@taloswork/ose-shared 0.1.15 → 0.1.16

package/skills/document/bin/html2pptx.cjs

@@ -37319,8 +37319,31 @@ ${TEMPLATE_CENTER_JS}
           continue;
         }
         const fill = color(cs.backgroundColor);
-        const bw = parseFloat(cs.borderTopWidth);
-        const borderColor = bw > 0 && cs.borderTopStyle !== "none" ? color(cs.borderTopColor) : undefined;
+        // Borders, per side. Four equal sides \u2192 the rect's own outline. Otherwise
+        // each painted side is its own bar filled with the border color, on the
+        // border-box edge (a lone left rule on a takeaway, a top rule on a card):
+        // reading the top side alone dropped a left rule and outlined all four
+        // sides of a top-only one. The bars are square-ended \u2014 a rounded corner's
+        // curve is not followed.
+        const sides = ["Top", "Right", "Bottom", "Left"].map((s) => {
+          const w = parseFloat(cs["border" + s + "Width"]);
+          const st = cs["border" + s + "Style"];
+          const c = w > 0 && st !== "none" && st !== "hidden" ? color(cs["border" + s + "Color"]) : undefined;
+          return c ? { w, st, c } : null;
+        });
+        const s0 = sides[0];
+        const uniform = s0 && sides.every((s) => s && s.w === s0.w && s.st === s0.st && s.c === s0.c);
+        const borderColor = uniform ? s0.c : undefined;
+        const bw = uniform ? s0.w : 0;
+        const borderBars = uniform ? [] : sides.flatMap((s, i) => {
+          if (!s) return [];
+          const f = rel(r);
+          const bar = i === 0 ? { x: f.x, y: f.y, w: f.w, h: s.w }
+            : i === 1 ? { x: f.x + f.w - s.w, y: f.y, w: s.w, h: f.h }
+            : i === 2 ? { x: f.x, y: f.y + f.h - s.w, w: f.w, h: s.w }
+            : { x: f.x, y: f.y, w: s.w, h: f.h };
+          return [{ kind: "rect", frame: bar, fill: s.c, radiusPx: 0, ...(ea ? { anim: ea } : {}) }];
+        });
         // box-shadow \u2192 native pptx outer shadow: the FIRST NON-INSET layer (computed
         // serialization is "color offX offY blur spread[ inset]", layers comma-joined).
         // An inset layer beside it (cool/apple cards' 1px top highlight) is dropped \u2014
@@ -37358,13 +37381,14 @@ ${TEMPLATE_CENTER_JS}
           elements.push({
             kind: "rect", frame: rel(r), fill, borderColor,
             ...(borderColor ? { borderWidthPx: bw } : {}),
-            ...(borderColor && (cs.borderTopStyle === "dashed" || cs.borderTopStyle === "dotted") ? { borderDash: true } : {}),
+            ...(borderColor && (s0.st === "dashed" || s0.st === "dotted") ? { borderDash: true } : {}),
             ...(shadow ? { shadow } : {}),
             ...(gradient ? { gradient } : {}),
             radiusPx: parseFloat(cs.borderTopLeftRadius) || 0,
             ...(ea ? { anim: ea } : {}),
           });
         }
+        elements.push(...borderBars);
         walk(child);
       }
     };

package/skills/document/bin-reference.md

@@ -60,4 +60,4 @@ Flags and outputs only; the workflow is deck-design.md.
 ## Validate and convert
 
 - `bin/doc-validate.cjs <file.docx|pptx|xlsx|pdf> [--strict] [--design-lint]` — structural validation gate: OOXML zip/parts/rels/Content_Types/XML well-formedness, plus pptx `notes-keynote` (→ `pptx-notes <in> {} <out>`) and docx `docx-default-style` (→ `docx-defaults`); a PDF must parse, open without a password (`pdf-encrypted` error: validate before `pdf-ops encrypt`) and hold at least one page (reports `pages` and a `pdf-parse-only` warning — how it looks is render-and-look's job). Exit 1 = broken, fix before delivering. `--strict` (OOXML only; on a PDF it just adds a `strict-not-applicable` warning) adds full ECMA-376 schema (XSD) validation of every recognised part — REQUIRED after custom-code (doc-run) or raw-XML output; a strict failure means the file is non-standard even if Office opens it. `--design-lint` (pptx only) adds deck-qa's lint as advisory warnings (never changes the exit code; codes under deck-qa in Decks) — real design bugs, fix them.
-- `bin/doc-convert.cjs <in.docx|pptx|xlsx> <out.pdf> [--cache-dir <dir>] [--require-office]` — Office → PDF. **PPTX requires Office**: local `soffice`, then `TALOS_OFFICE_URL` sidecar. Missing Office exits 69; failed Office exits 75. Never rebuild a deck as browser HTML. Spreadsheets also require Office. DOCX can fall back to reconstructed HTML via the app's Chromium or headless Chromium (content retained, layout lost); `--require-office` blocks this fallback. Report the `[pdf (engine)]` result and any caveat. `--cache-dir` (or `TALOS_OFFICE_CACHE_DIR`) reuses the local Office result for identical source bytes; after any PPTX edit, convert again. Fonts come from the Office environment, which must have the required faces for faithful typography.
+- `bin/doc-convert.cjs <in.docx|pptx|xlsx> <out.pdf> [--cache-dir <dir>] [--require-office]` — Office → PDF. **PPTX requires Office**: local `soffice`, then Keynote (Mac) / PowerPoint (Win) for .pptx, then `TALOS_OFFICE_URL` sidecar. Missing Office exits 69; failed Office exits 75. Never rebuild a deck as browser HTML. Spreadsheets also require Office. DOCX can fall back to reconstructed HTML via the app's Chromium or headless Chromium (content retained, layout lost); `--require-office` blocks this fallback. Report the `[pdf (engine)]` result and any caveat. `--cache-dir` (or `TALOS_OFFICE_CACHE_DIR`) reuses the local Office result for identical source bytes; after any PPTX edit, convert again. Fonts come from the Office environment, which must have the required faces for faithful typography.

package/skills/expert-create/LICENSE.txt

@@ -0,0 +1,7 @@
+© 2026 Nexora AI Limited. All rights reserved.
+
+LICENSE: This Skill (including all prompts, reference documents, and other
+components) is proprietary to Nexora AI Limited and provided solely for use
+within the Talos application under your agreement with Nexora AI Limited.
+Redistribution, extraction, or use outside Talos is not permitted without
+prior written consent.

package/skills/expert-create/SKILL.md

@@ -0,0 +1,106 @@
+---
+name: expert-create
+description: "Use when the user wants to create, edit or delete their own expert (an OSE: a named assistant persona with its own role prompt, shown in the expert switcher). Triggers: create an expert / make a new expert / build an assistant for X / edit my expert / change the expert's role / delete my expert, 新建专家 / 创建一个专家 / 做一个XX专家 / 修改专家 / 改一下专家的角色 / 删除专家. Not for installing skills (install_skill) or for switching experts."
+license: Proprietary. LICENSE.txt has complete terms
+---
+
+# Create, edit and delete local experts
+
+An expert is a persona the user switches to: a name, a one-line description,
+an optional English label, up to four starter prompts, and a role prompt
+(`role.md`) that becomes the opening of every conversation with it. Experts the
+user makes here are **local**: only on this machine, editable and deletable.
+Published experts cannot be changed here.
+
+Everything goes through one command, where `<skill>` is this skill's
+directory. The Talos app validates, writes and refreshes the expert list; never
+create or edit expert files yourself, and never state where they live.
+
+```
+node <skill>/bin/expert-create.cjs list
+node <skill>/bin/expert-create.cjs show <id>
+node <skill>/bin/expert-create.cjs create <draft.json>
+node <skill>/bin/expert-create.cjs update <id> <patch.json>
+node <skill>/bin/expert-create.cjs delete <id>
+```
+
+`create`, `update` and `delete` each wait for the user to confirm in a Talos
+dialog that shows what will change; agreeing in the chat does not replace it.
+The dialog stays open for up to 5 minutes (300 seconds), so run these three
+without a `timeout`, or with one of at least 330 seconds. A shorter timeout
+kills the command while the user is still reading the dialog: the dialog
+closes, nothing is written, and running it again opens a second one.
+
+Exit codes:
+
+- 0 done (JSON on stdout).
+- 1 the app refused or failed (read stderr; if it names a field, fix it and
+  retry).
+- 3 the user said no in the dialog; nothing was written.
+- 4 the dialog went unanswered and closed after 5 minutes; nothing was written.
+- 5 `update` would change nothing: the patch matches the expert as it is. No
+  dialog was shown and nothing was written; tell the user it already reads
+  that way.
+- 64 usage; 66/65 the JSON file could not be read or parsed.
+- 69 the Talos app is not reachable or not ready — not running inside Talos,
+  this is a scheduled task, a sub-agent or a channel session (which cannot
+  change experts), or Talos was starting or switched profile. Nothing was
+  written. Do not retry; tell the user, and do not work around it.
+
+## Draft JSON
+
+```json
+{
+  "name": "Sales Coach",
+  "desc": "Coaches sales calls",
+  "role": "…the full role.md…",
+  "en": { "name": "Sales Coach", "desc": "Coaches sales calls" },
+  "demos": [{ "label": "Review a call", "output": "PDF", "icon": "search", "seed": "…" }]
+}
+```
+
+Limits the app enforces: `name`, `desc`, `en.name`, `en.desc` and each demo
+`label` are one line (no line breaks); `name` ≤ 24 characters; `desc` ≤ 20
+characters when it contains Chinese/Japanese/Korean text or full-width
+punctuation, otherwise ≤ 38; `en.name` ≤ 40, `en.desc` ≤ 38; `role` up to 32 KiB; at most 4 `demos`, each with a
+`label` and a `seed` (≤ 420 characters, a prompt that stands alone), `icon` one
+of search, file, image, clock, code, chart, table, bug. A patch for `update`
+holds only the fields that change.
+
+## Creating
+
+1. Ask, in one message, what the expert is for: who uses it, the work it does,
+   the output it should produce, and anything it must or must not do. Do not
+   ask one question at a time.
+2. Draft every field. Write `role` following `references/role-guide.md`.
+   Write the name, description and demos in the language the user speaks; add
+   `en` when that language is not English.
+3. Show the user the name, description, demos and the full role, and revise
+   until they confirm. Do not create before they confirm.
+4. Write the draft to a JSON file in the working directory and run `create`;
+   Talos asks the user to confirm. Exit 3 means they said no — ask what to
+   change. On success, report the expert's name. Offer to switch to it — switching is the user's
+   action in the expert switcher.
+5. The new expert starts with the shared skills only. If the work needs more,
+   say which skills would help; installing them is a separate step.
+
+## Editing
+
+Run `show <id>` (get the id from `list`), change only what the user asked for,
+show the before and after of each changed field, and after confirmation run
+`update` with a patch of just those fields. Talos shows the user the change in
+its own dialog and keeps the version it replaces; exit 3 means they said no.
+An edit to the expert in use takes effect from the next message.
+
+## Deleting
+
+Say what goes: the expert itself. Its conversations stay on this machine but will no longer appear in Talos. Deleting the expert currently in use
+switches the user back to the default expert once this reply ends. Deleting
+the expert this conversation is with ends the conversation: finish your reply,
+and tell the user to continue with another expert, because Talos refuses any
+further message here.
+Then run `delete <id>`; Talos asks the user to confirm in its own dialog. Exit 3
+means they said no — leave it there.
+
+For any of the three, exit 4 means the dialog went unanswered and closed after
+5 minutes; nothing was written — ask the user before trying again.

package/skills/expert-create/bin/expert-create.cjs

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+// expert-create — thin client for the Talos app's local expert service.
+// All validation and every file write happen in the app; this only forwards.
+//
+//   expert-create list
+//   expert-create show <id>
+//   expert-create create <draft.json>   (Talos asks the user to confirm)
+//   expert-create update <id> <patch.json>   (Talos asks the user to confirm)
+//   expert-create delete <id>          (Talos asks the user to confirm)
+"use strict";
+const { readFileSync } = require("node:fs");
+const http = require("node:http");
+
+function die(message, code) { process.stderr.write(`expert-create: ${message}\n`); process.exit(code); }
+const USAGE = "usage: expert-create list | show <id> | create <draft.json> | update <id> <patch.json> | delete <id>";
+
+function readJson(path) {
+  let raw;
+  try { raw = readFileSync(path, "utf8"); } catch (e) { die(`cannot read ${path}: ${e.message}`, 66); }
+  try { return JSON.parse(raw); } catch (e) { die(`${path} is not valid JSON: ${e.message}`, 65); }
+}
+
+function request(argv) {
+  const [action, a, b] = argv;
+  switch (action) {
+    case "list": return { action };
+    case "show": case "delete": if (!a) die(USAGE, 64); return { action, id: a };
+    case "create": if (!a) die(USAGE, 64); return { action, draft: readJson(a) };
+    case "update": if (!a || !b) die(USAGE, 64); return { action, id: a, patch: readJson(b) };
+    default: die(USAGE, 64);
+  }
+}
+
+// What a refused or unanswered confirmation left undone, per action.
+const UNDONE = {
+  create: ["creation", "created"],
+  update: ["edit", "changed"],
+  delete: ["deletion", "deleted"],
+};
+
+function errorCode(text) {
+  try { return JSON.parse(text).error; } catch { return undefined; }
+}
+function messageOf(text) {
+  try { const m = JSON.parse(text).message; return typeof m === "string" ? m : undefined; } catch { return undefined; }
+}
+
+// node:http, not global fetch: fetch (undici) drops a response whose headers
+// take over 300 s, and a create, update or delete waits on the user's
+// confirmation for up to 5 minutes. The app ends that wait itself (HTTP 408).
+function post(url, token, body) {
+  return new Promise((resolve, reject) => {
+    const payload = Buffer.from(JSON.stringify(body));
+    const req = http.request(`${url}/expert`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "content-length": payload.length },
+    }, (res) => {
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("end", () => resolve({ status: res.statusCode ?? 0, text: Buffer.concat(chunks).toString("utf8") }));
+      res.on("error", reject);
+    });
+    req.on("error", reject);
+    req.end(payload);
+  });
+}
+
+async function main() {
+  const body = request(process.argv.slice(2));
+  const url = process.env.TALOS_EXPERT_URL;
+  const token = process.env.TALOS_EXPERT_TOKEN;
+  // Talos hands these only to a conversation with the user; a scheduled task,
+  // a sub-agent or a channel session never has them.
+  if (!url || !token) die("this needs the Talos app and a conversation with the user (TALOS_EXPERT_URL is not set). Scheduled tasks and sub-agents cannot change experts; do not write expert files yourself.", 69);
+  let res;
+  try {
+    res = await post(url, token, body);
+  } catch (e) { die(`cannot reach the Talos app: ${e.message}`, 69); }
+  const { status, text } = res;
+  const undone = UNDONE[body.action];
+  const error = errorCode(text);
+  if (undone && status === 409 && error === "cancelled_by_user") die(`the user cancelled the ${undone[0]}; nothing was ${undone[1]}`, 3);
+  if (undone && status === 408) die(`confirmation timed out; nothing was ${undone[1]}`, 4);
+  // The update would leave the expert as it is: the app wrote nothing and
+  // asked the user nothing.
+  if (status === 422 && error === "no_change") die(`${messageOf(text) ?? "the patch changes nothing"}; nothing was changed`, 5);
+  // Talos itself is not ready (no runtime yet, or the profile changed while
+  // the dialog was open). Not the request's fault, so not exit 1 ("fix the
+  // field and retry"): a retry would ask the user again about a runtime that
+  // is not the one they were shown.
+  if (status === 503 && error === "not_ready") die(`the Talos app is not ready (it is starting or switched profile); nothing was ${undone ? undone[1] : "done"}. Do not retry; tell the user.`, 69);
+  if (status < 200 || status >= 300) die(`HTTP ${status}${text ? `: ${text}` : ""}`, 1);
+  process.stdout.write(`${text}\n`);
+}
+
+main();

package/skills/expert-create/references/role-guide.md

@@ -0,0 +1,24 @@
+# Writing an expert's role
+
+The role is the first thing the model reads in every conversation with this
+expert, before Talos's own rules and tools. Keep it about the domain and the
+voice; Talos already explains its tools, files and safety rules — do not repeat
+or override them.
+
+Structure, in this order, as plain Markdown:
+
+1. **Who you are** — one or two sentences: the role, who it serves.
+2. **What you do** — the concrete jobs, as a short list.
+3. **How you work** — the method: what to check first, what to ask the user
+   before starting, the order of work, the quality bar.
+4. **What you deliver** — formats and shapes of the output (a PDF report, an
+   Excel model, a list of options with a recommendation).
+5. **Boundaries** — what this expert does not do, and when to say so.
+
+Rules:
+- Write instructions to the model ("Ask for the target market before…"), not a
+  description of a product.
+- Be specific to the domain; a generic "be helpful and accurate" adds nothing.
+- No tool names, file paths or claims about Talos features — they change and
+  the role would mislead.
+- Under ~600 words is usually enough; length is not quality.

package/skills/image-layout/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: image-layout
-description: "Use when EXISTING images (files already on disk) are combined or altered as pixels: 拼图 / 拼接 / 宫格 / 九宫格 / 长图 / 对比图 / 加水印 / 加标签 / 裁剪 / 圆角 / 缩放, stitch / combine / collage / contact sheet / side-by-side / before-after / watermark / label / crop / resize. The mechanical test: if the images do not exist as files yet, this is NOT the skill. Do NOT trigger for generating NEW images, INCLUDING when the request names a layout word ('生成一张九宫格的图' is one generated picture); documents (document skill); Xiaohongshu cards (talos-xhs-ops); or upscaling / background removal, which need a model."
+description: "Use when EXISTING images (files already on disk) are combined or altered as pixels: 拼图 / 拼接 / 宫格 / 九宫格 / 长图 / 对比图 / 加水印 / 加标签 / 裁剪 / 圆角 / 缩放, stitch / combine / collage / contact sheet / side-by-side / before-after / watermark / label / crop / resize. The mechanical test: if the images do not exist as files yet, this is NOT the skill. Do NOT trigger for generating NEW images, INCLUDING when the request names a layout word ('生成一张九宫格的图' is one generated picture); documents (document skill); social-post cards (social-cards); or upscaling / background removal, which need a model."
 license: Proprietary. LICENSE.txt has complete terms
 ---
 
@@ -146,7 +146,7 @@ tool.
   creates imagery, it only arranges what exists.
 - **A PDF / Word / PowerPoint deliverable** → the document skill (`doc-gen`,
   `html2pptx`). Do not build a "poster" here and call it a document.
-- **Xiaohongshu campaign cards** → `talos-xhs-ops` (`render-cards`), which owns
-  the 1080×1440 card format and its QA.
+- **Cards for a social post** → `social-cards` (`render`), which owns card
+  templates, every platform's card size and their QA.
 - **Pixel-level algorithms** — background removal, super-resolution,
   content-aware fill. CSS cannot do these; they need a model.