@olares/lares-core 0.15.6 → 0.15.9

package/media/tool.js

@@ -0,0 +1,92 @@
+import { producedEditCard } from "../drive/execute.js";
+import { workspaceRootFromSession } from "../workspace/env.js";
+import { MEDIA_GENERATION_TIMEOUT_MS, runMediaGeneration } from "./generation.js";
+
+export const MEDIA_GENERATE_TOOL = "media_generate";
+
+export const MEDIA_GENERATE_PROMPT = [
+  "Generate or edit images, video, music, and 3D with media_generate, not with curl and a sleep loop.",
+  "Name the catalog row by model. Pass the user's prompt unchanged, images as reference_images",
+  "(workspace paths) for an edit or I2V / R2V, an optional mask_image, and params for the row's",
+  "tunables, keyed by flowstudio.parameters[].key. The tool reads the row and takes the route,",
+  "the operation, and where each file goes. A supplied image on an image_generation row is an edit.",
+  "It submits as the logged-in user, waits, and publishes every output itself: do not",
+  "workspace_publish or download its files again. If a turn ended before a generation",
+  "finished, resume it with generation_id instead of generating it again.",
+].join(" ");
+
+/** @param deps - seams for tests: fetch, sleep, env, cat. */
+export function mediaGenerateDefinition(deps = {}) {
+  return {
+    name: MEDIA_GENERATE_TOOL,
+    description:
+      "Create one image, video, music, or 3D generation through Router and wait until it finishes."
+      + " Every output is published for preview when the call returns. For image-to-video or an"
+      + " image edit, pass the user's image as reference_images. Pass generation_id alone to wait"
+      + " for a generation an earlier turn started.",
+    parameters: {
+      model: {
+        type: "string",
+        description:
+          "<provider>/<model> exactly as the catalog row lists it. The row decides everything else"
+          + " about the call. Required unless generation_id is set.",
+      },
+      prompt: {
+        type: "string",
+        description: "The user's prompt, unchanged.",
+      },
+      reference_images: {
+        type: "array",
+        items: { type: "string" },
+        description:
+          "Workspace image paths for an edit or I2V / R2V. The tool places them on the row.",
+      },
+      mask_image: {
+        type: "string",
+        description: "Optional workspace mask image.",
+      },
+      params: {
+        type: "object",
+        additionalProperties: true,
+        description:
+          "Tunables keyed by the row's flowstudio.parameters[].key. The tool sends them as"
+          + " flowstudio.params. Match the user's words to each entry's label; for a select send"
+          + " the option's value. A row without flowstudio.parameters takes no params.",
+      },
+      generation_id: {
+        type: "string",
+        description: "Resume waiting for this generation instead of starting a new one.",
+      },
+    },
+    output: {
+      schema: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          id: { type: "string", required: true },
+          status: { type: "string", required: true },
+          files: { type: "array", items: { type: "string" }, required: true },
+        },
+      },
+      render: (_args, value) => [{
+        type: "text",
+        text: `Generation ${value.id} ${value.status}; published ${value.files.join(", ") || "no files"}.`,
+      }],
+    },
+    timeoutMs: MEDIA_GENERATION_TIMEOUT_MS,
+    execute: (args, exec) => runMediaGeneration(args, {
+      session: exec?.agent?.session,
+      callId: exec?.callId,
+      workspaceRoot: workspaceRootFromSession(exec, deps.env),
+      signal: exec?.signal,
+    }, deps),
+    presentCall: presentMediaGenerate,
+  };
+}
+
+export function presentMediaGenerate(args) {
+  const target = String(args?.generation_id ?? "").trim()
+    ? `generation ${args.generation_id}`
+    : `media with ${String(args?.model ?? "")}`;
+  return producedEditCard(`Generate ${target}`.slice(0, 160));
+}

package/olares/entrance.js

@@ -1,10 +1,9 @@
 /**
  * Olares 入口域推导（client 侧共享源码，由各插件 client 构建时内联）。
  *
- * Olares 给每个应用入口分配 `<前缀>.<用户>.<zone>`：Lares 的前缀随安装随机，
- * Router chart 固定申领第三级域名 `router`，两者共用同一 zone
- * （公网 olares.com 与局域网 olares.local 各一套）。因此把当前页面域名的
- * 首段换成 `router` 即 Router 控制台。
+ * Olares 给每个应用入口分配 `<第三级域名>.<用户域>`。用户域由 Olares ID 决定
+ * （olares.com、大陆的 olares.cn、局域网 olares.local，或自定义域名），zone 不可
+ * 枚举，只能从当前入口地址里取；scheme 同理——局域网入口未必是 https。
  *
  * 端口转发 / IP 直连等非入口访问下无法推断，返回空串，调用方应隐藏入口。
  */
@@ -16,25 +15,78 @@ export function loopbackWebUrl(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
 
-const ROUTER_LABEL = "router";
-const OLARES_ZONES = new Set(["olares.com", "olares.local"]);
 const DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 // Router 控制台是 history 模式 SPA，入口即顶层路由路径。
 const ROUTER_ROUTE = /^[a-z0-9]+(?:-[a-z0-9]+)*(?:\/[a-z0-9]+(?:-[a-z0-9]+)*)*$/;
 
+// 用户域是 `<用户名>.<zone>`，zone 本身至少两段，所以不足三段的不是用户域；
+// 末段全是数字则是 IP 字面量。
+function userDomainLabels(domain) {
+  const labels = String(domain ?? "").trim().toLowerCase().split(".");
+  if (labels.length < 3 || !/[a-z]/.test(labels[labels.length - 1])) return [];
+  return labels.every((label) => DNS_LABEL.test(label)) ? labels : [];
+}
+
+/**
+ * 入口 hostname 去掉应用自己的第三级域名，剩下的就是用户域。
+ * @param {string} hostname 入口 hostname（不含端口）
+ * @returns {string} `<用户名>.<zone>`；非入口访问时为空串
+ */
+export function userDomainOf(hostname) {
+  const labels = String(hostname ?? "").trim().toLowerCase().split(".");
+  if (!DNS_LABEL.test(labels[0] ?? "")) return "";
+  return userDomainLabels(labels.slice(1).join(".")).join(".");
+}
+
+/**
+ * @param {string} label 应用的第三级域名，如 files
+ * @param {{domain?: string, protocol?: string, port?: string}} entrance
+ * @returns {string} 同一入口区下该应用的 origin；无法推断时为空串
+ */
+export function entranceOrigin(label, { domain, protocol = "https:", port = "" } = {}) {
+  const scheme = String(protocol ?? "").trim().toLowerCase();
+  if (!["http:", "https:"].includes(scheme)) return "";
+  if (!DNS_LABEL.test(String(label ?? ""))) return "";
+  // 入口永远在 scheme 默认端口上，带端口的是转发或本地调试，不是入口。
+  if (String(port ?? "")) return "";
+  const labels = userDomainLabels(domain);
+  return labels.length ? `${scheme}//${label}.${labels.join(".")}` : "";
+}
+
+export const ROUTER_CONSOLE_GLOBAL = "__LARES_ROUTER_CONSOLE__";
+
+/**
+ * Router 控制台的入口不能靠当前页面域名推：它是 Router chart 申领的第三级域名
+ * `router.<用户域>`，只登记在公网 zone，局域网 DNS 里没有这条记录（同一入口在
+ * 节点 ingress 上是通的，但 `router.<用户>.olares.local` 解析不出来）。权威来源
+ * 只有 Host 侧的 `LLM_GATEWAY_URL`——chart 用 `.Values.user.zone` 渲染，天然跟着
+ * 用户的 .com / .cn / 自定义域名走。
+ *
+ * @param {string} [gatewayUrl] Router 数据面 URL，或已解析出的控制台 origin
+ * @returns {string} 控制台 origin；集群外（如本地 `router-svc.router-shared`）为空串
+ */
+export function routerConsoleOrigin(gatewayUrl) {
+  let url;
+  try {
+    url = new URL(String(gatewayUrl ?? ""));
+  } catch {
+    return "";
+  }
+  const [label, ...domain] = url.hostname.toLowerCase().split(".");
+  return entranceOrigin(label, { domain: domain.join("."), protocol: url.protocol, port: url.port });
+}
+
 /**
- * @param {string} [route] Router 控制台顶层路由，如 llm / audio / tools
- * @param {string} [hostname] 当前页面 hostname（不含端口）
- * @returns {string} Router 控制台 URL；无法推断时为空串
+ * @param {string} route Router 控制台顶层路由，如 llm / audio / tools
+ * @param {string} [origin] Host 注入的控制台 origin
+ * @returns {string} Router 控制台 URL；无入口时为空串
  */
-export function routerConsoleUrl(route = "", hostname = globalThis.location?.hostname ?? "") {
-  const labels = String(hostname).trim().toLowerCase().split(".");
-  if (labels.length !== 4 || labels.some((label) => !DNS_LABEL.test(label))) return "";
-  if (!OLARES_ZONES.has(labels.slice(-2).join("."))) return "";
+export function routerConsoleUrl(route = "", origin = globalThis[ROUTER_CONSOLE_GLOBAL]) {
+  const base = routerConsoleOrigin(origin);
+  if (!base) return "";
   const path = String(route).trim().toLowerCase();
   if (path && !ROUTER_ROUTE.test(path)) return "";
-  const origin = `https://${[ROUTER_LABEL, ...labels.slice(1)].join(".")}`;
-  return path ? `${origin}/${path}` : origin;
+  return path ? `${base}/${path}` : base;
 }
 
 /** 新标签页打开 Router 控制台；无入口时静默忽略。 */

package/olares/identity.js

@@ -1,24 +1,17 @@
 /**
- * Olares edge identity → olares-cli profile (from test_lares).
- * Access JWT only; no refresh. Commands work until the cookie expires.
+ * Olares edge identity: who the reverse proxy says this request is, and the
+ * browser credential it carried.
+ *
+ * The olares-cli session inside the container is NOT derived from this. It
+ * comes from the credential app-service mounts for `permission.loginOlaresCLI`
+ * (/olares/credentials), which is the only source that knows the user's full
+ * Olares ID and can refresh itself.
  */
-import { createCipheriv, randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-
-const MASTER_KEY_BYTES = 32;
-const IV_BYTES = 12;
-const SERVICE = "olares-cli";
 
 /**
- * @typedef {{ user: string, token: string, terminus: string }} OlaresIdentity
+ * @typedef {{ user: string, token: string }} OlaresIdentity
  */
 
-/** @param {OlaresIdentity} identity */
-export function identityAvailable(identity) {
-  return Boolean(identity.user && identity.token && identity.terminus);
-}
-
 /** @param {string} cookieHeader */
 function parseCookies(cookieHeader) {
   /** @type {Record<string, string>} */
@@ -31,31 +24,16 @@ function parseCookies(cookieHeader) {
   return out;
 }
 
-/** @param {string} user */
-function userLabel(user) {
-  return user.split("@", 1)[0]?.trim().toLowerCase() ?? "";
-}
-
-/**
- * @param {string} hostHeader
- * @param {string} user
- */
-function terminusFromHost(hostHeader, user) {
-  const host = hostHeader.trim().split(":")[0]?.toLowerCase() ?? "";
-  const parts = host.split(".");
-  if (parts.length < 3) return "";
-  const terminus = parts.slice(1).join(".");
-  const label = userLabel(user);
-  if (!label || terminus.split(".", 1)[0] !== label) return "";
-  return terminus;
+/** Username without domain; Olares may send `user` or `user@olares.com`. */
+export function olaresUsername(user) {
+  return String(user || "").split("@", 1)[0]?.trim().toLowerCase() ?? "";
 }
 
 /**
  * @param {import('node:http').IncomingHttpHeaders | Headers | Record<string, string | string[] | undefined>} headers
- * @param {string | null} [userDomain]
  * @returns {OlaresIdentity}
  */
-export function identityFromHeaders(headers, userDomain) {
+export function identityFromHeaders(headers) {
   const get = (name) => {
     if (typeof Headers !== "undefined" && headers instanceof Headers) {
       return headers.get(name) ?? "";
@@ -85,106 +63,5 @@ export function identityFromHeaders(headers, userDomain) {
   }
   if (!token) token = get("x-authorization").trim();
 
-  let terminus = (userDomain ?? "").trim();
-  if (!terminus) terminus = terminusFromHost(get("x-forwarded-host"), user);
-  if (!terminus && user) terminus = `${userLabel(user)}.olares.com`;
-
-  return { user, token, terminus };
-}
-
-/** @param {string} account */
-function safeFileName(account) {
-  return `${account.replace(/[^a-zA-Z0-9._-]/g, "_")}.enc`;
-}
-
-/**
- * @param {string} plaintext
- * @param {Buffer} key
- */
-function encryptAesGcm(plaintext, key) {
-  const iv = randomBytes(IV_BYTES);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return Buffer.concat([iv, ciphertext, tag]);
-}
-
-/** @param {OlaresIdentity} identity */
-function ownerHome(identity) {
-  const root = (
-    process.env.LARES_CLI_ROOT
-    ?? process.env.OLARES_CLI_ROOT
-    ?? "/data/cli"
-  ).replace(/\/+$/, "");
-  const label = userLabel(identity.user) || "anonymous";
-  return join(root, label);
-}
-
-/**
- * Materialize per-user olares-cli profile + Linux file keychain from the edge
- * access token so bash/`olares-cli` authenticates without interactive login.
- *
- * @param {OlaresIdentity} identity
- */
-export function ensureCliProfile(identity) {
-  if (!identityAvailable(identity)) {
-    throw new Error("Olares edge identity incomplete (need user + auth_token + terminus)");
-  }
-
-  const home = ownerHome(identity);
-  const configDir = join(home, ".olares-cli");
-  const dataDir = join(home, "keychain");
-  const serviceDir = join(dataDir, SERVICE);
-  mkdirSync(configDir, { recursive: true, mode: 0o700 });
-  mkdirSync(serviceDir, { recursive: true, mode: 0o700 });
-
-  const configPath = join(configDir, "config.json");
-  const config = {
-    currentProfile: identity.user,
-    profiles: [
-      {
-        olaresId: identity.user,
-        backendVersion: "1.12.7",
-        backendVersionRefreshedAt: Math.floor(Date.now() / 1000),
-      },
-    ],
-  };
-  writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
-
-  const masterPath = join(serviceDir, "master.key");
-  let master;
-  if (existsSync(masterPath)) {
-    master = readFileSync(masterPath);
-    if (master.length !== MASTER_KEY_BYTES) {
-      master = randomBytes(MASTER_KEY_BYTES);
-      writeFileSync(masterPath, master, { mode: 0o600 });
-    }
-  } else {
-    master = randomBytes(MASTER_KEY_BYTES);
-    writeFileSync(masterPath, master, { mode: 0o600 });
-  }
-
-  const stored = {
-    olaresId: identity.user,
-    accessToken: identity.token,
-    refreshToken: "",
-    grantedAt: Date.now(),
-    invalidatedAt: 0,
-  };
-  const enc = encryptAesGcm(JSON.stringify(stored), master);
-  const tokenPath = join(serviceDir, safeFileName(identity.user));
-  const tmp = `${tokenPath}.${process.pid}.tmp`;
-  writeFileSync(tmp, enc, { mode: 0o600 });
-  renameSync(tmp, tokenPath);
-
-  return {
-    home,
-    dataDir,
-    env: {
-      HOME: home,
-      OLARES_CLI_HOME: configDir,
-      OLARES_CLI_DATA_DIR: dataDir,
-      OLARES_CLI_REMOTE_ONLY: "1",
-    },
-  };
+  return { user, token };
 }

package/olares/session-identity.js

@@ -1,7 +1,4 @@
-import {
-  ensureCliProfile,
-  identityAvailable,
-} from "./identity.js";
+import { olaresUsername } from "./identity.js";
 
 /** @type {Map<string, import('./identity.js').OlaresIdentity>} */
 const bySession = new Map();
@@ -10,16 +7,21 @@ const bySession = new Map();
 let latest = null;
 
 /**
- * Cache edge identity and materialize olares-cli env (HOME / OLARES_CLI_*) for bash.
- * @param {string} sessionId
+ * The Router end user for calls that carry no request of their own. The
+ * olares-cli session is not set up here: it comes from the credential
+ * app-service mounts, which already names the full Olares ID.
+ *
  * @param {import('./identity.js').OlaresIdentity} identity
  */
+function applyIdentityEnv(identity) {
+  const user = olaresUsername(identity.user);
+  if (user) process.env.OLARES_USERNAME = user;
+}
+
 export function rememberSessionIdentity(sessionId, identity) {
   if (sessionId) bySession.set(sessionId, identity);
   latest = identity;
-  if (!identityAvailable(identity)) return;
-  const profile = ensureCliProfile(identity);
-  Object.assign(process.env, profile.env);
+  applyIdentityEnv(identity);
 }
 
 /**
@@ -28,9 +30,7 @@ export function rememberSessionIdentity(sessionId, identity) {
  */
 export function rememberRequestIdentity(identity) {
   latest = identity;
-  if (!identityAvailable(identity)) return;
-  const profile = ensureCliProfile(identity);
-  Object.assign(process.env, profile.env);
+  applyIdentityEnv(identity);
 }
 
 /** @param {string} sessionId */

package/olares/trusted-host.js

@@ -1,32 +1,3 @@
-export function trustedEntranceHosts(env = process.env) {
-  return (env.DSH_TRUSTED_HOSTS ?? "")
-    .split(",")
-    .map((s) => s.trim().toLowerCase())
-    .filter(Boolean);
-}
-
-/** Hostname of a bare `host[:port]` authority, or null when unparsable. */
-export function hostnameOf(authority) {
-  try {
-    return new URL(`http://${authority}`).hostname.toLowerCase();
-  } catch {
-    return null;
-  }
-}
-
-export function viaOlaresEntrance(hostHeader, entranceHosts) {
-  if (!hostHeader) return false;
-  const hostname = hostnameOf(hostHeader);
-  if (!hostname) return false;
-  return entranceHosts.some((entry) => hostnameOf(entry) === hostname);
-}
-
-export function shouldRewriteApiLoopback(req, entranceHosts) {
-  const path = new URL(req.url ?? "/", "http://x").pathname;
-  if (!path.startsWith("/api")) return false;
-  return viaOlaresEntrance(req.headers.host, entranceHosts);
-}
-
 export function loopbackAuthority(port) {
   return `127.0.0.1:${port}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olares/lares-core",
-  "version": "0.15.6",
+  "version": "0.15.9",
   "description": "Lares 共享业务核心：Router、workspace、文件/媒体、Olares 身份（无 UI、无平台壳）",
   "type": "module",
   "repository": {
@@ -15,23 +15,27 @@
   "files": [
     "brand",
     "drive",
+    "entrance",
     "files",
     "i18n",
     "icons",
     "larepass",
     "media",
+    "mcp",
     "olares",
     "router",
     "search",
     "tools",
     "voice",
-    "workspace"
+    "workspace",
+    "skills"
   ],
   "exports": {
     "./tools/http": "./tools/http.js",
     "./tools/json-file": "./tools/json-file.js",
     "./tools/async": "./tools/async.js",
     "./tools/crypto-uuid": "./tools/crypto-uuid.js",
+    "./tools/head-script": "./tools/head-script.js",
     "./brand/identity": "./brand/identity.js",
     "./brand/manifest": "./brand/manifest.js",
     "./icons/mark": "./icons/mark.js",
@@ -41,8 +45,10 @@
     "./i18n/files": "./i18n/files.js",
     "./i18n/voice": "./i18n/voice.js",
     "./i18n/search": "./i18n/search.js",
+    "./i18n/skills": "./i18n/skills.js",
     "./i18n/preview": "./i18n/preview.js",
     "./i18n/mobile": "./i18n/mobile.js",
+    "./i18n/mcp": "./i18n/mcp.js",
     "./router/catalog": "./router/catalog.js",
     "./router/catalog-cache": {
       "types": "./router/catalog-cache.d.ts",
@@ -55,7 +61,11 @@
     },
     "./router/search": "./router/search.js",
     "./router/shim": "./router/shim.js",
+    "./router/gemini-schema": "./router/gemini-schema.js",
+    "./router/generation-guard": "./router/generation-guard.js",
+    "./router/sref": "./router/sref.js",
     "./router/stt": "./router/stt.js",
+    "./router/tts": "./router/tts.js",
     "./router/catalog-sync": "./router/catalog-sync.js",
     "./router/session-model": "./router/session-model.js",
     "./workspace/env": "./workspace/env.js",
@@ -69,13 +79,19 @@
     "./files/upload-http": "./files/upload-http.js",
     "./files/limits": "./files/limits.js",
     "./files/upload-client": "./files/upload-client.js",
+    "./files/backend-client": "./files/backend-client.js",
+    "./files/app-link": "./files/app-link.js",
     "./files/preview": "./files/preview.js",
+    "./files/preview-local": "./files/preview-local.js",
     "./files/preview-workspace": "./files/preview-workspace.js",
     "./files/preview-tabs": "./files/preview-tabs.js",
     "./files/preview-groups": "./files/preview-groups.js",
-    "./files/preview-cache": "./files/preview-cache.js",
     "./files/markdown": "./files/markdown.js",
     "./files/deliverables": "./files/deliverables.js",
+    "./files/published-tools": "./files/published-tools.js",
+    "./files/published-turn-data": "./files/published-turn-data.js",
+    "./files/produced-gate": "./files/produced-gate.js",
+    "./files/produced-mentions": "./files/produced-mentions.js",
     "./files/disposition": "./files/disposition.js",
     "./files/intake": "./files/intake.js",
     "./files/draft-images": "./files/draft-images.js",
@@ -84,6 +100,8 @@
     "./drive/paths": "./drive/paths.js",
     "./drive/download": "./drive/download.js",
     "./drive/ls": "./drive/ls.js",
+    "./drive/cat": "./drive/cat.js",
+    "./drive/flowstudio-files": "./drive/flowstudio-files.js",
     "./drive/url-download": "./drive/url-download.js",
     "./drive/execute": "./drive/execute.js",
     "./drive/tools": "./drive/tools.js",
@@ -92,15 +110,34 @@
     "./voice/service": "./voice/service.js",
     "./voice/client": "./voice/client.js",
     "./voice/recorder": "./voice/recorder.js",
+    "./voice/endpoint": "./voice/endpoint.js",
+    "./voice/speech": "./voice/speech.js",
+    "./voice/script": "./voice/script.js",
+    "./voice/pcm": "./voice/pcm.js",
+    "./voice/link": "./voice/link.js",
+    "./voice/session": "./voice/session.js",
+    "./voice/duplex": "./voice/duplex.js",
+    "./voice/input": "./voice/input.js",
+    "./voice/playback": "./voice/playback.js",
+    "./voice/problem": "./voice/problem.js",
+    "./voice/capture": "./voice/capture.js",
+    "./voice/install": "./voice/install.js",
     "./search/config": "./search/config.js",
     "./search/menu": "./search/menu.js",
     "./search/client": "./search/client.js",
     "./router/models-client": "./router/models-client.js",
     "./media/ffmpeg-run": "./media/ffmpeg-run.js",
     "./media/router-images": "./media/router-images.js",
+    "./media/generation": "./media/generation.js",
+    "./media/tool": "./media/tool.js",
+    "./mcp/config": "./mcp/config.js",
+    "./mcp/client": "./mcp/client.js",
+    "./mcp/approval": "./mcp/approval.js",
     "./olares/identity": "./olares/identity.js",
     "./olares/session-identity": "./olares/session-identity.js",
     "./olares/entrance": "./olares/entrance.js",
+    "./entrance/surface": "./entrance/surface.js",
+    "./log/report": "./log/report.js",
     "./olares/trusted-host": "./olares/trusted-host.js",
     "./larepass/host": "./larepass/host.js",
     "./larepass/rpc": "./larepass/rpc.js",
@@ -108,6 +145,7 @@
     "./larepass/tool-row": "./larepass/tool-row.js",
     "./larepass/stage-copy": "./larepass/stage-copy.js",
     "./larepass/transcript": "./larepass/transcript.js",
+    "./larepass/process-fold": "./larepass/process-fold.js",
     "./larepass/chat": "./larepass/chat.js",
     "./larepass/mux": "./larepass/mux.js",
     "./larepass/session-cache": "./larepass/session-cache.js",
@@ -122,6 +160,12 @@
     "./larepass/references": "./larepass/references.js",
     "./larepass/submission-settings": "./larepass/submission-settings.js",
     "./larepass/turn-metrics": "./larepass/turn-metrics.js",
-    "./larepass/context-occupancy": "./larepass/context-occupancy.js"
+    "./larepass/context-occupancy": "./larepass/context-occupancy.js",
+    "./skills/packs": "./skills/packs.js",
+    "./skills/state": {
+      "types": "./skills/state.d.ts",
+      "default": "./skills/state.js"
+    },
+    "./skills/client": "./skills/client.js"
   }
 }

package/router/catalog-cache.d.ts

@@ -23,7 +23,7 @@ export class CatalogCache {
   seed(payload: unknown): void;
   snapshot(): CatalogSnapshot;
   restore(snap: CatalogSnapshot | { payload: unknown; rows?: RouterCatalogRow[]; fetchedAt?: number } | null): void;
-  get(): Promise<CatalogSnapshot>;
+  get(options?: { refresh?: boolean }): Promise<CatalogSnapshot>;
 }
 
 export const catalogCache: CatalogCache;

package/router/catalog-cache.js

@@ -56,8 +56,32 @@ export class CatalogCache {
     this.primed = false;
   }
 
+  /**
+   * Marking the seed consumed is the point: a caller that invalidates wants
+   * Router, and the boot seed would otherwise satisfy the very first reload
+   * of a fresh dsh child with the state the caller just declared stale.
+   */
   invalidate() {
     this.fetchedAt = 0;
+    this.primed = true;
+  }
+
+  /**
+   * @param {{ refresh?: boolean }} [options]
+   * `refresh` skips TTL and the boot seed so a user click hits Router now.
+   */
+  async get(options = {}) {
+    if (options.refresh) this.invalidate();
+    if (this.payload && this.fetchedAt !== 0 && this.now() - this.fetchedAt < this.ttlMs) {
+      return this.snapshot();
+    }
+    if (this.inflight) return this.inflight;
+    const pending = this.load();
+    const shared = pending.finally(() => {
+      if (this.inflight === shared) this.inflight = null;
+    });
+    this.inflight = shared;
+    return shared;
   }
 
   /**
@@ -92,19 +116,6 @@ export class CatalogCache {
     writeCatalogSeed(snap.payload, this.dataDir);
   }
 
-  async get() {
-    if (this.payload && this.fetchedAt !== 0 && this.now() - this.fetchedAt < this.ttlMs) {
-      return this.snapshot();
-    }
-    if (this.inflight) return this.inflight;
-    const pending = this.load();
-    const shared = pending.finally(() => {
-      if (this.inflight === shared) this.inflight = null;
-    });
-    this.inflight = shared;
-    return shared;
-  }
-
   async load() {
     if (!this.primed) {
       this.primed = true;
@@ -114,7 +125,7 @@ export class CatalogCache {
         return this.snapshot();
       }
     }
-    const response = await this.fetchImpl(`${routerGatewayUrl()}/models?include_not_ready=true`, {
+    const response = await this.fetchImpl(`${routerGatewayUrl()}/models`, {
       method: "GET",
       headers: routerHeaders(),
       signal: AbortSignal.timeout(15_000),