@withbuddi/buddi 0.1.0-pre.35 → 0.1.0-pre.37

package/packages/gateway/dist/web/people.js

@@ -0,0 +1,114 @@
+/**
+ * Settings → Memory → People, and Home's birthday card (docs/memory.md,
+ * "People"; docs/dashboard.md, Home).
+ *
+ *   GET  /api/memory/people                 → { people: PersonRow[], today }
+ *   POST /api/memory/people                 { id?, name, relationship?, addressAs?, birthday?, anniversary?, notes?, reminders? } → { person, people }
+ *   POST /api/memory/people/:id/forget      → { person, people }
+ *   POST /api/memory/people/:id/restore     → { person, people }
+ *   GET  /api/owner/birthday                → BirthdayGlance
+ *
+ * The owner writes People directly: no proposal, because the owner is the one
+ * who decides. Every save brings the date missions in step at once
+ * (`syncDateMissions`), so "Remind me of their dates" is the mission's own
+ * switch, created off and turned on here.
+ */
+import { daysUntil, localDateString, ownerTimezone, setMissionEnabled, turning } from '@buddi/core';
+import { PersonRefusal, forgetPerson, listPeople, restorePerson, upsertPerson } from '@buddi/tool-memory';
+import { birthdayGlance, personMissionId, syncDateMissions } from '../missions/dates.js';
+export async function peopleRows(deps) {
+    const today = localDateString(deps.now(), ownerTimezone());
+    let people = [];
+    try {
+        people = await listPeople(deps.pool);
+    }
+    catch (err) {
+        if (err?.code !== '42P01')
+            throw err;
+    }
+    const { rows: missions } = await deps.pool.query(`select id, enabled from core.missions where id like 'person-dates:%'`);
+    const enabled = new Map(missions.map((m) => [String(m.id), Boolean(m.enabled)]));
+    return {
+        today,
+        people: people.map((p) => {
+            const dates = ['birthday', 'anniversary']
+                .filter((what) => p[what] !== null)
+                .map((what) => ({ what, date: p[what], inDays: daysUntil(p[what], today) }))
+                .sort((a, b) => a.inDays - b.inDays);
+            const soonest = dates[0];
+            return {
+                ...p,
+                next: soonest ? { what: soonest.what, inDays: soonest.inDays, turning: turning(soonest.date, today) } : null,
+                reminders: dates.length === 0 ? null : (enabled.get(personMissionId(p.id)) ?? false),
+            };
+        }),
+    };
+}
+const dateOf = (value) => {
+    if (value === undefined)
+        return undefined;
+    if (value === null)
+        return null;
+    if (typeof value !== 'object')
+        return null;
+    const v = value;
+    return { day: Number(v.day), month: Number(v.month), year: v.year === undefined || v.year === null || v.year === '' ? null : Number(v.year) };
+};
+const textOf = (value) => value === undefined ? undefined : value === null ? null : typeof value === 'string' ? value : String(value);
+export async function peopleRoute(deps, method, path, body) {
+    if (method === 'GET' && path === '/api/owner/birthday') {
+        return { status: 200, body: await birthdayGlance(deps.pool, deps.now()) };
+    }
+    if (method === 'GET' && path === '/api/memory/people') {
+        return { status: 200, body: await peopleRows(deps) };
+    }
+    if (method !== 'POST')
+        return undefined;
+    const sync = async () => {
+        try {
+            await syncDateMissions({ pool: deps.pool, catalog: deps.catalog, now: deps.now, log: deps.log });
+        }
+        catch (err) {
+            deps.log(`dates: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    };
+    if (path === '/api/memory/people') {
+        const id = typeof body.id === 'string' && body.id !== '' ? body.id : undefined;
+        try {
+            const { person } = await upsertPerson(deps.pool, {
+                ...(id ? { id } : {}),
+                ...(body.name !== undefined ? { name: String(body.name) } : {}),
+                ...(textOf(body.relationship) !== undefined ? { relationship: textOf(body.relationship) } : {}),
+                ...(textOf(body.addressAs) !== undefined ? { addressAs: textOf(body.addressAs) } : {}),
+                ...(textOf(body.notes) !== undefined ? { notes: textOf(body.notes) } : {}),
+                ...(dateOf(body.birthday) !== undefined ? { birthday: dateOf(body.birthday) } : {}),
+                ...(dateOf(body.anniversary) !== undefined ? { anniversary: dateOf(body.anniversary) } : {}),
+            }, { by: 'owner', now: deps.now() });
+            await sync();
+            // The switch on the sheet is the mission's own: it exists once a date does.
+            if (typeof body.reminders === 'boolean' && (person.birthday || person.anniversary)) {
+                await setMissionEnabled(deps.pool, personMissionId(person.id), body.reminders);
+            }
+            const rows = await peopleRows(deps);
+            return { status: 200, body: { person: rows.people.find((p) => p.id === person.id) ?? person, people: rows.people } };
+        }
+        catch (err) {
+            if (err instanceof PersonRefusal)
+                return { status: 400, body: { error: err.message } };
+            if (err?.code === '23505')
+                return { status: 409, body: { error: 'Someone with that name is already in People.' } };
+            throw err;
+        }
+    }
+    const one = /^\/api\/memory\/people\/([0-9a-f-]{36})\/(forget|restore)$/.exec(path);
+    if (one) {
+        const person = one[2] === 'forget' ? await forgetPerson(deps.pool, one[1], deps.now()) : await restorePerson(deps.pool, one[1]);
+        if (!person)
+            return { status: 404, body: { error: one[2] === 'forget' ? 'That person is not in People.' : 'That person cannot come back: someone with the same name is in People now.' } };
+        await sync();
+        const rows = await peopleRows(deps);
+        return { status: 200, body: { person, people: rows.people } };
+    }
+    return undefined;
+}
+//# sourceMappingURL=people.js.map

package/packages/gateway/dist/web/people.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"people.js","sourceRoot":"","sources":["../../src/web/people.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAoC,MAAM,aAAa,CAAC;AACtI,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAmB,MAAM,oBAAoB,CAAC;AAE3H,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAqBzF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAsC;IACrE,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,GAAiB,EAAE,CAAC;IAC9B,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAC7C,OAAO,GAAG,EAAE,CAAC;QAAC,IAAK,GAAgC,EAAE,IAAI,KAAK,OAAO;YAAE,MAAM,GAAG,CAAC;IAAC,CAAC;IACnF,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC9C,sEAAsE,CACvE,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAkB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO;QACL,KAAK;QACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACvB,MAAM,KAAK,GAAI,CAAC,UAAU,EAAE,aAAa,CAAW;iBACjD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;iBAClC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAa,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAa,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;iBACnG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,OAAO;gBACL,GAAG,CAAC;gBACJ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC5G,SAAS,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC;aACrF,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAA+B,EAAE;IAC7D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAChJ,CAAC,CAAC;AACF,MAAM,MAAM,GAAG,CAAC,KAAc,EAA6B,EAAE,CAC3D,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE9G,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,MAAc,EAAE,IAAY,EAAE,IAA6B;IAC7G,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACtD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,CAAC;YAAC,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAAC,CAAC;QACzG,OAAO,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IACzF,CAAC,CAAC;IAEF,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE;gBAC/C,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9F,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrC,MAAM,IAAI,EAAE,CAAC;YACb,4EAA4E;YAC5E,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnF,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACvF,IAAK,GAAgC,EAAE,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,8CAA8C,EAAE,EAAE,CAAC;YACjJ,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpF,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;QAClI,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,4EAA4E,EAAE,EAAE,CAAC;QAC3L,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/packages/gateway/dist/web/server.d.ts

@@ -1,5 +1,6 @@
 import { type ProviderSettings } from '../providers.js';
 import { type ProviderAccounts } from '../provider-accounts.js';
+import { type OllamaMachine, type OllamaPulls } from '../ollama-local.js';
 import { type TelegramControl } from './telegram.js';
 import { type Server } from 'node:http';
 import type { AgentCatalog, JobControl, CoreToolContext, ToolRegistry } from '@buddi/core';
@@ -24,6 +25,9 @@ export interface WebServerDeps {
      * (plugins/requires.ts). Made here when absent.
      */
     requirements?: Requirements;
+    /** The first run's Ollama pull and machine facts, for a test; made here when absent (ollama-local.ts). */
+    ollamaPulls?: OllamaPulls;
+    ollamaMachine?: () => OllamaMachine;
     /** The place finder's road, for a test; Open-Meteo through core's guard otherwise. */
     placesHttp?: HttpArea;
     /** Host controller; test instances can inject a fake. Reads never enable it. */

package/packages/gateway/dist/web/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":"AAiEA,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAmBtF,OAAO,EAQL,KAAK,eAAe,EAErB,MAAM,eAAe,CAAC;AAYvB,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAEjG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAY,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAA0K,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAExN,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AA2BzE,OAAO,EAKL,OAAO,EAKP,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAuC,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAcL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAsC3E,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAcvB,OAAO,EAcL,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAoBtB,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE/E,OAAO,EAA0C,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AA2CpF,qFAAqF;AACrF,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,sFAAsF;IACtF,UAAU,CAAC,EAAE,QAAQ,CAAC;IACtB,gFAAgF;IAChF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;IACtB,GAAG,EAAE,eAAe,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACpE,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;OAGG;IACH,WAAW,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC7C;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC3C;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC;IAC/F;;;OAGG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE;QACV,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC;YAAE,SAAS,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;KAC7E,GAAG,SAAS,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qDAAqD;IACrD,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,oHAAoH;AACpH,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAwE/C,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAE7D;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAEnE;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,MAAM,CAAC;AAEhC,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CA2vGxD;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CAAC,SAAS,CAAC,CA+DpB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":"AAuEA,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAKtF,OAAO,EAAiD,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAgBzH,OAAO,EAQL,KAAK,eAAe,EAErB,MAAM,eAAe,CAAC;AAYvB,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAEjG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAY,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAAwL,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAEtO,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AA2BzE,OAAO,EAKL,OAAO,EAKP,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAuC,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAcL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAsC3E,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAcvB,OAAO,EAcL,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAoBtB,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAI/E,OAAO,EAAyD,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AA6CnG,qFAAqF;AACrF,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,0GAA0G;IAC1G,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,aAAa,CAAC;IACpC,sFAAsF;IACtF,UAAU,CAAC,EAAE,QAAQ,CAAC;IACtB,gFAAgF;IAChF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;IACtB,GAAG,EAAE,eAAe,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACpE,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;OAGG;IACH,WAAW,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC7C;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC3C;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC;IAC/F;;;OAGG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE;QACV,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC;YAAE,SAAS,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;KAC7E,GAAG,SAAS,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qDAAqD;IACrD,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,oHAAoH;AACpH,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAwE/C,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAE7D;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAEnE;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,MAAM,CAAC;AAEhC,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAy4GxD;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CAAC,SAAS,CAAC,CA+DpB"}

package/packages/gateway/dist/web/server.js

@@ -46,9 +46,10 @@ import { agentMuteRoute, focusRoute, listNotificationsRoute, markSeenRoute, noti
 import { catalogSkillLookup, discardProposalFromWeb, keepAllProposalsFromWeb, keepProposalFromWeb, readProposals, registryChangeLookup } from './proposals.js';
 import { latestDigest, readDigestSchedule, setDigestSchedule } from '../agents/learning-digest.js';
 import { readAgentSkills, removeLearnedSkillFromWeb } from '../agents/learned-skills.js';
-import { createSkillRoute, deleteSkillRoute, editSkillRoute, grantSkillRoute, listSkillsRoute, skillDetailRoute, skillDownload, trustSkillRoute, } from './skills.js';
+import { createSkillRoute, deleteSkillRoute, editSkillRoute, grantSkillRoute, listSkillsRoute, skillDetailRoute, skillDownload, skillFileRoute, skillImage, stagedFileRoute, stagedImage, acceptBundleRoute, trustSkillRoute, } from './skills.js';
+import { discardStaged, incomingDirFor, receiveBundleUpload, stageBundle, uploadLabel } from './skill-bundles.js';
 import { bindMcpRequests, requestThroughMcp } from '../mcp/requests.js';
-import { randomUUID, createHmac } from 'node:crypto';
+import { randomUUID, createHmac, createHash } from 'node:crypto';
 import { StringDecoder } from 'node:string_decoder';
 import { continueBrowserTask } from '../surfaces/browser-continuation.js';
 import { carryOverDeps } from '../surfaces/carry-over.js';
@@ -59,14 +60,15 @@ import { listBrowserProfiles, listInstalledApps } from './apps.js';
 import { agentSearchPath, EXAMPLES_AGENTS_DIR } from '../agents/catalog.js';
 import { setDelegatesFromWeb } from './write.js';
 import { mlxhBaseUrl, probeMlxh } from '../mlxh.js';
-import { OnboardingRefusal, WEB_ONBOARDING_STEPS, WEB_ONBOARDING_SURFACE, claimOpeningTurn, createFirstAgent, probeOllama, readOnboarding, rebindBrain, updateFirstAgent, withFirstRunFacts, readFirstAgentPersona } from './onboarding.js';
+import { PullRefusal, createOllamaPulls, ollamaMachine } from '../ollama-local.js';
+import { OnboardingRefusal, WEB_ONBOARDING_STEPS, WEB_ONBOARDING_SURFACE, claimOpeningTurn, createFirstAgent, OLLAMA_BASE_URL, probeOllama, readOnboarding, rebindBrain, updateFirstAgent, withFirstRunFacts, readFirstAgentPersona } from './onboarding.js';
 import { TakeOnRefusal, readTakeOn, startTakeOn } from './take-on.js';
 import { TelegramWebError, saveTelegramToken, telegramBot, telegramDevices, telegramPairing, telegramStatus, unpairTelegramDevice, } from './telegram.js';
 import { PAGE_ROUTE, sendPageFile, actOnPage, actRateLimited, listPageDescriptors, runPageQuery, } from './pages.js';
 import { listSecrets, secretUses, secretsAct } from './secrets.js';
 import { sayRoute, transcribeRoute } from './speech.js';
 import { createServer } from 'node:http';
-import { getAction, idleRolloverMs, inRecovery, listMissions, listPendingActions, isJobState, parseAgentFile, setSentinelEnabled, snoozeFinding, snoozeFindings, unmuteFindings } from '@buddi/core';
+import { asksEachTime, getAction, idleRolloverMs, inRecovery, listMissions, listPendingActions, isJobState, parseAgentFile, setSentinelEnabled, snoozeFinding, snoozeFindings, unmuteFindings } from '@buddi/core';
 import { actOnAlerts, askPrompt, findingsForAsk, muteAlert } from './alerts.js';
 import { connectionsOf } from '@buddi/tool-mcp';
 import { CONNECTIONS_CALLBACK_PATH, connectionsRoute } from './connections.js';
@@ -75,7 +77,7 @@ import { hostService } from '@buddi/tool-host';
 import { listToolPermissions, revokeToolPermission, getArtifact, readArtifactBytes, artifactBytesExist, discardUnreferencedUpload, listLibrary, getLibraryEntry, decodeCursor, filterKey, textPreviewable, readArtifactPrefix, FILE_FAMILIES, LIBRARY_PAGE_MAX, getOwnerProfile, saveOwnerProfile, isKnownTimezone, listGroups, getGroup, createGroup, updateGroup, archiveGroup, deleteGroup, restoreGroup, clearGroupHistory, groupHistorySize, GROUP_UNDO_MS, GroupRefusal, createGroupConversation, listGroupConversations, latestGroupConversation, openGroupRequest, conversationGroup } from '@buddi/core';
 import { EXPORT_MIME, MAX_EXPORT_SOURCE_BYTES, exportFormats, exportName } from '../export/document.js';
 import { ExportRefused, runExport } from '../export/convert.js';
-import { beginOnboarding, completeOnboarding, markStepDone, setOnboardingDetails, skipOnboarding, readWebSetting, writeWebSetting } from '@buddi/core';
+import { beginOnboarding, completeOnboarding, markStepDone, setOnboardingDetails, skipOnboarding, readWebSetting, writeWebSetting, isAssetKey, readPluginAsset } from '@buddi/core';
 import { listMemory, setPreference, forgetPreference, updateNote, forgetNote } from '@buddi/tool-memory';
 import { purgeGroups, stopGroupWork } from './group-lifecycle.js';
 import { engineChangeFromBody, readAgentEngines, readDefaultAgent, readEngineOptions, setAgentEngineFromWeb, setDefaultAgentFromWeb, } from './agents.js';
@@ -112,7 +114,9 @@ import { tipsRoute } from '../tips/route.js';
 import { createWidgets, widgetsRoute } from './widgets.js';
 import { createRequirements } from '../plugins/requires.js';
 import { placesList, placesRoute } from './places.js';
-import { OWNER_DATE_FORMATS, OWNER_TIME_FORMATS } from '@buddi/core';
+import { peopleRoute } from './people.js';
+import { syncDateMissions } from '../missions/dates.js';
+import { OWNER_DATE_FORMATS, OWNER_TIME_FORMATS, validDayMonth } from '@buddi/core';
 import { readFacts, webSettingsStore } from '../tips/facts.js';
 import { dismissAgentOffer, isPendingAccept, raiseAgentOffers, readAgentOffers } from './agent-offers.js';
 import { currentVersion, upgradeJobRoute, upgradeRoute, versionCheckRoute, versionRoute, } from './version.js';
@@ -125,6 +129,8 @@ import { ensureWebToken, verifyTicket } from './token.js';
 import { MAX_UPLOAD_BYTES, readUpload } from './upload.js';
 import { LOCKED_BODY, LockUnavailable, allowedWhileLocked, clientOf, createLock } from './lock.js';
 import { matchApiRoute, TOKEN_REFUSALS } from './api-routes.js';
+import { QUIET_UNAVAILABLE_TEXT, pluginCommands } from './composer.js';
+import { createEngagementHooks } from '../missions/engagement.js';
 import { apiTokensRoute, bearerOf, verifyApiToken } from './api-tokens.js';
 import { LockImageRefusal, MAX_LOCK_IMAGE_BYTES, normaliseLockImage } from './lock-image.js';
 import { cancelJobFromWeb, cancelReminderFromWeb, decideApprovalFromWeb, retryJobFromWeb, retryJobsFromWeb, dismissJobsFromWeb, undismissJobsFromWeb, setMissionEnabledFromWeb, keepMissionFromWeb, answerStillUsefulFromWeb, setPausedFromWeb, setScheduleFromWeb, dismissOfferFromWeb, dismissOffersFromWeb, takeOfferFromWeb, } from './write.js';
@@ -312,6 +318,9 @@ export function createWebApp(deps) {
     // Plugin readiness and requirements: serve's, or this server's own.
     const requirements = deps.requirements ??
         createRequirements({ registry: deps.registry, ctx: deps.ctx, env: deps.env ?? process.env, pool: deps.pool, now: deps.now, log });
+    // Ollama on this computer: the first run's pull of a small model, one at a time.
+    const ollamaPulls = deps.ollamaPulls ?? createOllamaPulls({ baseUrl: OLLAMA_BASE_URL });
+    const machine = deps.ollamaMachine ?? (() => ollamaMachine());
     // Home's widgets: one cache per server (web/widgets.ts).
     const widgets = createWidgets({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now });
     /*
@@ -430,7 +439,8 @@ export function createWebApp(deps) {
      */
     void chat?.recoverPendingInput().catch((err) => log(`web chat: recovering queued input failed: ${err instanceof Error ? err.message : String(err)}`));
     const streams = new StreamBudget();
-    const permissionScopes = (tool) => deps.registry.lookup(tool)?.reusableApproval
+    // A bundle script's run asks every time: its card offers no standing permission (`asksEachTime`).
+    const permissionScopes = (tool, envelope) => deps.registry.lookup(tool)?.reusableApproval && !asksEachTime(envelope)
         ? { permissionScopes: ['conversation', 'always'] } : {};
     writeDeps.resumeInteractive = (action, outcome) => chat?.resumeHost(action, outcome);
     /*
@@ -1158,6 +1168,20 @@ export function createWebApp(deps) {
                 return sendEmpty(res, 204);
             return sendJson(res, answer.status, answer.body);
         }
+        // `/quiet` typed into the composer: the verb Telegram and the terminal answer, in their words (missions/engagement.ts).
+        if (path === '/api/quiet' && method === 'POST') {
+            let body;
+            try {
+                body = await readJsonBody(req);
+            }
+            catch {
+                return sendJson(res, 400, { error: 'request body must be JSON' });
+            }
+            const raw = body?.arg;
+            const arg = typeof raw === 'string' ? raw.trim().slice(0, 40) : '';
+            const text = await createEngagementHooks({ pool: deps.pool, now: deps.now, timezone: deps.timezone, unavailableText: QUIET_UNAVAILABLE_TEXT }).quiet(arg);
+            return sendJson(res, 200, { text });
+        }
         // Home's widgets: the gallery, the owner's layout, each placed one's body (web/widgets.ts).
         if (path === '/api/widgets' || path.startsWith('/api/widgets/')) {
             let body = {};
@@ -1493,8 +1517,8 @@ export function createWebApp(deps) {
                 }
                 case '/api/approvals': {
                     const approvals = await readApprovals(deps.pool, now, boundedLimit(q.get('limit'), 50));
-                    return sendJson(res, 200, { pending: approvals.pending.map(a => ({ ...a, ...permissionScopes(a.tool) })),
-                        recent: approvals.recent.map(a => ({ ...a, ...permissionScopes(a.tool) })) });
+                    return sendJson(res, 200, { pending: approvals.pending.map(a => ({ ...a, ...permissionScopes(a.tool, a.envelope) })),
+                        recent: approvals.recent.map(a => ({ ...a, ...permissionScopes(a.tool, a.envelope) })) });
                 }
                 case '/api/offers':
                     // The roster goes in so the read can lapse an offer whose agent is
@@ -1524,7 +1548,8 @@ export function createWebApp(deps) {
                 case '/api/sentinels':
                     return sendJson(res, 200, await readSentinels(deps.pool, deps.registry, deps.now()));
                 case '/api/chat/agents':
-                    return sendJson(res, 200, readChatAgents(deps.catalog, await avatarVersions(deps.pool)));
+                    // With the commands the plugins add to the composer's `/` menu (web/composer.ts).
+                    return sendJson(res, 200, { ...readChatAgents(deps.catalog, await avatarVersions(deps.pool)), commands: pluginCommands(deps.registry) });
                 // Which agents are waiting on the owner. One small query, and the only
                 // definition of "waiting" in the installation — see attention.ts.
                 case '/api/chat/attention':
@@ -1681,8 +1706,12 @@ export function createWebApp(deps) {
                     const persona = readFirstAgentPersona(onboardingDeps());
                     return persona ? sendJson(res, 200, persona) : sendJson(res, 404, { error: 'There is no assistant of your own yet.' });
                 }
+                // With what the machine says: installed or not, how to install it, the
+                // model the first run would fetch here, and a fetch already going.
                 case '/api/onboarding/ollama':
-                    return sendJson(res, 200, await probeOllama());
+                    return sendJson(res, 200, { ...(await probeOllama()), machine: machine(), pull: ollamaPulls.read() });
+                case '/api/onboarding/ollama/pull':
+                    return sendJson(res, 200, { pull: ollamaPulls.read() });
                 // Is mlxh running here? The same question, asked the same way, of port 1060.
                 case '/api/onboarding/mlxh':
                     return sendJson(res, 200, await probeMlxh({ baseUrl: mlxhBaseUrl(deps.env ?? process.env) }));
@@ -1700,6 +1729,12 @@ export function createWebApp(deps) {
                     const profile = await getOwnerProfile(deps.pool);
                     return sendJson(res, 200, { ...profile, places: await placesList(deps.pool), detectedTimezone: Intl.DateTimeFormat().resolvedOptions().timeZone, zones: knownTimezones() });
                 }
+                // Settings → Memory → People, and Home's birthday card (web/people.ts).
+                case '/api/memory/people':
+                case '/api/owner/birthday': {
+                    const answered = await peopleRoute({ pool: deps.pool, catalog: deps.catalog, now: deps.now, log }, 'GET', path, {});
+                    return sendJson(res, answered.status, answered.body);
+                }
                 case '/api/memory': {
                     try {
                         // `?agent=` narrows it to what that agent sees: the agent sheet's tab.
@@ -1768,6 +1803,38 @@ export function createWebApp(deps) {
              * skills, its delegates. A read and only ever a read — a change to any of
              * it goes through the maker agent, where it becomes an approval.
              */
+            /*
+             * A plugin's asset (host API 1.27): a PNG core drew itself from what the
+             * plugin fetched, at 64 or 128 px. Only behind a session, like every
+             * other read here; never a file the plugin wrote byte for byte. Kept a
+             * day by the browser — a logo changes once a month — and revalidated
+             * by its bytes.
+             */
+            const asset = /^\/api\/plugin-assets\/([a-z][a-z0-9_-]{0,63})\/([^/]+)$/.exec(path);
+            if (asset) {
+                const key = decodeURIComponent(asset[2]);
+                const size = url.searchParams.get('size') === '64' ? 64 : 128;
+                const png = isAssetKey(key) ? await readPluginAsset(asset[1], key, size, deps.env ?? process.env).catch(() => null) : null;
+                if (!png)
+                    return sendEmpty(res, 404);
+                const etag = `"${createHash('sha256').update(png).digest('hex').slice(0, 32)}"`;
+                res.setHeader('Content-Type', 'image/png');
+                res.setHeader('ETag', etag);
+                res.setHeader('Cache-Control', 'private, max-age=86400');
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+                res.setHeader('Content-Security-Policy', "default-src 'none'; sandbox");
+                const presented = first(req.headers['if-none-match']);
+                if (presented !== undefined && presented.split(',').some((tag) => tag.trim() === etag)) {
+                    res.statusCode = 304;
+                    res.end();
+                    return;
+                }
+                res.setHeader('Content-Length', String(png.length));
+                res.statusCode = 200;
+                res.end(method === 'HEAD' ? undefined : png);
+                return;
+            }
             const avatar = /^\/api\/agents\/([^/]+)\/avatar$/.exec(path);
             if (avatar) {
                 const agent = deps.catalog.get(decodeURIComponent(avatar[1]));
@@ -1827,6 +1894,30 @@ export function createWebApp(deps) {
             // The Skills page: every skill, grouped, who holds each; one whole; one as its file.
             if (path === '/api/skills')
                 return reply(res, listSkillsRoute(skillsDeps()));
+            /*
+             * A bundle's files, for the viewer: one file's text (or its size when
+             * it is not text), and a picture's bytes for an <img>. The same for an
+             * upload still waiting in the preview. A picture is served with a CSP
+             * that runs nothing, so an SVG opened on its own cannot script the page.
+             */
+            const bundleRead = /^\/api\/skills\/(bundles\/)?([^/]+)\/(file|image)$/.exec(path);
+            if (bundleRead) {
+                const id = decodeURIComponent(bundleRead[2]);
+                const rel = url.searchParams.get('path') ?? '';
+                if (bundleRead[3] === 'file') {
+                    return reply(res, bundleRead[1] ? stagedFileRoute(skillsDeps(), id, rel) : skillFileRoute(skillsDeps(), id, rel));
+                }
+                const picture = bundleRead[1] ? stagedImage(skillsDeps(), id, rel) : skillImage(skillsDeps(), id, rel);
+                if (!picture)
+                    return sendJson(res, 404, { error: `There is no picture "${rel}" in this bundle.` });
+                res.statusCode = 200;
+                res.setHeader('Content-Type', picture.type);
+                res.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; sandbox");
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                res.setHeader('Cache-Control', 'no-store');
+                res.end(method === 'HEAD' ? undefined : picture.bytes);
+                return;
+            }
             const skillRead = /^\/api\/skills\/([^/]+)(\/download)?$/.exec(path);
             if (skillRead) {
                 const id = decodeURIComponent(skillRead[1]);
@@ -1835,6 +1926,14 @@ export function createWebApp(deps) {
                 const file = skillDownload(skillsDeps(), id);
                 if (!file)
                     return sendJson(res, 404, { error: `There is no skill "${id}".` });
+                if ('zip' in file) {
+                    res.statusCode = 200;
+                    res.setHeader('Content-Type', 'application/zip');
+                    res.setHeader('Content-Disposition', `attachment; filename="${file.filename}"`);
+                    res.setHeader('Cache-Control', 'no-store');
+                    res.end(method === 'HEAD' ? undefined : Buffer.from(file.zip));
+                    return;
+                }
                 res.statusCode = 200;
                 res.setHeader('Content-Type', 'text/markdown; charset=utf-8');
                 res.setHeader('Content-Disposition', `attachment; filename="${file.filename}"`);
@@ -1882,7 +1981,7 @@ export function createWebApp(deps) {
                 const action = await getAction(deps.pool, decodeURIComponent(approval[1]));
                 if (!action)
                     return sendJson(res, 404, { error: 'no such action' });
-                return sendJson(res, 200, { action: { ...toApprovalView(action), ...permissionScopes(action.tool) } });
+                return sendJson(res, 200, { action: { ...toApprovalView(action), ...permissionScopes(action.tool, action.envelope) } });
             }
             /* ---------------- chat ---------------- */
             const groupConversations = /^\/api\/groups\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/conversations$/i.exec(path);
@@ -2046,6 +2145,9 @@ export function createWebApp(deps) {
                 return sendJson(res, forgotten.status, forgotten.body);
             }
             // Delete a skill: the agents that asked for it stop, the file goes to the trash.
+            const stagedGone = /^\/api\/skills\/bundles\/([^/]+)$/.exec(path);
+            if (stagedGone)
+                return reply(res, discardStaged(incomingDirFor(skillsDeps().skillsDir), decodeURIComponent(stagedGone[1])));
             const skillGone = /^\/api\/skills\/([^/]+)$/.exec(path);
             if (skillGone)
                 return reply(res, await deleteSkillRoute(skillsDeps(), decodeURIComponent(skillGone[1])));
@@ -2337,6 +2439,20 @@ export function createWebApp(deps) {
          * staged exactly like a `.tgz` path they could have typed, and the upload
          * is deleted once staging has copied it.
          */
+        /*
+         * A skill bundle (.zip), handed over raw like a plugin tarball: streamed
+         * to a temporary file under a cap, checked, unpacked into staging, and
+         * answered with what is inside. Nothing in it runs, and nothing is kept
+         * until the owner accepts it (`POST /api/skills/bundles/:staged`).
+         */
+        if (path === '/api/skills/bundles') {
+            const incoming = incomingDirFor(skillsDeps().skillsDir);
+            const filename = uploadLabel(first(req.headers['x-filename']));
+            const received = await receiveBundleUpload(incoming, req, filename);
+            if ('status' in received)
+                return reply(res, received);
+            return reply(res, stageBundle(incoming, received.path, filename, deps.now()));
+        }
         if (path === '/api/plugins/upload') {
             const received = await receivePluginUpload(pluginDeps(), req, first(req.headers['x-filename']));
             if ('status' in received)
@@ -2982,6 +3098,20 @@ export function createWebApp(deps) {
          * Chapter 3: what buddi takes on. Records the tiles and starts the By-buddi
          * installs in the background; answers at once with a job per plugin.
          */
+        /*
+         * Fetch a model into the local Ollama, for the first run's "on this
+         * computer". Answers at once; GET the same path for the progress.
+         */
+        if (path === '/api/onboarding/ollama/pull') {
+            try {
+                return sendJson(res, 202, { pull: ollamaPulls.start(typeof body.model === 'string' ? body.model : '') });
+            }
+            catch (error) {
+                if (error instanceof PullRefusal)
+                    return sendJson(res, error.status, { error: error.message });
+                throw error;
+            }
+        }
         if (path === '/api/onboarding/take-on') {
             try {
                 return sendJson(res, 202, await startTakeOn(takeOnDeps(), body.tiles));
@@ -3161,7 +3291,7 @@ export function createWebApp(deps) {
          */
         if (path === '/api/owner') {
             const patch = {};
-            for (const key of ['preferredName', 'timezone', 'language', 'about']) {
+            for (const key of ['preferredName', 'timezone', 'language', 'about', 'fullName', 'pronouns']) {
                 const given = body[key];
                 if (given === undefined)
                     continue;
@@ -3186,8 +3316,27 @@ export function createWebApp(deps) {
                 return sendJson(res, 400, { error: 'The name is too long (80 characters at most).' });
             if (patch.about && patch.about.length > 1000)
                 return sendJson(res, 400, { error: 'Keep the line about you under 1,000 characters.' });
+            if (patch.fullName && patch.fullName.length > 120)
+                return sendJson(res, 400, { error: 'The full name is too long (120 characters at most).' });
+            if (patch.pronouns && patch.pronouns.length > 40)
+                return sendJson(res, 400, { error: 'Keep the pronouns under 40 characters.' });
+            // The birthday: day and month (the year optional), or null to clear it.
+            if (body.birthday !== undefined) {
+                if (body.birthday === null)
+                    patch.birthday = null;
+                else {
+                    const birthday = validDayMonth(body.birthday);
+                    if (!birthday)
+                        return sendJson(res, 400, { error: 'The birthday needs a real day and month; the year is optional.' });
+                    patch.birthday = birthday;
+                }
+            }
             // The zone applies at once; schedules kept in the old one move with it.
             const { profile, zoneChange } = await saveOwnerProfile(deps.pool, patch, deps.env ?? process.env);
+            // The birthday greeting follows the new day at once (missions/dates.ts).
+            if (patch.birthday !== undefined) {
+                await syncDateMissions({ pool: deps.pool, catalog: deps.catalog, now: deps.now, log }).catch((err) => log(`dates: ${err instanceof Error ? err.message : String(err)}`));
+            }
             if (zoneChange)
                 log(`owner: timezone ${zoneChange.from} → ${zoneChange.to}${zoneChange.missions.length > 0 ? `; moved ${zoneChange.missions.join(', ')}` : ''}`);
             return sendJson(res, 200, { ...profile, places: await placesList(deps.pool), detectedTimezone: Intl.DateTimeFormat().resolvedOptions().timeZone, zones: knownTimezones() });
@@ -3201,6 +3350,12 @@ export function createWebApp(deps) {
                 return sendJson(res, answered.status, answered.body);
             }
         }
+        /* People, the owner's side: add, change, forget, bring back (web/people.ts). */
+        if (path.startsWith('/api/memory/people')) {
+            const answered = await peopleRoute({ pool: deps.pool, catalog: deps.catalog, now: deps.now, log }, 'POST', path, body);
+            if (answered)
+                return sendJson(res, answered.status, answered.body);
+        }
         /* Memory, the owner's side: correct a preference, retire one, edit or forget a note. */
         if (path === '/api/memory/preferences') {
             const key = typeof body.key === 'string' ? body.key.trim() : '';
@@ -3392,6 +3547,9 @@ export function createWebApp(deps) {
         /* The Skills page's writes (skills.ts): each checked by reloading the catalog. */
         if (path === '/api/skills')
             return reply(res, createSkillRoute(skillsDeps(), body));
+        const bundleAccept = /^\/api\/skills\/bundles\/([^/]+)$/.exec(path);
+        if (bundleAccept)
+            return reply(res, acceptBundleRoute(skillsDeps(), decodeURIComponent(bundleAccept[1]), body));
         const skillWrite = /^\/api\/skills\/([^/]+)\/(text|grants|trust)$/.exec(path);
         if (skillWrite) {
             const id = decodeURIComponent(skillWrite[1]);