@exulu/backend 2.1.0 → 2.3.0

package/dist/index.cjs

@@ -415,7 +415,12 @@ function getS3Client(config) {
     credentials: {
       accessKeyId: config.fileUploads.s3key,
       secretAccessKey: config.fileUploads.s3secret
-    }
+    },
+    // AWS SDK >= 3.729 injects x-amz-checksum-crc32 (of an empty body) into
+    // presigned PUT URLs, which S3-compatible stores like MinIO reject on
+    // upload with a checksum mismatch. WHEN_REQUIRED disables that default.
+    requestChecksumCalculation: "WHEN_REQUIRED",
+    responseChecksumValidation: "WHEN_REQUIRED"
   });
   return s3Client;
 }
@@ -1667,6 +1672,9 @@ async function tagUpdate(input) {
     budget_duration: input.budget_duration
   });
 }
+async function budgetUpdate(budget_id, patch) {
+  await call("/budget/update", { budget_id, ...patch });
+}
 async function tagDelete(name) {
   await call("/tag/delete", { name });
 }
@@ -1675,8 +1683,9 @@ function extractBudget(raw) {
   const max_budget = bt.max_budget ?? raw?.max_budget ?? null;
   const budget_duration = bt.budget_duration ?? raw?.budget_duration ?? null;
   const budget_reset_at = bt.budget_reset_at ?? raw?.budget_reset_at ?? null;
+  const budget_id = bt.budget_id ?? raw?.budget_id ?? null;
   const spend = typeof raw?.spend === "number" ? raw.spend : typeof bt.spend === "number" ? bt.spend : 0;
-  return { max_budget, budget_duration, budget_reset_at, spend };
+  return { max_budget, budget_duration, budget_reset_at, budget_id, spend };
 }
 async function listTags() {
   const { url, masterKey } = litellmBase();
@@ -1709,7 +1718,8 @@ async function listTagBudgets() {
       spend: b.spend,
       max_budget: b.max_budget,
       budget_duration: b.budget_duration,
-      budget_reset_at: b.budget_reset_at
+      budget_reset_at: b.budget_reset_at,
+      budget_id: b.budget_id
     };
   }
   const names = Object.keys(map);
@@ -1755,7 +1765,8 @@ async function tagInfo(names) {
       spend: b.spend,
       max_budget: b.max_budget,
       budget_duration: b.budget_duration,
-      budget_reset_at: b.budget_reset_at
+      budget_reset_at: b.budget_reset_at,
+      budget_id: b.budget_id
     };
   }
   return out;
@@ -1986,7 +1997,16 @@ async function setBudgetSettings(settings) {
   }).onConflict("config_key").merge({ config_value: JSON.stringify(settings) });
   return settings;
 }
-async function upsertBudget(tag, max_budget, budget_duration) {
+function parseResetAt(raw) {
+  if (raw === void 0 || raw === null || raw === "") {
+    return { valid: true, value: void 0 };
+  }
+  if (typeof raw !== "string") return { valid: false };
+  const t = Date.parse(raw);
+  if (Number.isNaN(t)) return { valid: false };
+  return { valid: true, value: new Date(t).toISOString() };
+}
+async function upsertBudget(tag, max_budget, budget_duration, budget_reset_at) {
   const info = await tagInfo([tag]);
   try {
     if (info[tag]) {
@@ -2001,6 +2021,15 @@ async function upsertBudget(tag, max_budget, budget_duration) {
       await tagUpdate({ name: tag, max_budget, budget_duration });
     }
   }
+  if (budget_reset_at) {
+    const after = await tagInfo([tag]);
+    const budgetId = after[tag]?.budget_id ?? null;
+    if (budgetId) {
+      await budgetUpdate(budgetId, { budget_reset_at });
+    } else {
+      console.warn(`[EXULU] upsertBudget: no budget_id for ${tag}; reset date not applied`);
+    }
+  }
   invalidateBudgetCaches(tag);
 }
 function invalidateBudgetCaches(tag) {
@@ -3303,6 +3332,15 @@ var init_system_dependencies = __esm({
           macos: "brew install poppler"
         }
       },
+      {
+        check: { kind: "binary", binary: "pdftotext" },
+        displayName: "Poppler (pdftotext)",
+        purpose: "parse_document tool: extracting page-marked text from PDFs",
+        installHints: {
+          debian: "apt-get install -y poppler-utils",
+          macos: "brew install poppler"
+        }
+      },
       {
         check: { kind: "npm-global", packageName: "docx" },
         displayName: "docx (npm global)",
@@ -4140,6 +4178,595 @@ var init_session_file_read_tool = __esm({
   }
 });
 
+// src/templates/tools/document-render-helpers.ts
+async function pdfToText(pdf) {
+  const dir = await (0, import_promises2.mkdtemp)((0, import_node_path5.join)((0, import_node_os.tmpdir)(), "exulu-parse-"));
+  try {
+    const inputPath = (0, import_node_path5.join)(dir, "input.pdf");
+    await (0, import_promises2.writeFile)(inputPath, pdf);
+    const { stdout } = await execFileAsync("pdftotext", ["-layout", inputPath, "-"], {
+      timeout: 6e4,
+      maxBuffer: MAX_STDOUT_BYTES
+    });
+    return stdout;
+  } finally {
+    await (0, import_promises2.rm)(dir, { recursive: true, force: true });
+  }
+}
+async function renderPdfPageToPng(pdf, page, scaleTo) {
+  const dir = await (0, import_promises2.mkdtemp)((0, import_node_path5.join)((0, import_node_os.tmpdir)(), "exulu-render-"));
+  try {
+    const inputPath = (0, import_node_path5.join)(dir, "input.pdf");
+    await (0, import_promises2.writeFile)(inputPath, pdf);
+    try {
+      await execFileAsync(
+        "pdftoppm",
+        ["-png", "-f", String(page), "-l", String(page), "-scale-to", String(scaleTo), inputPath, (0, import_node_path5.join)(dir, "page")],
+        { timeout: 6e4, maxBuffer: MAX_STDOUT_BYTES }
+      );
+    } catch (err) {
+      if (err?.code === 99) return null;
+      throw err;
+    }
+    const produced = (await (0, import_promises2.readdir)(dir)).find((f) => f.startsWith("page") && f.endsWith(".png"));
+    if (!produced) return null;
+    return await (0, import_promises2.readFile)((0, import_node_path5.join)(dir, produced));
+  } finally {
+    await (0, import_promises2.rm)(dir, { recursive: true, force: true });
+  }
+}
+var import_node_child_process4, import_node_util3, import_promises2, import_node_os, import_node_path5, execFileAsync, MAX_STDOUT_BYTES;
+var init_document_render_helpers = __esm({
+  "src/templates/tools/document-render-helpers.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_child_process4 = require("child_process");
+    import_node_util3 = require("util");
+    import_promises2 = require("fs/promises");
+    import_node_os = require("os");
+    import_node_path5 = require("path");
+    execFileAsync = (0, import_node_util3.promisify)(import_node_child_process4.execFile);
+    MAX_STDOUT_BYTES = 64 * 1024 * 1024;
+  }
+});
+
+// src/templates/tools/parse-document-tool.ts
+var import_zod6, import_node_path6, import_officeparser, DEFAULT_LIMIT2, MAX_CONTENT_CHARS2, MIN_CHARS_PER_PAGE, OFFICE_EXTENSIONS, pagesPattern, createParseDocumentTool;
+var init_parse_document_tool = __esm({
+  "src/templates/tools/parse-document-tool.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_zod6 = require("zod");
+    import_node_path6 = require("path");
+    import_officeparser = require("officeparser");
+    init_tool();
+    init_uppy();
+    init_document_render_helpers();
+    DEFAULT_LIMIT2 = 250;
+    MAX_CONTENT_CHARS2 = 16e3;
+    MIN_CHARS_PER_PAGE = 20;
+    OFFICE_EXTENSIONS = /* @__PURE__ */ new Set([
+      ".docx",
+      ".doc",
+      ".xlsx",
+      ".xls",
+      ".pptx",
+      ".ppt",
+      ".odt",
+      ".ods",
+      ".odp",
+      ".rtf"
+    ]);
+    pagesPattern = /^(\d+)(?:-(\d+))?$/;
+    createParseDocumentTool = ({
+      sessionID,
+      user,
+      exuluConfig
+    }) => {
+      if (!sessionID || !exuluConfig?.fileUploads?.s3Bucket) return void 0;
+      const parseDocumentExecute = async ({
+        filename,
+        pages,
+        offset,
+        limit
+      }) => {
+        const safeName = String(filename ?? "").trim();
+        if (!safeName || safeName.includes("..") || safeName.includes("/") || safeName.includes("\\")) {
+          return {
+            error: "Invalid filename \u2014 pass the bare file name exactly as listed in the session files (no paths)."
+          };
+        }
+        const ext = (0, import_node_path6.extname)(safeName).toLowerCase();
+        if (ext !== ".pdf" && !OFFICE_EXTENSIONS.has(ext)) {
+          return {
+            error: `Unsupported extension "${ext}" \u2014 parse_document handles PDF and Office formats. For plain-text files use read_session_file.`
+          };
+        }
+        if (pages && ext !== ".pdf") {
+          return { error: `The pages option is only supported for PDF files \u2014 "${ext}" documents are extracted whole.` };
+        }
+        const uploads = exuluConfig.fileUploads;
+        const generalPrefix = uploads.s3prefix ? `${uploads.s3prefix.replace(/\/$/, "")}/` : "";
+        const key = `${generalPrefix}user_${user?.id ?? "api"}/sessions/${sessionID}/${safeName}`;
+        try {
+          const url = await getPresignedUrl(uploads.s3Bucket, key, exuluConfig);
+          const res = await fetch(url);
+          if (!res.ok) {
+            return { error: `Could not read session file "${safeName}" (status ${res.status}). Check the exact file name.` };
+          }
+          const bytes = Buffer.from(await res.arrayBuffer());
+          let fullText;
+          let totalPages;
+          if (ext === ".pdf") {
+            const raw = await pdfToText(bytes);
+            const pageTexts = raw.replace(/\f$/, "").split("\f");
+            totalPages = pageTexts.length;
+            const nonWhitespace = raw.replace(/\s/g, "").length;
+            if (nonWhitespace < totalPages * MIN_CHARS_PER_PAGE) {
+              return {
+                error: `"${safeName}" has no extractable text layer (likely a scan or image-based PDF). Use view_document_page to look at pages visually, or suggest the user add the document to a knowledge base with a document processor for full OCR.`
+              };
+            }
+            let range = [1, totalPages];
+            if (pages) {
+              const m = pagesPattern.exec(pages.trim());
+              if (!m) return { error: `Invalid pages "${pages}" \u2014 use "3" or "2-5".` };
+              range = [Number(m[1]), Number(m[2] ?? m[1])];
+              if (range[0] < 1 || range[0] > range[1]) {
+                return { error: `Invalid pages "${pages}" \u2014 start must be at least 1 and not greater than the end.` };
+              }
+              if (range[0] > totalPages) {
+                return { error: `Page range starts at ${range[0]} but "${safeName}" has only ${totalPages} page${totalPages === 1 ? "" : "s"}.` };
+              }
+            }
+            fullText = pageTexts.map((text, i) => ({ page: i + 1, text })).filter(({ page }) => page >= range[0] && page <= range[1]).map(({ page, text }) => `--- page ${page} ---
+${text.trim()}`).join("\n");
+          } else {
+            const extracted = await (0, import_officeparser.parseOfficeAsync)(bytes, {
+              outputErrorToConsole: false,
+              newlineDelimiter: "\n"
+            });
+            fullText = String(extracted);
+          }
+          const lines = fullText.split("\n");
+          const start = (offset ?? 1) - 1;
+          const requested = limit ?? DEFAULT_LIMIT2;
+          const sliced = lines.slice(start, start + requested);
+          let content = sliced.join("\n");
+          let linesReturned = sliced.length;
+          if (content.length > MAX_CONTENT_CHARS2) {
+            content = content.slice(0, MAX_CONTENT_CHARS2);
+            linesReturned = Math.max(1, content.split("\n").length - 1);
+            content = content + "\n[slice truncated \u2014 request fewer lines]";
+          }
+          return {
+            content,
+            ...totalPages !== void 0 ? { totalPages } : {},
+            totalLines: lines.length,
+            offset: start + 1,
+            linesReturned
+          };
+        } catch (err) {
+          return { error: `Failed to parse "${safeName}": ${err instanceof Error ? err.message : "unknown error"}` };
+        }
+      };
+      return ExuluTool.internal({
+        id: "parse_document",
+        name: "parse_document",
+        needsApproval: false,
+        description: `Extract the text of an uploaded PDF or Office document from this session's files, with "--- page N ---" markers for PDFs so you can locate content by page. Free and fast (no OCR): works only on documents with a real text layer. To SEE a page or an image inside a document, use view_document_page.`,
+        inputSchema: import_zod6.z.object({
+          filename: import_zod6.z.string().describe('Exact session file name, e.g. "report.pdf"'),
+          pages: import_zod6.z.string().optional().describe('PDF page or range to extract, e.g. "2" or "1-5" (default: all pages) (PDF only)'),
+          offset: import_zod6.z.number().int().min(1).optional().describe("1-based first output line to read (default 1)"),
+          limit: import_zod6.z.number().int().min(1).max(1e3).optional().describe(`Number of lines to read (default ${DEFAULT_LIMIT2})`)
+        }),
+        type: "function",
+        category: "session",
+        config: [],
+        // Same shape mismatch as read_session_file / memory-tool: internal utility
+        // tools return richer objects than ExuluTool's retrieval-flavored execute
+        // type; the AI SDK passes the object through verbatim.
+        execute: parseDocumentExecute
+      });
+    };
+  }
+});
+
+// src/sessions/pdf-preview-cache.ts
+function sanitizeEtag(raw) {
+  return raw.replace(/^"|"$/g, "").replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+async function getPdfPreviewBytes(opts) {
+  const { sourceKey, etag, config } = opts;
+  const safeEtag = sanitizeEtag(etag);
+  if (!safeEtag) {
+    throw new PreviewRenderError(`Invalid ETag for ${sourceKey}`);
+  }
+  const cachedPath = (0, import_node_path7.join)(CACHE_ROOT, `${safeEtag}.pdf`);
+  if ((0, import_node_fs6.existsSync)(cachedPath)) {
+    return (0, import_promises3.readFile)(cachedPath);
+  }
+  const existing = inFlight.get(safeEtag);
+  if (existing) return existing;
+  const promise = (async () => {
+    try {
+      await (0, import_promises3.mkdir)(CACHE_IN, { recursive: true });
+      await (0, import_promises3.mkdir)(CACHE_OUT, { recursive: true });
+      const ext = ((0, import_node_path7.extname)(sourceKey) || ".docx").toLowerCase();
+      const inputPath = (0, import_node_path7.join)(CACHE_IN, `${safeEtag}${ext}`);
+      const outputPath = (0, import_node_path7.join)(CACHE_OUT, `${safeEtag}.pdf`);
+      try {
+        const bytes = await getS3ObjectBytes(sourceKey, config);
+        await (0, import_promises3.writeFile)(inputPath, bytes);
+        try {
+          await execAsync3(
+            `soffice --headless --convert-to pdf "${inputPath}" --outdir "${CACHE_OUT}"`,
+            { timeout: 6e4, maxBuffer: 16 * 1024 * 1024 }
+          );
+        } catch (err) {
+          throw new PreviewRenderError(
+            `LibreOffice conversion failed for ${sourceKey} (etag ${etag}): ${err?.stderr ?? err?.message ?? "unknown error"}`
+          );
+        }
+        if (!(0, import_node_fs6.existsSync)(outputPath)) {
+          throw new PreviewRenderError(
+            `LibreOffice produced no output for ${sourceKey} (etag ${etag})`
+          );
+        }
+        await (0, import_promises3.rename)(outputPath, cachedPath);
+        return await (0, import_promises3.readFile)(cachedPath);
+      } finally {
+        await (0, import_promises3.rm)(inputPath, { force: true });
+      }
+    } finally {
+      inFlight.delete(safeEtag);
+    }
+  })();
+  inFlight.set(safeEtag, promise);
+  return promise;
+}
+var import_node_child_process5, import_node_fs6, import_promises3, import_node_path7, import_node_util4, execAsync3, CACHE_ROOT, CACHE_IN, CACHE_OUT, inFlight, PreviewRenderError;
+var init_pdf_preview_cache = __esm({
+  "src/sessions/pdf-preview-cache.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_child_process5 = require("child_process");
+    import_node_fs6 = require("fs");
+    import_promises3 = require("fs/promises");
+    import_node_path7 = require("path");
+    import_node_util4 = require("util");
+    init_uppy();
+    execAsync3 = (0, import_node_util4.promisify)(import_node_child_process5.exec);
+    CACHE_ROOT = "/tmp/exulu-pdf-cache";
+    CACHE_IN = (0, import_node_path7.join)(CACHE_ROOT, "_in");
+    CACHE_OUT = (0, import_node_path7.join)(CACHE_ROOT, "_out");
+    inFlight = /* @__PURE__ */ new Map();
+    PreviewRenderError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "PreviewRenderError";
+      }
+    };
+  }
+});
+
+// src/exulu/litellm/catalog.ts
+var catalog_exports = {};
+__export(catalog_exports, {
+  __resetLiteLLMCatalogCacheForTesting: () => __resetLiteLLMCatalogCacheForTesting,
+  fetchLiteLLMCatalog: () => fetchLiteLLMCatalog,
+  findLiteLLMModel: () => findLiteLLMModel
+});
+var CACHE_TTL_MS, _cache, __resetLiteLLMCatalogCacheForTesting, fetchLiteLLMCatalog, findLiteLLMModel;
+var init_catalog = __esm({
+  "src/exulu/litellm/catalog.ts"() {
+    "use strict";
+    init_cjs_shims();
+    CACHE_TTL_MS = 3e4;
+    __resetLiteLLMCatalogCacheForTesting = () => {
+      _cache = void 0;
+    };
+    fetchLiteLLMCatalog = async () => {
+      if (process.env.EXULU_USE_LITELLM !== "true") return [];
+      if (_cache && _cache.expiresAt > Date.now()) {
+        return _cache.items;
+      }
+      const host = process.env.LITELLM_HOST ?? "127.0.0.1";
+      const port = process.env.LITELLM_PORT ?? "4000";
+      const masterKey = process.env.LITELLM_MASTER_KEY;
+      if (!masterKey) return [];
+      try {
+        const res = await fetch(`http://${host}:${port}/model/info`, {
+          method: "GET",
+          headers: { Authorization: `Bearer ${masterKey}` }
+        });
+        if (!res.ok) {
+          console.error(
+            `[EXULU] litellmCatalog: LiteLLM /model/info returned ${res.status}`
+          );
+          return [];
+        }
+        const json = await res.json();
+        const items = (Array.isArray(json?.data) ? json.data : []).map((m) => ({
+          // filter out trailing * from model_name
+          model_name: m.model_name.replace(/\*$/, ""),
+          upstream_model: m.litellm_params?.model ?? null,
+          tags: Array.isArray(m.model_info?.tags) ? m.model_info.tags : [],
+          brand: m.model_info?.brand ?? null,
+          type: m.model_info?.type ?? null,
+          region: m.model_info?.region ?? null,
+          max_tokens: m.model_info?.max_tokens ?? null,
+          max_input_tokens: m.model_info?.max_input_tokens ?? null,
+          input_cost_per_million_tokens: m.model_info?.input_cost_per_token * 1e6,
+          output_cost_per_million_tokens: m.model_info?.output_cost_per_token * 1e6,
+          active: m.model_info?.active ?? true,
+          max_output_tokens: m.model_info?.max_output_tokens ?? null,
+          supports_vision: !!m.model_info?.supports_vision,
+          supports_function_calling: !!m.model_info?.supports_function_calling,
+          supports_pdf_input: !!m.model_info?.supports_pdf_input,
+          supports_audio_input: !!m.model_info?.supports_audio_input,
+          sizes: Array.isArray(m.model_info?.sizes) ? m.model_info.sizes : null,
+          qualities: Array.isArray(m.model_info?.qualities) ? m.model_info.qualities : null,
+          supports_edit: !!m.model_info?.supports_edit,
+          max_n: typeof m.model_info?.max_n === "number" ? m.model_info.max_n : null
+        }));
+        const map = /* @__PURE__ */ new Map();
+        for (const item of items) {
+          const key = `${item.model_name}-${item.upstream_model}`;
+          if (map.has(key)) {
+            map.get(key).tags.push(...item.tags);
+          } else {
+            map.set(key, item);
+          }
+        }
+        const uniqueItems = Array.from(map.values());
+        _cache = { expiresAt: Date.now() + CACHE_TTL_MS, items: uniqueItems };
+        return uniqueItems.filter((m) => m.type !== "speech_to_text" && m.type !== "text_to_speech");
+      } catch (err) {
+        console.error("[EXULU] litellmCatalog: failed to fetch /model/info:", err);
+        return [];
+      }
+    };
+    findLiteLLMModel = async (modelName) => {
+      if (!modelName) return void 0;
+      const items = await fetchLiteLLMCatalog();
+      return items.find((m) => m.model_name === modelName);
+    };
+  }
+});
+
+// src/exulu/tool-image-attachments.ts
+function sweep() {
+  const cutoff = Date.now() - TTL_MS;
+  for (const [id, entry] of stash) {
+    if (entry.stashedAt < cutoff) stash.delete(id);
+  }
+  while (stash.size > MAX_ENTRIES) {
+    const oldest = stash.keys().next().value;
+    if (oldest === void 0) break;
+    stash.delete(oldest);
+  }
+  let totalBytes = 0;
+  for (const entry of stash.values()) totalBytes += entry.data.length;
+  while (totalBytes > MAX_TOTAL_BYTES) {
+    const oldest = stash.keys().next().value;
+    if (oldest === void 0) break;
+    totalBytes -= stash.get(oldest).data.length;
+    stash.delete(oldest);
+  }
+}
+function stashToolImage(toolCallId, image) {
+  stash.set(toolCallId, { ...image, stashedAt: Date.now() });
+  sweep();
+}
+function stashedIdsInMessage(message) {
+  if (message?.role !== "tool" || !Array.isArray(message.content)) return [];
+  return message.content.filter(
+    (p) => p?.type === "tool-result" && typeof p.toolCallId === "string" && p.toolName === STASH_TOOL_NAME && stash.has(p.toolCallId)
+  ).map((p) => p.toolCallId);
+}
+function injectedTextFor(id, label) {
+  return `${INJECTED_IMAGE_PREFIX}${id}: ${label}]`;
+}
+function firstTextPart(message) {
+  if (message?.role !== "user" || !Array.isArray(message.content)) return void 0;
+  const first = message.content[0];
+  return first?.type === "text" ? first.text : void 0;
+}
+function imageAttachmentGuard() {
+  return ({ messages }) => {
+    sweep();
+    if (!Array.isArray(messages) || messages.length === 0 || stash.size === 0) return void 0;
+    let changed = false;
+    const next = [];
+    for (let i = 0; i < messages.length; i++) {
+      const message = messages[i];
+      next.push(message);
+      const ids = stashedIdsInMessage(message);
+      if (ids.length === 0) continue;
+      const alreadyInjected = [];
+      for (let j = i + 1; j < messages.length; j++) {
+        const text = firstTextPart(messages[j]);
+        if (text === void 0 || !text.startsWith(INJECTED_IMAGE_PREFIX)) break;
+        alreadyInjected.push(text);
+      }
+      for (const id of ids) {
+        if (alreadyInjected.some((text) => text.startsWith(`${INJECTED_IMAGE_PREFIX}${id}:`))) continue;
+        const image = stash.get(id);
+        changed = true;
+        next.push({
+          role: "user",
+          content: [
+            { type: "text", text: injectedTextFor(id, image.label) },
+            { type: "image", image: image.data, mediaType: image.mediaType }
+          ]
+        });
+      }
+    }
+    return changed ? { messages: next } : void 0;
+  };
+}
+var INJECTED_IMAGE_PREFIX, stash, MAX_ENTRIES, TTL_MS, MAX_TOTAL_BYTES, STASH_TOOL_NAME;
+var init_tool_image_attachments = __esm({
+  "src/exulu/tool-image-attachments.ts"() {
+    "use strict";
+    init_cjs_shims();
+    INJECTED_IMAGE_PREFIX = "[Image attached from tool call ";
+    stash = /* @__PURE__ */ new Map();
+    MAX_ENTRIES = 100;
+    TTL_MS = 30 * 60 * 1e3;
+    MAX_TOTAL_BYTES = 1e8;
+    STASH_TOOL_NAME = "view_document_page";
+  }
+});
+
+// src/templates/tools/view-document-page-tool.ts
+var import_zod7, import_node_path8, MAX_IMAGE_BYTES, SCALE_PRIMARY, SCALE_FALLBACK, IMAGE_MEDIA_TYPES, OFFICE_EXTENSIONS2, createViewDocumentPageTool;
+var init_view_document_page_tool = __esm({
+  "src/templates/tools/view-document-page-tool.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_zod7 = require("zod");
+    import_node_path8 = require("path");
+    init_tool();
+    init_uppy();
+    init_pdf_preview_cache();
+    init_catalog();
+    init_tool_image_attachments();
+    init_document_render_helpers();
+    MAX_IMAGE_BYTES = 375e4;
+    SCALE_PRIMARY = 1568;
+    SCALE_FALLBACK = 1024;
+    IMAGE_MEDIA_TYPES = {
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".webp": "image/webp"
+    };
+    OFFICE_EXTENSIONS2 = /* @__PURE__ */ new Set([
+      ".docx",
+      ".doc",
+      ".xlsx",
+      ".xls",
+      ".pptx",
+      ".ppt",
+      ".odt",
+      ".ods",
+      ".odp",
+      ".rtf"
+    ]);
+    createViewDocumentPageTool = ({
+      sessionID,
+      user,
+      exuluConfig
+    }) => {
+      if (!sessionID || !exuluConfig?.fileUploads?.s3Bucket) return void 0;
+      const viewDocumentPageExecute = async ({ filename, page, model }, options) => {
+        const safeName = String(filename ?? "").trim();
+        if (!safeName || safeName.includes("..") || safeName.includes("/") || safeName.includes("\\")) {
+          return {
+            error: "Invalid filename \u2014 pass the bare file name exactly as listed in the session files (no paths)."
+          };
+        }
+        const ext = (0, import_node_path8.extname)(safeName).toLowerCase();
+        const isImage = ext in IMAGE_MEDIA_TYPES;
+        const isPdf = ext === ".pdf";
+        const isOffice = OFFICE_EXTENSIONS2.has(ext);
+        if (!isImage && !isPdf && !isOffice) {
+          return { error: `Unsupported extension "${ext}" \u2014 view_document_page handles PDF, Office, and image files.` };
+        }
+        const modelId = typeof model === "string" ? model : model?.modelId;
+        if (!modelId) {
+          console.warn("[EXULU] view_document_page: no model id available for vision gating \u2014 proceeding optimistically.");
+        }
+        if (modelId) {
+          try {
+            const entry = await findLiteLLMModel(modelId);
+            if (entry && entry.supports_vision === false) {
+              return {
+                error: `The current model "${modelId}" does not support images, so this page cannot be shown to you. Use parse_document for the text, or tell the user a vision-capable model is required.`
+              };
+            }
+          } catch {
+          }
+        }
+        const uploads = exuluConfig.fileUploads;
+        const generalPrefix = uploads.s3prefix ? `${uploads.s3prefix.replace(/\/$/, "")}/` : "";
+        const key = `${generalPrefix}user_${user?.id ?? "api"}/sessions/${sessionID}/${safeName}`;
+        const pageNumber = page ?? 1;
+        try {
+          let imageBytes;
+          let mediaType = "image/png";
+          if (isImage) {
+            imageBytes = await getS3ObjectBytes(key, exuluConfig);
+            mediaType = IMAGE_MEDIA_TYPES[ext];
+            if (imageBytes.length > MAX_IMAGE_BYTES) {
+              return {
+                error: `"${safeName}" is too large to attach (${imageBytes.length} bytes, max ${MAX_IMAGE_BYTES}). Ask the user for a smaller version of the image.`
+              };
+            }
+          } else {
+            let pdfBytes;
+            if (isPdf) {
+              pdfBytes = await getS3ObjectBytes(key, exuluConfig);
+            } else {
+              const etag = await getS3ObjectEtag(key, exuluConfig);
+              if (!etag) {
+                return { error: `Could not read session file "${safeName}". Check the exact file name.` };
+              }
+              pdfBytes = await getPdfPreviewBytes({ sourceKey: key, etag, config: exuluConfig });
+            }
+            let rendered = await renderPdfPageToPng(pdfBytes, pageNumber, SCALE_PRIMARY);
+            if (!rendered) {
+              return { error: `Could not render page ${pageNumber} of "${safeName}" \u2014 the document may have fewer pages.` };
+            }
+            if (rendered.length > MAX_IMAGE_BYTES) {
+              rendered = await renderPdfPageToPng(pdfBytes, pageNumber, SCALE_FALLBACK);
+            }
+            if (!rendered || rendered.length > MAX_IMAGE_BYTES) {
+              return { error: `Page ${pageNumber} of "${safeName}" is too complex to attach within the image size limit.` };
+            }
+            imageBytes = rendered;
+          }
+          if (!options?.toolCallId) {
+            return { error: "Internal error: missing toolCallId \u2014 the image cannot be attached." };
+          }
+          stashToolImage(options.toolCallId, {
+            data: imageBytes.toString("base64"),
+            mediaType,
+            label: isImage ? safeName : `${safeName} page ${pageNumber}`
+          });
+          return {
+            attached: true,
+            filename: safeName,
+            page: pageNumber,
+            note: "The rendered image follows this tool result as an attached user message \u2014 analyze it there. If no image message follows, the attachment has expired; call this tool again to re-render it."
+          };
+        } catch (err) {
+          return { error: `Failed to render "${safeName}": ${err instanceof Error ? err.message : "unknown error"}` };
+        }
+      };
+      return ExuluTool.internal({
+        id: "view_document_page",
+        name: "view_document_page",
+        needsApproval: false,
+        description: "LOOK at a page of an uploaded PDF/Office document, or at an uploaded image, from this session's files. The rendered image is attached as a user message directly after this tool result so you can visually analyze photos, charts, scans, and layouts. Use parse_document first to find which page you need. Requires a vision-capable model.",
+        inputSchema: import_zod7.z.object({
+          filename: import_zod7.z.string().describe('Exact session file name, e.g. "report.pdf" or "screenshot.png"'),
+          page: import_zod7.z.number().int().min(1).optional().describe("Page number to render (default 1; ignored for image files)")
+        }),
+        type: "function",
+        category: "session",
+        config: [],
+        // Same execute-shape cast as read_session_file / parse_document.
+        execute: viewDocumentPageExecute
+      });
+    };
+  }
+});
+
 // src/templates/tools/convert-exulu-tools-to-ai-sdk-tools.ts
 var convert_exulu_tools_to_ai_sdk_tools_exports = {};
 __export(convert_exulu_tools_to_ai_sdk_tools_exports, {
@@ -4168,6 +4795,8 @@ var init_convert_exulu_tools_to_ai_sdk_tools = __esm({
     init_truncate_tool_output();
     init_tool_output_offload();
     init_session_file_read_tool();
+    init_parse_document_tool();
+    init_view_document_page_tool();
     init_context_budget();
     OUTPUT_OFFLOAD_EXEMPT_TOOL_IDS = /* @__PURE__ */ new Set(["agentic_context_search"]);
     generateS3Key = (filename) => `${(0, import_node_crypto4.randomUUID)()}-${filename}`;
@@ -4348,6 +4977,14 @@ var init_convert_exulu_tools_to_ai_sdk_tools = __esm({
       if (sessionFileReadTool && !disabled.has(sessionFileReadTool.id)) {
         currentTools.push(sessionFileReadTool);
       }
+      const parseDocumentTool = createParseDocumentTool({ sessionID, user, exuluConfig });
+      if (parseDocumentTool && !disabled.has(parseDocumentTool.id)) {
+        currentTools.push(parseDocumentTool);
+      }
+      const viewDocumentPageTool = createViewDocumentPageTool({ sessionID, user, exuluConfig });
+      if (viewDocumentPageTool && !disabled.has(viewDocumentPageTool.id)) {
+        currentTools.push(viewDocumentPageTool);
+      }
       console.log("[EXULU] Creating agentic search tool", contexts?.length, model);
       if (contexts?.length && model && !disabled.has("agentic_context_search")) {
         const index = currentTools.findIndex((tool4) => tool4.id === "agentic_context_search");
@@ -4615,13 +5252,13 @@ var init_convert_exulu_tools_to_ai_sdk_tools = __esm({
 });
 
 // src/exulu/tool.ts
-var import_ai3, import_zod6, import_node_crypto5, PUBLIC_TOOL_TYPES, ExuluTool;
+var import_ai3, import_zod8, import_node_crypto5, PUBLIC_TOOL_TYPES, ExuluTool;
 var init_tool = __esm({
   "src/exulu/tool.ts"() {
     "use strict";
     init_cjs_shims();
     import_ai3 = require("ai");
-    import_zod6 = require("zod");
+    import_zod8 = require("zod");
     init_sanitize_name();
     import_node_crypto5 = require("crypto");
     init_singleton();
@@ -4678,7 +5315,7 @@ var init_tool = __esm({
         this.type = type;
         this.tool = (0, import_ai3.tool)({
           description,
-          inputSchema: inputSchema || import_zod6.z.object({}),
+          inputSchema: inputSchema || import_zod8.z.object({}),
           execute: oauth ? wrapExecuteWithOauth(id, oauth, execute2) : execute2
         });
       }
@@ -4971,62 +5608,62 @@ function effectiveKbSettings(profile, ctx) {
     keywordPrefilter: preset.keywordPrefilter
   };
 }
-var import_zod7, KB_KINDS, DEFAULT_PREFILTER_CUTOFF, RRF_K, CHUNK_GROUP_MAX, kbProfileSchema, knowledgeBasesSchema, routingRuleSchema, routingSchema, identifierSetSchema, vocabularySchema, memorySchema, tuningSchema, boolVal, strVal, KIND_PRESETS;
+var import_zod9, KB_KINDS, DEFAULT_PREFILTER_CUTOFF, RRF_K, CHUNK_GROUP_MAX, kbProfileSchema, knowledgeBasesSchema, routingRuleSchema, routingSchema, identifierSetSchema, vocabularySchema, memorySchema, tuningSchema, boolVal, strVal, KIND_PRESETS;
 var init_config = __esm({
   "ee/agentic-retrieval/pipeline/config.ts"() {
     "use strict";
     init_cjs_shims();
-    import_zod7 = require("zod");
+    import_zod9 = require("zod");
     KB_KINDS = ["documents", "conversations", "records"];
     DEFAULT_PREFILTER_CUTOFF = 2.5;
     RRF_K = 60;
     CHUNK_GROUP_MAX = 10;
-    kbProfileSchema = import_zod7.z.object({
-      enabled: import_zod7.z.boolean().default(true),
-      kind: import_zod7.z.enum(KB_KINDS).default("documents"),
-      instructions: import_zod7.z.string().default(""),
-      overrides: import_zod7.z.object({
-        limit: import_zod7.z.number().int().positive().optional(),
-        expand: import_zod7.z.number().int().min(0).optional(),
-        multiQuery: import_zod7.z.boolean().optional(),
-        hyde: import_zod7.z.boolean().optional()
+    kbProfileSchema = import_zod9.z.object({
+      enabled: import_zod9.z.boolean().default(true),
+      kind: import_zod9.z.enum(KB_KINDS).default("documents"),
+      instructions: import_zod9.z.string().default(""),
+      overrides: import_zod9.z.object({
+        limit: import_zod9.z.number().int().positive().optional(),
+        expand: import_zod9.z.number().int().min(0).optional(),
+        multiQuery: import_zod9.z.boolean().optional(),
+        hyde: import_zod9.z.boolean().optional()
       }).default({})
     });
-    knowledgeBasesSchema = import_zod7.z.record(import_zod7.z.string(), kbProfileSchema);
-    routingRuleSchema = import_zod7.z.object({
-      id: import_zod7.z.string(),
-      label: import_zod7.z.string(),
-      description: import_zod7.z.string(),
-      main: import_zod7.z.array(import_zod7.z.string()),
-      fallback: import_zod7.z.array(import_zod7.z.string()).default([])
+    knowledgeBasesSchema = import_zod9.z.record(import_zod9.z.string(), kbProfileSchema);
+    routingRuleSchema = import_zod9.z.object({
+      id: import_zod9.z.string(),
+      label: import_zod9.z.string(),
+      description: import_zod9.z.string(),
+      main: import_zod9.z.array(import_zod9.z.string()),
+      fallback: import_zod9.z.array(import_zod9.z.string()).default([])
     });
-    routingSchema = import_zod7.z.object({ rules: import_zod7.z.array(routingRuleSchema).default([]) });
-    identifierSetSchema = import_zod7.z.object({
-      name: import_zod7.z.string(),
-      description: import_zod7.z.string().default(""),
-      examples: import_zod7.z.array(import_zod7.z.string()).default([]),
-      strategy: import_zod7.z.enum(["fuzzy", "exact"]),
-      contexts: import_zod7.z.array(import_zod7.z.string()).default([])
+    routingSchema = import_zod9.z.object({ rules: import_zod9.z.array(routingRuleSchema).default([]) });
+    identifierSetSchema = import_zod9.z.object({
+      name: import_zod9.z.string(),
+      description: import_zod9.z.string().default(""),
+      examples: import_zod9.z.array(import_zod9.z.string()).default([]),
+      strategy: import_zod9.z.enum(["fuzzy", "exact"]),
+      contexts: import_zod9.z.array(import_zod9.z.string()).default([])
     });
-    vocabularySchema = import_zod7.z.object({
-      glossary: import_zod7.z.array(import_zod7.z.object({ term: import_zod7.z.string(), meaning: import_zod7.z.string() })).default([]),
-      identifiers: import_zod7.z.array(identifierSetSchema).default([]),
-      rewrites: import_zod7.z.array(import_zod7.z.object({ find: import_zod7.z.string(), replace: import_zod7.z.string() })).default([]),
-      styleHint: import_zod7.z.string().default("")
+    vocabularySchema = import_zod9.z.object({
+      glossary: import_zod9.z.array(import_zod9.z.object({ term: import_zod9.z.string(), meaning: import_zod9.z.string() })).default([]),
+      identifiers: import_zod9.z.array(identifierSetSchema).default([]),
+      rewrites: import_zod9.z.array(import_zod9.z.object({ find: import_zod9.z.string(), replace: import_zod9.z.string() })).default([]),
+      styleHint: import_zod9.z.string().default("")
     });
-    memorySchema = import_zod7.z.object({
-      enabled: import_zod7.z.boolean().default(true),
-      override: import_zod7.z.boolean().default(false),
-      filePrioritization: import_zod7.z.boolean().default(false),
-      queryAugmentation: import_zod7.z.boolean().default(true)
+    memorySchema = import_zod9.z.object({
+      enabled: import_zod9.z.boolean().default(true),
+      override: import_zod9.z.boolean().default(false),
+      filePrioritization: import_zod9.z.boolean().default(false),
+      queryAugmentation: import_zod9.z.boolean().default(true)
     });
-    tuningSchema = import_zod7.z.object({
-      topK: import_zod7.z.number().int().positive().default(5),
-      fallbackThreshold: import_zod7.z.number().min(0).max(1).default(0.95),
-      pinBoost: import_zod7.z.number().min(0).max(1).default(0.15),
-      identifierBoost: import_zod7.z.number().min(0).max(1).default(0.15),
-      pageWindow: import_zod7.z.number().int().min(0).default(1),
-      maxQueriesPerContext: import_zod7.z.number().int().positive().default(5)
+    tuningSchema = import_zod9.z.object({
+      topK: import_zod9.z.number().int().positive().default(5),
+      fallbackThreshold: import_zod9.z.number().min(0).max(1).default(0.95),
+      pinBoost: import_zod9.z.number().min(0).max(1).default(0.15),
+      identifierBoost: import_zod9.z.number().min(0).max(1).default(0.15),
+      pageWindow: import_zod9.z.number().int().min(0).default(1),
+      maxQueriesPerContext: import_zod9.z.number().int().positive().default(5)
     });
     boolVal = (v) => v === true || v === "true" || v === 1;
     strVal = (v, fallback) => typeof v === "string" && v.length > 0 ? v : fallback;
@@ -5273,9 +5910,9 @@ async function resolveIdentifierPins({
             system: set.strategy === "exact" ? EXACT_EXTRACTION_PROMPT(set) : FUZZY_EXTRACTION_PROMPT(set),
             messages: [{ role: "user", content: question }],
             output: import_ai4.Output.object({
-              schema: import_zod8.z.object({
-                hasMatches: import_zod8.z.boolean(),
-                matches: import_zod8.z.array(import_zod8.z.string()).optional()
+              schema: import_zod10.z.object({
+                hasMatches: import_zod10.z.boolean(),
+                matches: import_zod10.z.array(import_zod10.z.string()).optional()
               })
             }),
             maxOutputTokens: 300
@@ -5323,14 +5960,14 @@ async function resolveIdentifierPins({
   );
   return { pinsByContext, exactPinsByContext, steps };
 }
-var import_fuse, import_ai4, import_zod8, itemCaches, ensureItemsCache, FUZZY_EXTRACTION_PROMPT, EXACT_EXTRACTION_PROMPT;
+var import_fuse, import_ai4, import_zod10, itemCaches, ensureItemsCache, FUZZY_EXTRACTION_PROMPT, EXACT_EXTRACTION_PROMPT;
 var init_prefilter = __esm({
   "ee/agentic-retrieval/pipeline/prefilter.ts"() {
     "use strict";
     init_cjs_shims();
     import_fuse = __toESM(require("fuse.js"), 1);
     import_ai4 = require("ai");
-    import_zod8 = require("zod");
+    import_zod10 = require("zod");
     init_with_retry();
     init_text_utils();
     init_config();
@@ -5415,11 +6052,11 @@ If explicit, return the knowledge base ids. If not, return an empty array.`;
               system: buildDocPagePrompt(knownIdentifiers),
               messages: [{ role: "user", content: question }],
               output: import_ai5.Output.object({
-                schema: import_zod9.z.object({
-                  hasFilenameHint: import_zod9.z.boolean(),
-                  filenameHints: import_zod9.z.array(import_zod9.z.string()).optional(),
-                  hasPageHint: import_zod9.z.boolean(),
-                  pageNumber: import_zod9.z.number().int().nullable().optional()
+                schema: import_zod11.z.object({
+                  hasFilenameHint: import_zod11.z.boolean(),
+                  filenameHints: import_zod11.z.array(import_zod11.z.string()).optional(),
+                  hasPageHint: import_zod11.z.boolean(),
+                  pageNumber: import_zod11.z.number().int().nullable().optional()
                 })
               }),
               maxOutputTokens: 300
@@ -5446,9 +6083,9 @@ If explicit, return the knowledge base ids. If not, return an empty array.`;
               temperature: 0,
               system: kbSystemPrompt,
               output: import_ai5.Output.object({
-                schema: import_zod9.z.object({
-                  explicitlyRequestedKnowledgeBases: import_zod9.z.array(
-                    import_zod9.z.enum(enabledContexts.map((c) => c.id))
+                schema: import_zod11.z.object({
+                  explicitlyRequestedKnowledgeBases: import_zod11.z.array(
+                    import_zod11.z.enum(enabledContexts.map((c) => c.id))
                   )
                 })
               }),
@@ -5546,9 +6183,9 @@ ${extraInstructions}
             system: classifyPrompt,
             messages: [{ role: "user", content: question }],
             output: import_ai5.Output.object({
-              schema: import_zod9.z.object({
-                ruleId: import_zod9.z.enum(ruleIds),
-                reason: import_zod9.z.string()
+              schema: import_zod11.z.object({
+                ruleId: import_zod11.z.enum(ruleIds),
+                reason: import_zod11.z.string()
               })
             }),
             maxOutputTokens: 200
@@ -5607,13 +6244,13 @@ ${extraInstructions}
     };
   }
 }
-var import_ai5, import_zod9, MAX_USER_PIN_MATCHES, buildDocPagePrompt;
+var import_ai5, import_zod11, MAX_USER_PIN_MATCHES, buildDocPagePrompt;
 var init_routing = __esm({
   "ee/agentic-retrieval/pipeline/routing.ts"() {
     "use strict";
     init_cjs_shims();
     import_ai5 = require("ai");
-    import_zod9 = require("zod");
+    import_zod11 = require("zod");
     init_with_retry();
     init_prefilter();
     init_text_utils();
@@ -5885,8 +6522,8 @@ async function runMemoryPhase({
             }
           ],
           output: import_ai6.Output.object({
-            schema: import_zod10.z.object({
-              relevantChunkIds: import_zod10.z.array(import_zod10.z.string()).describe(
+            schema: import_zod12.z.object({
+              relevantChunkIds: import_zod12.z.array(import_zod12.z.string()).describe(
                 "The chunk_ids (UUIDs at the start of each bullet) of chunks containing information relevant to the user's question. Empty array if none are relevant."
               )
             })
@@ -6002,17 +6639,17 @@ ${glossary.map((g) => `${g.term} : ${g.meaning}`).join("\n")}` : "";
               }
             ],
             output: import_ai6.Output.object({
-              schema: import_zod10.z.object({
-                overrides: import_zod10.z.boolean().describe(
+              schema: import_zod12.z.object({
+                overrides: import_zod12.z.boolean().describe(
                   "True ONLY if a memory chunk directly and sufficiently answers the user's question and should be authoritative over the documents. Be strict; when unsure, false."
                 ),
-                confidence: import_zod10.z.enum(["high", "medium", "low"]).describe(
+                confidence: import_zod12.z.enum(["high", "medium", "low"]).describe(
                   "Confidence that the selected memory chunk(s) fully and directly answer the question."
                 ),
-                authoritativeChunkIds: import_zod10.z.array(import_zod10.z.string()).describe(
+                authoritativeChunkIds: import_zod12.z.array(import_zod12.z.string()).describe(
                   "The chunk_ids of the memory chunk(s) that directly answer the question. Empty if overrides is false."
                 ),
-                reason: import_zod10.z.string().describe(
+                reason: import_zod12.z.string().describe(
                   "One short sentence: why this memory does or does not directly answer the question."
                 )
               })
@@ -6043,9 +6680,9 @@ ${glossary.map((g) => `${g.term} : ${g.meaning}`).join("\n")}` : "";
             system: "You are a helpful assistant that will strictly follow the user's instructions.",
             messages: [{ role: "user", content: PROMPT_EXTRACT_PRIORITIZED_FILES }],
             output: import_ai6.Output.object({
-              schema: import_zod10.z.object({
-                shouldPrioritizeFiles: import_zod10.z.boolean(),
-                fileNameHints: import_zod10.z.array(import_zod10.z.string()).optional()
+              schema: import_zod12.z.object({
+                shouldPrioritizeFiles: import_zod12.z.boolean(),
+                fileNameHints: import_zod12.z.array(import_zod12.z.string()).optional()
               })
             }),
             maxOutputTokens: 300
@@ -6064,10 +6701,10 @@ ${glossary.map((g) => `${g.term} : ${g.meaning}`).join("\n")}` : "";
             system: "You are a helpful assistant that will strictly follow the user's instructions.",
             messages: [{ role: "user", content: QUERY_AUGMENTATION_PROMPT }],
             output: import_ai6.Output.object({
-              schema: import_zod10.z.object({
-                updatedUserQuestion: import_zod10.z.string(),
-                updatedRelevantKeywords: import_zod10.z.array(import_zod10.z.string()),
-                updatedImportantKeyword: import_zod10.z.string()
+              schema: import_zod12.z.object({
+                updatedUserQuestion: import_zod12.z.string(),
+                updatedRelevantKeywords: import_zod12.z.array(import_zod12.z.string()),
+                updatedImportantKeyword: import_zod12.z.string()
               })
             }),
             maxOutputTokens: 600
@@ -6153,13 +6790,13 @@ ${glossary.map((g) => `${g.term} : ${g.meaning}`).join("\n")}` : "";
     return neutralResult(question, keywords, importantKeyword);
   }
 }
-var import_ai6, import_zod10, MEMORY_OVERRIDE_MIN_CONFIDENCE, MEMORY_SYNTHETIC_RERANK_SCORE, ITEM_CACHE_TTL_MS, memoryItemCache;
+var import_ai6, import_zod12, MEMORY_OVERRIDE_MIN_CONFIDENCE, MEMORY_SYNTHETIC_RERANK_SCORE, ITEM_CACHE_TTL_MS, memoryItemCache;
 var init_memory = __esm({
   "ee/agentic-retrieval/pipeline/memory.ts"() {
     "use strict";
     init_cjs_shims();
     import_ai6 = require("ai");
-    import_zod10 = require("zod");
+    import_zod12 = require("zod");
     init_with_retry();
     init_multi_query();
     init_prefilter();
@@ -6655,11 +7292,11 @@ function createAgenticRetrievalTool(opts) {
         default: '{"topK":5,"fallbackThreshold":0.95,"pinBoost":0.15,"identifierBoost":0.15,"pageWindow":1,"maxQueriesPerContext":5}'
       }
     ],
-    inputSchema: import_zod11.z.object({
-      userQuery: import_zod11.z.string().describe("The original unaltered question from the user"),
-      relevantKeywords: import_zod11.z.array(import_zod11.z.string()).describe("Keywords extracted from the user's question relevant to the search"),
-      importantKeyword: import_zod11.z.string().describe("The single most important keyword from the user's question"),
-      confirmedContextIds: import_zod11.z.array(import_zod11.z.string()).optional().describe(
+    inputSchema: import_zod13.z.object({
+      userQuery: import_zod13.z.string().describe("The original unaltered question from the user"),
+      relevantKeywords: import_zod13.z.array(import_zod13.z.string()).describe("Keywords extracted from the user's question relevant to the search"),
+      importantKeyword: import_zod13.z.string().describe("The single most important keyword from the user's question"),
+      confirmedContextIds: import_zod13.z.array(import_zod13.z.string()).optional().describe(
         "Knowledge base IDs explicitly confirmed by the user to be used in the retrieval. When present, only searches these contexts."
       )
     }),
@@ -7050,12 +7687,12 @@ Verified answer:
     }
   });
 }
-var import_zod11;
+var import_zod13;
 var init_pipeline = __esm({
   "ee/agentic-retrieval/pipeline/index.ts"() {
     "use strict";
     init_cjs_shims();
-    import_zod11 = require("zod");
+    import_zod13 = require("zod");
     init_tool();
     init_entitlements();
     init_resolve_reranker();
@@ -7073,91 +7710,6 @@ var init_pipeline = __esm({
   }
 });
 
-// src/exulu/litellm/catalog.ts
-var catalog_exports = {};
-__export(catalog_exports, {
-  __resetLiteLLMCatalogCacheForTesting: () => __resetLiteLLMCatalogCacheForTesting,
-  fetchLiteLLMCatalog: () => fetchLiteLLMCatalog,
-  findLiteLLMModel: () => findLiteLLMModel
-});
-var CACHE_TTL_MS, _cache, __resetLiteLLMCatalogCacheForTesting, fetchLiteLLMCatalog, findLiteLLMModel;
-var init_catalog = __esm({
-  "src/exulu/litellm/catalog.ts"() {
-    "use strict";
-    init_cjs_shims();
-    CACHE_TTL_MS = 3e4;
-    __resetLiteLLMCatalogCacheForTesting = () => {
-      _cache = void 0;
-    };
-    fetchLiteLLMCatalog = async () => {
-      if (process.env.EXULU_USE_LITELLM !== "true") return [];
-      if (_cache && _cache.expiresAt > Date.now()) {
-        return _cache.items;
-      }
-      const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-      const port = process.env.LITELLM_PORT ?? "4000";
-      const masterKey = process.env.LITELLM_MASTER_KEY;
-      if (!masterKey) return [];
-      try {
-        const res = await fetch(`http://${host}:${port}/model/info`, {
-          method: "GET",
-          headers: { Authorization: `Bearer ${masterKey}` }
-        });
-        if (!res.ok) {
-          console.error(
-            `[EXULU] litellmCatalog: LiteLLM /model/info returned ${res.status}`
-          );
-          return [];
-        }
-        const json = await res.json();
-        const items = (Array.isArray(json?.data) ? json.data : []).map((m) => ({
-          // filter out trailing * from model_name
-          model_name: m.model_name.replace(/\*$/, ""),
-          upstream_model: m.litellm_params?.model ?? null,
-          tags: Array.isArray(m.model_info?.tags) ? m.model_info.tags : [],
-          brand: m.model_info?.brand ?? null,
-          type: m.model_info?.type ?? null,
-          region: m.model_info?.region ?? null,
-          max_tokens: m.model_info?.max_tokens ?? null,
-          max_input_tokens: m.model_info?.max_input_tokens ?? null,
-          input_cost_per_million_tokens: m.model_info?.input_cost_per_token * 1e6,
-          output_cost_per_million_tokens: m.model_info?.output_cost_per_token * 1e6,
-          active: m.model_info?.active ?? true,
-          max_output_tokens: m.model_info?.max_output_tokens ?? null,
-          supports_vision: !!m.model_info?.supports_vision,
-          supports_function_calling: !!m.model_info?.supports_function_calling,
-          supports_pdf_input: !!m.model_info?.supports_pdf_input,
-          supports_audio_input: !!m.model_info?.supports_audio_input,
-          sizes: Array.isArray(m.model_info?.sizes) ? m.model_info.sizes : null,
-          qualities: Array.isArray(m.model_info?.qualities) ? m.model_info.qualities : null,
-          supports_edit: !!m.model_info?.supports_edit,
-          max_n: typeof m.model_info?.max_n === "number" ? m.model_info.max_n : null
-        }));
-        const map = /* @__PURE__ */ new Map();
-        for (const item of items) {
-          const key = `${item.model_name}-${item.upstream_model}`;
-          if (map.has(key)) {
-            map.get(key).tags.push(...item.tags);
-          } else {
-            map.set(key, item);
-          }
-        }
-        const uniqueItems = Array.from(map.values());
-        _cache = { expiresAt: Date.now() + CACHE_TTL_MS, items: uniqueItems };
-        return uniqueItems.filter((m) => m.type !== "speech_to_text" && m.type !== "text_to_speech");
-      } catch (err) {
-        console.error("[EXULU] litellmCatalog: failed to fetch /model/info:", err);
-        return [];
-      }
-    };
-    findLiteLLMModel = async (modelName) => {
-      if (!modelName) return void 0;
-      const items = await fetchLiteLLMCatalog();
-      return items.find((m) => m.model_name === modelName);
-    };
-  }
-});
-
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
@@ -18415,28 +18967,14 @@ var BundleValidationError = class extends Error {
 function isUnsafePath(path2) {
   if (!path2) return true;
   if (path2.startsWith("/")) return true;
-  return path2.split("/").some((segment) => segment === "..");
-}
-function isOsJunkPath(path2) {
-  if (path2.startsWith("__MACOSX/")) return true;
-  const basename = path2.split("/").pop() ?? "";
-  return basename === ".DS_Store" || basename === "Thumbs.db" || basename === "desktop.ini";
-}
-async function extractBundleToS3(opts) {
-  const { bytes, skillId, isZip, config } = opts;
-  if (!isZip) {
-    await uploadFile(
-      bytes,
-      `skills/${skillId}/v1/SKILL.md`,
-      config,
-      { contentType: "text/markdown" },
-      void 0,
-      void 0,
-      true
-      // global=true so the key isn't user-prefixed (skill files are shared)
-    );
-    return { filesCount: 1 };
-  }
+  return path2.split("/").some((segment) => segment === "..");
+}
+function isOsJunkPath(path2) {
+  if (path2.startsWith("__MACOSX/")) return true;
+  const basename = path2.split("/").pop() ?? "";
+  return basename === ".DS_Store" || basename === "Thumbs.db" || basename === "desktop.ini";
+}
+async function extractZipToPrefix(bytes, prefix, config) {
   let zip;
   try {
     zip = await import_jszip.default.loadAsync(bytes);
@@ -18500,7 +19038,7 @@ async function extractBundleToS3(opts) {
   }
   let filesCount = 0;
   for (const { relPath, content } of prepared) {
-    const s3Key = `skills/${skillId}/v1/${relPath}`;
+    const s3Key = `${prefix}${relPath}`;
     await uploadFile(
       content,
       s3Key,
@@ -18509,86 +19047,80 @@ async function extractBundleToS3(opts) {
       void 0,
       void 0,
       true
-      // global=true — see SKILL.md case above
+      // global=true — skill files are shared across users
     );
     filesCount += 1;
   }
   return { filesCount };
 }
+async function extractBundleToS3(opts) {
+  const { bytes, skillId, isZip, config } = opts;
+  if (!isZip) {
+    await uploadFile(
+      bytes,
+      `skills/${skillId}/v1/SKILL.md`,
+      config,
+      { contentType: "text/markdown" },
+      void 0,
+      void 0,
+      true
+      // global=true so the key isn't user-prefixed (skill files are shared)
+    );
+    return { filesCount: 1 };
+  }
+  return extractZipToPrefix(bytes, `skills/${skillId}/v1/`, config);
+}
+async function extractBundleToVersion(opts) {
+  const { bytes, skillId, version, config } = opts;
+  return extractZipToPrefix(bytes, `skills/${skillId}/v${version}/`, config);
+}
 
-// src/sessions/pdf-preview-cache.ts
+// src/skills/frontmatter.ts
 init_cjs_shims();
-var import_node_child_process4 = require("child_process");
-var import_node_fs6 = require("fs");
-var import_promises2 = require("fs/promises");
-var import_node_path5 = require("path");
-var import_node_util3 = require("util");
-init_uppy();
-var execAsync3 = (0, import_node_util3.promisify)(import_node_child_process4.exec);
-var CACHE_ROOT = "/tmp/exulu-pdf-cache";
-var CACHE_IN = (0, import_node_path5.join)(CACHE_ROOT, "_in");
-var CACHE_OUT = (0, import_node_path5.join)(CACHE_ROOT, "_out");
-var inFlight = /* @__PURE__ */ new Map();
-var PreviewRenderError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "PreviewRenderError";
+var import_jszip2 = __toESM(require("jszip"), 1);
+function parseFrontmatter(md) {
+  const match = /^?---\r?\n([\s\S]*?)\r?\n---/.exec(md);
+  if (!match) return {};
+  const block = match[1];
+  const out = {};
+  for (const line of block.split(/\r?\n/)) {
+    const m = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(line);
+    if (!m) continue;
+    const key = m[1];
+    let v = m[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'")) {
+      v = v.slice(1, -1);
+    }
+    out[key] = v;
   }
-};
-function sanitizeEtag(raw) {
-  return raw.replace(/^"|"$/g, "").replace(/[^a-zA-Z0-9_-]/g, "_");
+  return out;
 }
-async function getPdfPreviewBytes(opts) {
-  const { sourceKey, etag, config } = opts;
-  const safeEtag = sanitizeEtag(etag);
-  if (!safeEtag) {
-    throw new PreviewRenderError(`Invalid ETag for ${sourceKey}`);
-  }
-  const cachedPath = (0, import_node_path5.join)(CACHE_ROOT, `${safeEtag}.pdf`);
-  if ((0, import_node_fs6.existsSync)(cachedPath)) {
-    return (0, import_promises2.readFile)(cachedPath);
+async function parseSkillFrontmatter(zipBytes) {
+  let zip;
+  try {
+    zip = await import_jszip2.default.loadAsync(zipBytes);
+  } catch {
+    return {};
   }
-  const existing = inFlight.get(safeEtag);
-  if (existing) return existing;
-  const promise = (async () => {
-    try {
-      await (0, import_promises2.mkdir)(CACHE_IN, { recursive: true });
-      await (0, import_promises2.mkdir)(CACHE_OUT, { recursive: true });
-      const ext = ((0, import_node_path5.extname)(sourceKey) || ".docx").toLowerCase();
-      const inputPath = (0, import_node_path5.join)(CACHE_IN, `${safeEtag}${ext}`);
-      const outputPath = (0, import_node_path5.join)(CACHE_OUT, `${safeEtag}.pdf`);
-      try {
-        const bytes = await getS3ObjectBytes(sourceKey, config);
-        await (0, import_promises2.writeFile)(inputPath, bytes);
-        try {
-          await execAsync3(
-            `soffice --headless --convert-to pdf "${inputPath}" --outdir "${CACHE_OUT}"`,
-            { timeout: 6e4, maxBuffer: 16 * 1024 * 1024 }
-          );
-        } catch (err) {
-          throw new PreviewRenderError(
-            `LibreOffice conversion failed for ${sourceKey} (etag ${etag}): ${err?.stderr ?? err?.message ?? "unknown error"}`
-          );
-        }
-        if (!(0, import_node_fs6.existsSync)(outputPath)) {
-          throw new PreviewRenderError(
-            `LibreOffice produced no output for ${sourceKey} (etag ${etag})`
-          );
-        }
-        await (0, import_promises2.rename)(outputPath, cachedPath);
-        return await (0, import_promises2.readFile)(cachedPath);
-      } finally {
-        await (0, import_promises2.rm)(inputPath, { force: true });
-      }
-    } finally {
-      inFlight.delete(safeEtag);
-    }
-  })();
-  inFlight.set(safeEtag, promise);
-  return promise;
+  const paths = [];
+  zip.forEach((p, entry) => {
+    if (!entry.dir) paths.push(p);
+  });
+  const heads = new Set(paths.map((p) => p.split("/")[0]).filter(Boolean));
+  let strip = (p) => p;
+  if (heads.size === 1) {
+    const head = [...heads][0] + "/";
+    if (paths.every((p) => p.startsWith(head))) strip = (p) => p.slice(head.length);
+  }
+  const skillPath = paths.find((p) => strip(p) === "SKILL.md");
+  if (!skillPath) return {};
+  const md = await zip.file(skillPath).async("string");
+  const fm = parseFrontmatter(md);
+  return { name: fm.name, description: fm.description };
 }
 
 // src/exulu/routes.ts
+init_pdf_preview_cache();
 init_create_sandbox();
 var import_utils5 = require("@apollo/utils.keyvaluecache");
 var import_body_parser = __toESM(require("body-parser"), 1);
@@ -18598,7 +19130,7 @@ var import_fs3 = __toESM(require("fs"), 1);
 var import_node_crypto9 = require("crypto");
 var import_api2 = require("@opentelemetry/api");
 init_check_record_access();
-var import_jszip2 = __toESM(require("jszip"), 1);
+var import_jszip3 = __toESM(require("jszip"), 1);
 var import_ai15 = require("ai");
 var import_cookie_parser = __toESM(require("cookie-parser"), 1);
 init_statistics2();
@@ -18734,6 +19266,7 @@ function composePrepareSteps(...guards) {
 }
 
 // src/exulu/provider.ts
+init_tool_image_attachments();
 init_sanitize_tool_name();
 
 // src/exulu/auto-decline-stale-approvals.ts
@@ -18765,7 +19298,7 @@ var autoDeclineStaleApprovals = (messages) => {
 };
 
 // src/exulu/provider.ts
-var import_zod12 = require("zod");
+var import_zod14 = require("zod");
 init_tool();
 init_resolve_model();
 init_statistics2();
@@ -18785,7 +19318,7 @@ init_check_record_access();
 init_client();
 init_statistics();
 init_convert_exulu_tools_to_ai_sdk_tools();
-var import_officeparser = require("officeparser");
+var import_officeparser2 = require("officeparser");
 init_singleton();
 init_entitlements();
 
@@ -18914,9 +19447,9 @@ var ExuluProvider = class {
       name: `${agent.name}`,
       type: "agent",
       category: "agents",
-      inputSchema: import_zod12.z.object({
-        prompt: import_zod12.z.string().describe("The prompt (usually a question for the agent) to send to the agent."),
-        information: import_zod12.z.string().describe("A summary of relevant context / information from the current session")
+      inputSchema: import_zod14.z.object({
+        prompt: import_zod14.z.string().describe("The prompt (usually a question for the agent) to send to the agent."),
+        information: import_zod14.z.string().describe("A summary of relevant context / information from the current session")
       }),
       description: `This tool calls an agent named: ${agent.name}. The agent does the following: ${agent.description}.`,
       config: [],
@@ -19223,7 +19756,7 @@ When a tool execution is not approved by the user, do not retry it unless explic
         // Stop after the image_generation tool fires — the widget IS the
         // assistant's response, no follow-up text turn is wanted (same
         // reasoning as question_ask: the UI artifact is the message).
-        prepareStep: composePrepareSteps(contextGuard(contextWindow), retrievalGuard, finalAnswerGuard(turnBudget)),
+        prepareStep: composePrepareSteps(contextGuard(contextWindow), retrievalGuard, finalAnswerGuard(turnBudget), imageAttachmentGuard()),
         stopWhen: [(0, import_ai11.stepCountIs)(turnBudget), (0, import_ai11.hasToolCall)("image_generation")]
       });
       console.log("[EXULU] Output: " + JSON.stringify(output, null, 2));
@@ -19286,7 +19819,7 @@ When a tool execution is not approved by the user, do not retry it unless explic
         }),
         maxRetries: 2,
         tools,
-        prepareStep: composePrepareSteps(contextGuard(contextWindow), retrievalGuard, finalAnswerGuard(turnBudget)),
+        prepareStep: composePrepareSteps(contextGuard(contextWindow), retrievalGuard, finalAnswerGuard(turnBudget), imageAttachmentGuard()),
         stopWhen: [(0, import_ai11.stepCountIs)(turnBudget), (0, import_ai11.hasToolCall)("image_generation")]
       });
       if (statistics) {
@@ -19380,7 +19913,7 @@ When a tool execution is not approved by the user, do not retry it unless explic
                 };
               }
               const arrayBuffer = await response.arrayBuffer();
-              const extractedText = await (0, import_officeparser.parseOfficeAsync)(arrayBuffer, {
+              const extractedText = await (0, import_officeparser2.parseOfficeAsync)(arrayBuffer, {
                 outputErrorToConsole: false,
                 newlineDelimiter: "\n"
               });
@@ -19701,7 +20234,7 @@ When a tool execution is not approved by the user, do not retry it unless explic
         );
       },
       // todo allow configuring the step budget per skill
-      prepareStep: composePrepareSteps(contextGuard(contextWindow), retrievalGuard, finalAnswerGuard(turnBudget)),
+      prepareStep: composePrepareSteps(contextGuard(contextWindow), retrievalGuard, finalAnswerGuard(turnBudget), imageAttachmentGuard()),
       stopWhen: [(0, import_ai11.stepCountIs)(turnBudget), (0, import_ai11.hasToolCall)("image_generation")]
     });
     return {
@@ -19756,12 +20289,12 @@ var saveChat = async ({
 // src/exulu/suggestions.ts
 init_cjs_shims();
 var import_ai12 = require("ai");
-var import_zod13 = require("zod");
+var import_zod15 = require("zod");
 var SUGGESTIONS_SYSTEM_PROMPT = "You generate short follow-up message suggestions for the user. You are NOT continuing the conversation as the assistant \u2014 you are predicting what the user might want to say next. Suggest up to 3 short follow-up questions or messages the user might want to send next. Each suggestion must be written from the user's perspective (first person) and be 12 words or fewer. You MUST submit your answer by calling the `submit_suggestions` tool exactly once. Do not emit any plain text \u2014 only the tool call.";
 var submitSuggestionsTool = (0, import_ai12.tool)({
   description: "Submit the final list of follow-up message suggestions for the user. Must be called exactly once. Each suggestion is written from the user's perspective (first person) and is 12 words or fewer.",
-  inputSchema: import_zod13.z.object({
-    suggestions: import_zod13.z.array(import_zod13.z.string()).max(3)
+  inputSchema: import_zod15.z.object({
+    suggestions: import_zod15.z.array(import_zod15.z.string()).max(3)
   })
 });
 var MAX_CHARS_PER_MESSAGE = 1e4;
@@ -20323,7 +20856,7 @@ See docs/superpowers/specs/2026-05-31-in-chat-image-generation-design.md for the
 };
 
 // src/exulu/routes.ts
-var import_node_path6 = require("path");
+var import_node_path9 = require("path");
 init_tags();
 init_admin_client();
 init_env();
@@ -20452,6 +20985,7 @@ init_resolve_model();
 init_sanitize_tool_name();
 init_context_budget();
 init_supervisor();
+init_tool_image_attachments();
 function convertOpenAIToolsToAiSdkTools(tools) {
   return Object.fromEntries(
     tools.map((t) => {
@@ -20858,7 +21392,7 @@ ${project.description}` : ""}` : "",
             messages: coreMessages,
             tools: hasTools ? activeTools : void 0,
             maxRetries: 2,
-            prepareStep: clientTools.length > 0 ? void 0 : composePrepareSteps(contextGuard(contextWindow), gatewayRetrievalGuard, finalAnswerGuard(turnBudget)),
+            prepareStep: clientTools.length > 0 ? void 0 : composePrepareSteps(contextGuard(contextWindow), gatewayRetrievalGuard, finalAnswerGuard(turnBudget), imageAttachmentGuard()),
             stopWhen: clientTools.length > 0 ? void 0 : [(0, import_ai14.stepCountIs)(turnBudget)],
             onError: (error) => {
               console.error("[OPENAI GATEWAY] stream error:", error);
@@ -20898,7 +21432,7 @@ ${project.description}` : ""}` : "",
             messages: coreMessages,
             tools: hasTools ? activeTools : void 0,
             maxRetries: 2,
-            prepareStep: clientTools.length > 0 ? void 0 : composePrepareSteps(contextGuard(contextWindow), gatewayRetrievalGuard, finalAnswerGuard(turnBudget)),
+            prepareStep: clientTools.length > 0 ? void 0 : composePrepareSteps(contextGuard(contextWindow), gatewayRetrievalGuard, finalAnswerGuard(turnBudget), imageAttachmentGuard()),
             stopWhen: clientTools.length > 0 ? void 0 : [(0, import_ai14.stepCountIs)(turnBudget)]
           });
           res.json(transformCompletion(text, usage.inputTokens ?? 0, usage.outputTokens ?? 0, ctx));
@@ -21113,6 +21647,158 @@ var contentHeadersFor = (key, contentType, filename) => {
 };
 var getSharedArtifactByName = (db2, name) => db2("shared_artifacts").where({ name }).first();
 
+// src/skills/skill-access.ts
+init_cjs_shims();
+init_check_record_access();
+async function resolveSkillByName(db2, name) {
+  const row = await db2("skills").where({ name }).first();
+  return row ?? null;
+}
+async function canAccessSkill(db2, skill, action, user) {
+  const rbac = await RBACResolver(db2, "skill", skill.id, skill.rights_mode || "private");
+  return checkRecordAccess({ ...skill, RBAC: rbac }, action, user);
+}
+async function filterReadableSkills(db2, skills, user) {
+  const out = [];
+  for (const s of skills) {
+    if (await canAccessSkill(db2, s, "read", user)) out.push(s);
+  }
+  return out;
+}
+
+// src/skills/bootstrap/imp-skills.ts
+init_cjs_shims();
+
+// src/skills/bootstrap/clients.ts
+init_cjs_shims();
+var CLIENT_MANIFEST = [
+  { id: "agents", dir: ".agents/skills" },
+  // cross-agent standard (symlink canonical store)
+  { id: "claude", dir: ".claude/skills" },
+  { id: "windsurf", dir: ".windsurf/skills" },
+  { id: "continue", dir: ".continue/skills" },
+  { id: "roo", dir: ".roo/skills" },
+  { id: "kilocode", dir: ".kilocode/skills" },
+  { id: "crush", dir: ".crush/skills" },
+  { id: "goose", dir: ".goose/skills" },
+  { id: "qwen", dir: ".qwen/skills" },
+  { id: "iflow", dir: ".iflow/skills" },
+  { id: "junie", dir: ".junie/skills" },
+  { id: "kiro", dir: ".kiro/skills" },
+  { id: "trae", dir: ".trae/skills" },
+  { id: "augment", dir: ".augment/skills" },
+  { id: "factory", dir: ".factory/skills" },
+  { id: "devin", dir: ".devin/skills" },
+  { id: "openhands", dir: ".openhands/skills" },
+  { id: "pi", dir: ".pi/skills" },
+  { id: "cortex", dir: ".cortex/skills" },
+  { id: "zencoder", dir: ".zencoder/skills" },
+  { id: "codebuddy", dir: ".codebuddy/skills" },
+  { id: "codestudio", dir: ".codestudio/skills" },
+  { id: "commandcode", dir: ".commandcode/skills" },
+  { id: "codemaker", dir: ".codemaker/skills" },
+  { id: "codeartsdoer", dir: ".codeartsdoer/skills" },
+  { id: "lingma", dir: ".lingma/skills" },
+  { id: "qoder", dir: ".qoder/skills" },
+  { id: "rovodev", dir: ".rovodev/skills" },
+  { id: "moxby", dir: ".moxby/skills" },
+  { id: "mux", dir: ".mux/skills" },
+  { id: "neovate", dir: ".neovate/skills" },
+  { id: "ona", dir: ".ona/skills" },
+  { id: "pochi", dir: ".pochi/skills" },
+  { id: "reasonix", dir: ".reasonix/skills" },
+  { id: "terramind", dir: ".terramind/skills" },
+  { id: "tinycloud", dir: ".tinycloud/skills" },
+  { id: "vibe", dir: ".vibe/skills" },
+  { id: "adal", dir: ".adal/skills" },
+  { id: "aider-desk", dir: ".aider-desk/skills" },
+  { id: "autohand", dir: ".autohand/skills" },
+  { id: "bob", dir: ".bob/skills" },
+  { id: "hermes", dir: ".hermes/skills" },
+  { id: "inferencesh", dir: ".inferencesh/skills" },
+  { id: "jazz", dir: ".jazz/skills" },
+  { id: "kode", dir: ".kode/skills" },
+  { id: "mcpjam", dir: ".mcpjam/skills" },
+  { id: "forge", dir: ".forge/skills" },
+  { id: "tabnine", dir: ".tabnine/agent/skills" }
+  // exception: nested under agent/
+];
+
+// src/skills/bootstrap/imp-sh.generated.ts
+init_cjs_shims();
+var IMP_SH_B64 = "IyEvYmluL3NoCiMgaW1wIOKAlCBoZWxwZXIgZm9yIHRoZSBjZW50cmFsIHNraWxsIGxpYnJhcnkuIFRoZSBhZ2VudCBpbnZva2VzIHRoaXMKIyAobmV2ZXIgcmF3IGN1cmwpOiB0aGUgdG9rZW4gaXMgcmVhZCBmcm9tIHRoZSBjb25maWcgZmlsZSBoZXJlIGFuZCBzZW50IHZpYQojIGB4LWFwaS1rZXk6IEJlYXJlcmAsIHNvIGl0IG5ldmVyIGVudGVycyB0aGUgbW9kZWwgY29udGV4dC4gQ2xpZW50IGZhbi1vdXQKIyAoY29weS9zeW1saW5rIGFjcm9zcyBhZ2VudCBjbGllbnRzKSBpcyBkZXRlcm1pbmlzdGljLgpzZXQgLWV1CgpDT05GSUdfRElSPSIkSE9NRS8uY29uZmlnL2ltcCIKQ09ORklHX0ZJTEU9IiRDT05GSUdfRElSL3NraWxscy5qc29uIgoKZGllKCkgeyBwcmludGYgJ2ltcDogJXNcbicgIiQqIiA+JjI7IGV4aXQgMTsgfQppbmZvKCkgeyBwcmludGYgJyVzXG4nICIkKiIgPiYyOyB9Cgpqc29uX3N0cigpIHsgIyBqc29uX3N0ciA8a2V5PiA8ZmlsZT4g4oCUIGZsYXQgImtleSI6InZhbHVlIgogIHNlZCAtbiAicy8uKlwiJDFcIltbOnNwYWNlOl1dKjpbWzpzcGFjZTpdXSpcIlxcKFteXCJdKlxcKVwiLiovXFwxL3AiICIkMiIgfCBoZWFkIC1uMQp9CgpbIC1mICIkQ09ORklHX0ZJTEUiIF0gfHwgZGllICJub3QgY29uZmlndXJlZCDigJQgcnVuOiBjdXJsIC1mc1NMIDxiYXNlX3VybD4vYXBpL3NraWxscy9pbnN0YWxsLnNoIHwgc2giCgpCQVNFX1VSTD0iJChqc29uX3N0ciBiYXNlX3VybCAiJENPTkZJR19GSUxFIikiCkJBQ0tFTkQ9IiQoanNvbl9zdHIgYmFja2VuZCAiJENPTkZJR19GSUxFIikiCkFQSV9LRVk9IiQoanNvbl9zdHIgYXBpX2tleSAiJENPTkZJR19GSUxFIikiCkxJTktfTU9ERT0iJChqc29uX3N0ciBsaW5rX21vZGUgIiRDT05GSUdfRklMRSIpIgpTQ09QRT0iJChqc29uX3N0ciBzY29wZSAiJENPTkZJR19GSUxFIikiCkNMSUVOVFM9IiQoc2VkIC1uICdzLy4qImNsaWVudHMiW1s6c3BhY2U6XV0qOltbOnNwYWNlOl1dKlxbXChbXl1dKlwpXF0uKi9cMS9wJyAiJENPTkZJR19GSUxFIiB8IHRyICcsJyAnICcgfCB0ciAtZCAnIicgfCB0ciAtcyAnICcpIgoKWyAtbiAiJENMSUVOVFMiIF0gfHwgQ0xJRU5UUz0iYWdlbnRzIgpbIC1uICIkTElOS19NT0RFIiBdIHx8IExJTktfTU9ERT0iY29weSIKWyAtbiAiJFNDT1BFIiBdIHx8IFNDT1BFPSJwcm9qZWN0IgoKaWYgWyAteiAiJEJBQ0tFTkQiIF07IHRoZW4KICBbIC1uICIkQkFTRV9VUkwiIF0gfHwgZGllICJjb25maWcgaGFzIG5vIGJhY2tlbmQgYW5kIG5vIGJhc2VfdXJsIgogIEJBQ0tFTkQ9IiQoY3VybCAtZnNTTCAiJEJBU0VfVVJML2FwaS9jb25maWciIHwgc2VkIC1uICdzLy4qImJhY2tlbmQiW1s6c3BhY2U6XV0qOltbOnNwYWNlOl1dKiJcKFteIl0qXCkiLiovXDEvcCcgfCBoZWFkIC1uMSkiCiAgWyAtbiAiJEJBQ0tFTkQiIF0gfHwgZGllICJjb3VsZCBub3QgcmVzb2x2ZSBiYWNrZW5kIGZyb20gJEJBU0VfVVJML2FwaS9jb25maWciCmZpCkJBQ0tFTkQ9IiQocHJpbnRmICclcycgIiRCQUNLRU5EIiB8IHNlZCAnczovKiQ6OicpIgoKUk9PVD0iJFBXRCIKWyAiJFNDT1BFIiA9ICJob21lIiBdICYmIFJPT1Q9IiRIT01FIgoKIyBkaXJfZm9yIENMSUVOVF9JRCAtPiByZWxhdGl2ZSBza2lsbCBkaXIgKGdlbmVyYXRlZCBmcm9tIHRoZSBtYW5pZmVzdCBpbiB0aGUKIyByZWFsIGJ1aWxkOyBhIHJlcHJlc2VudGF0aXZlIHN1YnNldCBoZXJlIGZvciBsb2NhbCB0ZXN0aW5nKS4KZGlyX2ZvcigpIHsKICBjYXNlICIkMSIgaW4KX19ESVJfRk9SX0NBU0VTX18KICAgICopIHJldHVybiAxIDs7CiAgZXNhYwp9CgojIE9uZSAiLi4vIiBwZXIgcGF0aCBjb21wb25lbnQgb2YgJDEgKGEgY2xpZW50IGRpciByZWxhdGl2ZSB0byBST09UKSwgc28KIyBzeW1saW5rcyBhcmUgcmVsYXRpdmUgYW5kIHN1cnZpdmUgYmVpbmcgY29tbWl0dGVkIGFuZCBjaGVja2VkIG91dCBlbHNld2hlcmUuCnJlbF90b19yb290KCkgewogIF91cD0iIjsgX29sZGlmcz0kSUZTOyBJRlM9LwogIGZvciBfc2VnIGluICQxOyBkbyBbIC1uICIkX3NlZyIgXSAmJiBfdXA9Ii4uLyRfdXAiOyBkb25lCiAgSUZTPSRfb2xkaWZzOyBwcmludGYgJyVzJyAiJF91cCIKfQoKYXBpKCkgeyAjIGFwaSA8TUVUSE9EPiA8cGF0aD4gW2V4dHJhIGN1cmwgYXJncy4uLl0gLT4gYm9keSBvbiBzdGRvdXQKICBtPSIkMSI7IHA9IiQyIjsgc2hpZnQgMgogIGN1cmwgLWZzUyAtWCAiJG0iICIkQkFDS0VORCRwIiAtSCAieC1hcGkta2V5OiBCZWFyZXIgJEFQSV9LRVkiICIkQCIKfQoKbWV0YV92ZXJzaW9uKCkgeyAjIG1ldGFfdmVyc2lvbiA8bmFtZT4gLT4gY3VycmVudF92ZXJzaW9uIGZyb20gcmVnaXN0cnkKICBhcGkgR0VUICIvc2tpbGxzL3JlZ2lzdHJ5LyQxIiAyPi9kZXYvbnVsbCBcCiAgICB8IHNlZCAtbiAncy8uKiJjdXJyZW50X3ZlcnNpb24iW1s6c3BhY2U6XV0qOltbOnNwYWNlOl1dKlwoWzAtOV1bMC05XSpcKS4qL1wxL3AnIHwgaGVhZCAtbjEKfQoKX21hbmFnZWQoKSB7ICMgX21hbmFnZWQgPGRpcj4gLT4gMCBpZiBzYWZlIHRvIG92ZXJ3cml0ZSAob3VycyBvciBzeW1saW5rIG9yIGFic2VudCkKICBkPSIkMSIKICBpZiBbIC1lICIkZCIgXSAmJiBbICEgLUwgIiRkIiBdICYmIFsgISAtZiAiJGQvLmltcC1za2lsbC5qc29uIiBdOyB0aGVuCiAgICBpbmZvICJza2lwICRkIChleGlzdHMsIG5vdCBtYW5hZ2VkIGJ5IGltcCkiOyByZXR1cm4gMQogIGZpCiAgcmV0dXJuIDAKfQoKX3B1dF9yZWFsKCkgeyAjIF9wdXRfcmVhbCA8ZGVzdD4gPHNyY2Rpcj4gPG1hcmtlci1qc29uPgogIF9tYW5hZ2VkICIkMSIgfHwgcmV0dXJuIDAKICBybSAtcmYgIiQxIjsgbWtkaXIgLXAgIiQxIjsgY3AgLVIgIiQyLy4iICIkMS8iCiAgcHJpbnRmICclc1xuJyAiJDMiID4gIiQxLy5pbXAtc2tpbGwuanNvbiIKfQoKcGxhY2Vfc2tpbGwoKSB7ICMgcGxhY2Vfc2tpbGwgPG5hbWU+IDxzcmNkaXI+IDx2ZXJzaW9uPgogIHBuYW1lPSIkMSI7IHBzcmM9IiQyIjsgcHZlcj0iJHszOi0xfSIKICBtYXJrZXI9J3sgIm5hbWUiOiAiJyIkcG5hbWUiJyIsICJ2ZXJzaW9uIjogJyIkcHZlciInLCAic291cmNlIjogIiciJEJBQ0tFTkQiJyIgfScKICBjYW5vbj0iJFJPT1QvLmFnZW50cy9za2lsbHMvJHBuYW1lIgogIFsgIiRMSU5LX01PREUiID0gInN5bWxpbmsiIF0gJiYgX3B1dF9yZWFsICIkY2Fub24iICIkcHNyYyIgIiRtYXJrZXIiCiAgZm9yIGlkIGluICRDTElFTlRTOyBkbwogICAgZD0iJChkaXJfZm9yICIkaWQiKSIgfHwgeyBpbmZvICJ1bmtub3duIGNsaWVudDogJGlkIjsgY29udGludWU7IH0KICAgIHBhcmVudD0iJFJPT1QvJGQiOyBkZXN0PSIkcGFyZW50LyRwbmFtZSIKICAgIGlmIFsgIiRMSU5LX01PREUiID0gInN5bWxpbmsiIF0gJiYgWyAiJGlkIiAhPSAiYWdlbnRzIiBdOyB0aGVuCiAgICAgIF9tYW5hZ2VkICIkZGVzdCIgfHwgY29udGludWUKICAgICAgbWtkaXIgLXAgIiRwYXJlbnQiOyBybSAtcmYgIiRkZXN0IgogICAgICByZWw9IiQocmVsX3RvX3Jvb3QgIiRkIikuYWdlbnRzL3NraWxscy8kcG5hbWUiCiAgICAgIGlmIGxuIC1zICIkcmVsIiAiJGRlc3QiIDI+L2Rldi9udWxsOyB0aGVuCiAgICAgICAgaW5mbyAibGlua2VkICRkZXN0IC0+ICRyZWwiCiAgICAgIGVsc2UKICAgICAgICBpbmZvICJzeW1saW5rIHVuc3VwcG9ydGVkIGF0ICRkZXN0OyBjb3B5aW5nIgogICAgICAgIF9wdXRfcmVhbCAiJGRlc3QiICIkcHNyYyIgIiRtYXJrZXIiCiAgICAgIGZpCiAgICBlbGlmIFsgIiRMSU5LX01PREUiID0gImNvcHkiIF07IHRoZW4KICAgICAgX3B1dF9yZWFsICIkZGVzdCIgIiRwc3JjIiAiJG1hcmtlciIKICAgIGZpCiAgICAjIHN5bWxpbmsgKyBhZ2VudHM6IGFscmVhZHkgcGxhY2VkIGFzIHRoZSBjYW5vbmljYWwgc3RvcmUgYWJvdmUuCiAgZG9uZQp9CgppbnN0YWxsZWRfbmFtZXMoKSB7ICMgdW5pcXVlIHNraWxsIG5hbWVzIHRoYXQgY2Fycnkgb3VyIG1hcmtlciB1bmRlciBST09UCiAgeyBmaW5kICIkUk9PVC8uYWdlbnRzL3NraWxscyIgLW1heGRlcHRoIDIgLW5hbWUgLmltcC1za2lsbC5qc29uIDI+L2Rldi9udWxsCiAgICBmb3IgaWQgaW4gJENMSUVOVFM7IGRvCiAgICAgIGQ9IiQoZGlyX2ZvciAiJGlkIikiIHx8IGNvbnRpbnVlCiAgICAgIGZpbmQgIiRST09ULyRkIiAtbWF4ZGVwdGggMiAtbmFtZSAuaW1wLXNraWxsLmpzb24gMj4vZGV2L251bGwKICAgIGRvbmUKICB9IHwgd2hpbGUgcmVhZCAtciBtOyBkbyBqc29uX3N0ciBuYW1lICIkbSI7IGRvbmUgfCBzb3J0IC11Cn0KCm1hcmtlcl92ZXJzaW9uKCkgeyAjIG1hcmtlcl92ZXJzaW9uIDxuYW1lPgogIGZvciBiYXNlIGluICIkUk9PVC8uYWdlbnRzL3NraWxscyI7IGRvCiAgICBbIC1mICIkYmFzZS8kMS8uaW1wLXNraWxsLmpzb24iIF0gJiYgeyBqc29uX3N0ciB2ZXJzaW9uICIkYmFzZS8kMS8uaW1wLXNraWxsLmpzb24iOyByZXR1cm47IH0KICBkb25lCiAgZm9yIGlkIGluICRDTElFTlRTOyBkbwogICAgZD0iJChkaXJfZm9yICIkaWQiKSIgfHwgY29udGludWUKICAgIGY9IiRST09ULyRkLyQxLy5pbXAtc2tpbGwuanNvbiIKICAgIFsgLWYgIiRmIiBdICYmIHsganNvbl9zdHIgdmVyc2lvbiAiJGYiOyByZXR1cm47IH0KICBkb25lCn0KCmRvX2luc3RhbGwoKSB7ICMgZG9faW5zdGFsbCA8bmFtZT4KICBuYW1lPSIkMSIKICBUTVA9IiQobWt0ZW1wIC1kKSIKICBhcGkgR0VUICIvc2tpbGxzL3JlZ2lzdHJ5LyRuYW1lL2Rvd25sb2FkIiAtLW91dHB1dCAiJFRNUC9za2lsbC56aXAiIFwKICAgIHx8IHsgcm0gLXJmICIkVE1QIjsgZGllICJkb3dubG9hZCBmYWlsZWQgZm9yICckbmFtZScgKDQwMyA9IG5vIGFjY2VzcywgNDA0ID0gdW5rbm93bikiOyB9CiAgbWtkaXIgLXAgIiRUTVAveCIKICB1bnppcCAtcSAiJFRNUC9za2lsbC56aXAiIC1kICIkVE1QL3giIHx8IHsgcm0gLXJmICIkVE1QIjsgZGllICJiYWQgYXJjaGl2ZSBmb3IgJyRuYW1lJyI7IH0KICBzcmM9IiQoZmluZCAiJFRNUC94IiAtbWluZGVwdGggMSAtbWF4ZGVwdGggMSAtdHlwZSBkIHwgaGVhZCAtbjEpIgogIFsgLW4gIiRzcmMiIF0gfHwgeyBybSAtcmYgIiRUTVAiOyBkaWUgInVuZXhwZWN0ZWQgYXJjaGl2ZSBsYXlvdXQgZm9yICckbmFtZSciOyB9CiAgdmVyPSIkKG1ldGFfdmVyc2lvbiAiJG5hbWUiKSIKICBwbGFjZV9za2lsbCAiJG5hbWUiICIkc3JjIiAiJHt2ZXI6LTF9IgogIHJtIC1yZiAiJFRNUCIKICBpbmZvICJpbnN0YWxsZWQgJG5hbWUgKHYke3ZlcjotMX0pIFskTElOS19NT0RFXSBpbnRvOiAkQ0xJRU5UUyIKfQoKdXNhZ2UoKSB7CiAgY2F0ID4mMiA8PEVPRgppbXAg4oCUIHNraWxsIGxpYnJhcnkgaGVscGVyCiAgaW1wIGxpc3QgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsaXN0IHNraWxscyB5b3UgY2FuIGFjY2VzcyAoSlNPTikKICBpbXAgZ2V0IDxuYW1lPiAgICAgICAgICAgICAgICAgICAgICAgICAgIHNob3cgb25lIHNraWxsJ3MgbWV0YWRhdGEgKEpTT04pCiAgaW1wIGluc3RhbGwgPG5hbWU+ICAgICAgICAgICAgICAgICAgICAgICBpbnN0YWxsL3JlZnJlc2ggYSBza2lsbCBpbnRvIHlvdXIgYWdlbnQgY2xpZW50cwogIGltcCB1cGRhdGUgWzxuYW1lPl0gICAgICAgICAgICAgICAgICAgICAgdXBkYXRlIGluc3RhbGxlZCBza2lsbHMgKGFsbCwgb3Igb25lKSB0byBsYXRlc3QKICBpbXAgcHVibGlzaCA8bmFtZT4gPGRpcj4gPHB1YmxpY3xwcml2YXRlPiBwdWJsaXNoIGEgbG9jYWwgc2tpbGwgZm9sZGVyIGFzIDxuYW1lPgogIGltcCBjb25maWcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc2hvdyByZXNvbHZlZCBiYWNrZW5kIC8gc2NvcGUgLyBjbGllbnRzIChubyBzZWNyZXRzKQpFT0YKfQoKY21kPSIkezE6LWhlbHB9IgpbICQjIC1ndCAwIF0gJiYgc2hpZnQgfHwgdHJ1ZQoKY2FzZSAiJGNtZCIgaW4KICBsaXN0KSBhcGkgR0VUICIvc2tpbGxzL3JlZ2lzdHJ5IiA7OwogIGdldCkgWyAkIyAtZ2UgMSBdIHx8IGRpZSAidXNhZ2U6IGltcCBnZXQgPG5hbWU+IjsgYXBpIEdFVCAiL3NraWxscy9yZWdpc3RyeS8kMSIgOzsKICBpbnN0YWxsKSBbICQjIC1nZSAxIF0gfHwgZGllICJ1c2FnZTogaW1wIGluc3RhbGwgPG5hbWU+IjsgZG9faW5zdGFsbCAiJDEiIDs7CiAgdXBkYXRlKQogICAgaWYgWyAkIyAtZ2UgMSBdOyB0aGVuIG5hbWVzPSIkMSI7IGVsc2UgbmFtZXM9IiQoaW5zdGFsbGVkX25hbWVzKSI7IGZpCiAgICBbIC1uICIkbmFtZXMiIF0gfHwgeyBpbmZvICJubyBpbXAtbWFuYWdlZCBza2lsbHMgZm91bmQgdW5kZXIgJFJPT1QiOyBleGl0IDA7IH0KICAgIGZvciBuIGluICRuYW1lczsgZG8KICAgICAgY3VyPSIkKG1hcmtlcl92ZXJzaW9uICIkbiIpIgogICAgICBsYXRlc3Q9IiQobWV0YV92ZXJzaW9uICIkbiIpIgogICAgICBbIC1uICIkbGF0ZXN0IiBdIHx8IHsgaW5mbyAic2tpcCAkbiAobm90IGluIHJlZ2lzdHJ5KSI7IGNvbnRpbnVlOyB9CiAgICAgIGlmIFsgLXogIiRjdXIiIF0gfHwgWyAiJGxhdGVzdCIgLWd0ICIkY3VyIiBdIDI+L2Rldi9udWxsOyB0aGVuCiAgICAgICAgaW5mbyAidXBkYXRpbmcgJG46IHYke2N1cjotP30gLT4gdiRsYXRlc3QiOyBkb19pbnN0YWxsICIkbiIKICAgICAgZWxzZQogICAgICAgIGluZm8gIiRuIHVwIHRvIGRhdGUgKHYkY3VyKSIKICAgICAgZmkKICAgIGRvbmUKICAgIDs7CiAgcHVibGlzaCkKICAgIFsgJCMgLWdlIDMgXSB8fCBkaWUgInVzYWdlOiBpbXAgcHVibGlzaCA8bmFtZT4gPGRpcj4gPHB1YmxpY3xwcml2YXRlPiIKICAgIG5hbWU9IiQxIjsgZm9sZGVyPSIkMiI7IHZpc2liaWxpdHk9IiQzIgogICAgY2FzZSAiJHZpc2liaWxpdHkiIGluCiAgICAgIHB1YmxpY3xwcml2YXRlKSA7OwogICAgICAqKSBkaWUgInZpc2liaWxpdHkgbXVzdCBiZSAncHVibGljJyBvciAncHJpdmF0ZScgKGFzayB0aGUgdXNlciB3aGljaCB0aGV5IHdhbnQpIiA7OwogICAgZXNhYwogICAgWyAtZCAiJGZvbGRlciIgXSB8fCBkaWUgIm5vIHN1Y2ggZm9sZGVyOiAkZm9sZGVyIgogICAgWyAtZiAiJGZvbGRlci9TS0lMTC5tZCIgXSB8fCBkaWUgIiRmb2xkZXIgaGFzIG5vIFNLSUxMLm1kIGF0IGl0cyByb290IgogICAgY29tbWFuZCAtdiB6aXAgPi9kZXYvbnVsbCAyPiYxIHx8IGRpZSAidGhlICd6aXAnIGNvbW1hbmQgaXMgcmVxdWlyZWQgdG8gcHVibGlzaCIKICAgIFRNUD0iJChta3RlbXAgLWQpIgogICAgKCBjZCAiJChkaXJuYW1lICIkZm9sZGVyIikiIFwKICAgICAgJiYgemlwIC1xIC1yIC1YICIkVE1QL3NraWxsLnppcCIgIiQoYmFzZW5hbWUgIiRmb2xkZXIiKSIgXAogICAgICAgICAgIC14ICcqLy5pbXAtc2tpbGwuanNvbicgJyovLmdpdC8qJyAnKi5EU19TdG9yZScgJyovX19NQUNPU1gvKicgKSBcCiAgICAgIHx8IHsgcm0gLXJmICIkVE1QIjsgZGllICJjb3VsZCBub3QgemlwICRmb2xkZXIiOyB9CiAgICBhcGkgUE9TVCAiL3NraWxscy9yZWdpc3RyeS8kbmFtZT92aXNpYmlsaXR5PSR2aXNpYmlsaXR5IiAtSCAiQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi96aXAiIFwKICAgICAgLS1kYXRhLWJpbmFyeSBAIiRUTVAvc2tpbGwuemlwIiBcCiAgICAgIHx8IHsgcm0gLXJmICIkVE1QIjsgZGllICJwdWJsaXNoIGZhaWxlZCAoNDAzID0gbm8gd3JpdGUgYWNjZXNzLCA0MDkgPSBuYW1lIHRha2VuKSI7IH0KICAgIHJtIC1yZiAiJFRNUCIKICAgIGluZm8gInB1Ymxpc2hlZCAkbmFtZSAoJHZpc2liaWxpdHkpIgogICAgOzsKICBjb25maWcpCiAgICBwcmludGYgJ2JhY2tlbmQ9JXNcbnNjb3BlPSVzXG5saW5rX21vZGU9JXNcbmNsaWVudHM9JXNcbmFwaV9rZXk9JXNcbicgXAogICAgICAiJEJBQ0tFTkQiICIkU0NPUEUiICIkTElOS19NT0RFIiAiJENMSUVOVFMiIFwKICAgICAgIiQoWyAtbiAiJEFQSV9LRVkiIF0gJiYgZWNobyBzZXQgfHwgZWNobyBNSVNTSU5HKSIKICAgIDs7CiAgaGVscHwtLWhlbHB8LWgpIHVzYWdlIDs7CiAgKikgaW5mbyAidW5rbm93biBjb21tYW5kOiAkY21kIjsgdXNhZ2U7IGV4aXQgMiA7Owplc2FjCg==";
+
+// src/skills/bootstrap/imp-skills.ts
+var BOOTSTRAP_CLIENTS_JSON = JSON.stringify(CLIENT_MANIFEST, null, 2);
+var DIR_FOR_CASES = CLIENT_MANIFEST.map(
+  (c) => `    ${c.id}) printf '%s' '${c.dir}' ;;`
+).join("\n");
+var BOOTSTRAP_IMP_SH = Buffer.from(IMP_SH_B64, "base64").toString("utf8").replace("__DIR_FOR_CASES__", DIR_FOR_CASES);
+var BOOTSTRAP_SKILL_MD = `---
+name: imp-skills
+description: Install, update, and publish skills from this instance's central skill library. Use when the user asks to install a skill, get the latest version of a skill, list IMP skills, or publish a skill to IMP.
+---
+
+# IMP Skills
+
+Bridge to the IMP central skill library. **All operations go through the
+bundled helper script \u2014 do not hand-write curl or copy files yourself.** The
+script reads the API token from config (keeping it out of this conversation) and
+handles the multi-client copy/symlink fan-out deterministically.
+
+## The helper
+
+Run the script next to this file, \`scripts/imp\`, with \`sh\` and the absolute
+path of this skill's directory:
+
+\`\`\`
+sh "<this-skill-dir>/scripts/imp" <command>
+\`\`\`
+
+Commands:
+- \`list\` \u2014 skills you can access (JSON on stdout)
+- \`get <name>\` \u2014 one skill's metadata (JSON)
+- \`install <name>\` \u2014 install/refresh a skill into the user's agent clients
+- \`update [<name>]\` \u2014 update every installed skill, or just \`<name>\`, to latest
+- \`publish <name> <folder> <public|private>\` \u2014 publish a local skill folder as \`<name>\`
+- \`config\` \u2014 show resolved backend / scope / clients (prints no secrets)
+
+The token, backend URL, target clients, copy-vs-symlink mode, and scope all come
+from \`~/.config/imp/skills.json\` (written by the installer). Never print the
+\`api_key\` or read it into your reply \u2014 the script uses it internally.
+
+## Requests \u2192 commands
+
+- "list / search skills" \u2192 \`imp list\`, then filter the JSON for the user.
+- "install skill X" / "add the X skill" \u2192 \`imp install X\`.
+- "update / get the latest version [of X]" \u2192 \`imp update [X]\`.
+- "publish / upload this skill as X" \u2192 confirm the target name with the user; for
+  an existing skill run \`imp get X\` first and confirm a new version is intended.
+  For a NEW skill you MUST ask the user whether it should be \`public\` (visible
+  to everyone on the instance) or \`private\` (only them) \u2014 never pick a
+  visibility yourself; then \`imp publish X <folder> <public|private>\`.
+
+## Not configured yet?
+
+If \`imp config\` reports it's not configured (or \`~/.config/imp/skills.json\`
+is missing), tell the user to run the installer \u2014 it sets everything up
+interactively (base URL, API key, target clients, copy/symlink):
+
+\`\`\`
+curl -fsSL <base_url>/api/skills/install.sh | sh
+\`\`\`
+
+\`<base_url>\` is their instance's frontend URL (e.g. https://ai.open.de). They
+can create an API key at \`<base_url>/token\`.
+
+## Errors
+
+- install: \`403\` = no access to that skill; \`404\` = unknown name.
+- publish: \`400\` = missing/invalid visibility (new skills need public|private);
+  \`403\` = you can see it but lack write access; \`409\` = the name is taken by a
+  skill you can't access.
+`;
+
 // src/exulu/routes.ts
 var REQUEST_SIZE_LIMIT = "50mb";
 var getExuluVersionNumber = async () => {
@@ -21186,6 +21872,7 @@ var createExpressRoutes = async (app, providers, tools, contexts, config, evals,
     }
     next();
   });
+  const rawZip = import_express5.default.raw({ type: ["application/zip", "application/octet-stream", "application/x-zip-compressed", "application/x-zip"], limit: "50mb" });
   console.log(`
     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557  \u2588\u2588\u2557\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2557      \u2588\u2588\u2557   \u2588\u2588\u2557
     \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u255A\u2588\u2588\u2557\u2588\u2588\u2554\u255D\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551      \u2588\u2588\u2551   \u2588\u2588\u2551
@@ -22140,7 +22827,7 @@ ${customInstructions}` : agent.instructions;
   const imageModelsByName = (() => {
     if (!isLiteLLMEnabled() || !config?.fileUploads) return /* @__PURE__ */ new Map();
     try {
-      const configPath = process.env.LITELLM_CONFIG_PATH ?? (0, import_node_path6.resolve)(process.cwd(), "./config.litellm.yaml");
+      const configPath = process.env.LITELLM_CONFIG_PATH ?? (0, import_node_path9.resolve)(process.cwd(), "./config.litellm.yaml");
       const models2 = parseImageGenerationModels(configPath);
       return new Map(models2.map((m) => [m.model_name, m]));
     } catch (err) {
@@ -22838,7 +23525,9 @@ ${style.markdown}` : params.prompt;
     const budget_duration = String(body?.budget_duration ?? "");
     if (!Number.isFinite(max_budget) || max_budget <= 0) return null;
     if (!BUDGET_ALLOWED_DURATIONS.has(budget_duration)) return null;
-    return { max_budget, budget_duration };
+    const reset = parseResetAt(body?.budget_reset_at);
+    if (!reset.valid) return null;
+    return { max_budget, budget_duration, budget_reset_at: reset.value };
   };
   const parseBudgetSettingsBody = (body) => {
     if (!body || typeof body !== "object") return null;
@@ -22908,7 +23597,7 @@ ${style.markdown}` : params.prompt;
       }
       const body = parseBudgetBody(req.body);
       if (!body) {
-        res.status(400).json({ detail: "Invalid budget (max_budget, budget_duration)." });
+        res.status(400).json({ detail: "Invalid budget (max_budget, budget_duration, budget_reset_at)." });
         return;
       }
       const entityIds = Array.isArray(req.body?.entityIds) ? req.body.entityIds : [];
@@ -22920,7 +23609,7 @@ ${style.markdown}` : params.prompt;
       for (const id of entityIds) {
         const tag = budgetTagFor(entityType, id);
         try {
-          await upsertBudget(tag, body.max_budget, body.budget_duration);
+          await upsertBudget(tag, body.max_budget, body.budget_duration, body.budget_reset_at);
           results.push({ entityId: String(id), ok: true });
         } catch (err) {
           results.push({
@@ -22945,12 +23634,12 @@ ${style.markdown}` : params.prompt;
       }
       const body = parseBudgetBody(req.body);
       if (!body) {
-        res.status(400).json({ detail: "Invalid budget (max_budget, budget_duration)." });
+        res.status(400).json({ detail: "Invalid budget (max_budget, budget_duration, budget_reset_at)." });
         return;
       }
       const tag = budgetTagFor(entityType, req.params.entityId ?? "");
       try {
-        await upsertBudget(tag, body.max_budget, body.budget_duration);
+        await upsertBudget(tag, body.max_budget, body.budget_duration, body.budget_reset_at);
         const info = await tagInfo([tag]);
         res.status(200).json({ budget: info[tag] ?? null });
       } catch (err) {
@@ -23413,6 +24102,206 @@ ${style.markdown}` : params.prompt;
     }
     return root;
   }
+  app.get("/skills/agent/bootstrap", async (_req, res) => {
+    try {
+      const zip = new import_jszip3.default();
+      zip.file("imp-skills/SKILL.md", BOOTSTRAP_SKILL_MD);
+      zip.file("imp-skills/references/clients.json", BOOTSTRAP_CLIENTS_JSON);
+      zip.file("imp-skills/scripts/imp", BOOTSTRAP_IMP_SH, {
+        unixPermissions: 493
+      });
+      const buffer = await zip.generateAsync({
+        type: "nodebuffer",
+        platform: "UNIX"
+      });
+      res.setHeader("Content-Type", "application/zip");
+      res.setHeader("Content-Disposition", 'attachment; filename="imp-skills.zip"');
+      res.send(buffer);
+    } catch (err) {
+      console.error("[SKILLS] Failed to build bootstrap zip", err);
+      res.status(500).json({ detail: "Failed to build bootstrap skill." });
+    }
+  });
+  app.get("/skills/registry", async (req, res) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code ?? 401).json({ detail: authResult.message });
+      return;
+    }
+    const { db: db2 } = await postgresClient();
+    const tag = typeof req.query.tag === "string" ? req.query.tag : void 0;
+    const all = await db2("skills").select("*");
+    const readable = await filterReadableSkills(db2, all, authResult.user);
+    const skills = readable.filter((s) => {
+      if (!tag) return true;
+      const tags = Array.isArray(s.tags) ? s.tags : [];
+      return tags.includes(tag);
+    }).map((s) => ({
+      name: s.name,
+      description: s.description ?? "",
+      tags: Array.isArray(s.tags) ? s.tags : [],
+      current_version: s.current_version ?? 1,
+      updated_at: s.updatedAt ?? s.updated_at ?? null
+    }));
+    res.json({ skills });
+  });
+  app.get("/skills/registry/:name/download", async (req, res) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code ?? 401).json({ detail: authResult.message });
+      return;
+    }
+    const { db: db2 } = await postgresClient();
+    const skill = await resolveSkillByName(db2, req.params.name);
+    if (!skill) {
+      res.status(404).json({ detail: "Skill not found." });
+      return;
+    }
+    if (!await canAccessSkill(db2, skill, "read", authResult.user)) {
+      res.status(403).json({ detail: "You don't have access to this skill." });
+      return;
+    }
+    const vQuery = req.query.version;
+    const version = !vQuery || vQuery === "latest" ? skill.current_version ?? 1 : Number(vQuery);
+    if (!Number.isFinite(version) || version < 1) {
+      res.status(400).json({ detail: "Invalid version." });
+      return;
+    }
+    const safeName = String(skill.name ?? "skill").replace(/[^a-zA-Z0-9-_]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
+    const versionPrefix = `skills/${skill.id}/v${version}/`;
+    const files = await listS3ObjectsByPrefix(versionPrefix, config);
+    if (files.length === 0) {
+      res.status(404).json({ detail: `Version v${version} has no files.` });
+      return;
+    }
+    const zip = new import_jszip3.default();
+    for (const file of files) {
+      const idx = file.key.indexOf(versionPrefix);
+      const rel = idx >= 0 ? file.key.slice(idx + versionPrefix.length) : file.key;
+      if (!rel) continue;
+      const bytes = await getS3ObjectBytes(file.key, config);
+      zip.file(`${safeName}/${rel}`, bytes);
+    }
+    const buffer = await zip.generateAsync({ type: "nodebuffer" });
+    res.setHeader("Content-Type", "application/zip");
+    res.setHeader("Content-Disposition", `attachment; filename="${safeName}.skill"`);
+    res.send(buffer);
+  });
+  app.post("/skills/registry/:name", rawZip, async (req, res) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code ?? 401).json({ detail: authResult.message });
+      return;
+    }
+    const name = req.params.name;
+    const bytes = req.body;
+    if (!Buffer.isBuffer(bytes) || bytes.length === 0) {
+      res.status(400).json({ detail: "Empty body. Send the skill as a zip/.skill payload." });
+      return;
+    }
+    const { db: db2 } = await postgresClient();
+    const existing = await resolveSkillByName(db2, name);
+    if (existing) {
+      const canWrite = await canAccessSkill(db2, existing, "write", authResult.user);
+      if (canWrite) {
+        const nextVersion = (existing.current_version ?? 1) + 1;
+        try {
+          await extractBundleToVersion({ bytes, skillId: existing.id, version: nextVersion, config });
+        } catch (err) {
+          if (err instanceof BundleValidationError) {
+            res.status(400).json({ detail: err.message });
+            return;
+          }
+          console.error("[SKILLS] publish (new version) failed", err);
+          res.status(500).json({ detail: "Failed to publish new version." });
+          return;
+        }
+        const history = Array.isArray(existing.history) ? existing.history : [];
+        await db2("skills").where({ id: existing.id }).update({
+          current_version: nextVersion,
+          history: JSON.stringify([
+            ...history,
+            { version: nextVersion, created_at: (/* @__PURE__ */ new Date()).toISOString(), label: "Published from agent" }
+          ])
+        });
+        res.json({ name, version: nextVersion, created: false });
+        return;
+      } else {
+        const canRead = await canAccessSkill(db2, existing, "read", authResult.user);
+        if (!canRead) {
+          res.status(409).json({ detail: "That name is unavailable." });
+          return;
+        }
+        res.status(403).json({ detail: "You don't have write access to this skill." });
+        return;
+      }
+    }
+    const visibility = req.query.visibility;
+    if (visibility !== "public" && visibility !== "private") {
+      res.status(400).json({
+        detail: "Missing or invalid 'visibility'. New skills require ?visibility=public or ?visibility=private \u2014 ask the user which they want."
+      });
+      return;
+    }
+    const meta = await parseSkillFrontmatter(bytes);
+    const skillId = (0, import_node_crypto9.randomUUID)();
+    try {
+      await extractBundleToVersion({ bytes, skillId, version: 1, config });
+    } catch (err) {
+      if (err instanceof BundleValidationError) {
+        res.status(400).json({ detail: err.message });
+        return;
+      }
+      console.error("[SKILLS] publish (create) failed", err);
+      res.status(500).json({ detail: "Failed to publish skill." });
+      return;
+    }
+    try {
+      await db2("skills").insert({
+        id: skillId,
+        name,
+        description: meta.description ?? "",
+        s3folder: `skills/${skillId}`,
+        tags: JSON.stringify([]),
+        usage_count: 0,
+        favorite_count: 0,
+        current_version: 1,
+        history: JSON.stringify([
+          { version: 1, created_at: (/* @__PURE__ */ new Date()).toISOString(), label: "Published from agent" }
+        ]),
+        rights_mode: visibility,
+        created_by: authResult.user.id
+      });
+    } catch (err) {
+      res.status(409).json({ detail: "That name is unavailable." });
+      return;
+    }
+    res.json({ name, version: 1, created: true });
+  });
+  app.get("/skills/registry/:name", async (req, res) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code ?? 401).json({ detail: authResult.message });
+      return;
+    }
+    const { db: db2 } = await postgresClient();
+    const skill = await resolveSkillByName(db2, req.params.name);
+    if (!skill) {
+      res.status(404).json({ detail: "Skill not found." });
+      return;
+    }
+    if (!await canAccessSkill(db2, skill, "read", authResult.user)) {
+      res.status(403).json({ detail: "You don't have access to this skill." });
+      return;
+    }
+    res.json({
+      name: skill.name,
+      description: skill.description ?? "",
+      tags: Array.isArray(skill.tags) ? skill.tags : [],
+      current_version: skill.current_version ?? 1,
+      history: Array.isArray(skill.history) ? skill.history : []
+    });
+  });
   app.post("/skills/:skillId/init", async (req, res) => {
     const authResult = await requestValidators.authenticate(req);
     if (!authResult.user?.id) {
@@ -23460,8 +24349,8 @@ ${style.markdown}` : params.prompt;
     }
     const { skillId } = req.params;
     const { extension, contentType } = req.body ?? {};
-    if (extension !== ".zip" && extension !== ".md") {
-      res.status(400).json({ detail: 'extension must be ".zip" or ".md".' });
+    if (extension !== ".zip" && extension !== ".md" && extension !== ".skill") {
+      res.status(400).json({ detail: 'extension must be ".zip", ".md", or ".skill".' });
       return;
     }
     if (!contentType || typeof contentType !== "string") {
@@ -23600,19 +24489,22 @@ ${style.markdown}` : params.prompt;
     }
     const versionPrefix = `skills/${skillId}/v${version}/`;
     const files = await listS3ObjectsByPrefix(versionPrefix, config);
-    const zip = new import_jszip2.default();
+    const asSkill = req.query.format === "skill";
+    const safeName = String(skill.name ?? "skill").replace(/[^a-zA-Z0-9-_]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
+    const zip = new import_jszip3.default();
     let fileCount = 0;
     for (const file of files) {
       const prefixIndex = file.key.indexOf(versionPrefix);
       const relativePath = prefixIndex >= 0 ? file.key.slice(prefixIndex + versionPrefix.length) : file.key;
       if (!relativePath) continue;
       const bytes = await getS3ObjectBytes(file.key, config);
-      zip.file(relativePath, bytes);
+      const archivePath = asSkill ? `${safeName}/${relativePath}` : relativePath;
+      zip.file(archivePath, bytes);
       fileCount += 1;
     }
     const exportedAt = (/* @__PURE__ */ new Date()).toISOString();
     zip.file(
-      "version.txt",
+      asSkill ? `${safeName}/version.txt` : "version.txt",
       [
         `Skill: ${skill.name ?? skillId}`,
         `Skill id: ${skillId}`,
@@ -23623,13 +24515,9 @@ ${style.markdown}` : params.prompt;
       ].join("\n")
     );
     const buffer = await zip.generateAsync({ type: "nodebuffer" });
-    const safeName = String(skill.name ?? "skill").replace(/[^a-zA-Z0-9-_]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
-    const filename = `${safeName}-v${version}.zip`;
+    const filename = asSkill ? `${safeName}.skill` : `${safeName}-v${version}.zip`;
     res.setHeader("Content-Type", "application/zip");
-    res.setHeader(
-      "Content-Disposition",
-      `attachment; filename="${filename}"`
-    );
+    res.setHeader("Content-Disposition", `attachment; filename="${filename}"`);
     res.send(buffer);
   });
   app.post("/skills/:skillId/sign", async (req, res) => {
@@ -23929,6 +24817,12 @@ ${style.markdown}` : params.prompt;
     const fullSessionPrefix = `${generalPrefix}${userSessionPrefix}`;
     return { userSessionPrefix, fullSessionPrefix };
   }
+  const loadSessionFilesAuth = async (req, res, sessionId, rights) => {
+    const authed = await loadAuthedSession(req, res, sessionId, rights);
+    if (!authed) return null;
+    const ownerId = authed.session.user ?? authed.user.id;
+    return { ...authed, ownerId, ...buildSessionPrefixes(ownerId, sessionId) };
+  };
   function sanitizeFilename(name) {
     const trimmed = name.trim();
     if (!trimmed) return "";
@@ -23937,11 +24831,6 @@ ${style.markdown}` : params.prompt;
     return trimmed.replace(/[\\/]/g, "_");
   }
   app.get("/sessions/:sessionId/files", async (req, res) => {
-    const authResult = await requestValidators.authenticate(req);
-    if (!authResult.user?.id) {
-      res.status(authResult.code ?? 401).json({ detail: authResult.message });
-      return;
-    }
     const sessionId = req.params.sessionId;
     if (!sessionId) {
       res.status(400).json({ detail: "Missing sessionId in path." });
@@ -23951,10 +24840,9 @@ ${style.markdown}` : params.prompt;
       res.status(500).json({ detail: "File uploads are not configured." });
       return;
     }
-    const { userSessionPrefix } = buildSessionPrefixes(
-      authResult.user.id,
-      sessionId
-    );
+    const authed = await loadSessionFilesAuth(req, res, sessionId, "read");
+    if (!authed) return;
+    const { userSessionPrefix } = authed;
     let objects;
     try {
       objects = await listS3ObjectsByPrefix(userSessionPrefix, config);
@@ -23984,11 +24872,6 @@ ${style.markdown}` : params.prompt;
   app.post(
     "/sessions/:sessionId/files/upload-sign",
     async (req, res) => {
-      const authResult = await requestValidators.authenticate(req);
-      if (!authResult.user?.id) {
-        res.status(authResult.code ?? 401).json({ detail: authResult.message });
-        return;
-      }
       const sessionId = req.params.sessionId;
       if (!sessionId) {
         res.status(400).json({ detail: "Missing sessionId in path." });
@@ -23998,6 +24881,8 @@ ${style.markdown}` : params.prompt;
         res.status(500).json({ detail: "File uploads are not configured." });
         return;
       }
+      const authed = await loadSessionFilesAuth(req, res, sessionId, "write");
+      if (!authed) return;
       const { filename, contentType } = req.body ?? {};
       if (!filename || typeof filename !== "string") {
         res.status(400).json({ detail: "Missing filename in request body." });
@@ -24012,11 +24897,7 @@ ${style.markdown}` : params.prompt;
         res.status(400).json({ detail: "Missing contentType in request body." });
         return;
       }
-      const { userSessionPrefix, fullSessionPrefix } = buildSessionPrefixes(
-        authResult.user.id,
-        sessionId
-      );
-      const fullKey = `${fullSessionPrefix}${safeName}`;
+      const fullKey = `${authed.fullSessionPrefix}${safeName}`;
       const uploadUrl = await getS3SignedUploadUrl(fullKey, contentType, config);
       res.json({ uploadUrl, key: fullKey });
     }
@@ -24024,11 +24905,6 @@ ${style.markdown}` : params.prompt;
   app.post(
     "/sessions/:sessionId/files/sync-to-sandbox",
     async (req, res) => {
-      const authResult = await requestValidators.authenticate(req);
-      if (!authResult.user?.id) {
-        res.status(authResult.code ?? 401).json({ detail: authResult.message });
-        return;
-      }
       const sessionId = req.params.sessionId;
       if (!sessionId) {
         res.status(400).json({ detail: "Missing sessionId in path." });
@@ -24039,18 +24915,16 @@ ${style.markdown}` : params.prompt;
         res.status(400).json({ detail: "Missing key in request body." });
         return;
       }
-      const { fullSessionPrefix } = buildSessionPrefixes(
-        authResult.user.id,
-        sessionId
-      );
-      if (!key.startsWith(fullSessionPrefix)) {
+      const authed = await loadSessionFilesAuth(req, res, sessionId, "write");
+      if (!authed) return;
+      if (!key.startsWith(authed.fullSessionPrefix)) {
         res.status(403).json({ detail: "Key does not belong to this session." });
         return;
       }
       try {
         const result = await downloadKeyIntoSandbox({
           sessionId,
-          userId: authResult.user.id,
+          userId: authed.ownerId,
           fullS3Key: key,
           config
         });
@@ -24064,11 +24938,6 @@ ${style.markdown}` : params.prompt;
   app.delete(
     "/sessions/:sessionId/files",
     async (req, res) => {
-      const authResult = await requestValidators.authenticate(req);
-      if (!authResult.user?.id) {
-        res.status(authResult.code ?? 401).json({ detail: authResult.message });
-        return;
-      }
       const sessionId = req.params.sessionId;
       if (!sessionId) {
         res.status(400).json({ detail: "Missing sessionId in path." });
@@ -24079,11 +24948,9 @@ ${style.markdown}` : params.prompt;
         res.status(400).json({ detail: "Missing or invalid 'key' query parameter." });
         return;
       }
-      const { fullSessionPrefix } = buildSessionPrefixes(
-        authResult.user.id,
-        sessionId
-      );
-      if (!key.startsWith(fullSessionPrefix)) {
+      const authed = await loadSessionFilesAuth(req, res, sessionId, "write");
+      if (!authed) return;
+      if (!key.startsWith(authed.fullSessionPrefix)) {
         res.status(403).json({ detail: "Key does not belong to this session." });
         return;
       }
@@ -24102,11 +24969,6 @@ ${style.markdown}` : params.prompt;
       if (!req.headers.authorization && typeof req.query.auth === "string") {
         req.headers.authorization = `Bearer ${req.query.auth}`;
       }
-      const authResult = await requestValidators.authenticate(req);
-      if (!authResult.user?.id) {
-        res.status(authResult.code ?? 401).json({ detail: authResult.message });
-        return;
-      }
       const sessionId = req.params.sessionId;
       if (!sessionId) {
         res.status(400).json({ detail: "Missing sessionId in path." });
@@ -24117,11 +24979,9 @@ ${style.markdown}` : params.prompt;
         res.status(400).json({ detail: "Missing or invalid 'key' query parameter." });
         return;
       }
-      const { fullSessionPrefix } = buildSessionPrefixes(
-        authResult.user.id,
-        sessionId
-      );
-      if (!key.startsWith(fullSessionPrefix)) {
+      const authed = await loadSessionFilesAuth(req, res, sessionId, "read");
+      if (!authed) return;
+      if (!key.startsWith(authed.fullSessionPrefix)) {
         res.status(403).json({ detail: "Key does not belong to this session." });
         return;
       }
@@ -24225,7 +25085,7 @@ ${style.markdown}` : params.prompt;
         `  - tracking.json         tracking events linked to the user`,
         ``
       ].join("\n");
-      const zip = new import_jszip2.default();
+      const zip = new import_jszip3.default();
       zip.file("README.txt", readme);
       zip.file("user_data.json", JSON.stringify(userExport, null, 2));
       zip.file("sessions.json", JSON.stringify(sessionsWithMessages, null, 2));
@@ -24516,7 +25376,7 @@ init_check_record_access();
 init_resolve_model();
 init_supervisor();
 init_client();
-var import_zod14 = require("zod");
+var import_zod16 = require("zod");
 init_convert_exulu_tools_to_ai_sdk_tools();
 init_singleton();
 var SESSION_ID_HEADER = "mcp-session-id";
@@ -24590,7 +25450,7 @@ var ExuluMCP = class {
           title: tool4.name + " agent",
           description: tool4.description,
           inputSchema: {
-            inputs: tool4.inputSchema || import_zod14.z.object({})
+            inputs: tool4.inputSchema || import_zod16.z.object({})
           }
         },
         async ({ inputs }, args) => {
@@ -24642,7 +25502,7 @@ var ExuluMCP = class {
           title: "Get List of Prompt Templates",
           description: "Retrieves a list of prompt templates available for this agent. Returns the name, description, and ID of each template.",
           inputSchema: {
-            inputs: import_zod14.z.object({})
+            inputs: import_zod16.z.object({})
           }
         },
         async ({ inputs }, args) => {
@@ -24688,8 +25548,8 @@ var ExuluMCP = class {
           title: "Get Prompt Template Details",
           description: "Retrieves the full details of a specific prompt template by ID, including the actual template content with variables.",
           inputSchema: {
-            inputs: import_zod14.z.object({
-              id: import_zod14.z.string().describe("The ID of the prompt template to retrieve")
+            inputs: import_zod16.z.object({
+              id: import_zod16.z.string().describe("The ID of the prompt template to retrieve")
             })
           }
         },
@@ -25804,7 +26664,7 @@ var ExuluEval = class {
 // src/templates/evals/index.ts
 init_resolve_model();
 init_singleton();
-var import_zod15 = require("zod");
+var import_zod17 = require("zod");
 var import_ai17 = require("ai");
 var llmAsJudgeEval = () => {
   if (process.env.REDIS_HOST?.length && process.env.REDIS_PORT?.length) {
@@ -25857,8 +26717,8 @@ var llmAsJudgeEval = () => {
           prompt,
           maxRetries: 2,
           output: import_ai17.Output.object({
-            schema: import_zod15.z.object({
-              score: import_zod15.z.number().min(0).max(100).describe("The score between 0 and 100.")
+            schema: import_zod17.z.object({
+              score: import_zod17.z.number().min(0).max(100).describe("The score between 0 and 100.")
             })
           })
         });
@@ -26089,15 +26949,15 @@ Usage:
 - If no todos exist yet, an empty list will be returned`;
 
 // src/templates/tools/todo/todo.ts
-var import_zod16 = __toESM(require("zod"), 1);
+var import_zod18 = __toESM(require("zod"), 1);
 init_tool();
 init_check_record_access();
 init_client();
-var TodoSchema = import_zod16.default.object({
-  content: import_zod16.default.string().describe("Brief description of the task"),
-  status: import_zod16.default.string().describe("Current status of the task: pending, in_progress, completed, cancelled"),
-  priority: import_zod16.default.string().describe("Priority level of the task: high, medium, low"),
-  id: import_zod16.default.string().describe("Unique identifier for the todo item")
+var TodoSchema = import_zod18.default.object({
+  content: import_zod18.default.string().describe("Brief description of the task"),
+  status: import_zod18.default.string().describe("Current status of the task: pending, in_progress, completed, cancelled"),
+  priority: import_zod18.default.string().describe("Priority level of the task: high, medium, low"),
+  id: import_zod18.default.string().describe("Unique identifier for the todo item")
 });
 var TodoWriteTool = new ExuluTool({
   id: "todo_write",
@@ -26113,8 +26973,8 @@ var TodoWriteTool = new ExuluTool({
       default: todowrite_default
     }
   ],
-  inputSchema: import_zod16.default.object({
-    todos: import_zod16.default.array(TodoSchema).describe("The updated todo list")
+  inputSchema: import_zod18.default.object({
+    todos: import_zod18.default.array(TodoSchema).describe("The updated todo list")
   }),
   execute: async (inputs) => {
     const { sessionID, todos, user } = inputs;
@@ -26149,7 +27009,7 @@ var TodoReadTool = new ExuluTool({
   id: "todo_read",
   name: "Todo Read",
   description: "Use this tool to read your todo list",
-  inputSchema: import_zod16.default.object({}),
+  inputSchema: import_zod18.default.object({}),
   type: "function",
   category: "todo",
   config: [
@@ -26194,7 +27054,7 @@ init_cjs_shims();
 var questionread_default = 'Use this tool to read questions you\'ve asked and check if they\'ve been answered by the user. This tool helps you track the status of questions and retrieve the user\'s selected answers.\n\n## When to Use This Tool\n\nUse this tool proactively in these situations:\n- After asking a question to check if the user has responded\n- To retrieve the user\'s answer before proceeding with implementation\n- To review all questions and answers in the current session\n- When you need to reference a previous answer\n\n## How It Works\n\n- This tool takes no parameters (leave the input blank or empty)\n- Returns an array of all questions in the session\n- Each question includes:\n  - `id`: Unique identifier for the question\n  - `question`: The question text\n  - `answerOptions`: Array of answer options with their IDs and text\n  - `status`: Either "pending" (not answered) or "answered"\n  - `selectedAnswerId`: The ID of the chosen answer (only present if answered)\n\n## Usage Pattern\n\nTypically you\'ll:\n1. Use Question Ask to pose a question\n2. Wait for the user to respond\n3. Use Question Read to check the answer\n4. Find the selected answer by matching the `selectedAnswerId` with an option in `answerOptions`\n5. Proceed with implementation based on the user\'s choice\n\n## Example Response\n\n```json\n[\n  {\n    "id": "question123",\n    "question": "Which authentication method would you like to implement?",\n    "answerOptions": [\n      { "id": "ans1", "text": "JWT tokens" },\n      { "id": "ans2", "text": "OAuth 2.0" },\n      { "id": "ans3", "text": "Session-based auth" },\n      { "id": "ans4", "text": "None of the above..." }\n    ],\n    "status": "answered",\n    "selectedAnswerId": "ans1"\n  }\n]\n```\n\nIn this example, the user selected "JWT tokens" (id: ans1).\n\n## Important Notes\n\n- If no questions exist in the session, an empty array will be returned\n- Questions remain in the session even after being answered for reference\n- Use the `selectedAnswerId` to find which answer option the user chose by matching it against the `id` field in `answerOptions`\n';
 
 // src/templates/tools/question/question.ts
-var import_zod18 = __toESM(require("zod"), 1);
+var import_zod20 = __toESM(require("zod"), 1);
 init_tool();
 init_client();
 
@@ -26286,21 +27146,21 @@ After asking a question, use the Question Read tool to check if the user has ans
 `;
 
 // src/templates/tools/question/question-ask.ts
-var import_zod17 = __toESM(require("zod"), 1);
+var import_zod19 = __toESM(require("zod"), 1);
 init_tool();
 init_check_record_access();
 init_client();
 var import_node_crypto11 = require("crypto");
-var AnswerOptionSchema = import_zod17.default.object({
-  id: import_zod17.default.string().describe("Unique identifier for the answer option"),
-  text: import_zod17.default.string().describe("The text of the answer option")
+var AnswerOptionSchema = import_zod19.default.object({
+  id: import_zod19.default.string().describe("Unique identifier for the answer option"),
+  text: import_zod19.default.string().describe("The text of the answer option")
 });
-var _QuestionSchema = import_zod17.default.object({
-  id: import_zod17.default.string().describe("Unique identifier for the question"),
-  question: import_zod17.default.string().describe("The question to ask the user"),
-  answerOptions: import_zod17.default.array(AnswerOptionSchema).describe("Array of possible answer options"),
-  selectedAnswerId: import_zod17.default.string().optional().describe("The ID of the answer option selected by the user"),
-  status: import_zod17.default.enum(["pending", "answered"]).describe("Status of the question: pending or answered")
+var _QuestionSchema = import_zod19.default.object({
+  id: import_zod19.default.string().describe("Unique identifier for the question"),
+  question: import_zod19.default.string().describe("The question to ask the user"),
+  answerOptions: import_zod19.default.array(AnswerOptionSchema).describe("Array of possible answer options"),
+  selectedAnswerId: import_zod19.default.string().optional().describe("The ID of the answer option selected by the user"),
+  status: import_zod19.default.enum(["pending", "answered"]).describe("Status of the question: pending or answered")
 });
 var QuestionAskTool = new ExuluTool({
   id: "question_ask",
@@ -26317,9 +27177,9 @@ var QuestionAskTool = new ExuluTool({
       default: questionask_default
     }
   ],
-  inputSchema: import_zod17.default.object({
-    question: import_zod17.default.string().describe("The question to ask the user"),
-    answerOptions: import_zod17.default.array(import_zod17.default.string()).describe("Array of possible answer options (strings)")
+  inputSchema: import_zod19.default.object({
+    question: import_zod19.default.string().describe("The question to ask the user"),
+    answerOptions: import_zod19.default.array(import_zod19.default.string()).describe("Array of possible answer options (strings)")
   }),
   execute: async (inputs) => {
     const { sessionID, question, answerOptions, user } = inputs;
@@ -26392,7 +27252,7 @@ var QuestionReadTool = new ExuluTool({
   name: "Question Read",
   needsApproval: false,
   description: "Use this tool to read questions and their answers",
-  inputSchema: import_zod18.default.object({}),
+  inputSchema: import_zod20.default.object({}),
   type: "function",
   category: "question",
   config: [
@@ -26424,15 +27284,15 @@ var questionTools = [QuestionAskTool, QuestionReadTool];
 // src/templates/tools/perplexity.ts
 init_cjs_shims();
 init_tool();
-var import_zod19 = __toESM(require("zod"), 1);
+var import_zod21 = __toESM(require("zod"), 1);
 var import_perplexity_ai = __toESM(require("@perplexity-ai/perplexity_ai"), 1);
 var internetSearchTool = new ExuluTool({
   id: "internet_search",
   name: "Internet Search",
   description: "Search the internet for information.",
-  inputSchema: import_zod19.default.object({
-    query: import_zod19.default.string().describe("The query to the tool."),
-    search_recency_filter: import_zod19.default.enum(["day", "week", "month", "year"]).optional().describe("The recency filter for the search, can be day, week, month or year.")
+  inputSchema: import_zod21.default.object({
+    query: import_zod21.default.string().describe("The query to the tool."),
+    search_recency_filter: import_zod21.default.enum(["day", "week", "month", "year"]).optional().describe("The recency filter for the search, can be day, week, month or year.")
   }),
   category: "internet_search",
   type: "web_search",
@@ -26527,7 +27387,7 @@ var perplexityTools = [internetSearchTool];
 init_cjs_shims();
 init_tool();
 var nodemailer = __toESM(require("nodemailer"), 1);
-var import_zod20 = require("zod");
+var import_zod22 = require("zod");
 var transporter = null;
 function getTransporter(config) {
   if (!transporter) {
@@ -26551,11 +27411,11 @@ var emailTool = new ExuluTool({
   id: "email",
   name: "Email",
   description: "Send an email.",
-  inputSchema: import_zod20.z.object({
-    recipient: import_zod20.z.string().describe("The recipient of the email."),
-    subject: import_zod20.z.string().describe("The subject of the email."),
-    html: import_zod20.z.string().describe("The HTML body of the email."),
-    text: import_zod20.z.string().describe("The text body of the email.")
+  inputSchema: import_zod22.z.object({
+    recipient: import_zod22.z.string().describe("The recipient of the email."),
+    subject: import_zod22.z.string().describe("The subject of the email."),
+    html: import_zod22.z.string().describe("The HTML body of the email."),
+    text: import_zod22.z.string().describe("The text body of the email.")
   }),
   type: "function",
   config: [{
@@ -26626,7 +27486,7 @@ init_tool();
 init_supervisor();
 init_client();
 init_check_record_access();
-var import_zod21 = require("zod");
+var import_zod23 = require("zod");
 var _cachedImageModels;
 var setCachedImageModels = (models2) => {
   _cachedImageModels = models2;
@@ -26687,8 +27547,8 @@ var createImageGenerationWidgetTool = (models2) => {
     needsApproval: false,
     type: "function",
     config: [],
-    inputSchema: import_zod21.z.object({
-      prompt: import_zod21.z.string().describe(
+    inputSchema: import_zod23.z.object({
+      prompt: import_zod23.z.string().describe(
         "Initial image prompt. The user can edit it before generating."
       )
     }),
@@ -26727,7 +27587,7 @@ var createImageGenerationWidgetTool = (models2) => {
 };
 
 // src/exulu/app/index.ts
-var import_node_path7 = require("path");
+var import_node_path10 = require("path");
 
 // src/validators/postgres-name.ts
 init_cjs_shims();
@@ -27113,7 +27973,7 @@ var ExuluApp = class {
     const imageGenerationTools = [];
     const s3Configured = !!config?.fileUploads && !!config.fileUploads.s3region && !!config.fileUploads.s3key && !!config.fileUploads.s3secret && !!config.fileUploads.s3Bucket;
     if (isLiteLLMEnabled() && s3Configured) {
-      const configPath = process.env.LITELLM_CONFIG_PATH ?? (0, import_node_path7.resolve)(process.cwd(), "./config.litellm.yaml");
+      const configPath = process.env.LITELLM_CONFIG_PATH ?? (0, import_node_path10.resolve)(process.cwd(), "./config.litellm.yaml");
       const imageModels = parseImageGenerationModels(configPath);
       if (imageModels.length > 0) {
         console.log(
@@ -28573,8 +29433,8 @@ init_cjs_shims();
 // src/exulu/litellm/db-init.ts
 init_cjs_shims();
 var import_node_fs9 = require("fs");
-var import_node_path8 = require("path");
-var import_node_child_process5 = require("child_process");
+var import_node_path11 = require("path");
+var import_node_child_process6 = require("child_process");
 var import_pg = require("pg");
 
 // src/exulu/litellm/db-setup-check.ts
@@ -28643,7 +29503,7 @@ ${WARNING_BANNER}`);
 };
 var log5 = (line) => console.log(`[EXULU-LITELLM] ${line}`);
 var initLiteLLMDatabase = async (packageRoot) => {
-  const configPath = process.env.LITELLM_CONFIG_PATH ?? (0, import_node_path8.resolve)(process.cwd(), "./config.litellm.yaml");
+  const configPath = process.env.LITELLM_CONFIG_PATH ?? (0, import_node_path11.resolve)(process.cwd(), "./config.litellm.yaml");
   const safety = checkLiteLLMDatabaseSafety(configPath);
   if (safety.ok && safety.reason === "no-litellm-db-mode") return;
   if (!safety.ok && safety.reason === "unparseable-url") {
@@ -28781,9 +29641,9 @@ var initLiteLLMDatabase = async (packageRoot) => {
     ]);
     return;
   }
-  const venvBin = (0, import_node_path8.resolve)(packageRoot, "ee/python/.venv/bin");
-  const prismaCli = (0, import_node_path8.resolve)(venvBin, "prisma");
-  const venvLibDir = (0, import_node_path8.resolve)(packageRoot, "ee/python/.venv/lib");
+  const venvBin = (0, import_node_path11.resolve)(packageRoot, "ee/python/.venv/bin");
+  const prismaCli = (0, import_node_path11.resolve)(venvBin, "prisma");
+  const venvLibDir = (0, import_node_path11.resolve)(packageRoot, "ee/python/.venv/lib");
   const pythonVersionDir = (0, import_node_fs9.existsSync)(venvLibDir) ? (0, import_node_fs9.readdirSync)(venvLibDir).find((entry) => /^python3\.\d+$/.test(entry)) : void 0;
   if (!pythonVersionDir) {
     warn2([
@@ -28793,12 +29653,12 @@ var initLiteLLMDatabase = async (packageRoot) => {
     ]);
     return;
   }
-  const litellmProxyDir = (0, import_node_path8.resolve)(
+  const litellmProxyDir = (0, import_node_path11.resolve)(
     venvLibDir,
     pythonVersionDir,
     "site-packages/litellm/proxy"
   );
-  const schemaPath = (0, import_node_path8.resolve)(litellmProxyDir, "schema.prisma");
+  const schemaPath = (0, import_node_path11.resolve)(litellmProxyDir, "schema.prisma");
   if (!(0, import_node_fs9.existsSync)(prismaCli)) {
     warn2([
       `Prisma CLI not found at ${prismaCli}.`,
@@ -28815,7 +29675,7 @@ var initLiteLLMDatabase = async (packageRoot) => {
     return;
   }
   log5("Running `prisma db push` against LiteLLM's schema\u2026");
-  const result = (0, import_node_child_process5.spawnSync)(prismaCli, ["db", "push", "--skip-generate"], {
+  const result = (0, import_node_child_process6.spawnSync)(prismaCli, ["db", "push", "--skip-generate"], {
     cwd: litellmProxyDir,
     env: {
       ...process.env,
@@ -29387,14 +30247,14 @@ init_cjs_shims();
 var fs4 = __toESM(require("fs"), 1);
 var path = __toESM(require("path"), 1);
 var import_ai18 = require("ai");
-var import_zod22 = require("zod");
+var import_zod24 = require("zod");
 var import_p_limit = __toESM(require("p-limit"), 1);
 var import_crypto2 = require("crypto");
 init_with_retry();
 var mammoth = __toESM(require("mammoth"), 1);
 var import_turndown = __toESM(require("turndown"), 1);
 var import_word_extractor = __toESM(require("word-extractor"), 1);
-var import_officeparser2 = require("officeparser");
+var import_officeparser3 = require("officeparser");
 init_entitlements();
 
 // src/utils/python-executor.ts
@@ -29854,15 +30714,15 @@ If the page contains a flow-chart, schematic, technical drawing or control board
   const result = await (0, import_ai18.generateText)({
     model,
     output: import_ai18.Output.object({
-      schema: import_zod22.z.object({
-        needs_correction: import_zod22.z.boolean(),
-        corrected_text: import_zod22.z.string().nullable(),
-        current_page_table: import_zod22.z.object({
-          headers: import_zod22.z.array(import_zod22.z.string()),
-          is_continuation: import_zod22.z.boolean()
+      schema: import_zod24.z.object({
+        needs_correction: import_zod24.z.boolean(),
+        corrected_text: import_zod24.z.string().nullable(),
+        current_page_table: import_zod24.z.object({
+          headers: import_zod24.z.array(import_zod24.z.string()),
+          is_continuation: import_zod24.z.boolean()
         }).nullable(),
-        confidence: import_zod22.z.enum(["high", "medium", "low"]),
-        reasoning: import_zod22.z.string()
+        confidence: import_zod24.z.enum(["high", "medium", "low"]),
+        reasoning: import_zod24.z.string()
       })
     }),
     messages: [
@@ -30111,7 +30971,7 @@ ${setupResult.output || ""}`);
       const jsonContent = await fs4.promises.readFile(paths.json, "utf-8");
       json = JSON.parse(jsonContent);
     } else if (config?.processor.name === "officeparser") {
-      const text = await (0, import_officeparser2.parseOfficeAsync)(buffer, {
+      const text = await (0, import_officeparser3.parseOfficeAsync)(buffer, {
         outputErrorToConsole: false,
         newlineDelimiter: "\n"
       });