@opengeni/core 2.8.0-canary.1 → 2.8.2-canary.0

package/dist/index.js

@@ -128,6 +128,73 @@ import {
   validateEditableArtifactActor
 } from "./chunk-VCZFFEPB.js";
 
+// src/domain/skills.ts
+import { validateSkillTextFiles } from "@opengeni/contracts";
+import { buildPortableSkillArtifact } from "@opengeni/runtime/skill-library";
+import {
+  applySkillLifecycle,
+  listSkillRecords,
+  skillFilesContentHash
+} from "@opengeni/db";
+import { replayPortableSkillInstall } from "@opengeni/db";
+function validateSkillFiles(files) {
+  validateSkillTextFiles(files);
+  const result = files.map(({ path, content }) => ({ path, content }));
+  if (!result.some((file) => file.path === "SKILL.md" && file.content.trim()))
+    throw new Error("Skill requires nonempty SKILL.md");
+  return result.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+}
+function skillBundleHash(files) {
+  return skillFilesContentHash(validateSkillFiles(files));
+}
+var listSkills = listSkillRecords;
+async function readSkill(db, context, skillId, revisionId) {
+  return (await listSkillRecords(db, context, {
+    skillId,
+    ...revisionId ? { revisionId } : {},
+    limit: 1
+  }))[0] ?? null;
+}
+async function saveSkill(db, input) {
+  const { accountId, workspaceId, actor, ...request } = input;
+  const artifact = buildPortableSkillArtifact(validateSkillFiles(input.files));
+  return applySkillLifecycle(
+    db,
+    { accountId, workspaceId, actor },
+    {
+      ...request,
+      operation: "save",
+      files: artifact.files,
+      title: artifact.name,
+      description: artifact.description
+    }
+  );
+}
+async function installSkill(db, input) {
+  const { accountId, workspaceId, actor, ...request } = input;
+  return applySkillLifecycle(
+    db,
+    { accountId, workspaceId, actor },
+    { ...request, operation: "install" }
+  );
+}
+async function approveSkill(db, input) {
+  const { accountId, workspaceId, actor, ...request } = input;
+  return applySkillLifecycle(
+    db,
+    { accountId, workspaceId, actor },
+    { ...request, operation: "approve" }
+  );
+}
+async function restoreSkill(db, input) {
+  const { accountId, workspaceId, actor, ...request } = input;
+  return applySkillLifecycle(
+    db,
+    { accountId, workspaceId, actor },
+    { ...request, operation: "restore" }
+  );
+}
+
 // src/workflow-wake-contract.ts
 var SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID = "opengeni-session-workflow-wake-dispatcher";
 var SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE = "sessionWorkflowWakeDispatcherWorkflow";
@@ -140,12 +207,15 @@ var TranscriptionServiceError = class extends Error {
   code;
   status;
   retryable;
+  /** Explicit rejection before any transcription result; safe to try another provider. */
+  fallbackSafe;
   constructor(input) {
     super(input.message);
     this.name = "TranscriptionServiceError";
     this.code = input.code;
     this.status = input.status ?? statusForVoiceInputError(input.code);
     this.retryable = input.retryable ?? false;
+    this.fallbackSafe = input.fallbackSafe ?? false;
   }
 };
 function statusForVoiceInputError(code) {
@@ -718,6 +788,11 @@ import {
 
 // src/sandbox/routing.ts
 import { sandboxLifecycleTransitionWaitMs } from "@opengeni/config";
+import { appendSessionCommandOutput } from "@opengeni/db/session-command-output";
+import {
+  createProviderCommandRetainer,
+  retainedProviderCommandPersistence
+} from "@opengeni/db/retained-provider-commands";
 import {
   advanceWorkspaceGenerationForDirectRequest,
   advanceWorkspaceGenerationForRetainedProcess,
@@ -727,6 +802,7 @@ import {
   markWarmLeaseInstanceLost,
   readActiveSandbox,
   retainWorkspaceMutationProcess,
+  SandboxRetainedProcessPromotionFencedError,
   retainedProcessSettlementIdentity,
   settleRetainedProcess,
   verifyDirectWorkspaceMutationSettlement,
@@ -741,6 +817,10 @@ import {
   RoutingSandboxSession,
   resolveModalCheckpointProviderBindingForSession
 } from "@opengeni/runtime/sandbox";
+var retainWorkspaceProviderCommand = createProviderCommandRetainer(
+  retainWorkspaceMutationProcess,
+  (error) => error instanceof SandboxRetainedProcessPromotionFencedError ? error.process : null
+);
 function directRetainedProcessMatchesBackend(durable, process, backend) {
   return durable.providerSessionId === process.providerSessionId && durable.providerBackend === backend.kind && durable.providerInstanceId === backend.providerInstanceId && durable.leaseEpoch === backend.leaseEpoch && durable.routeKind === "active" && durable.routeTargetId === backend.sandboxId && durable.routeEpoch === backend.activeEpoch;
 }
@@ -860,12 +940,13 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       throw new Error("API-direct workspace mutation settlement lacked its bound admission");
     }
     if (outcome === "resolved" && retainedProcess) {
-      await retainWorkspaceMutationProcess(db, {
+      await retainWorkspaceProviderCommand(db, {
         accountId: ids.accountId,
         workspaceId: ids.workspaceId,
         sessionId: ids.sessionId,
         processId: retainedProcess.id,
         providerSessionId: retainedProcess.providerSessionId,
+        ...retainedProcess.providerCommand ? { providerCommand: retainedProcess.providerCommand } : {},
         admissionId: exactAdmission.id,
         admittedWorkspaceGeneration: exactAdmission.workspaceGeneration,
         operation: op,
@@ -1022,6 +1103,27 @@ function wrapChannelABoxWithRouting(services, ids, established) {
     } : {}
   });
   const proxy = new RoutingSandboxSession({
+    providerCommandHandle: (value) => value && typeof value === "object" ? value.admission?.workspaceGeneration : void 0,
+    providerCommandPersistence: (process) => retainedProviderCommandPersistence(db, {
+      accountId: ids.accountId,
+      workspaceId: ids.workspaceId,
+      sessionId: ids.sessionId,
+      processId: process.id
+    }),
+    captureProcessOutput: async ({ process, chunkId, chunk, stream, streamFidelity }) => {
+      const events = await appendSessionCommandOutput(db, {
+        accountId: ids.accountId,
+        workspaceId: ids.workspaceId,
+        sessionId: ids.sessionId,
+        commandId: process.id,
+        chunkId,
+        chunk,
+        stream,
+        streamFidelity
+      });
+      if (events.length && bus)
+        await bus.publish(ids.workspaceId, ids.sessionId, events).catch(() => void 0);
+    },
     bindActiveRouteOnFirstResolve: true,
     defaultResolved: {
       session: established.session,
@@ -1079,7 +1181,7 @@ function wrapChannelABoxWithRouting(services, ids, established) {
 
 // src/sandbox/runtime-settings.ts
 import {
-  CapabilityPack
+  StoredCapabilityPack
 } from "@opengeni/contracts";
 import {
   getRigVersion,
@@ -1157,8 +1259,14 @@ async function resolveWorkspaceLegacyRuntimePacks(db, workspaceId) {
       continue;
     }
     const registration = await getWorkspacePack(db, workspaceId, installation.packId);
-    const parsed = CapabilityPack.safeParse(registration?.pack);
-    if (parsed.success) packs2.push(parsed.data);
+    if (!registration)
+      throw new Error(`Enabled Pack ${installation.packId} has no registered manifest`);
+    const parsed = StoredCapabilityPack.safeParse(registration.pack);
+    if (!parsed.success)
+      throw new Error(
+        `Enabled Pack ${installation.packId} requires repair: ${parsed.error.message}`
+      );
+    packs2.push(parsed.data);
   }
   return packs2;
 }
@@ -2939,7 +3047,7 @@ import { listSkillLibraryEntries } from "@opengeni/runtime/skill-library";
 // src/domain/packs.ts
 import { createHash as createHash3 } from "crypto";
 import {
-  CapabilityPack as CapabilityPack2,
+  StoredCapabilityPack as StoredCapabilityPack2,
   OPENGENI_PR_REVIEW_PACK_ID,
   OPENGENI_PR_REVIEW_SESSION_ROLE as OPENGENI_PR_REVIEW_SESSION_ROLE2,
   stableJson as stableJson2
@@ -2954,7 +3062,7 @@ import {
   resolvePackComponentReferences,
   resolvePackInlineSkillReferences
 } from "@opengeni/db";
-import { buildPortableSkillArtifact } from "@opengeni/runtime/skill-library";
+import { buildPortableSkillArtifact as buildPortableSkillArtifact2 } from "@opengeni/runtime/skill-library";
 import { HTTPException as HTTPException3 } from "hono/http-exception";
 
 // src/domain/pr-review.ts
@@ -3486,6 +3594,7 @@ The desired outcome is a native-feeling product experience backed by a standalon
 - When an unknown choice is reversible and low-risk, choose the best-fitting default, state the assumption, and continue. When it changes privacy, tenant authority, write access, cost exposure, or an external mutation, resolve it before crossing that boundary.
 - Possession of a credential or access to a cloud, repository, or deployment is technical capability, not authorization. Match the user's requested delivery autonomy and the repository's stated workflow.
 - Keep alternatives open until evidence eliminates them. Use strict rules only for actual security, privacy, protocol, or authorization invariants.
+- For packaged React chat, use SessionConversation or compose MessageTimeline and ChatComposer with the normal SDK and authenticated session routes. For a custom or compatible frontend, use the optional backend chat handler.
 
 Read the references selectively:
 
@@ -4197,9 +4306,13 @@ function isBuiltInCapabilityPack(packId) {
 async function listWorkspaceCapabilityPacks(db, workspaceId) {
   const registered = await listWorkspacePacks(db, workspaceId);
   const builtInIds = new Set(packs.map((pack) => pack.id));
-  const registeredPacks = registered.filter((registration) => !builtInIds.has(registration.pack.id)).flatMap((registration) => {
-    const parsed = CapabilityPack2.safeParse(registration.pack);
-    return parsed.success ? [parsed.data] : [];
+  const registeredPacks = registered.filter((registration) => !builtInIds.has(registration.pack.id)).map((registration) => {
+    const parsed = StoredCapabilityPack2.safeParse(registration.pack);
+    if (!parsed.success)
+      throw new HTTPException3(422, {
+        message: `Stored Pack ${registration.pack.id} requires repair before it can be used: ${parsed.error.message}`
+      });
+    return parsed.data;
   });
   return [...packs, ...registeredPacks];
 }
@@ -4212,8 +4325,12 @@ async function resolveCapabilityPack(db, workspaceId, packId) {
   if (!registration) {
     return null;
   }
-  const parsed = CapabilityPack2.safeParse(registration.pack);
-  return parsed.success ? parsed.data : null;
+  const parsed = StoredCapabilityPack2.safeParse(registration.pack);
+  if (!parsed.success)
+    throw new HTTPException3(422, {
+      message: `Stored Pack ${packId} requires repair before it can be used: ${parsed.error.message}`
+    });
+  return parsed.data;
 }
 function capabilityPackManifestDigest(pack) {
   return createHash3("sha256").update(stableJson2(pack)).digest("hex");
@@ -4222,7 +4339,7 @@ function capabilityPackRequiresInstallationPlan(pack) {
   return pack.components.length > 0 || pack.skills.length > 0 || (pack.automationTemplates?.length ?? 0) > 0 || pack.rig !== void 0 || pack.sandboxImage !== void 0 || pack.sandboxProviderImages !== void 0;
 }
 function inlinePackSkillInstall(pack, skill) {
-  const artifact = buildPortableSkillArtifact(skill.files);
+  const artifact = buildPortableSkillArtifact2(skill.files);
   if (artifact.name.toLowerCase() !== skill.name.toLowerCase()) {
     throw new HTTPException3(422, {
       message: `Pack Skill ${skill.name} has SKILL.md name ${artifact.name}; the names must match`
@@ -4919,13 +5036,13 @@ async function probeStreamableHttpMcpServer(input) {
 function mcpProbeErrorMessage(error, endpointUrl) {
   const message = error instanceof Error ? error.message : String(error);
   const normalized = message.replace(/\s+/g, " ").trim();
-  const endpoint = safeEndpointLabel(endpointUrl);
+  const endpoint2 = safeEndpointLabel(endpointUrl);
   if (/404|405|not found|unexpected token|not valid json|invalid json|failed to parse|streamable http error|unable to connect|fetch failed|econnrefused|enotfound|timeout|aborted/i.test(
     normalized
   )) {
-    return `OpenGeni could not reach a valid Streamable HTTP MCP server at ${endpoint}. Check the endpoint URL or choose a different catalog entry.`;
+    return `OpenGeni could not reach a valid Streamable HTTP MCP server at ${endpoint2}. Check the endpoint URL or choose a different catalog entry.`;
   }
-  return `OpenGeni could not initialize ${endpoint}. Check the endpoint configuration or try again.`;
+  return `OpenGeni could not initialize ${endpoint2}. Check the endpoint configuration or try again.`;
 }
 function safeEndpointLabel(endpointUrl) {
   try {
@@ -5920,7 +6037,9 @@ function storedConnectionRef(config) {
 // src/domain/skill-imports.ts
 import { createHash as createHash4 } from "crypto";
 import {
-  buildPortableSkillArtifact as buildPortableSkillArtifact2,
+  buildPortableSkillArtifact as buildPortableSkillArtifact3,
+  parsePortableSkillFrontmatter,
+  PORTABLE_SKILL_MAX_FILE_BYTES,
   PORTABLE_SKILL_MAX_FILES,
   PORTABLE_SKILL_MAX_TOTAL_BYTES
 } from "@opengeni/runtime/skill-library";
@@ -5935,7 +6054,16 @@ async function resolveSkillImport(rawUrl, client) {
     throw new HTTPException6(422, { message: "GitHub returned an invalid source commit" });
   }
   const tree = await client.listTree(parsed.owner, parsed.repository, sourceCommit);
-  const sourcePath = selectSkillRoot(parsed, tree);
+  const blobs = /* @__PURE__ */ new Map();
+  const readBlob = (sha) => {
+    let pending = blobs.get(sha);
+    if (!pending) {
+      pending = client.readBlob(parsed.owner, parsed.repository, sha);
+      blobs.set(sha, pending);
+    }
+    return pending;
+  };
+  const sourcePath = await selectSkillRoot(parsed, tree, readBlob, sourceCommit);
   const entries = skillFilesUnderRoot(tree, sourcePath);
   const declaredBytes = entries.reduce((sum, entry) => sum + (entry.size ?? 0), 0);
   if (entries.length > PORTABLE_SKILL_MAX_FILES) {
@@ -5949,11 +6077,10 @@ async function resolveSkillImport(rawUrl, client) {
     });
   }
   const files = await mapConcurrent(entries, maxConcurrentBlobReads, async (entry) => {
+    const bytes = await readBlob(entry.sha);
     let content;
     try {
-      content = new TextDecoder("utf-8", { fatal: true }).decode(
-        await client.readBlob(parsed.owner, parsed.repository, entry.sha)
-      );
+      content = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
     } catch {
       throw new HTTPException6(422, {
         message: `Skill file is not valid UTF-8 text: ${relativeSkillPath(entry.path, sourcePath)}`
@@ -5963,7 +6090,7 @@ async function resolveSkillImport(rawUrl, client) {
   });
   let artifact;
   try {
-    artifact = buildPortableSkillArtifact2(files);
+    artifact = buildPortableSkillArtifact3(files);
   } catch (error) {
     throw new HTTPException6(422, {
       message: error instanceof Error ? error.message : "Skill artifact is invalid"
@@ -6029,7 +6156,12 @@ function parseSkillSource(rawUrl) {
       message: "Skill imports require a credential-free HTTPS URL without a fragment"
     });
   }
-  const segments = url.pathname.split("/").filter(Boolean).map(decodeURIComponent);
+  let segments;
+  try {
+    segments = url.pathname.split("/").filter(Boolean).map(decodeURIComponent);
+  } catch {
+    throw new HTTPException6(422, { message: "The Skill URL contains invalid encoding" });
+  }
   if (url.hostname === "skills.sh" || url.hostname === "www.skills.sh") {
     if (segments.length !== 3) {
       throw new HTTPException6(422, {
@@ -6082,12 +6214,11 @@ function parseSkillSource(rawUrl) {
   const ref = segments[3];
   if (!ref) throw new HTTPException6(422, { message: "The GitHub URL is missing a revision" });
   const pathSegments = segments.slice(4);
-  if (pathSegments.length === 0) {
+  if (pathSegments.length === 0 && mode === "blob") {
     throw new HTTPException6(422, { message: "The GitHub URL is missing a Skill folder" });
   }
-  const requestedPath = normalizeGitHubPath(
-    mode === "blob" && pathSegments.at(-1)?.toLowerCase() === "skill.md" ? pathSegments.slice(0, -1) : pathSegments
-  );
+  const folderSegments = mode === "blob" && pathSegments.at(-1)?.toLowerCase() === "skill.md" ? pathSegments.slice(0, -1) : pathSegments;
+  const requestedPath = folderSegments.length === 0 ? "." : normalizeGitHubPath(folderSegments);
   return {
     source: "github",
     owner,
@@ -6098,10 +6229,10 @@ function parseSkillSource(rawUrl) {
     inputUrl: url.toString()
   };
 }
-function selectSkillRoot(source, tree) {
+async function selectSkillRoot(source, tree, readBlob, sourceCommit) {
   const skillFiles = tree.filter(
     (entry) => entry.type === "blob" && entry.mode !== "120000" && (entry.path === "SKILL.md" || entry.path.endsWith("/SKILL.md"))
-  ).map((entry) => entry.path.slice(0, -"/SKILL.md".length) || ".").sort();
+  ).map((entry) => entry.path === "SKILL.md" ? "." : entry.path.slice(0, -"/SKILL.md".length)).sort();
   if (source.requestedPath) {
     const root = source.requestedPath;
     if (!skillFiles.includes(root)) {
@@ -6111,7 +6242,48 @@ function selectSkillRoot(source, tree) {
     }
     return root;
   }
-  const candidates = source.skillSlug ? skillFiles.filter((path) => path.split("/").at(-1) === source.skillSlug) : skillFiles;
+  let candidates = skillFiles;
+  if (source.skillSlug) {
+    if (skillFiles.length > PORTABLE_SKILL_MAX_FILES) {
+      throw new HTTPException6(422, {
+        message: "Too many Skill candidates; paste the exact GitHub folder URL"
+      });
+    }
+    let metadataBytes = 0;
+    const entriesByPath = new Map(tree.map((entry) => [entry.path, entry]));
+    const matches = await mapConcurrent(skillFiles, maxConcurrentBlobReads, async (root) => {
+      const entry = entriesByPath.get(root === "." ? "SKILL.md" : `${root}/SKILL.md`);
+      if ((entry.size ?? 0) > PORTABLE_SKILL_MAX_FILE_BYTES) {
+        throw new HTTPException6(422, {
+          message: "Skill metadata is too large; paste the exact GitHub folder URL"
+        });
+      }
+      const bytes = await readBlob(entry.sha);
+      metadataBytes += bytes.byteLength;
+      if (bytes.byteLength > PORTABLE_SKILL_MAX_FILE_BYTES || metadataBytes > PORTABLE_SKILL_MAX_TOTAL_BYTES) {
+        throw new HTTPException6(422, {
+          message: "Skill metadata is too large; paste the exact GitHub folder URL"
+        });
+      }
+      let markdown;
+      try {
+        markdown = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+      } catch {
+        throw new HTTPException6(422, {
+          message: "Skill metadata is not valid UTF-8; paste the exact GitHub folder URL"
+        });
+      }
+      return parsePortableSkillFrontmatter(markdown).name?.toLowerCase() === source.skillSlug.toLowerCase();
+    });
+    candidates = skillFiles.filter((_, index) => matches[index]);
+    if (candidates.length === 0) {
+      const folders = skillFiles.filter((path) => path.split("/").at(-1) === source.skillSlug);
+      const exactPath = folders.length === 1 ? encodeGitHubPath(folders[0]) : "<exact-skill-folder-path>";
+      throw new HTTPException6(422, {
+        message: `No Skill frontmatter name matches skills.sh slug "${source.skillSlug}"; the link may be stale. Check the current Skill name, or explicitly select the intended Skill using its exact GitHub folder URL: https://github.com/${source.owner}/${source.repository}/tree/${sourceCommit}/${exactPath}`
+      });
+    }
+  }
   if (candidates.length === 0) {
     throw new HTTPException6(422, { message: "No Skill folder with SKILL.md was found" });
   }
@@ -6164,13 +6336,20 @@ function assertGitHubRepository(owner, repository) {
 async function mapConcurrent(values, concurrency, map) {
   const output = new Array(values.length);
   let next = 0;
+  let failed = false;
   await Promise.all(
     Array.from({ length: Math.min(concurrency, values.length) }, async () => {
       for (; ; ) {
+        if (failed) return;
         const index = next;
         next += 1;
         if (index >= values.length) return;
-        output[index] = await map(values[index]);
+        try {
+          output[index] = await map(values[index]);
+        } catch (error) {
+          failed = true;
+          throw error;
+        }
       }
     })
   );
@@ -6180,6 +6359,260 @@ function sha256Hex2(bytes) {
   return createHash4("sha256").update(bytes).digest("hex");
 }
 
+// src/domain/skill-search.ts
+import { pinnedFetch, readResponseJsonBounded } from "@opengeni/network";
+var PublicSkillSearchError = class extends Error {
+  constructor(code, message, retryAfterSeconds = null) {
+    super(message);
+    this.code = code;
+    this.retryAfterSeconds = retryAfterSeconds;
+    this.name = "PublicSkillSearchError";
+  }
+};
+var endpoint = "https://skills.sh/api/search";
+var timeoutMs = 1e4;
+var maxResponseBytes = 256 * 1024;
+var maxResults = 20;
+var ownerPattern = /^[a-z0-9](?:[a-z0-9-]{0,38})$/iu;
+var segmentPattern = /^[a-z0-9](?:[a-z0-9._-]{0,98}[a-z0-9])?$/iu;
+function createPublicSkillSearchClient(settings, fetcher = pinnedFetch) {
+  return {
+    async search(input) {
+      const query = input.query.trim();
+      const limit = input.limit ?? maxResults;
+      const owner = input.owner?.trim().toLowerCase();
+      if (query.length < 2 || query.length > 200 || /[\u0000-\u001f\u007f]/u.test(query) || !Number.isSafeInteger(limit) || limit < 1 || limit > maxResults || owner !== void 0 && !ownerPattern.test(owner)) {
+        throw new PublicSkillSearchError("invalid_query", "Invalid public Skill search parameters");
+      }
+      const url = new URL(endpoint);
+      url.searchParams.set("q", query);
+      url.searchParams.set("limit", String(limit));
+      if (owner) url.searchParams.set("owner", owner);
+      const controller = new AbortController();
+      let timer;
+      const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          reject(new PublicSkillSearchError("timeout", "Public Skill search timed out"));
+        }, timeoutMs);
+      });
+      try {
+        return await Promise.race([
+          deadline,
+          (async () => {
+            const response = await fetcher(
+              url,
+              {
+                method: "GET",
+                headers: { accept: "application/json" },
+                credentials: "omit",
+                redirect: "manual",
+                signal: controller.signal
+              },
+              settings,
+              { label: "Public Skill search", requireHttpsOutsideLocalTest: true }
+            );
+            if (controller.signal.aborted || !response.ok) {
+              void response.body?.cancel().catch(() => void 0);
+              if (controller.signal.aborted) {
+                throw new PublicSkillSearchError("timeout", "Public Skill search timed out");
+              }
+              if (response.status === 429) {
+                throw new PublicSkillSearchError(
+                  "rate_limited",
+                  "Public Skill search is rate limited",
+                  parseRetryAfter(response.headers.get("retry-after"))
+                );
+              }
+              throw new PublicSkillSearchError("unavailable", "Public Skill search is unavailable");
+            }
+            let payload;
+            try {
+              payload = await readResponseJsonBounded(
+                response,
+                maxResponseBytes,
+                "Public Skill search",
+                {
+                  signal: controller.signal
+                }
+              );
+            } catch {
+              throw new PublicSkillSearchError(
+                controller.signal.aborted ? "timeout" : "invalid_response",
+                controller.signal.aborted ? "Public Skill search timed out" : "Public Skill search returned an invalid response"
+              );
+            }
+            return normalizeResponse(payload, query, limit, owner);
+          })()
+        ]);
+      } catch (error) {
+        if (error instanceof PublicSkillSearchError) throw error;
+        throw new PublicSkillSearchError(
+          controller.signal.aborted ? "timeout" : "unavailable",
+          controller.signal.aborted ? "Public Skill search timed out" : "Public Skill search is unavailable"
+        );
+      } finally {
+        clearTimeout(timer);
+      }
+    }
+  };
+}
+function normalizeResponse(payload, query, limit, owner) {
+  const invalid = () => new PublicSkillSearchError(
+    "invalid_response",
+    "Public Skill search returned an invalid response"
+  );
+  if (!isRecord2(payload) || !Array.isArray(payload.skills) || payload.skills.length > maxResults) {
+    throw invalid();
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const items = [];
+  for (const skill of payload.skills) {
+    if (!isRecord2(skill) || typeof skill.id !== "string" || typeof skill.source !== "string")
+      throw invalid();
+    const parts = skill.id.split("/");
+    if (parts.length !== 3 || !ownerPattern.test(parts[0]) || !parts.every((part) => segmentPattern.test(part)) || skill.source !== parts.slice(0, 2).join("/") || skill.skillId !== void 0 && skill.skillId !== parts[2] || typeof skill.name !== "string" || !skill.name.trim() || skill.name.length > 200 || /[\u0000-\u001f\u007f]/u.test(skill.name) || typeof skill.installs !== "number" || !Number.isSafeInteger(skill.installs) || skill.installs < 0 || owner !== void 0 && parts[0].toLowerCase() !== owner)
+      throw invalid();
+    if (seen.has(skill.id)) continue;
+    seen.add(skill.id);
+    items.push({
+      id: skill.id,
+      name: skill.name.trim(),
+      source: skill.source,
+      skillId: parts[2],
+      url: `https://skills.sh/${parts.map(encodeURIComponent).join("/")}`,
+      installs: skill.installs
+    });
+  }
+  return { provider: "skills_sh", query, items: items.slice(0, limit), nextCursor: null };
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseRetryAfter(value) {
+  if (value === null) return null;
+  if (/^\d+$/u.test(value)) {
+    const seconds = Number(value);
+    return Number.isSafeInteger(seconds) ? seconds : null;
+  }
+  const date = Date.parse(value);
+  return Number.isFinite(date) ? Math.max(0, Math.ceil((date - Date.now()) / 1e3)) : null;
+}
+
+// src/domain/github-skill-source.ts
+import { pinnedFetch as pinnedFetch2, readResponseJsonBounded as readResponseJsonBounded2, readResponseTextBounded } from "@opengeni/network";
+var githubApiBase = "https://api.github.com";
+var githubRequestTimeoutMs = 15e3;
+var githubMetadataMaxBytes = 4 * 1024 * 1024;
+var githubBlobResponseMaxBytes = 512 * 1024;
+function createGitHubSkillSourceClient(settings, requestJson = (path, maxBytes, label) => githubJson(settings, path, maxBytes, label)) {
+  return {
+    resolveCommit: async (owner, repository, ref) => {
+      const payload = recordValue(
+        await requestJson(
+          `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/commits/${encodeURIComponent(ref)}`,
+          githubMetadataMaxBytes,
+          "GitHub Skill commit"
+        ),
+        "GitHub commit"
+      );
+      const sha = stringValue(payload.sha);
+      if (!sha) throw new Error("GitHub commit response omitted sha");
+      return sha.toLowerCase();
+    },
+    listTree: async (owner, repository, commit) => {
+      const payload = recordValue(
+        await requestJson(
+          `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/git/trees/${encodeURIComponent(commit)}?recursive=1`,
+          githubMetadataMaxBytes,
+          "GitHub Skill tree"
+        ),
+        "GitHub tree"
+      );
+      if (payload.truncated === true) {
+        throw new Error("GitHub repository tree is too large to import safely");
+      }
+      if (!Array.isArray(payload.tree)) throw new Error("GitHub tree response omitted entries");
+      return payload.tree.map((entry, index) => {
+        const record3 = recordValue(entry, `GitHub tree entry ${index}`);
+        const path = stringValue(record3.path);
+        const type = stringValue(record3.type);
+        const mode = stringValue(record3.mode);
+        const sha = stringValue(record3.sha);
+        const size = record3.size;
+        if (!path || type !== "blob" && type !== "tree" && type !== "commit" || !mode || !sha || size !== void 0 && size !== null && (typeof size !== "number" || !Number.isSafeInteger(size) || size < 0)) {
+          throw new Error(`GitHub tree entry ${index} is invalid`);
+        }
+        return { path, type, mode, sha, size: typeof size === "number" ? size : null };
+      });
+    },
+    readBlob: async (owner, repository, sha) => {
+      const payload = recordValue(
+        await requestJson(
+          `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/git/blobs/${encodeURIComponent(sha)}`,
+          githubBlobResponseMaxBytes,
+          "GitHub Skill file"
+        ),
+        "GitHub blob"
+      );
+      if (payload.encoding !== "base64" || typeof payload.content !== "string") {
+        throw new Error("GitHub Skill file did not use base64 encoding");
+      }
+      const normalized = payload.content.replace(/\s+/gu, "");
+      if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(normalized)) {
+        throw new Error("GitHub Skill file contained invalid base64");
+      }
+      const bytes = Uint8Array.from(Buffer.from(normalized, "base64"));
+      if (typeof payload.size === "number" && Number.isSafeInteger(payload.size) && payload.size !== bytes.byteLength) {
+        throw new Error("GitHub Skill file size did not match its payload");
+      }
+      return bytes;
+    }
+  };
+}
+async function githubJson(settings, path, maxBytes, label) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), githubRequestTimeoutMs);
+  try {
+    const response = await pinnedFetch2(
+      `${githubApiBase}${path}`,
+      {
+        method: "GET",
+        headers: {
+          accept: "application/vnd.github+json",
+          "user-agent": "OpenGeni-Capabilities",
+          "x-github-api-version": "2022-11-28"
+        },
+        signal: controller.signal
+      },
+      settings,
+      { label, requireHttpsOutsideLocalTest: true }
+    );
+    if (!response.ok) {
+      await readResponseTextBounded(response, 8192, `${label} error`).catch(() => void 0);
+      if (response.status === 404) throw new Error(`${label} was not found or is not public`);
+      if (response.status === 403 || response.status === 429) {
+        throw new Error(`${label} is temporarily unavailable because GitHub limited the request`);
+      }
+      throw new Error(`${label} failed with HTTP ${response.status}`);
+    }
+    return await readResponseJsonBounded2(response, maxBytes, label, {
+      signal: controller.signal
+    });
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function recordValue(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} response is invalid`);
+  }
+  return value;
+}
+function stringValue(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
 // src/domain/environments.ts
 import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } from "@opengeni/config";
 import {
@@ -8253,6 +8686,7 @@ import {
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS as DEFAULT_FIRST_PARTY_MCP_PERMISSIONS2,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY as OPENGENI_SLACK_BOT_SESSION_METADATA_KEY3,
   resolveWorkspaceSessionToolDefaults as resolveWorkspaceSessionToolDefaults3,
+  resolveBundledSkillSelection as resolveBundledSkillSelection2,
   SessionAgentAccess,
   SessionEndUser,
   SessionMemoryScope
@@ -8320,6 +8754,7 @@ import {
   FIRST_PARTY_MCP_TOOL_NAMES as FIRST_PARTY_MCP_TOOL_NAMES2,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY as OPENGENI_SLACK_BOT_SESSION_METADATA_KEY2,
   SessionSkills,
+  resolveBundledSkillSelection,
   SessionSpawnDenial,
   ServiceTurnInitiator,
   ServiceTurnInitiatorContext,
@@ -9364,6 +9799,7 @@ async function createAndStartSessionWithOutcome(input) {
       initialModelContext: input.modelContext ?? null,
       resources: input.resources,
       skills: input.skills ?? [],
+      bundledSkillIds: input.bundledSkillIds,
       tools: input.tools,
       toolPolicy: input.toolPolicy,
       metadata: sessionMetadata,
@@ -9448,6 +9884,7 @@ async function createAndStartSessionWithOutcome(input) {
       initialModelContext: input.modelContext ?? null,
       resources: input.resources,
       skills: input.skills ?? [],
+      bundledSkillIds: input.bundledSkillIds,
       tools: input.tools,
       toolPolicy: input.toolPolicy,
       metadata: sessionMetadata,
@@ -10038,6 +10475,17 @@ async function createSessionForRequestWithOutcome(unresolvedDeps, grant, workspa
       message: error instanceof Error ? error.message : "invalid child visibility"
     });
   }
+  let bundledSkillIds;
+  try {
+    bundledSkillIds = resolveBundledSkillSelection(
+      payload.bundledSkillIds,
+      parentSession?.bundledSkillIds
+    );
+  } catch (error) {
+    throw new HTTPException12(422, {
+      message: error instanceof Error ? error.message : "Invalid bundled Skill selection"
+    });
+  }
   const sessionScope = resolveSessionCreateScope({
     requested: {
       agentAccess: payload.agentAccess,
@@ -10070,6 +10518,7 @@ async function createSessionForRequestWithOutcome(unresolvedDeps, grant, workspa
   if (payload.idempotencyKey && (effectiveVisibility !== "user_private" || replayManagedHumanSubjectId !== null)) {
     try {
       const initializedReplay = await getInitializedSessionCreateReplay(db, {
+        bundledSkillIds,
         accountId: grant.accountId,
         workspaceId,
         subjectId: replayManagedHumanSubjectId ?? grant.subjectId,
@@ -10619,6 +11068,7 @@ async function createSessionForRequestWithOutcome(unresolvedDeps, grant, workspa
       modelContext: payload.modelContext ?? null,
       resources,
       skills,
+      bundledSkillIds,
       tools,
       toolPolicy,
       ...payload.clientEventId ? { clientEventId: payload.clientEventId } : {},
@@ -11661,6 +12111,11 @@ async function validateScheduledTaskTarget(input) {
   if (!session || session.accountId !== input.grant.accountId) {
     throw new HTTPException13(404, { message: "target session not found" });
   }
+  if (input.agentConfig.bundledSkillIds !== void 0 && !isDeepStrictEqual(input.agentConfig.bundledSkillIds, session.bundledSkillIds)) {
+    throw new HTTPException13(422, {
+      message: "An existing-session schedule cannot change that session's bundled Skill selection"
+    });
+  }
   if (session.status === "cancelled") {
     throw new HTTPException13(409, {
       message: "target session is cancelled; choose a revivable session"
@@ -12201,6 +12656,24 @@ function manualScheduledTaskTriggerUsageKey(workspaceId, taskId, triggerToken) {
   return `agent_run.created:scheduled-trigger:${workspaceId}:${taskId}:${triggerToken}`;
 }
 async function validateScheduledTaskAgentConfig(input) {
+  const actor = creationInitiatorForGrant(input.grant).actor;
+  const parent = actor ? await getSession3(input.db, input.workspaceId, actor.sessionId) : null;
+  if (actor && (!parent || parent.accountId !== input.grant.accountId)) {
+    throw new HTTPException13(403, {
+      message: "Scheduled Skill selection requires the creating agent's session"
+    });
+  }
+  let bundledSkillIds;
+  try {
+    bundledSkillIds = resolveBundledSkillSelection2(
+      input.payload.agentConfig.bundledSkillIds,
+      parent?.bundledSkillIds
+    );
+  } catch (error) {
+    throw new HTTPException13(422, {
+      message: error instanceof Error ? error.message : "Invalid bundled Skill selection"
+    });
+  }
   const model = canonicalConfiguredModel(input.settings, input.payload.agentConfig.model);
   await assertWorkspaceModelPolicyAllows(input.db, input.settings, input.workspaceId, model);
   const resources = normalizeResources(input.payload.agentConfig.resources ?? []);
@@ -12260,6 +12733,7 @@ async function validateScheduledTaskAgentConfig(input) {
   }
   const validated = {
     ...input.payload.agentConfig,
+    ...bundledSkillIds !== void 0 ? { bundledSkillIds } : {},
     ...model === void 0 || model === null ? {} : { model },
     prompt,
     resources,
@@ -13954,6 +14428,12 @@ function createRememberRouter(options) {
     async remember(input) {
       const attempt = await attemptOf(input.attempt);
       const request = RememberRequest.parse(input.request);
+      if (request.lane === "preference") {
+        throw new RememberError(
+          "preference_retired",
+          "The Remember preference lane is retired; use skill_save for shared Skill files. No note or proposal was created."
+        );
+      }
       const note = await createNote(options.db, {
         ...attempt,
         operationId: derivedRememberOperationId(request.operationId, "note"),
@@ -16620,6 +17100,7 @@ export {
   PR_REVIEW_AUTOMATION_ADAPTER_ID,
   PR_REVIEW_AUTOMATION_TEMPLATE_ID,
   ProductionEditableArtifactSnapshotVerifier,
+  PublicSkillSearchError,
   RIG_DEFAULT_VARIABLE_SET_LOAD_CONCURRENCY,
   RememberError,
   SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS,
@@ -16657,6 +17138,7 @@ export {
   appendRigSetupCommand,
   applyCapabilityEnablement,
   applyGitHubRepositoryBindings,
+  approveSkill,
   assertAllowedEnvironmentVariableName,
   assertAllowedVariableSetVariableName,
   assertBoundedArtifactTitle,
@@ -16721,7 +17203,9 @@ export {
   createCompanyBrainLearningPolicyRouter,
   createCompanyProfileAgentAdminRouter,
   createCompanyProfileDurableLearningAdapter,
+  createGitHubSkillSourceClient,
   createGovernedLearningActivationController,
+  createPublicSkillSearchClient,
   createRememberRouter,
   createRigForApi,
   createRigVersionForApi,
@@ -16814,6 +17298,7 @@ export {
   inlinePackSkillInstall,
   insightsSessionLabel,
   inspectEditableArtifactLiveWireEnvelope,
+  installSkill,
   isAcceptedMimeType,
   isAuthoritativeGitHubRepositorySelectionError,
   isBuiltInCapabilityPack,
@@ -16834,6 +17319,7 @@ export {
   listManagedHumanUserResourceAuthorities,
   listRigChangesForApi,
   listRigVersionsForApi,
+  listSkills,
   listWorkspaceCapabilityPacks,
   loadRigDefaultVariableSetEnvironment,
   lockActiveCustomModelForAdmission,
@@ -16900,6 +17386,7 @@ export {
   provisionSandbox,
   publishGovernedLearningEventToSlack,
   readSessionLineage,
+  readSkill,
   recordRigAuditEvent,
   recordVariableSetAuditEvent,
   recordWorkspaceUsage,
@@ -16908,6 +17395,7 @@ export {
   relayDialBaseFromSettings,
   releaseManagedAuthRequestActorLease,
   rememberConfirmationLabel,
+  replayPortableSkillInstall,
   reportSessionUsageRecordingFailure,
   requireAccessContext,
   requireAccessGrant,
@@ -16953,6 +17441,7 @@ export {
   resolveWorkspaceLegacyRuntimePacks,
   resolveWorkspaceModelSelection,
   restoreScheduledTask,
+  restoreSkill,
   retainedProcessBackgroundSettlement,
   revokeManagedHumanUserResourceGrant,
   rigActorForGrant,
@@ -16968,6 +17457,7 @@ export {
   sanitizeSlackPublicationText,
   saveActorNewSessionDraft,
   saveHumanComposerDraft,
+  saveSkill,
   saveWorkspaceMemoryWithSlackPublication,
   scheduledConnectionSurfaceEligibility,
   scheduledSlackBotConnectionId,
@@ -16992,6 +17482,7 @@ export {
   settingsWithRigProviderImage,
   settingsWithSessionMcpServerMetadata,
   signedJsonAutomationAdapter,
+  skillBundleHash,
   stableJson3 as stableJson,
   statusForVoiceInputError,
   steerAgentSession,
@@ -17021,6 +17512,7 @@ export {
   validateOpenGeniSlackBotConnectionSelection,
   validateScheduledTaskMachineTarget,
   validateScheduledTaskTarget,
+  validateSkillFiles,
   validateToolRefs,
   validateToolRefsForSessionPolicy,
   validateVariableSetAttachment,