@wipcomputer/wip-ldm-os 0.4.73-alpha.11 → 0.4.73-alpha.13

package/dist/bridge/{chunk-LF7EMFBY.js → chunk-RUQEH7GZ.js}

@@ -6,6 +6,27 @@ import { homedir } from "os";
 import { promisify } from "util";
 import { randomUUID } from "crypto";
 var execAsync = promisify(exec);
+var GATEWAY_HOST = "127.0.0.1";
+var DEFAULT_GATEWAY_PORT = 18789;
+var DEFAULT_INBOX_PORT = 18790;
+var GATEWAY_TIMEOUT_MS = 15e3;
+var OP_CLI_TIMEOUT_MS = 1e4;
+var EMBEDDING_API_URL = "https://api.openai.com/v1/embeddings";
+var DEFAULT_EMBEDDING_MODEL = "text-embedding-3-small";
+var DEFAULT_EMBEDDING_DIMS = 1536;
+var VECTOR_SEARCH_ROW_LIMIT = 1e3;
+var RECENCY_DECAY_RATE = 0.01;
+var RECENCY_FLOOR = 0.5;
+var FRESHNESS_FRESH_DAYS = 3;
+var FRESHNESS_RECENT_DAYS = 7;
+var FRESHNESS_AGING_DAYS = 14;
+var DEFAULT_SEARCH_LIMIT = 5;
+var WORKSPACE_MAX_DEPTH = 4;
+var WORKSPACE_MAX_EXCERPTS = 5;
+var WORKSPACE_MAX_RESULTS = 10;
+var SKILL_EXEC_TIMEOUT_MS = 12e4;
+var SKILL_EXEC_MAX_BUFFER = 10 * 1024 * 1024;
+var MS_PER_DAY = 1e3 * 60 * 60 * 24;
 var HOME = process.env.HOME || homedir();
 var LDM_ROOT = process.env.LDM_ROOT || join(HOME, ".ldm");
 function resolveConfig(overrides) {
@@ -14,9 +35,9 @@ function resolveConfig(overrides) {
     openclawDir,
     workspaceDir: overrides?.workspaceDir || join(openclawDir, "workspace"),
     dbPath: overrides?.dbPath || join(openclawDir, "memory", "context-embeddings.sqlite"),
-    inboxPort: overrides?.inboxPort || parseInt(process.env.LESA_BRIDGE_INBOX_PORT || "18790", 10),
-    embeddingModel: overrides?.embeddingModel || "text-embedding-3-small",
-    embeddingDimensions: overrides?.embeddingDimensions || 1536
+    inboxPort: overrides?.inboxPort || parseInt(process.env.LESA_BRIDGE_INBOX_PORT || String(DEFAULT_INBOX_PORT), 10),
+    embeddingModel: overrides?.embeddingModel || DEFAULT_EMBEDDING_MODEL,
+    embeddingDimensions: overrides?.embeddingDimensions || DEFAULT_EMBEDDING_DIMS
   };
 }
 function resolveConfigMulti(overrides) {
@@ -29,9 +50,9 @@ function resolveConfigMulti(overrides) {
         openclawDir,
         workspaceDir: raw.workspaceDir || overrides?.workspaceDir || join(openclawDir, "workspace"),
         dbPath: raw.dbPath || overrides?.dbPath || join(openclawDir, "memory", "context-embeddings.sqlite"),
-        inboxPort: raw.inboxPort || overrides?.inboxPort || parseInt(process.env.LESA_BRIDGE_INBOX_PORT || "18790", 10),
-        embeddingModel: raw.embeddingModel || overrides?.embeddingModel || "text-embedding-3-small",
-        embeddingDimensions: raw.embeddingDimensions || overrides?.embeddingDimensions || 1536
+        inboxPort: raw.inboxPort || overrides?.inboxPort || parseInt(process.env.LESA_BRIDGE_INBOX_PORT || String(DEFAULT_INBOX_PORT), 10),
+        embeddingModel: raw.embeddingModel || overrides?.embeddingModel || DEFAULT_EMBEDDING_MODEL,
+        embeddingDimensions: raw.embeddingDimensions || overrides?.embeddingDimensions || DEFAULT_EMBEDDING_DIMS
       };
     } catch {
     }
@@ -53,7 +74,7 @@ function resolveApiKey(openclawDir) {
         `op read "op://Agent Secrets/OpenAI API/api key" 2>/dev/null`,
         {
           env: { ...process.env, OP_SERVICE_ACCOUNT_TOKEN: saToken },
-          timeout: 1e4,
+          timeout: OP_CLI_TIMEOUT_MS,
           encoding: "utf-8"
         }
       ).trim();
@@ -76,7 +97,7 @@ function resolveGatewayConfig(openclawDir) {
   }
   const config = JSON.parse(readFileSync(configPath, "utf-8"));
   const token = config?.gateway?.auth?.token;
-  const port = config?.gateway?.port || 18789;
+  const port = config?.gateway?.port || DEFAULT_GATEWAY_PORT;
   if (!token) {
     throw new Error("No gateway.auth.token found in openclaw.json");
   }
@@ -262,37 +283,54 @@ async function sendMessage(openclawDir, message, options) {
   const { token, port } = resolveGatewayConfig(openclawDir);
   const agentId = options?.agentId || "main";
   const senderLabel = options?.senderLabel || "Claude Code";
-  const response = await fetch(`http://127.0.0.1:${port}/v1/chat/completions`, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
-      "x-openclaw-scopes": "operator.read,operator.write",
-      "x-openclaw-session-key": `agent:${agentId}:main`
-    },
-    body: JSON.stringify({
-      model: `openclaw/${agentId}`,
-      messages: [
-        {
-          role: "user",
-          content: `[${senderLabel}]: ${message}`
-        }
-      ]
-    })
-  });
-  if (!response.ok) {
-    const body = await response.text();
-    throw new Error(`Gateway returned ${response.status}: ${body}`);
-  }
-  const data = await response.json();
-  const reply = data.choices?.[0]?.message?.content;
-  if (!reply) {
-    throw new Error("No response content from gateway");
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), GATEWAY_TIMEOUT_MS);
+  try {
+    const response = await fetch(
+      `http://${GATEWAY_HOST}:${port}/v1/chat/completions`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json",
+          "x-openclaw-scopes": "operator.read,operator.write",
+          "x-openclaw-session-key": `agent:${agentId}:main`
+        },
+        body: JSON.stringify({
+          model: `openclaw/${agentId}`,
+          messages: [
+            {
+              role: "user",
+              content: `[${senderLabel}]: ${message}`
+            }
+          ]
+        }),
+        signal: controller.signal
+      }
+    );
+    clearTimeout(timeoutId);
+    if (!response.ok) {
+      const body = await response.text();
+      throw new Error(`Gateway returned ${response.status}: ${body}`);
+    }
+    const data = await response.json();
+    const reply = data.choices?.[0]?.message?.content;
+    if (!reply) {
+      throw new Error("No response content from gateway");
+    }
+    return reply;
+  } catch (err) {
+    clearTimeout(timeoutId);
+    if (err.name === "AbortError") {
+      throw new Error(
+        "Gateway timeout: Lesa may be busy or the gateway is processing another request. Try again in a moment."
+      );
+    }
+    throw err;
   }
-  return reply;
 }
-async function getQueryEmbedding(text, apiKey, model = "text-embedding-3-small", dimensions = 1536) {
-  const response = await fetch("https://api.openai.com/v1/embeddings", {
+async function getQueryEmbedding(text, apiKey, model = DEFAULT_EMBEDDING_MODEL, dimensions = DEFAULT_EMBEDDING_DIMS) {
+  const response = await fetch(EMBEDDING_API_URL, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${apiKey}`,
@@ -331,15 +369,15 @@ function cosineSimilarity(a, b) {
   return denom === 0 ? 0 : dot / denom;
 }
 function recencyWeight(ageDays) {
-  return Math.max(0.5, 1 - ageDays * 0.01);
+  return Math.max(RECENCY_FLOOR, 1 - ageDays * RECENCY_DECAY_RATE);
 }
 function freshnessLabel(ageDays) {
-  if (ageDays < 3) return "fresh";
-  if (ageDays < 7) return "recent";
-  if (ageDays < 14) return "aging";
+  if (ageDays < FRESHNESS_FRESH_DAYS) return "fresh";
+  if (ageDays < FRESHNESS_RECENT_DAYS) return "recent";
+  if (ageDays < FRESHNESS_AGING_DAYS) return "aging";
   return "stale";
 }
-async function searchConversations(config, query, limit = 5) {
+async function searchConversations(config, query, limit = DEFAULT_SEARCH_LIMIT) {
   const Database = (await import("better-sqlite3")).default;
   if (!existsSync(config.dbPath)) {
     throw new Error(`Database not found: ${config.dbPath}`);
@@ -360,12 +398,12 @@ async function searchConversations(config, query, limit = 5) {
            FROM conversation_chunks
            WHERE embedding IS NOT NULL
            ORDER BY timestamp DESC
-           LIMIT 1000`
+           LIMIT ${VECTOR_SEARCH_ROW_LIMIT}`
       ).all();
       const now = Date.now();
       return rows.map((row) => {
         const cosine = cosineSimilarity(queryEmbedding, blobToEmbedding(row.embedding));
-        const ageDays = (now - row.timestamp) / (1e3 * 60 * 60 * 24);
+        const ageDays = (now - row.timestamp) / MS_PER_DAY;
         const weight = recencyWeight(ageDays);
         return {
           text: row.chunk_text,
@@ -396,7 +434,7 @@ async function searchConversations(config, query, limit = 5) {
     db.close();
   }
 }
-function findMarkdownFiles(dir, maxDepth = 4, depth = 0) {
+function findMarkdownFiles(dir, maxDepth = WORKSPACE_MAX_DEPTH, depth = 0) {
   if (depth > maxDepth || !existsSync(dir)) return [];
   const files = [];
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
@@ -426,7 +464,7 @@ function searchWorkspace(workspaceDir, query) {
       if (score === 0) continue;
       const lines = content.split("\n");
       const excerpts = [];
-      for (let i = 0; i < lines.length && excerpts.length < 5; i++) {
+      for (let i = 0; i < lines.length && excerpts.length < WORKSPACE_MAX_EXCERPTS; i++) {
         const lineLower = lines[i].toLowerCase();
         if (words.some((w) => lineLower.includes(w))) {
           const start = Math.max(0, i - 1);
@@ -438,7 +476,7 @@ function searchWorkspace(workspaceDir, query) {
     } catch {
     }
   }
-  return results.sort((a, b) => b.score - a.score).slice(0, 10);
+  return results.sort((a, b) => b.score - a.score).slice(0, WORKSPACE_MAX_RESULTS);
 }
 function parseSkillFrontmatter(content) {
   const match = content.match(/^---\n([\s\S]*?)\n---/);
@@ -532,9 +570,8 @@ async function executeSkillScript(skillDir, scripts, scriptName, args) {
       `${interpreter} "${scriptPath}" ${args}`,
       {
         env: { ...process.env },
-        timeout: 12e4,
-        maxBuffer: 10 * 1024 * 1024
-        // 10MB
+        timeout: SKILL_EXEC_TIMEOUT_MS,
+        maxBuffer: SKILL_EXEC_MAX_BUFFER
       }
     );
     return stdout || stderr || "(no output)";

package/dist/bridge/cli.js

@@ -8,7 +8,7 @@ import {
   searchConversations,
   searchWorkspace,
   sendMessage
-} from "./chunk-LF7EMFBY.js";
+} from "./chunk-RUQEH7GZ.js";
 
 // cli.ts
 import { existsSync, statSync } from "fs";

package/dist/bridge/core.js

@@ -23,7 +23,7 @@ import {
   sendLdmMessage,
   sendMessage,
   setSessionIdentity
-} from "./chunk-LF7EMFBY.js";
+} from "./chunk-RUQEH7GZ.js";
 export {
   LDM_ROOT,
   blobToEmbedding,

package/dist/bridge/mcp-server.js

@@ -15,7 +15,7 @@ import {
   sendLdmMessage,
   sendMessage,
   setSessionIdentity
-} from "./chunk-LF7EMFBY.js";
+} from "./chunk-RUQEH7GZ.js";
 
 // mcp-server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.4.73-alpha.11",
+  "version": "0.4.73-alpha.13",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "engines": {

package/src/bridge/core.ts

@@ -10,6 +10,31 @@ import { randomUUID } from "node:crypto";
 
 const execAsync = promisify(exec);
 
+// ── Settings ─────────────────────────────────────────────────────────
+// All tunable constants in one place. No magic numbers below this block.
+
+const GATEWAY_HOST = "127.0.0.1";
+const DEFAULT_GATEWAY_PORT = 18_789;         // openclaw.json gateway.port fallback
+const DEFAULT_INBOX_PORT = 18_790;           // env LESA_BRIDGE_INBOX_PORT fallback
+const GATEWAY_TIMEOUT_MS = 15_000;           // max wait for gateway chat response
+const OP_CLI_TIMEOUT_MS = 10_000;            // max wait for 1Password CLI
+const EMBEDDING_API_URL = "https://api.openai.com/v1/embeddings";
+const DEFAULT_EMBEDDING_MODEL = "text-embedding-3-small";
+const DEFAULT_EMBEDDING_DIMS = 1_536;
+const VECTOR_SEARCH_ROW_LIMIT = 1_000;       // max rows scanned for cosine ranking
+const RECENCY_DECAY_RATE = 0.01;             // per-day decay multiplier
+const RECENCY_FLOOR = 0.5;                   // minimum recency weight
+const FRESHNESS_FRESH_DAYS = 3;
+const FRESHNESS_RECENT_DAYS = 7;
+const FRESHNESS_AGING_DAYS = 14;
+const DEFAULT_SEARCH_LIMIT = 5;              // default results for searchConversations
+const WORKSPACE_MAX_DEPTH = 4;               // findMarkdownFiles recursion limit
+const WORKSPACE_MAX_EXCERPTS = 5;            // max excerpts per file in search
+const WORKSPACE_MAX_RESULTS = 10;            // max files returned from workspace search
+const SKILL_EXEC_TIMEOUT_MS = 120_000;       // max wait for skill script execution
+const SKILL_EXEC_MAX_BUFFER = 10 * 1024 * 1024; // 10 MB stdout/stderr cap
+const MS_PER_DAY = 1_000 * 60 * 60 * 24;
+
 // ── Constants ─────────────────────────────────────────────────────────
 
 const HOME = process.env.HOME || homedir();
@@ -66,9 +91,9 @@ export function resolveConfig(overrides?: Partial<BridgeConfig>): BridgeConfig {
     openclawDir,
     workspaceDir: overrides?.workspaceDir || join(openclawDir, "workspace"),
     dbPath: overrides?.dbPath || join(openclawDir, "memory", "context-embeddings.sqlite"),
-    inboxPort: overrides?.inboxPort || parseInt(process.env.LESA_BRIDGE_INBOX_PORT || "18790", 10),
-    embeddingModel: overrides?.embeddingModel || "text-embedding-3-small",
-    embeddingDimensions: overrides?.embeddingDimensions || 1536,
+    inboxPort: overrides?.inboxPort || parseInt(process.env.LESA_BRIDGE_INBOX_PORT || String(DEFAULT_INBOX_PORT), 10),
+    embeddingModel: overrides?.embeddingModel || DEFAULT_EMBEDDING_MODEL,
+    embeddingDimensions: overrides?.embeddingDimensions || DEFAULT_EMBEDDING_DIMS,
   };
 }
 
@@ -88,9 +113,9 @@ export function resolveConfigMulti(overrides?: Partial<BridgeConfig>): BridgeCon
         openclawDir,
         workspaceDir: raw.workspaceDir || overrides?.workspaceDir || join(openclawDir, "workspace"),
         dbPath: raw.dbPath || overrides?.dbPath || join(openclawDir, "memory", "context-embeddings.sqlite"),
-        inboxPort: raw.inboxPort || overrides?.inboxPort || parseInt(process.env.LESA_BRIDGE_INBOX_PORT || "18790", 10),
-        embeddingModel: raw.embeddingModel || overrides?.embeddingModel || "text-embedding-3-small",
-        embeddingDimensions: raw.embeddingDimensions || overrides?.embeddingDimensions || 1536,
+        inboxPort: raw.inboxPort || overrides?.inboxPort || parseInt(process.env.LESA_BRIDGE_INBOX_PORT || String(DEFAULT_INBOX_PORT), 10),
+        embeddingModel: raw.embeddingModel || overrides?.embeddingModel || DEFAULT_EMBEDDING_MODEL,
+        embeddingDimensions: raw.embeddingDimensions || overrides?.embeddingDimensions || DEFAULT_EMBEDDING_DIMS,
       };
     } catch {
       // LDM config unreadable, fall through to legacy
@@ -123,7 +148,7 @@ export function resolveApiKey(openclawDir: string): string | null {
         `op read "op://Agent Secrets/OpenAI API/api key" 2>/dev/null`,
         {
           env: { ...process.env, OP_SERVICE_ACCOUNT_TOKEN: saToken },
-          timeout: 10000,
+          timeout: OP_CLI_TIMEOUT_MS,
           encoding: "utf-8",
         }
       ).trim();
@@ -154,7 +179,7 @@ export function resolveGatewayConfig(openclawDir: string): GatewayConfig {
 
   const config = JSON.parse(readFileSync(configPath, "utf-8"));
   const token = config?.gateway?.auth?.token;
-  const port = config?.gateway?.port || 18789;
+  const port = config?.gateway?.port || DEFAULT_GATEWAY_PORT;
 
   if (!token) {
     throw new Error("No gateway.auth.token found in openclaw.json");
@@ -459,40 +484,58 @@ export async function sendMessage(
   // Send user: "main" to route to the main session (agent:main:main).
   // This ensures Parker sees CC's messages in the same stream as iMessage.
   // The OpenClaw gateway treats user: "main" as "use the default session."
-  const response = await fetch(`http://127.0.0.1:${port}/v1/chat/completions`, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
-      "x-openclaw-scopes": "operator.read,operator.write",
-      "x-openclaw-session-key": `agent:${agentId}:main`,
-    },
-    body: JSON.stringify({
-      model: `openclaw/${agentId}`,
-      messages: [
-        {
-          role: "user",
-          content: `[${senderLabel}]: ${message}`,
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), GATEWAY_TIMEOUT_MS);
+
+  try {
+    const response = await fetch(
+      `http://${GATEWAY_HOST}:${port}/v1/chat/completions`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json",
+          "x-openclaw-scopes": "operator.read,operator.write",
+          "x-openclaw-session-key": `agent:${agentId}:main`,
         },
-      ],
-    }),
-  });
+        body: JSON.stringify({
+          model: `openclaw/${agentId}`,
+          messages: [
+            {
+              role: "user",
+              content: `[${senderLabel}]: ${message}`,
+            },
+          ],
+        }),
+        signal: controller.signal,
+      }
+    );
+    clearTimeout(timeoutId);
 
-  if (!response.ok) {
-    const body = await response.text();
-    throw new Error(`Gateway returned ${response.status}: ${body}`);
-  }
+    if (!response.ok) {
+      const body = await response.text();
+      throw new Error(`Gateway returned ${response.status}: ${body}`);
+    }
 
-  const data = (await response.json()) as {
-    choices: Array<{ message: { content: string } }>;
-  };
+    const data = (await response.json()) as {
+      choices: Array<{ message: { content: string } }>;
+    };
 
-  const reply = data.choices?.[0]?.message?.content;
-  if (!reply) {
-    throw new Error("No response content from gateway");
-  }
+    const reply = data.choices?.[0]?.message?.content;
+    if (!reply) {
+      throw new Error("No response content from gateway");
+    }
 
-  return reply;
+    return reply;
+  } catch (err: any) {
+    clearTimeout(timeoutId);
+    if (err.name === "AbortError") {
+      throw new Error(
+        "Gateway timeout: Lesa may be busy or the gateway is processing another request. Try again in a moment."
+      );
+    }
+    throw err;
+  }
 }
 
 // ── Embedding helpers ────────────────────────────────────────────────
@@ -500,10 +543,10 @@ export async function sendMessage(
 export async function getQueryEmbedding(
   text: string,
   apiKey: string,
-  model = "text-embedding-3-small",
-  dimensions = 1536
+  model = DEFAULT_EMBEDDING_MODEL,
+  dimensions = DEFAULT_EMBEDDING_DIMS
 ): Promise<number[]> {
-  const response = await fetch("https://api.openai.com/v1/embeddings", {
+  const response = await fetch(EMBEDDING_API_URL, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${apiKey}`,
@@ -549,15 +592,15 @@ export function cosineSimilarity(a: number[], b: number[]): number {
 // ── Recency scoring ─────────────────────────────────────────────────
 
 function recencyWeight(ageDays: number): number {
-  // Linear decay with floor at 0.5. Old stuff never fully disappears
+  // Linear decay with floor. Old stuff never fully disappears
   // but fresh context wins ties. ~50 days to hit the floor.
-  return Math.max(0.5, 1.0 - ageDays * 0.01);
+  return Math.max(RECENCY_FLOOR, 1.0 - ageDays * RECENCY_DECAY_RATE);
 }
 
 function freshnessLabel(ageDays: number): "fresh" | "recent" | "aging" | "stale" {
-  if (ageDays < 3) return "fresh";
-  if (ageDays < 7) return "recent";
-  if (ageDays < 14) return "aging";
+  if (ageDays < FRESHNESS_FRESH_DAYS) return "fresh";
+  if (ageDays < FRESHNESS_RECENT_DAYS) return "recent";
+  if (ageDays < FRESHNESS_AGING_DAYS) return "aging";
   return "stale";
 }
 
@@ -566,7 +609,7 @@ function freshnessLabel(ageDays: number): "fresh" | "recent" | "aging" | "stale"
 export async function searchConversations(
   config: BridgeConfig,
   query: string,
-  limit = 5
+  limit = DEFAULT_SEARCH_LIMIT
 ): Promise<ConversationResult[]> {
   // Lazy import to avoid requiring better-sqlite3 if not needed
   const Database = (await import("better-sqlite3")).default;
@@ -593,7 +636,7 @@ export async function searchConversations(
            FROM conversation_chunks
            WHERE embedding IS NOT NULL
            ORDER BY timestamp DESC
-           LIMIT 1000`
+           LIMIT ${VECTOR_SEARCH_ROW_LIMIT}`
         )
         .all() as Array<{
         chunk_text: string;
@@ -607,7 +650,7 @@ export async function searchConversations(
       return rows
         .map((row) => {
           const cosine = cosineSimilarity(queryEmbedding, blobToEmbedding(row.embedding));
-          const ageDays = (now - row.timestamp) / (1000 * 60 * 60 * 24);
+          const ageDays = (now - row.timestamp) / MS_PER_DAY;
           const weight = recencyWeight(ageDays);
           return {
             text: row.chunk_text,
@@ -652,7 +695,7 @@ export async function searchConversations(
 
 // ── Workspace search ─────────────────────────────────────────────────
 
-export function findMarkdownFiles(dir: string, maxDepth = 4, depth = 0): string[] {
+export function findMarkdownFiles(dir: string, maxDepth = WORKSPACE_MAX_DEPTH, depth = 0): string[] {
   if (depth > maxDepth || !existsSync(dir)) return [];
 
   const files: string[] = [];
@@ -687,7 +730,7 @@ export function searchWorkspace(workspaceDir: string, query: string): WorkspaceS
 
       const lines = content.split("\n");
       const excerpts: string[] = [];
-      for (let i = 0; i < lines.length && excerpts.length < 5; i++) {
+      for (let i = 0; i < lines.length && excerpts.length < WORKSPACE_MAX_EXCERPTS; i++) {
         const lineLower = lines[i].toLowerCase();
         if (words.some((w) => lineLower.includes(w))) {
           const start = Math.max(0, i - 1);
@@ -702,7 +745,7 @@ export function searchWorkspace(workspaceDir: string, query: string): WorkspaceS
     }
   }
 
-  return results.sort((a, b) => b.score - a.score).slice(0, 10);
+  return results.sort((a, b) => b.score - a.score).slice(0, WORKSPACE_MAX_RESULTS);
 }
 
 // ── Read workspace file ──────────────────────────────────────────────
@@ -858,8 +901,8 @@ export async function executeSkillScript(
       `${interpreter} "${scriptPath}" ${args}`,
       {
         env: { ...process.env },
-        timeout: 120000,
-        maxBuffer: 10 * 1024 * 1024, // 10MB
+        timeout: SKILL_EXEC_TIMEOUT_MS,
+        maxBuffer: SKILL_EXEC_MAX_BUFFER,
       }
     );
     return stdout || stderr || "(no output)";

package/src/hosted-mcp/deploy.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# deploy.sh: Deploy hosted MCP server to wip.computer
+#
+# Prerequisites:
+#   - SSH config has Host wip.computer
+#   - pm2 installed on the server
+#   - nginx configured on the server
+#
+# Usage: bash deploy.sh
+
+set -euo pipefail
+
+REMOTE="wip.computer"
+REMOTE_DIR="/var/www/wip.computer/app/mcp-server"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+echo "Deploying hosted MCP server to ${REMOTE}..."
+
+# 1. Create remote directory structure
+echo "Creating remote directories..."
+ssh "${REMOTE}" "mkdir -p ${REMOTE_DIR}/inbox"
+
+# 2. Copy server files
+echo "Copying files..."
+scp "${SCRIPT_DIR}/server.mjs" "${REMOTE}:${REMOTE_DIR}/"
+scp "${SCRIPT_DIR}/inbox.mjs" "${REMOTE}:${REMOTE_DIR}/"
+scp "${SCRIPT_DIR}/tools.mjs" "${REMOTE}:${REMOTE_DIR}/"
+scp "${SCRIPT_DIR}/package.json" "${REMOTE}:${REMOTE_DIR}/"
+
+# 3. Install dependencies
+echo "Installing dependencies..."
+ssh "${REMOTE}" "cd ${REMOTE_DIR} && npm install --omit=dev"
+
+# 4. Register with pm2 (restart if already running)
+echo "Starting with pm2..."
+ssh "${REMOTE}" "cd ${REMOTE_DIR} && pm2 delete mcp-server 2>/dev/null || true && pm2 start server.mjs --name mcp-server && pm2 save"
+
+# 5. Configure nginx reverse proxy
+echo "Configuring nginx..."
+ssh "${REMOTE}" "cat > /tmp/mcp-server.conf << 'NGINX'
+# MCP server reverse proxy
+# Location block to add inside the wip.computer server block
+location /mcp {
+    proxy_pass http://127.0.0.1:18800/mcp;
+    proxy_http_version 1.1;
+    proxy_set_header Host \$host;
+    proxy_set_header X-Real-IP \$remote_addr;
+    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto \$scheme;
+
+    # SSE support (for MCP Streamable HTTP GET streams)
+    proxy_set_header Connection '';
+    proxy_buffering off;
+    proxy_cache off;
+    proxy_read_timeout 86400;
+    chunked_transfer_encoding on;
+}
+NGINX
+"
+
+echo ""
+echo "nginx config written to /tmp/mcp-server.conf on the server."
+echo "To activate, add it to your server block and reload:"
+echo "  ssh ${REMOTE} 'sudo cp /tmp/mcp-server.conf /etc/nginx/snippets/mcp-server.conf'"
+echo "  # Then include it in your server block: include snippets/mcp-server.conf;"
+echo "  ssh ${REMOTE} 'sudo nginx -t && sudo systemctl reload nginx'"
+echo ""
+echo "Deployment complete."
+echo "Health check: curl https://wip.computer/health"
+echo "MCP endpoint: https://wip.computer/mcp"

package/src/hosted-mcp/inbox.mjs

@@ -0,0 +1,64 @@
+// inbox.mjs: File-based message inbox for hosted MCP server.
+// Each message is a JSON file. Same format as local bridge.
+
+import { randomUUID } from "node:crypto";
+import { mkdirSync, readdirSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+
+const INBOX_DIR = process.env.MCP_INBOX_DIR || "/var/www/wip.computer/app/mcp-server/inbox";
+mkdirSync(INBOX_DIR, { recursive: true });
+
+/** Push a message into the inbox. Returns message ID. */
+export function pushMessage({ from, to, body, type = "chat" }) {
+  const id = randomUUID();
+  const msg = { id, type, from, to, body, timestamp: new Date().toISOString(), read: false };
+  writeFileSync(join(INBOX_DIR, `${Date.now()}-${id}.json`), JSON.stringify(msg, null, 2));
+  return id;
+}
+
+/** Get messages for a recipient. If markRead, consumed messages are deleted. */
+export function getMessages(to, markRead = false) {
+  const files = readdirSync(INBOX_DIR).filter((f) => f.endsWith(".json")).sort();
+  const matched = [];
+  for (const file of files) {
+    const fp = join(INBOX_DIR, file);
+    let msg;
+    try { msg = JSON.parse(readFileSync(fp, "utf-8")); } catch { continue; }
+    if (msg.read || !matches(msg.to, to)) continue;
+    matched.push(msg);
+    if (markRead) { try { unlinkSync(fp); } catch {} }
+  }
+  return matched;
+}
+
+/** Count pending (unread) messages for a recipient. */
+export function countPending(to) {
+  const files = readdirSync(INBOX_DIR).filter((f) => f.endsWith(".json"));
+  let n = 0;
+  for (const file of files) {
+    try {
+      const msg = JSON.parse(readFileSync(join(INBOX_DIR, file), "utf-8"));
+      if (!msg.read && matches(msg.to, to)) n++;
+    } catch { continue; }
+  }
+  return n;
+}
+
+/**
+ * Recipient matching. Supports:
+ *   "agent", "agent:session", "agent:*" (all sessions), "*" (broadcast)
+ */
+function matches(msgTo, query) {
+  if (msgTo === "*" || query === "*" || msgTo === query) return true;
+  if (query.endsWith(":*")) {
+    const p = query.slice(0, -2);
+    if (msgTo === p || msgTo.startsWith(p + ":")) return true;
+  }
+  if (msgTo.endsWith(":*")) {
+    const p = msgTo.slice(0, -2);
+    if (query === p || query.startsWith(p + ":")) return true;
+  }
+  if (!query.includes(":") && msgTo === query + ":default") return true;
+  if (!msgTo.includes(":") && query === msgTo + ":default") return true;
+  return false;
+}

package/src/hosted-mcp/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@wipcomputer/hosted-mcp",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Hosted MCP server for wip.computer. Bridge + memory for any platform.",
+  "main": "server.mjs",
+  "scripts": {
+    "start": "node server.mjs",
+    "dev": "node --watch server.mjs"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^3.25.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "private": true
+}

package/src/hosted-mcp/server.mjs

@@ -0,0 +1,132 @@
+// server.mjs: Hosted MCP server for wip.computer
+// MCP Streamable HTTP transport at /mcp, health check at /health.
+// Auth: Bearer ck-... API key maps to an agent ID.
+
+import { randomUUID } from "node:crypto";
+import { createServer } from "node:http";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import { registerTools } from "./tools.mjs";
+
+const PORT = parseInt(process.env.MCP_PORT || "18800", 10);
+
+// Prototype: one hardcoded test key. Later: database / Agent Pay.
+const API_KEYS = { "ck-test-001": "test-agent" };
+
+// Session ID -> { transport, server, identity }
+const sessions = {};
+
+function authenticate(req) {
+  const auth = req.headers["authorization"];
+  if (!auth?.startsWith("Bearer ")) return null;
+  const key = auth.slice(7).trim();
+  return API_KEYS[key] ? { agentId: API_KEYS[key], apiKey: key } : null;
+}
+
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => {
+      try { const raw = Buffer.concat(chunks).toString(); resolve(raw ? JSON.parse(raw) : undefined); }
+      catch (e) { reject(e); }
+    });
+    req.on("error", reject);
+  });
+}
+
+function json(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+
+function rpcError(res, status, code, message) {
+  json(res, status, { jsonrpc: "2.0", error: { code, message }, id: null });
+}
+
+function cors(res) {
+  res.setHeader("Access-Control-Allow-Origin", "*");
+  res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, Mcp-Session-Id, Last-Event-ID");
+  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
+}
+
+async function handlePost(req, res, identity) {
+  const sid = req.headers["mcp-session-id"];
+  let body;
+  try { body = await readBody(req); } catch { rpcError(res, 400, -32700, "Parse error"); return; }
+
+  if (sid && sessions[sid]) {
+    await sessions[sid].transport.handleRequest(req, res, body);
+    return;
+  }
+
+  if (!sid && isInitializeRequest(body)) {
+    const transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: () => randomUUID(),
+      onsessioninitialized: (id) => {
+        sessions[id] = { transport, server: mcpServer, identity };
+        console.log(`Session created: ${id} (agent: ${identity.agentId})`);
+      },
+    });
+    transport.onclose = () => {
+      const id = transport.sessionId;
+      if (id && sessions[id]) { console.log(`Session closed: ${id}`); delete sessions[id]; }
+    };
+    const mcpServer = new McpServer({ name: "wip-mcp", version: "0.1.0" });
+    registerTools(mcpServer, () => identity);
+    await mcpServer.connect(transport);
+    await transport.handleRequest(req, res, body);
+    return;
+  }
+
+  rpcError(res, 400, -32000, "Bad request: missing or invalid session");
+}
+
+async function handleGetOrDelete(req, res) {
+  const sid = req.headers["mcp-session-id"];
+  if (!sid || !sessions[sid]) { rpcError(res, 400, -32000, "Invalid or missing session ID"); return; }
+  await sessions[sid].transport.handleRequest(req, res);
+}
+
+const httpServer = createServer(async (req, res) => {
+  cors(res);
+  if (req.method === "OPTIONS") { res.writeHead(204); res.end(); return; }
+
+  if (req.method === "GET" && req.url === "/health") {
+    json(res, 200, { ok: true, server: "wip-mcp", version: "0.1.0", sessions: Object.keys(sessions).length, uptime: process.uptime() });
+    return;
+  }
+
+  if (req.url === "/mcp") {
+    const identity = authenticate(req);
+    if (!identity && req.method === "POST") { json(res, 401, { error: "Unauthorized. Provide Bearer ck-... token." }); return; }
+    try {
+      if (req.method === "POST") await handlePost(req, res, identity);
+      else if (req.method === "GET" || req.method === "DELETE") await handleGetOrDelete(req, res);
+      else rpcError(res, 405, -32000, "Method not allowed");
+    } catch (err) {
+      console.error("MCP error:", err);
+      if (!res.headersSent) rpcError(res, 500, -32603, "Internal server error");
+    }
+    return;
+  }
+
+  json(res, 404, { error: "Not found" });
+});
+
+httpServer.listen(PORT, "0.0.0.0", () => {
+  console.log(`wip-mcp listening on 0.0.0.0:${PORT}`);
+  console.log(`Health: http://localhost:${PORT}/health`);
+  console.log(`MCP:    http://localhost:${PORT}/mcp`);
+});
+
+async function shutdown() {
+  console.log("Shutting down...");
+  for (const sid of Object.keys(sessions)) { try { await sessions[sid].transport.close(); } catch {} delete sessions[sid]; }
+  httpServer.close();
+  process.exit(0);
+}
+process.on("SIGINT", shutdown);
+process.on("SIGTERM", shutdown);

package/src/hosted-mcp/tools.mjs

@@ -0,0 +1,57 @@
+// tools.mjs: MCP tool definitions. Bridge (messaging) + placeholder memory tools.
+
+import { z } from "zod";
+import { pushMessage, getMessages, countPending } from "./inbox.mjs";
+
+/** Register all tools on an McpServer instance. */
+export function registerTools(server, getIdentity) {
+
+  server.registerTool("send_message", {
+    description: "Send a message to any agent. Stored in inbox until read. " +
+      "Target: 'agent', 'agent:session', 'agent:*' (all sessions), '*' (broadcast).",
+    inputSchema: {
+      to: z.string().describe("Recipient"),
+      body: z.string().describe("Message body"),
+      type: z.string().optional().default("chat").describe("chat, system, or task"),
+    },
+  }, async ({ to, body, type }) => {
+    const id = pushMessage({ from: getIdentity().agentId, to, body, type });
+    return { content: [{ type: "text", text: `Sent (id: ${id}) to ${to}` }] };
+  });
+
+  server.registerTool("check_inbox", {
+    description: "Check for pending messages. Returns unread messages and marks them read.",
+    inputSchema: {},
+  }, async () => {
+    const msgs = getMessages(getIdentity().agentId, true);
+    if (!msgs.length) return { content: [{ type: "text", text: "No pending messages." }] };
+    const text = msgs.map((m) => `**${m.from}** [${m.type}] (${m.timestamp}):\n${m.body}`).join("\n\n---\n\n");
+    return { content: [{ type: "text", text: `${msgs.length} message(s):\n\n${text}` }] };
+  });
+
+  server.registerTool("search_memory", {
+    description: "Search semantic memory (Crystal). Placeholder... coming soon.",
+    inputSchema: { query: z.string().describe("Search query") },
+  }, async ({ query }) => {
+    return { content: [{ type: "text", text: `Memory search coming soon. Query: "${query}"` }] };
+  });
+
+  server.registerTool("remember", {
+    description: "Store a fact in memory (Crystal). Placeholder... coming soon.",
+    inputSchema: {
+      text: z.string().describe("What to remember"),
+      tags: z.string().optional().describe("Comma-separated tags"),
+    },
+  }, async ({ text, tags }) => {
+    return { content: [{ type: "text", text: `Memory storage coming soon. Would remember: "${text}"${tags ? ` (tags: ${tags})` : ""}` }] };
+  });
+
+  server.registerTool("status", {
+    description: "Show connection info and pending message count.",
+    inputSchema: {},
+  }, async () => {
+    const { agentId, apiKey } = getIdentity();
+    const masked = apiKey.slice(0, 7) + "..." + apiKey.slice(-4);
+    return { content: [{ type: "text", text: `Agent: ${agentId}\nAPI key: ${masked}\nPending: ${countPending(agentId)}\nServer: wip.computer hosted MCP` }] };
+  });
+}