmaW5kICIkVE1QL3giIC1taW5kZXB0aCAxIC1tYXhkZXB0aCAxIC10eXBlIGQgfCBoZWFkIC1uMSkiCiAgWyAtbiAiJHNyYyIgXSB8fCB7IHJtIC1yZiAiJFRNUCI7IGRpZSAidW5leHBlY3RlZCBhcmNoaXZlIGxheW91dCBmb3IgJyRuYW1lJyI7IH0KICB2ZXI9IiQobWV0YV92ZXJzaW9uICIkbmFtZSIpIgogIHBsYWNlX3NraWxsICIkbmFtZSIgIiRzcmMiICIke3ZlcjotMX0iCiAgcm0gLXJmICIkVE1QIgogIGluZm8gImluc3RhbGxlZCAkbmFtZSAodiR7dmVyOi0xfSkgWyRMSU5LX01PREVdIGludG86ICRDTElFTlRTIgp9Cgp1c2FnZSgpIHsKICBjYXQgPiYyIDw8RU9GCmV4dWx1IOKAlCBFeHVsdSBza2lsbCBsaWJyYXJ5IGhlbHBlcgogIGV4dWx1IGxpc3QgICAgICAgICAgICAgICAgIGxpc3Qgc2tpbGxzIHlvdSBjYW4gYWNjZXNzIChKU09OKQogIGV4dWx1IGdldCA8bmFtZT4gICAgICAgICAgIHNob3cgb25lIHNraWxsJ3MgbWV0YWRhdGEgKEpTT04pCiAgZXh1bHUgaW5zdGFsbCA8bmFtZT4gICAgICAgaW5zdGFsbC9yZWZyZXNoIGEgc2tpbGwgaW50byB5b3VyIGFnZW50IGNsaWVudHMKICBleHVsdSB1cGRhdGUgWzxuYW1lPl0gICAgICB1cGRhdGUgaW5zdGFsbGVkIHNraWxscyAoYWxsLCBvciBvbmUpIHRvIGxhdGVzdAogIGV4dWx1IHB1Ymxpc2ggPG5hbWU+IDxkaXI+IHB1Ymxpc2ggYSBsb2NhbCBza2lsbCBmb2xkZXIgYXMgPG5hbWU+CiAgZXh1bHUgY29uZmlnICAgICAgICAgICAgICAgc2hvdyByZXNvbHZlZCBiYWNrZW5kIC8gc2NvcGUgLyBjbGllbnRzIChubyBzZWNyZXRzKQpFT0YKfQoKY21kPSIkezE6LWhlbHB9IgpbICQjIC1ndCAwIF0gJiYgc2hpZnQgfHwgdHJ1ZQoKY2FzZSAiJGNtZCIgaW4KICBsaXN0KSBhcGkgR0VUICIvc2tpbGxzL3JlZ2lzdHJ5IiA7OwogIGdldCkgWyAkIyAtZ2UgMSBdIHx8IGRpZSAidXNhZ2U6IGV4dWx1IGdldCA8bmFtZT4iOyBhcGkgR0VUICIvc2tpbGxzL3JlZ2lzdHJ5LyQxIiA7OwogIGluc3RhbGwpIFsgJCMgLWdlIDEgXSB8fCBkaWUgInVzYWdlOiBleHVsdSBpbnN0YWxsIDxuYW1lPiI7IGRvX2luc3RhbGwgIiQxIiA7OwogIHVwZGF0ZSkKICAgIGlmIFsgJCMgLWdlIDEgXTsgdGhlbiBuYW1lcz0iJDEiOyBlbHNlIG5hbWVzPSIkKGluc3RhbGxlZF9uYW1lcykiOyBmaQogICAgWyAtbiAiJG5hbWVzIiBdIHx8IHsgaW5mbyAibm8gZXh1bHUtbWFuYWdlZCBza2lsbHMgZm91bmQgdW5kZXIgJFJPT1QiOyBleGl0IDA7IH0KICAgIGZvciBuIGluICRuYW1lczsgZG8KICAgICAgY3VyPSIkKG1hcmtlcl92ZXJzaW9uICIkbiIpIgogICAgICBsYXRlc3Q9IiQobWV0YV92ZXJzaW9uICIkbiIpIgogICAgICBbIC1uICIkbGF0ZXN0IiBdIHx8IHsgaW5mbyAic2tpcCAkbiAobm90IGluIHJlZ2lzdHJ5KSI7IGNvbnRpbnVlOyB9CiAgICAgIGlmIFsgLXogIiRjdXIiIF0gfHwgWyAiJGxhdGVzdCIgLWd0ICIkY3VyIiBdIDI+L2Rldi9udWxsOyB0aGVuCiAgICAgICAgaW5mbyAidXBkYXRpbmcgJG46IHYke2N1cjotP30gLT4gdiRsYXRlc3QiOyBkb19pbnN0YWxsICIkbiIKICAgICAgZWxzZQogICAgICAgIGluZm8gIiRuIHVwIHRvIGRhdGUgKHYkY3VyKSIKICAgICAgZmkKICAgIGRvbmUKICAgIDs7CiAgcHVibGlzaCkKICAgIFsgJCMgLWdlIDIgXSB8fCBkaWUgInVzYWdlOiBleHVsdSBwdWJsaXNoIDxuYW1lPiA8ZGlyPiIKICAgIG5hbWU9IiQxIjsgZm9sZGVyPSIkMiIKICAgIFsgLWQgIiRmb2xkZXIiIF0gfHwgZGllICJubyBzdWNoIGZvbGRlcjogJGZvbGRlciIKICAgIFsgLWYgIiRmb2xkZXIvU0tJTEwubWQiIF0gfHwgZGllICIkZm9sZGVyIGhhcyBubyBTS0lMTC5tZCBhdCBpdHMgcm9vdCIKICAgIGNvbW1hbmQgLXYgemlwID4vZGV2L251bGwgMj4mMSB8fCBkaWUgInRoZSAnemlwJyBjb21tYW5kIGlzIHJlcXVpcmVkIHRvIHB1Ymxpc2giCiAgICBUTVA9IiQobWt0ZW1wIC1kKSIKICAgICggY2QgIiQoZGlybmFtZSAiJGZvbGRlciIpIiBcCiAgICAgICYmIHppcCAtcSAtciAtWCAiJFRNUC9za2lsbC56aXAiICIkKGJhc2VuYW1lICIkZm9sZGVyIikiIFwKICAgICAgICAgICAteCAnKi8uZXh1bHUtc2tpbGwuanNvbicgJyovLmdpdC8qJyAnKi5EU19TdG9yZScgJyovX19NQUNPU1gvKicgKSBcCiAgICAgIHx8IHsgcm0gLXJmICIkVE1QIjsgZGllICJjb3VsZCBub3QgemlwICRmb2xkZXIiOyB9CiAgICBhcGkgUE9TVCAiL3NraWxscy9yZWdpc3RyeS8kbmFtZSIgLUggIkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vemlwIiBcCiAgICAgIC0tZGF0YS1iaW5hcnkgQCIkVE1QL3NraWxsLnppcCIgXAogICAgICB8fCB7IHJtIC1yZiAiJFRNUCI7IGRpZSAicHVibGlzaCBmYWlsZWQgKDQwMyA9IG5vIHdyaXRlIGFjY2VzcywgNDA5ID0gbmFtZSB0YWtlbikiOyB9CiAgICBybSAtcmYgIiRUTVAiCiAgICBpbmZvICJwdWJsaXNoZWQgJG5hbWUiCiAgICA7OwogIGNvbmZpZykKICAgIHByaW50ZiAnYmFja2VuZD0lc1xuc2NvcGU9JXNcbmxpbmtfbW9kZT0lc1xuY2xpZW50cz0lc1xuYXBpX2tleT0lc1xuJyBcCiAgICAgICIkQkFDS0VORCIgIiRTQ09QRSIgIiRMSU5LX01PREUiICIkQ0xJRU5UUyIgXAogICAgICAiJChbIC1uICIkQVBJX0tFWSIgXSAmJiBlY2hvIHNldCB8fCBlY2hvIE1JU1NJTkcpIgogICAgOzsKICBoZWxwfC0taGVscHwtaCkgdXNhZ2UgOzsKICAqKSBpbmZvICJ1bmtub3duIGNvbW1hbmQ6ICRjbWQiOyB1c2FnZTsgZXhpdCAyIDs7CmVzYWMK";
+
+// src/skills/bootstrap/exulu-skills.ts
+var BOOTSTRAP_CLIENTS_JSON = JSON.stringify(CLIENT_MANIFEST, null, 2);
+var DIR_FOR_CASES = CLIENT_MANIFEST.map(
+  (c) => `    ${c.id}) printf '%s' '${c.dir}' ;;`
+).join("\n");
+var BOOTSTRAP_EXULU_SH = Buffer.from(EXULU_SH_B64, "base64").toString("utf8").replace("__DIR_FOR_CASES__", DIR_FOR_CASES);
+var BOOTSTRAP_SKILL_MD = `---
+name: exulu-skills
+description: Install, update, and publish skills from this Exulu instance's central skill library. Use when the user asks to install a skill, get the latest version of a skill, list available skills, or publish a skill to Exulu.
+---
+
+# Exulu Skills
+
+Bridge to the Exulu central skill library. **All operations go through the
+bundled helper script \u2014 do not hand-write curl or copy files yourself.** The
+script reads the API token from config (keeping it out of this conversation) and
+handles the multi-client copy/symlink fan-out deterministically.
+
+## The helper
+
+Run the script next to this file, \`scripts/exulu\`, with \`sh\` and the absolute
+path of this skill's directory:
+
+\`\`\`
+sh "<this-skill-dir>/scripts/exulu" <command>
+\`\`\`
+
+Commands:
+- \`list\` \u2014 skills you can access (JSON on stdout)
+- \`get <name>\` \u2014 one skill's metadata (JSON)
+- \`install <name>\` \u2014 install/refresh a skill into the user's agent clients
+- \`update [<name>]\` \u2014 update every installed skill, or just \`<name>\`, to latest
+- \`publish <name> <folder>\` \u2014 publish a local skill folder as \`<name>\`
+- \`config\` \u2014 show resolved backend / scope / clients (prints no secrets)
+
+The token, backend URL, target clients, copy-vs-symlink mode, and scope all come
+from \`~/.config/exulu/skills.json\` (written by the installer). Never print the
+\`api_key\` or read it into your reply \u2014 the script uses it internally.
+
+## Requests \u2192 commands
+
+- "list / search skills" \u2192 \`exulu list\`, then filter the JSON for the user.
+- "install skill X" / "add the X skill" \u2192 \`exulu install X\`.
+- "update / get the latest version [of X]" \u2192 \`exulu update [X]\`.
+- "publish / upload this skill as X" \u2192 confirm the target name with the user; for
+  an existing skill run \`exulu get X\` first and confirm a new version is intended;
+  then \`exulu publish X <folder>\`.
+
+## Not configured yet?
+
+If \`exulu config\` reports it's not configured (or \`~/.config/exulu/skills.json\`
+is missing), tell the user to run the installer \u2014 it sets everything up
+interactively (base URL, API key, target clients, copy/symlink):
+
+\`\`\`
+curl -fsSL <base_url>/api/skills/install.sh | sh
+\`\`\`
+
+\`<base_url>\` is their Exulu frontend URL (e.g. https://ai.open.de). They can
+create an API key at \`<base_url>/token\`.
+
+## Errors
+
+- install: \`403\` = no access to that skill; \`404\` = unknown name.
+- publish: \`403\` = you can see it but lack write access; \`409\` = the name is
+  taken by a skill you can't access.
+`;
+
 // src/exulu/routes.ts
 var REQUEST_SIZE_LIMIT = "50mb";
 var getExuluVersionNumber = async () => {
@@ -13836,6 +14029,7 @@ var createExpressRoutes = async (app, providers, tools, contexts, config, evals,
     }
     next();
   });
+  const rawZip = express2.raw({ type: ["application/zip", "application/octet-stream", "application/x-zip-compressed", "application/x-zip"], limit: "50mb" });
   console.log(`
     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557  \u2588\u2588\u2557\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2557      \u2588\u2588\u2557   \u2588\u2588\u2557
     \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u255A\u2588\u2588\u2557\u2588\u2588\u2554\u255D\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551      \u2588\u2588\u2551   \u2588\u2588\u2551
@@ -15488,7 +15682,9 @@ ${style.markdown}` : params.prompt;
     const budget_duration = String(body?.budget_duration ?? "");
     if (!Number.isFinite(max_budget) || max_budget <= 0) return null;
     if (!BUDGET_ALLOWED_DURATIONS.has(budget_duration)) return null;
-    return { max_budget, budget_duration };
+    const reset = parseResetAt(body?.budget_reset_at);
+    if (!reset.valid) return null;
+    return { max_budget, budget_duration, budget_reset_at: reset.value };
   };
   const parseBudgetSettingsBody = (body) => {
     if (!body || typeof body !== "object") return null;
@@ -15558,7 +15754,7 @@ ${style.markdown}` : params.prompt;
       }
       const body = parseBudgetBody(req.body);
       if (!body) {
-        res.status(400).json({ detail: "Invalid budget (max_budget, budget_duration)." });
+        res.status(400).json({ detail: "Invalid budget (max_budget, budget_duration, budget_reset_at)." });
         return;
       }
       const entityIds = Array.isArray(req.body?.entityIds) ? req.body.entityIds : [];
@@ -15570,7 +15766,7 @@ ${style.markdown}` : params.prompt;
       for (const id of entityIds) {
         const tag = budgetTagFor(entityType, id);
         try {
-          await upsertBudget(tag, body.max_budget, body.budget_duration);
+          await upsertBudget(tag, body.max_budget, body.budget_duration, body.budget_reset_at);
           results.push({ entityId: String(id), ok: true });
         } catch (err) {
           results.push({
@@ -15595,12 +15791,12 @@ ${style.markdown}` : params.prompt;
       }
       const body = parseBudgetBody(req.body);
       if (!body) {
-        res.status(400).json({ detail: "Invalid budget (max_budget, budget_duration)." });
+        res.status(400).json({ detail: "Invalid budget (max_budget, budget_duration, budget_reset_at)." });
         return;
       }
       const tag = budgetTagFor(entityType, req.params.entityId ?? "");
       try {
-        await upsertBudget(tag, body.max_budget, body.budget_duration);
+        await upsertBudget(tag, body.max_budget, body.budget_duration, body.budget_reset_at);
         const info = await tagInfo([tag]);
         res.status(200).json({ budget: info[tag] ?? null });
       } catch (err) {
@@ -16063,6 +16259,199 @@ ${style.markdown}` : params.prompt;
     }
     return root;
   }
+  app.get("/skills/agent/bootstrap", async (_req, res) => {
+    try {
+      const zip = new JSZip3();
+      zip.file("exulu-skills/SKILL.md", BOOTSTRAP_SKILL_MD);
+      zip.file("exulu-skills/references/clients.json", BOOTSTRAP_CLIENTS_JSON);
+      zip.file("exulu-skills/scripts/exulu", BOOTSTRAP_EXULU_SH, {
+        unixPermissions: 493
+      });
+      const buffer = await zip.generateAsync({
+        type: "nodebuffer",
+        platform: "UNIX"
+      });
+      res.setHeader("Content-Type", "application/zip");
+      res.setHeader("Content-Disposition", 'attachment; filename="exulu-skills.zip"');
+      res.send(buffer);
+    } catch (err) {
+      console.error("[SKILLS] Failed to build bootstrap zip", err);
+      res.status(500).json({ detail: "Failed to build bootstrap skill." });
+    }
+  });
+  app.get("/skills/registry", async (req, res) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code ?? 401).json({ detail: authResult.message });
+      return;
+    }
+    const { db } = await postgresClient();
+    const tag = typeof req.query.tag === "string" ? req.query.tag : void 0;
+    const all = await db("skills").select("*");
+    const readable = await filterReadableSkills(db, all, authResult.user);
+    const skills = readable.filter((s) => {
+      if (!tag) return true;
+      const tags = Array.isArray(s.tags) ? s.tags : [];
+      return tags.includes(tag);
+    }).map((s) => ({
+      name: s.name,
+      description: s.description ?? "",
+      tags: Array.isArray(s.tags) ? s.tags : [],
+      current_version: s.current_version ?? 1,
+      updated_at: s.updatedAt ?? s.updated_at ?? null
+    }));
+    res.json({ skills });
+  });
+  app.get("/skills/registry/:name/download", async (req, res) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code ?? 401).json({ detail: authResult.message });
+      return;
+    }
+    const { db } = await postgresClient();
+    const skill = await resolveSkillByName(db, req.params.name);
+    if (!skill) {
+      res.status(404).json({ detail: "Skill not found." });
+      return;
+    }
+    if (!await canAccessSkill(db, skill, "read", authResult.user)) {
+      res.status(403).json({ detail: "You don't have access to this skill." });
+      return;
+    }
+    const vQuery = req.query.version;
+    const version = !vQuery || vQuery === "latest" ? skill.current_version ?? 1 : Number(vQuery);
+    if (!Number.isFinite(version) || version < 1) {
+      res.status(400).json({ detail: "Invalid version." });
+      return;
+    }
+    const safeName = String(skill.name ?? "skill").replace(/[^a-zA-Z0-9-_]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
+    const versionPrefix = `skills/${skill.id}/v${version}/`;
+    const files = await listS3ObjectsByPrefix(versionPrefix, config);
+    if (files.length === 0) {
+      res.status(404).json({ detail: `Version v${version} has no files.` });
+      return;
+    }
+    const zip = new JSZip3();
+    for (const file of files) {
+      const idx = file.key.indexOf(versionPrefix);
+      const rel = idx >= 0 ? file.key.slice(idx + versionPrefix.length) : file.key;
+      if (!rel) continue;
+      const bytes = await getS3ObjectBytes(file.key, config);
+      zip.file(`${safeName}/${rel}`, bytes);
+    }
+    const buffer = await zip.generateAsync({ type: "nodebuffer" });
+    res.setHeader("Content-Type", "application/zip");
+    res.setHeader("Content-Disposition", `attachment; filename="${safeName}.skill"`);
+    res.send(buffer);
+  });
+  app.post("/skills/registry/:name", rawZip, async (req, res) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code ?? 401).json({ detail: authResult.message });
+      return;
+    }
+    const name = req.params.name;
+    const bytes = req.body;
+    if (!Buffer.isBuffer(bytes) || bytes.length === 0) {
+      res.status(400).json({ detail: "Empty body. Send the skill as a zip/.skill payload." });
+      return;
+    }
+    const { db } = await postgresClient();
+    const existing = await resolveSkillByName(db, name);
+    if (existing) {
+      const canWrite = await canAccessSkill(db, existing, "write", authResult.user);
+      if (canWrite) {
+        const nextVersion = (existing.current_version ?? 1) + 1;
+        try {
+          await extractBundleToVersion({ bytes, skillId: existing.id, version: nextVersion, config });
+        } catch (err) {
+          if (err instanceof BundleValidationError) {
+            res.status(400).json({ detail: err.message });
+            return;
+          }
+          console.error("[SKILLS] publish (new version) failed", err);
+          res.status(500).json({ detail: "Failed to publish new version." });
+          return;
+        }
+        const history = Array.isArray(existing.history) ? existing.history : [];
+        await db("skills").where({ id: existing.id }).update({
+          current_version: nextVersion,
+          history: JSON.stringify([
+            ...history,
+            { version: nextVersion, created_at: (/* @__PURE__ */ new Date()).toISOString(), label: "Published from agent" }
+          ])
+        });
+        res.json({ name, version: nextVersion, created: false });
+        return;
+      } else {
+        const canRead = await canAccessSkill(db, existing, "read", authResult.user);
+        if (!canRead) {
+          res.status(409).json({ detail: "That name is unavailable." });
+          return;
+        }
+        res.status(403).json({ detail: "You don't have write access to this skill." });
+        return;
+      }
+    }
+    const meta = await parseSkillFrontmatter(bytes);
+    const skillId = randomUUID3();
+    try {
+      await extractBundleToVersion({ bytes, skillId, version: 1, config });
+    } catch (err) {
+      if (err instanceof BundleValidationError) {
+        res.status(400).json({ detail: err.message });
+        return;
+      }
+      console.error("[SKILLS] publish (create) failed", err);
+      res.status(500).json({ detail: "Failed to publish skill." });
+      return;
+    }
+    try {
+      await db("skills").insert({
+        id: skillId,
+        name,
+        description: meta.description ?? "",
+        s3folder: `skills/${skillId}`,
+        tags: JSON.stringify([]),
+        usage_count: 0,
+        favorite_count: 0,
+        current_version: 1,
+        history: JSON.stringify([
+          { version: 1, created_at: (/* @__PURE__ */ new Date()).toISOString(), label: "Published from agent" }
+        ]),
+        rights_mode: "private",
+        created_by: authResult.user.id
+      });
+    } catch (err) {
+      res.status(409).json({ detail: "That name is unavailable." });
+      return;
+    }
+    res.json({ name, version: 1, created: true });
+  });
+  app.get("/skills/registry/:name", async (req, res) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code ?? 401).json({ detail: authResult.message });
+      return;
+    }
+    const { db } = await postgresClient();
+    const skill = await resolveSkillByName(db, req.params.name);
+    if (!skill) {
+      res.status(404).json({ detail: "Skill not found." });
+      return;
+    }
+    if (!await canAccessSkill(db, skill, "read", authResult.user)) {
+      res.status(403).json({ detail: "You don't have access to this skill." });
+      return;
+    }
+    res.json({
+      name: skill.name,
+      description: skill.description ?? "",
+      tags: Array.isArray(skill.tags) ? skill.tags : [],
+      current_version: skill.current_version ?? 1,
+      history: Array.isArray(skill.history) ? skill.history : []
+    });
+  });
   app.post("/skills/:skillId/init", async (req, res) => {
     const authResult = await requestValidators.authenticate(req);
     if (!authResult.user?.id) {
@@ -16110,8 +16499,8 @@ ${style.markdown}` : params.prompt;
     }
     const { skillId } = req.params;
     const { extension, contentType } = req.body ?? {};
-    if (extension !== ".zip" && extension !== ".md") {
-      res.status(400).json({ detail: 'extension must be ".zip" or ".md".' });
+    if (extension !== ".zip" && extension !== ".md" && extension !== ".skill") {
+      res.status(400).json({ detail: 'extension must be ".zip", ".md", or ".skill".' });
       return;
     }
     if (!contentType || typeof contentType !== "string") {
@@ -16250,19 +16639,22 @@ ${style.markdown}` : params.prompt;
     }
     const versionPrefix = `skills/${skillId}/v${version}/`;
     const files = await listS3ObjectsByPrefix(versionPrefix, config);
-    const zip = new JSZip2();
+    const asSkill = req.query.format === "skill";
+    const safeName = String(skill.name ?? "skill").replace(/[^a-zA-Z0-9-_]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
+    const zip = new JSZip3();
     let fileCount = 0;
     for (const file of files) {
       const prefixIndex = file.key.indexOf(versionPrefix);
       const relativePath = prefixIndex >= 0 ? file.key.slice(prefixIndex + versionPrefix.length) : file.key;
       if (!relativePath) continue;
       const bytes = await getS3ObjectBytes(file.key, config);
-      zip.file(relativePath, bytes);
+      const archivePath = asSkill ? `${safeName}/${relativePath}` : relativePath;
+      zip.file(archivePath, bytes);
       fileCount += 1;
     }
     const exportedAt = (/* @__PURE__ */ new Date()).toISOString();
     zip.file(
-      "version.txt",
+      asSkill ? `${safeName}/version.txt` : "version.txt",
       [
         `Skill: ${skill.name ?? skillId}`,
         `Skill id: ${skillId}`,
@@ -16273,13 +16665,9 @@ ${style.markdown}` : params.prompt;
       ].join("\n")
     );
     const buffer = await zip.generateAsync({ type: "nodebuffer" });
-    const safeName = String(skill.name ?? "skill").replace(/[^a-zA-Z0-9-_]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
-    const filename = `${safeName}-v${version}.zip`;
+    const filename = asSkill ? `${safeName}.skill` : `${safeName}-v${version}.zip`;
     res.setHeader("Content-Type", "application/zip");
-    res.setHeader(
-      "Content-Disposition",
-      `attachment; filename="${filename}"`
-    );
+    res.setHeader("Content-Disposition", `attachment; filename="${filename}"`);
     res.send(buffer);
   });
   app.post("/skills/:skillId/sign", async (req, res) => {
@@ -16579,6 +16967,12 @@ ${style.markdown}` : params.prompt;
     const fullSessionPrefix = `${generalPrefix}${userSessionPrefix}`;
     return { userSessionPrefix, fullSessionPrefix };
   }
+  const loadSessionFilesAuth = async (req, res, sessionId, rights) => {
+    const authed = await loadAuthedSession(req, res, sessionId, rights);
+    if (!authed) return null;
+    const ownerId = authed.session.user ?? authed.user.id;
+    return { ...authed, ownerId, ...buildSessionPrefixes(ownerId, sessionId) };
+  };
   function sanitizeFilename(name) {
     const trimmed = name.trim();
     if (!trimmed) return "";
@@ -16587,11 +16981,6 @@ ${style.markdown}` : params.prompt;
     return trimmed.replace(/[\\/]/g, "_");
   }
   app.get("/sessions/:sessionId/files", async (req, res) => {
-    const authResult = await requestValidators.authenticate(req);
-    if (!authResult.user?.id) {
-      res.status(authResult.code ?? 401).json({ detail: authResult.message });
-      return;
-    }
     const sessionId = req.params.sessionId;
     if (!sessionId) {
       res.status(400).json({ detail: "Missing sessionId in path." });
@@ -16601,10 +16990,9 @@ ${style.markdown}` : params.prompt;
       res.status(500).json({ detail: "File uploads are not configured." });
       return;
     }
-    const { userSessionPrefix } = buildSessionPrefixes(
-      authResult.user.id,
-      sessionId
-    );
+    const authed = await loadSessionFilesAuth(req, res, sessionId, "read");
+    if (!authed) return;
+    const { userSessionPrefix } = authed;
     let objects;
     try {
       objects = await listS3ObjectsByPrefix(userSessionPrefix, config);
@@ -16634,11 +17022,6 @@ ${style.markdown}` : params.prompt;
   app.post(
     "/sessions/:sessionId/files/upload-sign",
     async (req, res) => {
-      const authResult = await requestValidators.authenticate(req);
-      if (!authResult.user?.id) {
-        res.status(authResult.code ?? 401).json({ detail: authResult.message });
-        return;
-      }
       const sessionId = req.params.sessionId;
       if (!sessionId) {
         res.status(400).json({ detail: "Missing sessionId in path." });
@@ -16648,6 +17031,8 @@ ${style.markdown}` : params.prompt;
         res.status(500).json({ detail: "File uploads are not configured." });
         return;
       }
+      const authed = await loadSessionFilesAuth(req, res, sessionId, "write");
+      if (!authed) return;
       const { filename, contentType } = req.body ?? {};
       if (!filename || typeof filename !== "string") {
         res.status(400).json({ detail: "Missing filename in request body." });
@@ -16662,11 +17047,7 @@ ${style.markdown}` : params.prompt;
         res.status(400).json({ detail: "Missing contentType in request body." });
         return;
       }
-      const { userSessionPrefix, fullSessionPrefix } = buildSessionPrefixes(
-        authResult.user.id,
-        sessionId
-      );
-      const fullKey = `${fullSessionPrefix}${safeName}`;
+      const fullKey = `${authed.fullSessionPrefix}${safeName}`;
       const uploadUrl = await getS3SignedUploadUrl(fullKey, contentType, config);
       res.json({ uploadUrl, key: fullKey });
     }
@@ -16674,11 +17055,6 @@ ${style.markdown}` : params.prompt;
   app.post(
     "/sessions/:sessionId/files/sync-to-sandbox",
     async (req, res) => {
-      const authResult = await requestValidators.authenticate(req);
-      if (!authResult.user?.id) {
-        res.status(authResult.code ?? 401).json({ detail: authResult.message });
-        return;
-      }
       const sessionId = req.params.sessionId;
       if (!sessionId) {
         res.status(400).json({ detail: "Missing sessionId in path." });
@@ -16689,18 +17065,16 @@ ${style.markdown}` : params.prompt;
         res.status(400).json({ detail: "Missing key in request body." });
         return;
       }
-      const { fullSessionPrefix } = buildSessionPrefixes(
-        authResult.user.id,
-        sessionId
-      );
-      if (!key.startsWith(fullSessionPrefix)) {
+      const authed = await loadSessionFilesAuth(req, res, sessionId, "write");
+      if (!authed) return;
+      if (!key.startsWith(authed.fullSessionPrefix)) {
         res.status(403).json({ detail: "Key does not belong to this session." });
         return;
       }
       try {
         const result = await downloadKeyIntoSandbox({
           sessionId,
-          userId: authResult.user.id,
+          userId: authed.ownerId,
           fullS3Key: key,
           config
         });
@@ -16714,11 +17088,6 @@ ${style.markdown}` : params.prompt;
   app.delete(
     "/sessions/:sessionId/files",
     async (req, res) => {
-      const authResult = await requestValidators.authenticate(req);
-      if (!authResult.user?.id) {
-        res.status(authResult.code ?? 401).json({ detail: authResult.message });
-        return;
-      }
       const sessionId = req.params.sessionId;
       if (!sessionId) {
         res.status(400).json({ detail: "Missing sessionId in path." });
@@ -16729,11 +17098,9 @@ ${style.markdown}` : params.prompt;
         res.status(400).json({ detail: "Missing or invalid 'key' query parameter." });
         return;
       }
-      const { fullSessionPrefix } = buildSessionPrefixes(
-        authResult.user.id,
-        sessionId
-      );
-      if (!key.startsWith(fullSessionPrefix)) {
+      const authed = await loadSessionFilesAuth(req, res, sessionId, "write");
+      if (!authed) return;
+      if (!key.startsWith(authed.fullSessionPrefix)) {
         res.status(403).json({ detail: "Key does not belong to this session." });
         return;
       }
@@ -16752,11 +17119,6 @@ ${style.markdown}` : params.prompt;
       if (!req.headers.authorization && typeof req.query.auth === "string") {
         req.headers.authorization = `Bearer ${req.query.auth}`;
       }
-      const authResult = await requestValidators.authenticate(req);
-      if (!authResult.user?.id) {
-        res.status(authResult.code ?? 401).json({ detail: authResult.message });
-        return;
-      }
       const sessionId = req.params.sessionId;
       if (!sessionId) {
         res.status(400).json({ detail: "Missing sessionId in path." });
@@ -16767,11 +17129,9 @@ ${style.markdown}` : params.prompt;
         res.status(400).json({ detail: "Missing or invalid 'key' query parameter." });
         return;
       }
-      const { fullSessionPrefix } = buildSessionPrefixes(
-        authResult.user.id,
-        sessionId
-      );
-      if (!key.startsWith(fullSessionPrefix)) {
+      const authed = await loadSessionFilesAuth(req, res, sessionId, "read");
+      if (!authed) return;
+      if (!key.startsWith(authed.fullSessionPrefix)) {
         res.status(403).json({ detail: "Key does not belong to this session." });
         return;
       }
@@ -16875,7 +17235,7 @@ ${style.markdown}` : params.prompt;
         `  - tracking.json         tracking events linked to the user`,
         ``
       ].join("\n");
-      const zip = new JSZip2();
+      const zip = new JSZip3();
       zip.file("README.txt", readme);
       zip.file("user_data.json", JSON.stringify(userExport, null, 2));
       zip.file("sessions.json", JSON.stringify(sessionsWithMessages, null, 2));