@neuralis/brain-core 0.2.0 → 0.3.0

package/skills/git/scripts/git.sh

@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-# Generic caller for the brain-core git routes — ONE helper for all 19 endpoints
-# (9 GET + 10 POST, spread over 17 route names: `commit` and `branch` carry both verbs).
-# NOTE the shape: the HTTP VERB is a positional ARGUMENT, not a property of this file.
-# Anything auditing "which examples mutate" must read the verb off the INVOCATION line
-# (`git.sh POST commit …`), never off this script — 10 of the 19 endpoints are POST writes,
-# and `commit`/`branch` READ on GET while WRITING on POST.
-#   GET:  git.sh GET  <route> [key=value ...]     # each pair is URL-encoded
-#   POST: git.sh POST <route> '<json-body>'       # body carries "source" + params
-# Auth is the per-stream session ticket (NEURALIS_SESSION_TOKEN), injected by the
-# skill activation — never a platform/admin token, never a git credential (the
-# route resolves the remote token server-side for fetch/pull/push).
-# `--fail-with-body` (NOT `-f`): the routes' error bodies still reach you on
-# 400/403/404/409 — `-f` would leave a bare `curl: (22)` — and a refused call
-# now exits NON-ZERO as well, so a rejected commit/push can no longer read as a
-# success. Failure shapes, measured 2026-09-01 against `src/routes/git.ts` —
-# EVERY refusal carries `error`, and:
-#   · a write-op failure (400/409/500) and the three remote 409s
-#     (`no_https_remote` / `not_connected` / `no_credential`) also carry
-#     `ok:false` AND `code`;
-#   · a 403 carries `code` (`feature_denied` / `uri_policy_denied`), no `ok`;
-#   · a plain argument or lookup 400/404 carries `error` only.
-# Separately, a **200** may still carry `ok:false`: `unavailable` from
-# `commit`/`outgoing`/`show`, `too_large` from `diff`. So use THIS script's exit
-# code as the discriminator — non-zero = an HTTP refusal (read `.error`, then
-# `.code` when present); zero + `ok:false` = a soft 200.
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-METHOD="${1:?usage: git.sh <GET|POST> <route> [key=value ... | json-body]}"
-ROUTE="${2:?usage: git.sh <GET|POST> <route> [key=value ... | json-body]}"
-shift 2
-URL="${API_BASE}/api/packages/@neuralis/brain-core/git/${ROUTE}"
-AUTH=(-H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: git")
-if [ "${METHOD}" = "GET" ]; then
-  ENC=()
-  for kv in "$@"; do ENC+=(--data-urlencode "${kv}"); done
-  curl --fail-with-body -sS -G "${AUTH[@]}" "${ENC[@]}" "${URL}"
-else
-  # `${1:-{}}` does NOT work here: bash closes the expansion at the FIRST `}`, so
-  # the default becomes `{` and the trailing `}` is appended as a LITERAL — every
-  # POST body went on the wire as `{…}}`, invalid JSON, for all 10 POST routes.
-  # `--data-raw` (not `-d`): `-d` treats a leading `@` as a FILE reference.
-  BODY="${1:-}"
-  [ -z "${BODY}" ] && BODY='{}'
-  curl --fail-with-body -sS -X "${METHOD}" "${AUTH[@]}" \
-    -H "Content-Type: application/json" --data-raw "${BODY}" "${URL}"
-fi

package/skills/manage-files/scripts/approve.sh

@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-BODY_JSON="${BODY_JSON:?BODY_JSON is required (see /approve route schema)}"
-curl --fail-with-body -sS -X POST \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-files" \
-  -H "Content-Type: application/json" -d "${BODY_JSON}" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/approve"

package/skills/manage-files/scripts/list.sh

@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-BODY_JSON="${BODY_JSON:?BODY_JSON is required (see /list route schema)}"
-curl --fail-with-body -sS -X POST \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-files" \
-  -H "Content-Type: application/json" -d "${BODY_JSON}" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/list"

package/skills/manage-files/scripts/pending.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-# GET /pending — the project-wide list of revertible pending changes behind the
-# Files widget "Changes" tab (gate: drive.read; per-record owner + uri-policy
-# floor is enforced server-side). Optional filters via env: STATUS
-# (pending_review|approved|reverted), SOURCE, OP (create|modify|delete|move), LIMIT.
-if [[ -n "${BODY_JSON:-}" ]]; then
-  curl --fail-with-body -sS -X POST \
-    -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-files" \
-    -H 'Content-Type: application/json' -d "${BODY_JSON}" \
-    "${API_BASE}/api/packages/@neuralis/brain-core/pending"
-  exit
-fi
-args=(-G)
-[ -n "${STATUS:-}" ] && args+=(--data-urlencode "status=${STATUS}")
-[ -n "${SOURCE:-}" ] && args+=(--data-urlencode "source=${SOURCE}")
-[ -n "${OP:-}" ] && args+=(--data-urlencode "op=${OP}")
-[ -n "${LIMIT:-}" ] && args+=(--data-urlencode "limit=${LIMIT}")
-curl --fail-with-body -sS "${args[@]}" \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-files" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/pending"

package/skills/manage-files/scripts/raw.sh

@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-# GET /raw returns the un-summarized bytes for a single URI. agentId is taken
-# from the session ticket; pass the file URI via URI=…
-URI="${URI:?URI is required (e.g. brain://docs/screen.png)}"
-curl --fail-with-body -sS -G \
-  --data-urlencode "uri=${URI}" \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-files" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/raw"

package/skills/manage-files/scripts/read.sh

@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-BODY_JSON="${BODY_JSON:?BODY_JSON is required (see /read route schema)}"
-curl --fail-with-body -sS -X POST \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-files" \
-  -H "Content-Type: application/json" -d "${BODY_JSON}" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/read"

package/skills/manage-files/scripts/search.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-# The /search route body uses: search_mode (semantic|filter|grep), query, folder_uri,
-# glob, category, tags, status, created_after/before, limit — the SAME vocabulary as
-# the fs_search tool (the legacy `mode` key is rejected with 400).
-# grep mode greps the LIVE connector (ripgrep/git-grep) and is uri-policy
-# read-gated (a non-brain folder_uri the caller cannot read → 403). Requires the
-# `drive.search` feature (distinct from drive.write) — a 403 is returned otherwise.
-BODY_JSON="${BODY_JSON:?BODY_JSON is required (see /search route schema)}"
-curl --fail-with-body -sS -X POST \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-files" \
-  -H "Content-Type: application/json" -d "${BODY_JSON}" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/search"

package/skills/manage-sources/scripts/browse.sh

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-PATH_ARG="${PATH_ARG:?PATH_ARG is required (filesystem path to browse)}"
-ENCODED=$(printf '%s' "${PATH_ARG}" | jq -sRr @uri)
-# `--fail-with-body`, not `-f`: this route answers 403 with the NAME of the
-# feature you are missing (`drive.mount`, or `drive.mount.privileged` for the
-# filesystem root and the protected host zones). Plain `-f` discards the body,
-# so the agent would see an empty output and exit 22 with no idea why.
-curl --fail-with-body -sS -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/browse?path=${ENCODED}"

package/skills/manage-sources/scripts/cancel.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-# Requires drive.sync (403 otherwise).
-# Optional SOURCE: cancels that source's active job; omitted = cancel every
-# job on sources visible to the caller.
-SOURCE="${SOURCE:-}"
-BODY=$(jq -n --arg source "${SOURCE}" \
-  'if $source == "" then {} else { source: $source } end')
-curl --fail-with-body -sS -X POST \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  -H "Content-Type: application/json" -d "${BODY}" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/cancel"

package/skills/manage-sources/scripts/create.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-# Requires drive.mount (403 otherwise). BODY_JSON MUST carry `source`,
-# `connection.kind`, and `permissions.default.{read,write,exec}` (all booleans);
-# optional `scope` / `sync` / `description` / `agentId`. Create also enforces
-# the kind's scope rules and canAccessScope(..,'write').
-BODY_JSON="${BODY_JSON:?BODY_JSON is required (source + connection.kind + permissions)}"
-curl --fail-with-body -sS -X POST \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  -H "Content-Type: application/json" -d "${BODY_JSON}" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources"

package/skills/manage-sources/scripts/delete.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-# Requires drive.mount (403 otherwise). SLUG is a REAL path segment here
-# (matched against each config's sanitized source name). Optional PURGE=1
-# enqueues an async vector purge: response is 200 normally, 202 + {purgeJob,…}
-# when a purge job was queued.
-SLUG="${SLUG:?SLUG is required}"
-PURGE="${PURGE:-false}"
-QS=""
-if [[ "${PURGE}" == "true" || "${PURGE}" == "1" ]]; then
-  QS="?purge=1"
-fi
-curl --fail-with-body -sS -X DELETE \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/${SLUG}${QS}"

package/skills/manage-sources/scripts/discoverable.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-curl --fail-with-body -sS -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/discoverable"

package/skills/manage-sources/scripts/get.sh

@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-SLUG="${SLUG:?SLUG is required}"
-curl --fail-with-body -sS -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/${SLUG}"

package/skills/manage-sources/scripts/kind-schema.sh

@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-KIND="${KIND:?KIND is required}"
-curl --fail-with-body -sS -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/kinds/${KIND}/schema"

package/skills/manage-sources/scripts/kinds.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-curl --fail-with-body -sS -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/kinds"

package/skills/manage-sources/scripts/list.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-curl --fail-with-body -sS -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources"

package/skills/manage-sources/scripts/purge-index.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-SOURCE="${SOURCE:?SOURCE is required}"
-FOLDER="${FOLDER:-}"
-URI="${URI:-}"
-OBSOLETE_ONLY="${OBSOLETE_ONLY:-true}"
-CONFIRM="${CONFIRM:-}"
-case "${OBSOLETE_ONLY}" in true|false) ;; *) echo 'OBSOLETE_ONLY must be true or false' >&2; exit 2 ;; esac
-if [[ -n "${FOLDER}" && -n "${URI}" ]]; then echo 'Give FOLDER or URI, not both' >&2; exit 2; fi
-BODY=$(jq -n --arg source "${SOURCE}" --arg folder "${FOLDER}" --arg uri "${URI}" --arg confirm "${CONFIRM}" --argjson obsoleteOnly "${OBSOLETE_ONLY}" \
-  '{source:$source, obsoleteOnly:$obsoleteOnly, mode:(if $confirm=="1" then "apply" else "estimate" end),
-    selector:(if $uri!="" then {kind:"file",uri:$uri} elif $folder!="" then {kind:"folder",uri:$folder} else {kind:"source"} end)}')
-curl --fail-with-body -sS -X POST \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  -H 'Content-Type: application/json' -d "${BODY}" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/purge"

package/skills/manage-sources/scripts/reindex.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-# Requires drive.sync (403 otherwise).
-SOURCE="${SOURCE:?SOURCE is required}"
-AGENT_ID="${AGENT_ID:-}"
-BODY=$(jq -n --arg source "${SOURCE}" --arg agentId "${AGENT_ID}" \
-  '{ source: $source } + (if $agentId == "" then {} else { agentId: $agentId } end)')
-curl --fail-with-body -sS -X POST \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  -H "Content-Type: application/json" -d "${BODY}" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/reindex"

package/skills/manage-sources/scripts/reset.sh

@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-# Requires drive.sync (403 otherwise) — reset also cancels the source's active job.
-SOURCE="${SOURCE:?SOURCE is required}"
-BODY=$(jq -n --arg source "${SOURCE}" '{ source: $source }')
-curl --fail-with-body -sS -X POST \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  -H "Content-Type: application/json" -d "${BODY}" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/reset"

package/skills/manage-sources/scripts/set-enabled.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-# Requires drive.mount (403 otherwise).
-SOURCE="${SOURCE:?SOURCE is required}"
-ENABLED="${ENABLED:?ENABLED is required (true | false | auto)}"
-if [[ "${ENABLED}" == "auto" ]]; then
-  BODY=$(jq -n --arg source "${SOURCE}" '{ source: $source, enabled: "auto" }')
-else
-  BODY=$(jq -n --arg source "${SOURCE}" --argjson enabled "${ENABLED}" \
-    '{ source: $source, enabled: $enabled }')
-fi
-curl --fail-with-body -sS -X POST \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  -H "Content-Type: application/json" -d "${BODY}" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/enabled"

package/skills/manage-sources/scripts/sync-status.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-# Requires drive.sync (403 otherwise).
-# Optional SOURCE: one source's job snapshot; omitted = every visible job.
-SOURCE="${SOURCE:-}"
-QS=""
-if [ -n "${SOURCE}" ]; then
-  QS="?source=$(jq -rn --arg s "${SOURCE}" '$s|@uri')"
-fi
-curl --fail-with-body -sS \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/sync-status${QS}"

package/skills/manage-sources/scripts/sync.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-# Requires drive.sync (403 otherwise).
-SOURCE="${SOURCE:?SOURCE is required}"
-AGENT_ID="${AGENT_ID:-}"
-BODY=$(jq -n --arg source "${SOURCE}" --arg agentId "${AGENT_ID}" \
-  '{ source: $source } + (if $agentId == "" then {} else { agentId: $agentId } end)')
-curl --fail-with-body -sS -X POST \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  -H "Content-Type: application/json" -d "${BODY}" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources/sync"

package/skills/manage-sources/scripts/update.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-# PATCH /sources (NO :slug segment): the handler reads the target from the body
-# `source` field, not the path. BODY_JSON MUST carry `source` +
-# `permissions.default.{read,write,exec}` (both required); optional
-# `description` / `sync` / `clearSync` / `enabled`. Requires drive.mount (403 otherwise).
-# DESTRUCTIVE SHAPE: the handler REPLACES `permissions` wholesale — it never merges.
-# A body carrying only `permissions.default` returns 200 and drops every `paths[]`
-# rule on the source (immutable `floor:true` rules are the sole protected class and
-# 409 instead). Build BODY_JSON from the source's current config (see SKILL.md),
-# never by hand.
-BODY_JSON="${BODY_JSON:?BODY_JSON is required (must include source + permissions)}"
-curl --fail-with-body -sS -X PATCH \
-  -H "Authorization: Bearer ${TOKEN}" -H "X-Neuralis-Skill: manage-sources" \
-  -H "Content-Type: application/json" -d "${BODY_JSON}" \
-  "${API_BASE}/api/packages/@neuralis/brain-core/sources"

package/skills/manage-uri-policy/scripts/manifests.sh

@@ -1,20 +0,0 @@
-#!/usr/bin/env bash
-# manage-uri-policy/manifests.sh — return every loaded package's resolved uriPolicies baseline.
-#
-# Env (projected by `execute action="shell"`):
-#   NEURALIS_API           required
-#   NEURALIS_SESSION_TOKEN   auto-injected per skill activation (real caller identity)
-#
-# Output: JSON `{ packages: { "<pkg-id>": { ...uriPolicies... } } }`.
-
-set -euo pipefail
-
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-
-ROUTE="${API_BASE}/api/packages/@neuralis/brain-core/policies/uri/manifests"
-
-curl --fail-with-body -sS \
-  -H "Authorization: Bearer ${TOKEN}" \
-  -H "X-Neuralis-Skill: manage-uri-policy" \
-  "${ROUTE}"

package/skills/manage-uri-policy/scripts/set-uri.sh

@@ -1,66 +0,0 @@
-#!/usr/bin/env bash
-# manage-uri-policy/set-uri.sh — add or remove a path-rule on a source's URI policy.
-#
-# Env (projected by `execute action="shell"`):
-#   NEURALIS_API           required
-#   NEURALIS_SESSION_TOKEN   auto-injected per skill activation (real caller identity)
-#   SOURCE                 required — source slug
-#   OPERATION              optional — "addRule" (default) | "removeRule"
-#   PATTERN                required — URI pattern with ** wildcards
-#   DENY                   optional — comma-list of capabilities to deny (read,write,exec)
-#   ALLOW                  optional — comma-list of capabilities to allow
-#   ROLES                  optional — comma-list of roles the rule applies to
-
-set -euo pipefail
-
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-SOURCE="${SOURCE:?SOURCE is required (source slug, e.g. data)}"
-PATTERN="${PATTERN:?PATTERN is required (URI pattern with ** wildcards)}"
-OPERATION="${OPERATION:-addRule}"
-
-ROUTE="${API_BASE}/api/packages/@neuralis/brain-core/policies/uri"
-
-case "${OPERATION}" in
-  addRule)
-    PERMS_JSON='{}'
-    if [[ -n "${DENY:-}" ]]; then
-      for cap in ${DENY//,/ }; do
-        PERMS_JSON=$(echo "${PERMS_JSON}" | jq --arg cap "${cap}" '. + { ($cap): false }')
-      done
-    fi
-    if [[ -n "${ALLOW:-}" ]]; then
-      for cap in ${ALLOW//,/ }; do
-        PERMS_JSON=$(echo "${PERMS_JSON}" | jq --arg cap "${cap}" '. + { ($cap): true }')
-      done
-    fi
-    ROLES_JSON='null'
-    if [[ -n "${ROLES:-}" ]]; then
-      ROLES_JSON=$(echo "${ROLES}" | jq -R 'split(",")')
-    fi
-    BODY=$(jq -n \
-      --arg source "${SOURCE}" \
-      --arg pattern "${PATTERN}" \
-      --argjson perms "${PERMS_JSON}" \
-      --argjson roles "${ROLES_JSON}" \
-      '{ source: $source, addPaths: [ { pattern: $pattern, permissions: $perms } + (if $roles == null then {} else { roles: $roles } end) ] }')
-    ;;
-  removeRule)
-    BODY=$(jq -n \
-      --arg source "${SOURCE}" \
-      --arg pattern "${PATTERN}" \
-      '{ source: $source, removePatterns: [$pattern] }')
-    ;;
-  *)
-    echo "manage-uri-policy: unknown OPERATION '${OPERATION}' (expected: addRule | removeRule)" >&2
-    exit 64
-    ;;
-esac
-
-curl --fail-with-body -sS \
-  -X POST \
-  -H "Authorization: Bearer ${TOKEN}" \
-  -H "X-Neuralis-Skill: manage-uri-policy" \
-  -H "Content-Type: application/json" \
-  -d "${BODY}" \
-  "${ROUTE}"

package/skills/manage-uri-policy/scripts/show-uri.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-# manage-uri-policy/show-uri.sh — return effective merged URI policy for a source.
-#
-# Env (projected by `execute action="shell"`):
-#   NEURALIS_API           required — host's internal API base URL
-#   NEURALIS_SESSION_TOKEN   auto-injected per skill activation (real caller identity)
-#   SOURCE                 required — source slug (e.g. "data", "packages")
-#
-# Exits non-zero on any HTTP failure AND prints the route's own error body
-# (`--fail-with-body`, not `-f`: `-f` would discard the `{code,error}` you branch on).
-
-set -euo pipefail
-
-API_BASE="${NEURALIS_API:?NEURALIS_API not set; activate skill first}"
-TOKEN="${NEURALIS_SESSION_TOKEN:?missing session ticket; activate the skill via execute action=\"skill\"}"
-SOURCE="${SOURCE:?SOURCE is required (source slug, e.g. data)}"
-
-ROUTE="${API_BASE}/api/packages/@neuralis/brain-core/policies/uri/${SOURCE}"
-
-curl --fail-with-body -sS \
-  -H "Authorization: Bearer ${TOKEN}" \
-  -H "X-Neuralis-Skill: manage-uri-policy" \
-  "${ROUTE}"