@hybridlabor-api/aos 4.4.2-beta.6 → 4.4.2-beta.8

package/CLAUDE.md

@@ -616,58 +616,6 @@ must not do.
 
 ## Headless timeouts
 
-A trivial headless `agy` prompt was measured at **605s** in 2026-09.
-`agy-delegate` defaults to `--print-timeout 5m`, so it aborts at 300s and
-reports an empty body while the answer is still arriving. Pass `--timeout 15m`
-for anything non-trivial. A short timeout does not read as "slow", it reads as
-"broken".
-
-# AOS — Antigravity / Gemini
-
-**Read [AGENTS.md](AGENTS.md) first.** It holds every rule that applies to all
-harnesses: the non-negotiables, the release gate, Conventional Commits, the
-skill contract and category routing, the pipeline variants, and the delegation
-policy. Nothing from it is repeated here — a rule that lives in two files is a
-rule that will eventually disagree with itself.
-
-This file covers only what is specific to running AOS under Antigravity.
-
-## Nothing enforces the gate here — you are the enforcement
-
-`.claude/hooks/go-gate.mjs` is a Claude Code hook and does not run on this
-harness. Not one of the four release commands is mechanically blocked for you,
-and neither is anything else.
-
-So the full rule in AGENTS.md applies here in its entirety, not just its
-hook-enforced subset: when the user asks for a plan, review, audit or
-multi-step action, you are read-only until they answer with the literal **GO**
-— including file writes and `git commit`. On Claude Code a hook would catch the
-four worst cases if discipline failed. Here there is no backstop, which makes
-this the harness where the rule matters most, not least.
-
-## Model routing
-
-The tier names in `agy-delegate` map to models that go stale — the built-in
-`flash` still points at Gemini 3.7 while 3.8 ships. Re-check against
-`agy models` after every upgrade; the id carries both the version and the
-effort suffix.
-
-| Work | Model |
-|---|---|
-| Media, fast or mechanical coding, boilerplate | `Gemini 3.8 Flash (Medium)` |
-| Trivial one-liners | `Gemini 3.8 Flash (Low)` |
-| Review, architecture, hard reasoning | `Claude Sonnet 4.6 (Thinking)` |
-
-Set these once via `CLAUDE_PLUGIN_OPTION_TIER_{FLASH,FLASH_LO,PRO}` in
-`~/.zshenv` — **not** `~/.zshrc`, which non-interactive tool shells never
-source.
-
-Adversarial review is the case that most repays the stronger model: a Flash
-tier tends to agree with what it is shown, which is the one thing a reviewer
-must not do.
-
-## Headless timeouts
-
 A trivial headless `agy` prompt was measured at **605s** in 2026-09.
 `agy-delegate` defaults to `--print-timeout 5m`, so it aborts at 300s and
 reports an empty body while the answer is still arriving. Pass `--timeout 15m`

package/README.de.md

@@ -20,10 +20,10 @@
 [![NPM Version](https://img.shields.io/npm/v/@hybridlabor-api/aos.svg)](https://www.npmjs.com/package/@hybridlabor-api/aos)
 [![runtime](https://img.shields.io/badge/node-20+-blue.svg)](https://github.com/hybridlabor-api/aos)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
-[![skills](https://img.shields.io/badge/skills-154%20kuratiert-brightgreen.svg)](https://github.com/hybridlabor-api/aos)
+[![skills](https://img.shields.io/badge/skills-183%20kuratiert-brightgreen.svg)](https://github.com/hybridlabor-api/aos)
 [![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
 
-> **Supercharging von KI-Coding-Agenten mit 154 hochkuratierten Skills, 21 lokalen MCP Wrappern und tiefgreifenden Integrationen für die Creative-Technology-Branche.**
+> **Supercharging von KI-Coding-Agenten mit 183 hochkuratierten Skills, 19 lokalen MCP Wrappern und tiefgreifenden Integrationen für die Creative-Technology-Branche.**
 
 Willkommen im **BDB DEV Skills & MCP Configuration** Repository. Dieses Projekt dient als Rückgrat unseres Entwicklungs-Ecosystems für Creative & Full-Stack Development. Es erweitert KI-Agenten um hochspezialisierte Fähigkeiten, die speziell auf die Event- und Medientechnologie-Branche sowie auf allgemeine Software-Entwicklung zugeschnitten sind.
 
@@ -82,9 +82,9 @@ Keines dieser Plugins ist in diesem Paket enthalten — es handelt sich um unabh
 
 Dieses Repo liefert drei Dinge: eine kuratierte Skill-Bibliothek für Coding-Agenten, einen Installer, der diese (plus 21 lokale MCP Wrapper) in das von Ihnen genutzte Harness einbindet, und einen Dispatcher-Graphen, der sie als Multi-Agenten Build-Pipeline orchestriert. Siehe [AOS: Der Dispatcher-Graph](#-aos-der-dispatcher-graph) weiter unten für Details zur Funktionsweise der Pipeline selbst.
 
-## 🌟 ~154+ Optimierte Skills (Aktualisiert für v4.0.0)
+## 🌟 183 Optimierte Skills
 
-Wir haben mit einem gewaltigen Pool von über 1.400 rohen KI-Skills begonnen. Nach intensiven Tests, Filterungen und Verfeinerungen haben wir sie zu einem hochkuratierten Set von **154+ Optimierten Skills** destilliert (mit nativer OpenWiki-Dokumentationsengine, dem **lokalen semantischen Gedächtnis memB** und jetzt der **Universal Agent Harness Synchronisation in v4.0.0**).
+Wir haben mit einem gewaltigen Pool von über 1.400 rohen KI-Skills begonnen. Nach intensiven Tests, Filterungen und Verfeinerungen haben wir sie zu einem hochkuratierten Set von **183 Optimierten Skills** destilliert (mit nativer OpenWiki-Dokumentationsengine, dem **lokalen semantischen Gedächtnis memB** und jetzt der **Universal Agent Harness Synchronisation in v4.0.0**).
 
 Diese Skills sind präzise optimiert, damit Agenten keine Zeit mit redundanten Aufgaben verschwenden, sondern mit maximaler Autonomie, strengen Architekturvorgaben und robustem Kontextbewusstsein agieren.
 

package/README.md

@@ -10,15 +10,15 @@
 [![GitHub stars](https://img.shields.io/github/stars/hybridlabor-api/aos?style=flat&color=gold)](https://github.com/hybridlabor-api/aos/stargazers)
 [![last commit](https://img.shields.io/github/last-commit/hybridlabor-api/aos.svg)](https://github.com/hybridlabor-api/aos/commits/main)
 
-[![skills](https://img.shields.io/badge/skills-169%20curated-brightgreen.svg)](docs/skills_table.md)
-[![MCPs](https://img.shields.io/badge/local%20MCPs-21-brightgreen.svg)](mcps/)
+[![skills](https://img.shields.io/badge/skills-183%20curated-brightgreen.svg)](docs/skills_table.md)
+[![MCPs](https://img.shields.io/badge/local%20MCPs-19-brightgreen.svg)](mcps/)
 [![harnesses](https://img.shields.io/badge/harnesses-9%20supported-blueviolet.svg)](#-installation)
 [![runtime](https://img.shields.io/badge/node-20+-blue.svg)](https://github.com/hybridlabor-api/aos)
 [![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
 
-> **Supercharging AI coding agents with 169 hyper-curated skills, 21 local MCP wrappers, and a runnable multi-agent dispatcher graph.**
+> **Supercharging AI coding agents with 183 hyper-curated skills, 21 local MCP wrappers, and a runnable multi-agent dispatcher graph.**
 
-Welcome to **BDB Agent OS — AOS**: 169 curated skills, 21 local MCP wrappers, an optional Hardware & PCB design module, and a dispatcher graph that turns all of it into a real multi-agent build pipeline, not just a prompt library. Point it at a goal and it plans, builds, reviews, and ships through seven coordinated agent nodes — with a mechanically enforced gate before anything actually goes live.
+Welcome to **BDB Agent OS — AOS**: 183 curated skills, 19 local MCP wrappers, an optional Hardware & PCB design module, and a dispatcher graph that turns all of it into a real multi-agent build pipeline, not just a prompt library. Point it at a goal and it plans, builds, reviews, and ships through seven coordinated agent nodes — with a mechanically enforced gate before anything actually goes live.
 
 **Current release:** `v4.4.2` (beta channel) — see the NPM badge above for the exact published version.
 
@@ -105,9 +105,9 @@ below for how the pipeline itself works.
 
 ---
 
-## 🌟 169 Optimized Skills
+## 🌟 183 Optimized Skills
 
-We started with a massive pool of over 1,400 raw AI skills. After rigorous testing, filtering, and refinement, we've distilled them down to a hyper-curated set of **169 Optimized Skills** (featuring a native OpenWiki documentation engine, the **memB local semantic memory brain**, and **Universal Agent Harness synchronization**).
+We started with a massive pool of over 1,400 raw AI skills. After rigorous testing, filtering, and refinement, we've distilled them down to a hyper-curated set of **183 Optimized Skills** (featuring a native OpenWiki documentation engine, the **memB local semantic memory brain**, and **Universal Agent Harness synchronization**).
 
 These skills are precision-engineered to ensure agents waste no time on redundant tasks and instead operate with maximum agency, strict architectural constraints, and robust context awareness.
 

package/README.pt.md

@@ -20,12 +20,12 @@
 [![NPM Version](https://img.shields.io/npm/v/@hybridlabor-api/aos.svg)](https://www.npmjs.com/package/@hybridlabor-api/aos)
 [![runtime](https://img.shields.io/badge/node-20+-blue.svg)](https://github.com/hybridlabor-api/aos)
 [![license](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
-[![skills](https://img.shields.io/badge/skills-154%20curadas-brightgreen.svg)](https://github.com/hybridlabor-api/aos)
+[![skills](https://img.shields.io/badge/skills-183%20curadas-brightgreen.svg)](https://github.com/hybridlabor-api/aos)
 [![SkillSpector](https://img.shields.io/badge/NVIDIA%20SkillSpector-CLEAN-76B900?logo=nvidia&logoColor=white)](https://github.com/NVIDIA/SkillSpector)
 
-> **Potencializando agentes de código de IA com 154 skills hipercuradas, 21 wrappers MCP locais e um grafo dispatcher de multi-agentes executável.**
+> **Potencializando agentes de código de IA com 183 skills hipercuradas, 19 wrappers MCP locais e um grafo dispatcher de multi-agentes executável.**
 
-Bem-vindo ao **BDB Agent OS — AOS v4.0.0**: 154 skills curadas, 21 wrappers MCP locais e um grafo dispatcher que os transforma em um verdadeiro pipeline de build multi-agente, não apenas uma biblioteca de prompts. Aponte para um objetivo e ele planeja, constrói, revisa e implementa através de sete nós de agentes coordenados — com um portão imposto mecanicamente antes que qualquer coisa vá ao ar.
+Bem-vindo ao **BDB Agent OS — AOS**: 183 skills curadas, 19 wrappers MCP locais e um grafo dispatcher que os transforma em um verdadeiro pipeline de build multi-agente, não apenas uma biblioteca de prompts. Aponte para um objetivo e ele planeja, constrói, revisa e implementa através de sete nós de agentes coordenados — com um portão imposto mecanicamente antes que qualquer coisa vá ao ar.
 
 É neutro em relação ao harness por design, não "otimizado para uma ferramenta com outras como reflexão tardia": o grafo dispatcher é executado no Dynamic Workflows do Claude Code, as mesmas skills e configuração MCP são instaladas nativamente no **Google Antigravity, ChatGPT Codex / Codex CLI, Claude Desktop, Cursor, Aider, Roo Code, Cline e Windsurf**, e a variante leve `/startcycle-graph-user` recorre aos próprios subagentes do Claude Code em qualquer máquina que não tenha nenhum dos acima instalados.
 
@@ -86,9 +86,9 @@ que você use, e um grafo dispatcher que os orquestra como um pipeline de
 build multi-agente. Veja [AOS: O Grafo Dispatcher](#-aos-o-grafo-dispatcher)
 abaixo para entender como o próprio pipeline funciona.
 
-## 🌟 ~154+ Skills Otimizadas (Atualizado para v4.0.0)
+## 🌟 183 Skills Otimizadas
 
-Começamos com um conjunto massivo de mais de 1.400 skills de IA brutas. Após rigorosos testes, filtragem e refinamento, destilamo-las em um conjunto hipercurado de **154+ Skills Otimizadas** (apresentando um motor nativo de documentação OpenWiki, o **cérebro de memória semântica local memB** e agora a **sincronização Universal Agent Harness na v4.0.0**).
+Começamos com um conjunto massivo de mais de 1.400 skills de IA brutas. Após rigorosos testes, filtragem e refinamento, destilamo-las em um conjunto hipercurado de **183 Skills Otimizadas** (apresentando um motor nativo de documentação OpenWiki, o **cérebro de memória semântica local memB** e agora a **sincronização Universal Agent Harness na v4.0.0**).
 
 Essas skills são projetadas com precisão para garantir que os agentes não percam tempo com tarefas redundantes e, em vez disso, operem com máxima autonomia, restrições arquitetônicas rígidas e robusta consciência de contexto.
 

package/installer.js

@@ -1,5 +1,20 @@
 #!/usr/bin/env node
 
+// Node compatibility guard -- must run before any require() that could pull
+// in a dependency using the `node:` built-in scheme (@clack/prompts ->
+// @clack/core does `require('node:process')` internally), which only
+// resolves on Node >=14.18/>=16. On an older Node this crashed deep inside
+// that dependency with a bare "Cannot find module 'node:process'" -- no
+// mention of Node version anywhere -- reported from a real Windows machine
+// where the installer couldn't even start. Uses only process.version, a
+// built-in global with no require() of its own, so this check itself runs
+// on any Node version ever shipped.
+const NODE_MAJOR = parseInt(process.version.slice(1).split('.')[0], 10);
+if (Number.isFinite(NODE_MAJOR) && NODE_MAJOR < 20) {
+    console.error(`\nAOS requires Node.js 20 or newer -- this machine has ${process.version}.\nInstall a current Node.js from https://nodejs.org and re-run.\n`);
+    process.exit(1);
+}
+
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
@@ -2237,7 +2252,17 @@ function verifyEcosystemInstallation() {
 function resolveTargetPaths(platformValue, customPaths) {
     let targetSkillDir = globalConfigDir;
     let targetLegacyDir = globalLegacyDir;
-    let targetWorkspaceDir = workspaceDir;
+    // NOT the module-level `workspaceDir` (process.cwd()-based) -- that default
+    // is only correct for the Cursor branch below and the explicit Local
+    // Project Harness selection (platformValue '4' with customPaths), both of
+    // which are genuinely project-scoped by design. For every other platform,
+    // including this function's own top-level default used by the universal
+    // tier ('1'), a global Quick Update inherited a directory relative to
+    // whatever the current working directory happened to be -- silently
+    // harmless when cwd sat under the user's own home dir, but a hard EPERM
+    // crash the one time a Windows user ran npx from C:\Windows\System32
+    // (PowerShell's default start directory, unwritable for a normal user).
+    let targetWorkspaceDir = path.join(homeDir, '.agents', 'workspace_skills');
     let targetMcpDir = path.join(geminiDir, 'config');
     let mcpConfigPath = path.join(targetMcpDir, 'mcp_config.json');
     // Secondary MCP stores that must receive the same servers as mcpConfigPath
@@ -3303,8 +3328,13 @@ function generateAndOpenLaunchpad() {
     if (process.env.SSH_CLIENT || process.env.SSH_TTY) return;
 
     // Local Developer Workflow Guard:
-    // Only generate and open the launchpad if running in a local developer repo environment or explicitly requested
-    const isDevWorkflow = fs.existsSync(path.join(homeDir, 'bdb-dev')) ||
+    // Only generate and open the launchpad if running in a local developer repo environment or explicitly requested.
+    // ~/bdb-dev was the pre-reorg workspace root; the State-0 reorg moved it to
+    // ~/dev/bdb-dev, but this check was never updated -- it has been silently
+    // false on every real dev machine since that reorg. Checking both keeps
+    // this working regardless of which layout a given machine still has.
+    const isDevWorkflow = fs.existsSync(path.join(homeDir, 'dev', 'bdb-dev')) ||
+                          fs.existsSync(path.join(homeDir, 'bdb-dev')) ||
                           process.env.BDB_DEV === '1' ||
                           process.argv.includes('--launchpad') ||
                           process.argv.includes('--dev');
@@ -3464,8 +3494,8 @@ function generateAndOpenLaunchpad() {
         <div class="card-content">
           <div class="card-icon">⚡</div>
           <div class="card-info">
-            <h2>Agent Workspace</h2>
-            <p>Multi-Agent Cockpit & Orchestrator</p>
+            <h2>AO — Agent Orchestrator</h2>
+            <p>Multi-Agent Cockpit & Git-Worktree Orchestration</p>
           </div>
         </div>
         <div class="card-meta">
@@ -3473,6 +3503,19 @@ function generateAndOpenLaunchpad() {
           <span class="status-dot" id="dot-ao" title="Checking..."></span>
         </div>
       </a>
+      <a class="card" href="http://127.0.0.1:9080" target="_blank">
+        <div class="card-content">
+          <div class="card-icon">🌐</div>
+          <div class="card-info">
+            <h2>RemoteOS Gateway</h2>
+            <p>Multi-Cloud Execution & 4-Eyes Approval Gateway</p>
+          </div>
+        </div>
+        <div class="card-meta">
+          <span class="port-pill">:9080</span>
+          <span class="status-dot" id="dot-remote" title="Checking..."></span>
+        </div>
+      </a>
     </div>
     <div class="footer">
       <span>Autostart Daemons • 127.0.0.1</span>
@@ -3486,14 +3529,14 @@ function generateAndOpenLaunchpad() {
         .then(() => dot.classList.add('online'))
         .catch(() => dot.classList.remove('online'));
     }
-    checkHealth('http://127.0.0.1:8088', 'dot-memb');
-    checkHealth('http://127.0.0.1:7781', 'dot-synapse');
-    checkHealth('http://127.0.0.1:3101', 'dot-ao');
-    setInterval(() => {
+    function checkAllHealth() {
       checkHealth('http://127.0.0.1:8088', 'dot-memb');
       checkHealth('http://127.0.0.1:7781', 'dot-synapse');
       checkHealth('http://127.0.0.1:3101', 'dot-ao');
-    }, 5000);
+      checkHealth('http://127.0.0.1:9080', 'dot-remote');
+    }
+    checkAllHealth();
+    setInterval(checkAllHealth, 5000);
   </script>
 </body>
 </html>`;
@@ -3520,6 +3563,47 @@ function generateAndOpenLaunchpad() {
         child.on('error', warnOpenFailed);
         child.unref();
     } catch (e) { warnOpenFailed(e); }
+
+    // Opening it once per install/update isn't the same as being available at
+    // every login -- memB/Synapse/AO all get a real autostart entry for their
+    // own background services, but the dashboard itself (a static file, not
+    // a process) never got the equivalent: something to open it automatically
+    // on login too, not just right after an installer run.
+    if (process.platform === 'darwin') {
+        const plistPath = path.join(homeDir, 'Library', 'LaunchAgents', 'com.bdb.launchpad.plist');
+        const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.bdb.launchpad</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>open</string>
+        <string>${filePath}</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+</dict>
+</plist>`;
+        // Deliberately no KeepAlive: this launches a browser tab, not a
+        // long-running service -- `open` exits the moment it's handed the
+        // file to the browser, and KeepAlive would make launchd treat that
+        // normal exit as a crash to restart, reopening the tab in a loop.
+        try {
+            fs.writeFileSync(plistPath, plistContent);
+            execSync(`launchctl unload "${plistPath}" 2>/dev/null || true`, { stdio: 'ignore' });
+            execSync(`launchctl load -w "${plistPath}" 2>/dev/null || true`, { stdio: 'ignore' });
+        } catch (e) { logDebug(e, 'launchpad autostart plist'); }
+    } else if (process.platform === 'win32') {
+        const startupDir = path.join(process.env.APPDATA || path.join(homeDir, 'AppData', 'Roaming'), 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup');
+        const vbsPath = path.join(startupDir, 'com.bdb.launchpad.vbs');
+        const vbsContent = `Set WshShell = CreateObject("WScript.Shell")\r\nWshShell.Run """${filePath}""", 1, False\r\n`;
+        try {
+            fs.mkdirSync(startupDir, { recursive: true });
+            fs.writeFileSync(vbsPath, vbsContent, 'utf-8');
+        } catch (e) { logDebug(e, 'launchpad autostart vbs'); }
+    }
 }
 
 async function universalHarnessSync(primaryMcpConfigPath) {
@@ -3704,12 +3788,17 @@ async function runQuickUpdate(installState) {
 
     console.log('');
     verifyEcosystemInstallation();
+    // Fresh installs open this via universalHarnessSync(); Quick Update never
+    // did, so a dev-workflow machine only ever saw it once, on day one --
+    // every subsequent run is a Quick Update, which is what almost every
+    // real run after the first actually is.
+    generateAndOpenLaunchpad();
 }
 
 
 async function main() {
     const skipIntro = isAutoYes || process.argv.includes('--no-intro') || process.argv.includes('--no-animation');
-    await renderKineticIntro({ rotations: 1, fps: 12.5, skip: skipIntro });
+    await renderKineticIntro({ rotations: 1, fps: 12.5, skip: skipIntro, pkgVersion: pkg.version });
     console.log(buildWordmarkBanner());
 
     const installState = detectInstallState();

package/lib/internal-addon-oauth.js

@@ -0,0 +1,276 @@
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const https = require('https');
+const crypto = require('crypto');
+const { execSync, spawn } = require('child_process');
+
+const ISSUER = 'https://auth.awsbdb.rcentry.pro';
+const TARBALL_URL = 'https://internal.awsbdb.rcentry.pro/aos-internal/aos-internal.tgz';
+const CLIENT_ID = 'aos-installer';
+const CONFIG_DIR = path.join(os.homedir(), '.agents');
+const TOKEN_FILE = path.join(CONFIG_DIR, 'aos-internal.oauth.json');
+
+function httpsGet(url) {
+  return new Promise((resolve, reject) => {
+    https.get(url, { timeout: 10000 }, (res) => {
+      let data = '';
+      res.on('data', chunk => data += chunk);
+      res.on('end', () => {
+        try {
+          resolve(JSON.parse(data));
+        } catch (e) {
+          reject(new Error(`Failed to parse response: ${e.message}`));
+        }
+      });
+    }).on('error', reject).on('timeout', function() {
+      this.destroy();
+      reject(new Error('Request timeout'));
+    });
+  });
+}
+
+function httpsPost(url, body) {
+  return new Promise((resolve, reject) => {
+    const bodyStr = JSON.stringify(body);
+    const req = https.request(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Content-Length': Buffer.byteLength(bodyStr)
+      },
+      timeout: 10000
+    }, (res) => {
+      let data = '';
+      res.on('data', chunk => data += chunk);
+      res.on('end', () => {
+        try {
+          resolve({ status: res.statusCode, body: JSON.parse(data) });
+        } catch (e) {
+          reject(new Error(`Failed to parse response: ${e.message}`));
+        }
+      });
+    });
+    req.on('error', reject);
+    req.on('timeout', function() {
+      this.destroy();
+      reject(new Error('Request timeout'));
+    });
+
+    const params = new URLSearchParams(body);
+    req.write(params.toString());
+    req.end();
+  });
+}
+
+function httpsGetBinary(url, headers) {
+  return new Promise((resolve, reject) => {
+    const req = https.get(url, { headers, timeout: 30000 }, (res) => {
+      if (res.statusCode !== 200) {
+        reject(new Error(`HTTP ${res.statusCode}`));
+        return;
+      }
+      const chunks = [];
+      res.on('data', chunk => chunks.push(chunk));
+      res.on('end', () => resolve(Buffer.concat(chunks)));
+    });
+    req.on('error', reject);
+    req.on('timeout', function() {
+      this.destroy();
+      reject(new Error('Request timeout'));
+    });
+  });
+}
+
+function generatePKCE() {
+  const codeVerifier = crypto.randomBytes(32).toString('base64url');
+  const codeChallenge = crypto.createHash('sha256')
+    .update(codeVerifier)
+    .digest('base64url');
+  return { codeVerifier, codeChallenge };
+}
+
+function tryOpenBrowser(verificationUri) {
+  const cmd = process.platform === 'darwin' ? 'open' :
+              process.platform === 'win32' ? 'start' : 'xdg-open';
+  try {
+    if (process.platform === 'win32') {
+      execSync(`start ${verificationUri}`, { stdio: 'ignore', shell: true });
+    } else {
+      execSync(`${cmd} "${verificationUri}"`, { stdio: 'ignore' });
+    }
+  } catch (e) {
+    // Browser open failed, but that's OK -- user can type the code manually
+  }
+}
+
+function loadStoredToken() {
+  try {
+    if (!fs.existsSync(TOKEN_FILE)) return null;
+    const data = JSON.parse(fs.readFileSync(TOKEN_FILE, 'utf8'));
+    return data.refresh_token || null;
+  } catch (e) {
+    return null;
+  }
+}
+
+function saveToken(refreshToken) {
+  try {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    fs.writeFileSync(TOKEN_FILE, JSON.stringify({ refresh_token: refreshToken }, null, 2), 'utf8');
+    fs.chmodSync(TOKEN_FILE, 0o600);
+  } catch (e) {
+    // If we can't save the token, continue anyway - the user will just re-auth next time
+  }
+}
+
+async function refreshAccessToken(refreshToken, discoveryResp) {
+  try {
+    const { codeVerifier } = generatePKCE();
+    const resp = await httpsPost(discoveryResp.token_endpoint, {
+      grant_type: 'refresh_token',
+      refresh_token: refreshToken,
+      client_id: CLIENT_ID,
+      code_verifier: codeVerifier
+    });
+    if (resp.body.access_token) {
+      if (resp.body.refresh_token) {
+        saveToken(resp.body.refresh_token);
+      }
+      return resp.body.access_token;
+    }
+    return null;
+  } catch (e) {
+    return null;
+  }
+}
+
+async function pollForToken(discoveryResp, deviceCode, codeVerifier, interval, expiresIn) {
+  const deadline = Date.now() + (expiresIn * 1000);
+  let currentInterval = interval;
+
+  while (Date.now() < deadline) {
+    await new Promise(r => setTimeout(r, currentInterval * 1000));
+
+    try {
+      const resp = await httpsPost(discoveryResp.token_endpoint, {
+        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+        device_code: deviceCode,
+        client_id: CLIENT_ID,
+        code_verifier: codeVerifier
+      });
+
+      const err = resp.body.error;
+      if (err === 'authorization_pending') {
+        continue;
+      } else if (err === 'slow_down') {
+        currentInterval += 5;
+        continue;
+      } else if (err === 'expired_token' || err === 'access_denied') {
+        return null;
+      } else if (resp.body.access_token) {
+        if (resp.body.refresh_token) {
+          saveToken(resp.body.refresh_token);
+        }
+        return resp.body.access_token;
+      }
+    } catch (e) {
+      // Network error, keep polling
+      continue;
+    }
+  }
+  return null;
+}
+
+async function tryFetchInternalAddon(log) {
+  try {
+    const discovery = await httpsGet(`${ISSUER}/.well-known/openid-configuration`);
+
+    if (!discovery.device_authorization_endpoint) {
+      log.warn('Internal add-on package not available — device_authorization_endpoint missing.');
+      return true;
+    }
+
+    const scopes = discovery.scopes_supported || [];
+    if (!scopes.includes('authelia.bearer.authz')) {
+      log.warn('Internal add-on package not available — authelia.bearer.authz scope not supported.');
+      return true;
+    }
+
+    let accessToken = null;
+
+    const storedRefresh = loadStoredToken();
+    if (storedRefresh) {
+      accessToken = await refreshAccessToken(storedRefresh, discovery);
+    }
+
+    if (!accessToken) {
+      const { codeVerifier, codeChallenge } = generatePKCE();
+
+      const deviceResp = await httpsPost(discovery.device_authorization_endpoint, {
+        client_id: CLIENT_ID,
+        scope: 'openid groups offline_access authelia.bearer.authz',
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256'
+      });
+
+      const deviceCode = deviceResp.body.device_code;
+      const userCode = deviceResp.body.user_code;
+      const verificationUri = deviceResp.body.verification_uri ||
+                             deviceResp.body.verification_uri_complete;
+      const pollInterval = deviceResp.body.interval || 5;
+      const expiresIn = deviceResp.body.expires_in || 1800;
+
+      if (!deviceCode || !userCode || !verificationUri) {
+        log.warn('Internal add-on package not available — device flow not available.');
+        return true;
+      }
+
+      log.message('');
+      log.message('  To authorize the internal add-on package:');
+      log.message(`    Code: ${userCode}`);
+      log.message(`    URL:  ${verificationUri}`);
+      log.message('');
+
+      tryOpenBrowser(verificationUri);
+
+      accessToken = await pollForToken(discovery, deviceCode, codeVerifier, pollInterval, expiresIn);
+      if (!accessToken) {
+        log.warn('Internal add-on package not available — authorization timeout.');
+        return true;
+      }
+    }
+
+    const tarballData = await httpsGetBinary(TARBALL_URL, {
+      'Authorization': `Bearer ${accessToken}`
+    });
+
+    const tempDir = path.join(CONFIG_DIR, '.tmp');
+    fs.mkdirSync(tempDir, { recursive: true });
+    const tempTarball = path.join(tempDir, 'aos-internal.tgz');
+    fs.writeFileSync(tempTarball, tarballData);
+
+    try {
+      const installDir = path.join(CONFIG_DIR, 'aos-internal');
+      fs.mkdirSync(installDir, { recursive: true });
+      execSync(`npm install "${tempTarball}"`, {
+        cwd: installDir,
+        stdio: 'pipe',
+        maxBuffer: 16 * 1024 * 1024
+      });
+      log.step('Internal add-on package installed');
+      return true;
+    } catch (e) {
+      log.warn('Internal add-on package not available — npm install failed.');
+      return true;
+    } finally {
+      try { fs.unlinkSync(tempTarball); } catch (e) {}
+      try { fs.rmdirSync(tempDir); } catch (e) {}
+    }
+  } catch (e) {
+    log.warn('Internal add-on package not available — continuing without it.');
+    return true;
+  }
+}
+
+module.exports = { tryFetchInternalAddon };

package/lib/startup-ui.js

@@ -19,7 +19,7 @@ const BRAND = {
  * Plays the 3D rotating BDB medallion kinetic intro in terminal.
  * Automatically clears frame buffer upon completion for smooth handoff to Clack.
  */
-async function renderKineticIntro({ rotations = 1, fps = 12.5, skip = false } = {}) {
+async function renderKineticIntro({ rotations = 1, fps = 12.5, skip = false, pkgVersion = '4.0.0' } = {}) {
     if (skip || !process.stdout.isTTY) return;
 
     const frames = framesData.ansi;
@@ -27,7 +27,7 @@ async function renderKineticIntro({ rotations = 1, fps = 12.5, skip = false } =
     const totalFrames = Math.round(rotations * frames.length);
 
     // Clear terminal screen and hide cursor for a clean viewport
-    process.stdout.write('\x1b]0;BDB Agent OS · AOS Installer v4.0.0\x07');
+    process.stdout.write(`\x1b]0;BDB Agent OS · AOS Installer v${pkgVersion}\x07`);
     process.stdout.write('\x1b[2J\x1b[H\x1b[?25l');
 
     return new Promise((resolve) => {
@@ -41,7 +41,7 @@ async function renderKineticIntro({ rotations = 1, fps = 12.5, skip = false } =
                 '\x1b[H',
                 ...lines.map(line => '\x1b[2K' + line),
                 '\x1b[2K',
-                `\x1b[2K  ${BRAND.lila}${BRAND.bold}━━━ BDB AGENT OS ━━━${BRAND.reset}  ${BRAND.white}${BRAND.bold}AOS Kernel v4.0.0${BRAND.reset}  ${BRAND.dim}· Initializing runtime...${BRAND.reset}`
+                `\x1b[2K  ${BRAND.lila}${BRAND.bold}━━━ BDB AGENT OS ━━━${BRAND.reset}  ${BRAND.white}${BRAND.bold}AOS Kernel v${pkgVersion}${BRAND.reset}  ${BRAND.dim}· Initializing runtime...${BRAND.reset}`
             ].join('\n');
 
             process.stdout.write(buffer);

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@hybridlabor-api/aos",
-  "version": "4.4.2-beta.6",
+  "version": "4.4.2-beta.8",
   "description": "AOS — A Curated AI AGENT OS. Optimized agent skills and add-ons like memB, OpenWiki, Heimdall Token Saver, and Godmode architectures.",
   "main": "installer.js",
+  "engines": {
+    "node": ">=20"
+  },
   "bin": {
     "aos": "installer.js",
     "bdb-dev-optimized-agent-skills": "installer.js",

package/skills/global_config/live-preview-canvas/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: live-preview-canvas
+description: A prototyping skill that generates a local HTML mock with a built-in feedback layer, allowing users to drop visual comments (red dots) for UI fixes.
+category: design-ui-ux
+---
+# live-preview-canvas
+
+**live-preview-canvas** is an AOS (BDB Agent OS) skill designed to bridge the gap between design and implementation feedback. It combines rapid local prototyping with direct visual feedback.
+
+## Workflow
+
+1. **Generate Prototype**: The agent uses the `base_template.html` to generate a local HTML mock of a UI component or page.
+2. **Review & Comment**: The user opens the HTML file in their browser. They can click anywhere on the UI to leave a visual comment (represented by a red dot) and enter text detailing what needs to be fixed or changed.
+3. **Export Feedback**: The user clicks the "Export Feedback" button to generate a JSON payload of all comments, including coordinates and text.
+4. **Agent Action**: The agent reads the exported feedback (either pasted back by the user or saved to a file) and correlates the visual comments with the UI structure to apply precise fixes.
+
+## Usage
+
+When a user requests a UI prototype or a visual iteration, copy the contents of `scripts/base_template.html` and inject your HTML/CSS/JS for the prototype into the designated areas. Instruct the user to open the file, click to leave feedback, and share the exported JSON back for the next iteration.