@lazyingart/agintiflow 0.20.46 → 0.20.48

package/docs/housekeeping.md

@@ -0,0 +1,39 @@
+# AgInTiFlow Housekeeping
+
+AgInTiFlow keeps full private session history in `~/.agintiflow/sessions/<session-id>/`.
+That history can include user prompts, model text, tool arguments, file diffs, and artifacts, so it is local-only and should not be committed.
+
+Housekeeping is a lighter background layer for reusable learning:
+
+- It listens to session events without blocking the main agent loop.
+- It writes sanitized cross-session records to `~/.agintiflow/housekeeping/events.jsonl`.
+- It maintains aggregate model, tool, and skill usage in `~/.agintiflow/housekeeping/capabilities.json`.
+- It redacts common token/key/password patterns and replaces local project/home paths with placeholders.
+- It stores previews, hashes, counts, model/tool names, selected skill ids, and touched skill files rather than a full second transcript.
+
+Use:
+
+```bash
+aginti housekeeping
+aginti housekeeping --json
+```
+
+Disable local housekeeping for a run:
+
+```bash
+AGINTIFLOW_HOUSEKEEPING=0 aginti
+```
+
+Project session pointers live in `.aginti-sessions/`, and old `.sessions/` folders may still exist after migration.
+AgInTiFlow adds both to `.gitignore` during `aginti init` and when session storage is prepared, because these folders can contain private local metadata.
+
+## Sharing Without A Center Server
+
+Without a central server, the safe sharing path is:
+
+1. Keep raw sessions and artifacts local.
+2. Aggregate local learning into sanitized housekeeping capability data.
+3. Promote reviewed reusable knowledge into Markdown skills, task profiles, command policy, or docs.
+4. Ship those reviewed files through the npm package.
+
+This avoids uploading private transcripts while still letting users receive better skills and tools when they upgrade `@lazyingart/agintiflow`.

package/docs/skillmesh.md

@@ -0,0 +1,115 @@
+# Skill Mesh
+
+Skill Mesh lets AgInTiFlow exchange reusable skills without sharing raw sessions, project code, `.env` files, browser state, artifacts, or provider keys.
+
+The first implementation is intentionally conservative:
+
+- Skills are shared as signed JSON skill packs.
+- Each pack is validated for required `SKILL.md` frontmatter, safe paths, size limits, secret-like text, and privacy metadata.
+- Shared packs cannot override built-in skills.
+- Community skills are installed disabled by default.
+- Sync is explicit and metadata-first; there is no realtime polling loop.
+- Relay nodes run without model/API keys.
+
+## Modes
+
+```bash
+aginti skillmesh status
+aginti skillmesh share
+aginti skillmesh record
+aginti skillmesh off
+```
+
+Interactive CLI:
+
+```text
+/skillmesh
+```
+
+The selector has three modes:
+
+- `share`: record locally and allow reviewed skill-pack sharing.
+- `record`: record local sanitized learning metadata only.
+- `off`: disable Skill Mesh loading and sync.
+
+## Pack Commands
+
+Export a reviewed local skill:
+
+```bash
+aginti skillmesh export <skill-id>
+```
+
+Import a reviewed pack:
+
+```bash
+aginti skillmesh import ./example.skillpack.json
+aginti skillmesh enable <skill-id>
+```
+
+Submit a reviewed pack to a relay:
+
+```bash
+aginti skillmesh submit ./example.skillpack.json --node https://skills.flow.lazying.art
+```
+
+Sync metadata and optionally download packs:
+
+```bash
+aginti skillmesh sync
+aginti skillmesh sync --node http://127.0.0.1:7377 --install
+```
+
+Downloaded community packs are still disabled until explicitly enabled.
+
+## Relay Node
+
+Run a Skill Mesh relay:
+
+```bash
+aginti skillmesh serve \
+  --role major \
+  --host 127.0.0.1 \
+  --port 7377 \
+  --data ~/.aginti-skill-relay \
+  --public-url https://skills.flow.lazying.art
+```
+
+Endpoints:
+
+- `GET /health`
+- `GET /feed.json`
+- `POST /sync/metadata`
+- `POST /submit`
+- `GET /packs/<hash>.json`
+- `GET /packs/<hash>/metadata.json`
+
+The relay stores only validated skill packs and metadata in its data directory. It rejects raw sessions, unsafe paths, secret-like text, unsupported schemas, overlarge packs, unsigned packs, and packs that do not declare the strict privacy contract.
+
+## Storage
+
+Local client storage:
+
+```text
+~/.agintiflow/skillmesh/
+  config.json
+  identity.json
+  index.sqlite
+  skills/
+  packs/
+  inbox/
+  outbox/
+  reviewed/
+  feeds/
+```
+
+Relay storage:
+
+```text
+~/.aginti-skill-relay/
+  index.sqlite
+  packs/
+  logs/
+```
+
+`identity.json` contains the local Ed25519 signing key and should remain private.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.46",
+  "version": "0.20.48",
   "type": "module",
   "description": "AgInTiFlow is a web-first coding agent and CLI with DeepSeek routing, sandboxed tools, model providers, canvas artifacts, and optional wrappers.",
   "license": "Apache-2.0",
@@ -58,6 +58,7 @@
     "scripts/smoke-model-roles.js",
     "scripts/smoke-platform.js",
     "scripts/smoke-skills.js",
+    "scripts/smoke-skillmesh.js",
     "scripts/smoke-tmux-tools.js",
     "scripts/smoke-toolchain-docker.js",
     "scripts/smoke-web-api.js",
@@ -81,6 +82,7 @@
     "smoke:canvas-artifacts": "node scripts/smoke-canvas-artifacts.js",
     "smoke:cli-chat": "node scripts/smoke-cli-chat.js",
     "smoke:skills": "node scripts/smoke-skills.js",
+    "smoke:skillmesh": "node scripts/smoke-skillmesh.js",
     "smoke:toolchain-docker": "node scripts/smoke-toolchain-docker.js",
     "smoke:inbox": "node scripts/smoke-inbox.js",
     "smoke:model-roles": "node scripts/smoke-model-roles.js",
@@ -91,7 +93,7 @@
     "real:deepseek": "node scripts/real-deepseek-capabilities.js",
     "supervision:seed": "node scripts/seed-supervised-homework.js",
     "storage:migrate": "node bin/aginti-cli.js storage migrate",
-    "test": "npm run check && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:coding-tools && npm run smoke:auxiliary-tools && npm run smoke:auth && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:model-roles && npm run smoke:platform && npm run smoke:skills && npm run smoke:tmux-tools && npm run smoke:cli-chat && npm run smoke:inbox",
+    "test": "npm run check && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:coding-tools && npm run smoke:auxiliary-tools && npm run smoke:auth && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:model-roles && npm run smoke:platform && npm run smoke:skills && npm run smoke:skillmesh && npm run smoke:tmux-tools && npm run smoke:cli-chat && npm run smoke:inbox",
     "pack:dry-run": "npm pack --dry-run",
     "smoke:capabilities": "node scripts/smoke-capabilities.js"
   },