@xopcai/xopc 0.0.126 → 0.0.128

package/dist/src/gateway/hono/routes/commands-skills.js

@@ -1,5 +1,6 @@
 import { effectiveWorkspacePathForSession } from "../../../session/session-workspace.js";
 import { getProjectForSession } from "../../../projects/workspace.js";
+import { isSkillInstallTarget } from "../../../agent/skills/install-target.js";
 import { commandRegistry } from "../../../chat-commands/registry.js";
 import { isRegisteredProvider } from "../../../agent/skills/marketplace/registry.js";
 import { buildReviewContext, resolveGitRoot } from "../../../review/review-git.js";
@@ -10,6 +11,23 @@ function parseMarketplaceProviderQuery(raw) {
 	const v = raw?.trim().toLowerCase();
 	if (v && isRegisteredProvider(v)) return v;
 }
+function optionalTrimmedString(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function optionalBoolean(value) {
+	if (value === true || value === "true" || value === "1") return true;
+	if (value === false || value === "false" || value === "0") return false;
+}
+function optionalSkillInstallTarget(value) {
+	if (value == null || value === "") return void 0;
+	return isSkillInstallTarget(value) ? value : void 0;
+}
+function skillHubInstallStatus(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	if (message.includes("already exists")) return 409;
+	if (message.startsWith("HTTP ") || message.includes("fetching archive") || message.includes("git clone failed") || message.includes("Git operation failed")) return 502;
+	return 400;
+}
 function registerCommandsSkillsRoutes(authenticated, deps) {
 	const { service } = deps;
 	authenticated.get("/api/commands", (c) => {
@@ -64,6 +82,13 @@ function registerCommandsSkillsRoutes(authenticated, deps) {
 			payload
 		});
 	});
+	authenticated.get("/api/chat/capabilities", (c) => {
+		const payload = service.agentService.getCapabilityCatalog(c.req.query("sessionKey")?.trim());
+		return c.json({
+			ok: true,
+			payload
+		});
+	});
 	authenticated.get("/api/skills", (c) => {
 		const payload = service.marketplace.getSkillsApi();
 		return c.json({
@@ -238,6 +263,11 @@ function registerCommandsSkillsRoutes(authenticated, deps) {
 		const version = typeof body.version === "string" ? body.version.trim() : void 0;
 		const overwrite = body.overwrite === true || body.overwrite === "true" || body.overwrite === "1";
 		const provider = parseMarketplaceProviderQuery(typeof body.provider === "string" ? body.provider : void 0);
+		const target = optionalSkillInstallTarget(body.target);
+		if (body.target != null && !target) return c.json({
+			ok: false,
+			error: "Expected target to be \"workspace\" or \"global\""
+		}, 400);
 		if (!name) return c.json({
 			ok: false,
 			error: "Expected { name: string, version?: string, overwrite?: boolean }"
@@ -247,7 +277,8 @@ function registerCommandsSkillsRoutes(authenticated, deps) {
 				name,
 				version,
 				overwrite,
-				provider
+				provider,
+				target
 			});
 			return c.json({
 				ok: true,
@@ -260,6 +291,47 @@ function registerCommandsSkillsRoutes(authenticated, deps) {
 			}, 400);
 		}
 	});
+	authenticated.post("/api/skills/hub/install", async (c) => {
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({
+				ok: false,
+				error: "Invalid JSON"
+			}, 400);
+		}
+		const source = optionalTrimmedString(body.source);
+		if (!source) return c.json({
+			ok: false,
+			error: "Expected { source: string }"
+		}, 400);
+		const target = optionalSkillInstallTarget(body.target);
+		if (body.target != null && body.target !== "" && !target) return c.json({
+			ok: false,
+			error: "Expected target to be \"workspace\" or \"global\""
+		}, 400);
+		try {
+			const payload = await service.marketplace.installSkillFromSource({
+				source,
+				ref: optionalTrimmedString(body.ref),
+				path: optionalTrimmedString(body.path),
+				skillId: optionalTrimmedString(body.skillId),
+				target,
+				force: optionalBoolean(body.force) ?? false,
+				strictScan: optionalBoolean(body.strictScan) ?? false
+			});
+			return c.json({
+				ok: true,
+				payload
+			});
+		} catch (err) {
+			return c.json({
+				ok: false,
+				error: err instanceof Error ? err.message : "Install failed"
+			}, skillHubInstallStatus(err));
+		}
+	});
 	authenticated.post("/api/skills/upload", async (c) => {
 		let body;
 		try {
@@ -286,10 +358,17 @@ function registerCommandsSkillsRoutes(authenticated, deps) {
 		const overwriteRaw = body["overwrite"];
 		const skillId = typeof skillIdRaw === "string" && skillIdRaw.trim() ? skillIdRaw.trim() : void 0;
 		const overwrite = overwriteRaw === "true" || overwriteRaw === true || overwriteRaw === "1";
+		const targetRaw = body["target"];
+		const target = optionalSkillInstallTarget(targetRaw);
+		if (targetRaw != null && targetRaw !== "" && !target) return c.json({
+			ok: false,
+			error: "Expected target to be \"workspace\" or \"global\""
+		}, 400);
 		try {
 			const result = service.marketplace.installSkillZip(buf, {
 				skillId,
-				overwrite
+				overwrite,
+				target
 			});
 			return c.json({
 				ok: true,
@@ -308,8 +387,14 @@ function registerCommandsSkillsRoutes(authenticated, deps) {
 			ok: false,
 			error: "Missing id"
 		}, 400);
+		const targetRaw = c.req.query("target");
+		const target = optionalSkillInstallTarget(targetRaw);
+		if (targetRaw != null && targetRaw !== "" && !target) return c.json({
+			ok: false,
+			error: "Expected target to be \"workspace\" or \"global\""
+		}, 400);
 		try {
-			service.marketplace.deleteSkill(id);
+			service.marketplace.deleteSkill(id, target);
 			return c.json({ ok: true });
 		} catch (err) {
 			return c.json({

package/dist/src/gateway/hono/routes/commands-skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"commands-skills.js","names":[],"sources":["../../../../../src/gateway/hono/routes/commands-skills.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport { commandRegistry } from '../../../chat-commands/index.js';\nimport { isRegisteredProvider } from '../../../agent/skills/skills-marketplace.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\nimport { effectiveWorkspacePathForSession } from '../../../session/session-workspace.js';\nimport { getProjectForSession } from '../../../projects/workspace.js';\nimport { buildReviewContext, resolveGitRoot } from '../../../review/review-git.js';\n\nfunction parseMarketplaceProviderQuery(raw: string | undefined): string | undefined {\n  const v = raw?.trim().toLowerCase();\n  if (v && isRegisteredProvider(v)) return v;\n  return undefined;\n}\n\nexport function registerCommandsSkillsRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service } = deps;\n\n  // ========== Chat slash commands (CommandRegistry) ==========\n\n  authenticated.get('/api/commands', (c) => {\n    const all = commandRegistry.list();\n    const commands = all\n      .filter((cmd) => cmd.scope.includes('global') || cmd.scope.includes('private'))\n      .map((cmd) => ({\n        id: cmd.id,\n        name: cmd.name,\n        aliases: cmd.aliases ?? [],\n        description: cmd.description,\n        category: cmd.category,\n        scope: cmd.scope,\n        acceptsArgs: cmd.acceptsArgs ?? false,\n        examples: cmd.examples ?? [],\n      }));\n    const extensionCommands = all\n      .filter((cmd) => cmd.category === 'extension')\n      .map((cmd) => ({\n        id: cmd.id,\n        name: cmd.name,\n        description: cmd.description,\n        extensionId: cmd.id.startsWith('ext.') ? cmd.id.split('.')[1] : undefined,\n      }));\n    return c.json({ ok: true, payload: { commands, extensionCommands } });\n  });\n\n  authenticated.get('/api/review/context', async (c) => {\n    const sessionKey = c.req.query('sessionKey')?.trim() || 'agent:main:main';\n    try {\n      const workspace = effectiveWorkspacePathForSession(\n        service.getConfig(),\n        sessionKey,\n        null,\n        getProjectForSession(sessionKey),\n      );\n      const cwd = await resolveGitRoot(workspace);\n      const payload = await buildReviewContext(cwd);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        {\n          ok: false,\n          error: {\n            code: 'REVIEW_CONTEXT_FAILED',\n            message: err instanceof Error ? err.message : 'Failed to load review context',\n          },\n        },\n        400,\n      );\n    }\n  });\n\n  // ========== Skills (managed global skills under ~/.xopc/skills) ==========\n\n  authenticated.get('/api/chat/skills', (c) => {\n    const agentId = c.req.query('agentId')?.trim() || service.getConfig().agents?.default || 'main';\n    const payload = service.marketplace.getAgentSkillsApi(agentId);\n    return c.json({ ok: true, payload });\n  });\n\n  authenticated.get('/api/skills', (c) => {\n    const payload = service.marketplace.getSkillsApi();\n    return c.json({ ok: true, payload });\n  });\n\n  authenticated.get('/api/skills/status', (c) => {\n    const payload = service.marketplace.getSkillsStatusApi();\n    return c.json({ ok: true, payload });\n  });\n\n  authenticated.get('/api/skills/:skillName/content', (c) => {\n    const raw = c.req.param('skillName');\n    if (!raw) {\n      return c.json({ ok: false, error: 'Missing skill name' }, 400);\n    }\n    let skillName: string;\n    try {\n      skillName = decodeURIComponent(raw);\n    } catch {\n      return c.json({ ok: false, error: 'Invalid skill name' }, 400);\n    }\n    const data = service.marketplace.getSkillMarkdownSource(skillName);\n    if (!data) {\n      return c.json({ ok: false, error: 'Skill not found' }, 404);\n    }\n    return c.json({ ok: true, payload: data });\n  });\n\n  authenticated.post('/api/skills/reload', (c) => {\n    service.marketplace.reloadSkills();\n    return c.json({ ok: true });\n  });\n\n  authenticated.patch('/api/skills/enabled', async (c) => {\n    let body: { skillName?: unknown; enabled?: unknown };\n    try {\n      body = (await c.req.json()) as { skillName?: unknown; enabled?: unknown };\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const skillName = typeof body.skillName === 'string' ? body.skillName.trim() : '';\n    const enabled = body.enabled;\n    if (!skillName || typeof enabled !== 'boolean') {\n      return c.json({ ok: false, error: 'Expected { skillName: string, enabled: boolean }' }, 400);\n    }\n    try {\n      service.marketplace.patchSkillEnabled(skillName, enabled);\n      return c.json({ ok: true });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Update failed' },\n        400,\n      );\n    }\n  });\n\n  authenticated.get('/api/skills/marketplace', async (c) => {\n    const q = c.req.query('q')?.trim() ?? '';\n    const pageRaw = c.req.query('page');\n    const pageSizeRaw = c.req.query('pageSize');\n    const sortRaw = c.req.query('sort');\n    const page = pageRaw != null && pageRaw !== '' ? Math.max(1, Number(pageRaw) || 1) : undefined;\n    const pageSize =\n      pageSizeRaw != null && pageSizeRaw !== ''\n        ? Math.min(50, Math.max(1, Number(pageSizeRaw) || 20))\n        : undefined;\n    const sort =\n      sortRaw === 'newest' || sortRaw === 'downloads' ? sortRaw : undefined;\n    const category = c.req.query('category')?.trim() ?? '';\n    const provider = parseMarketplaceProviderQuery(c.req.query('provider'));\n    try {\n      const payload = await service.marketplace.fetchSkillsCatalog(\n        {\n          q: q || undefined,\n          page,\n          pageSize,\n          sort,\n          category: category || undefined,\n        },\n        provider,\n      );\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Marketplace request failed' },\n        502,\n      );\n    }\n  });\n\n  authenticated.get('/api/skills/marketplace/provider', async (c) => {\n    const info = await service.marketplace.getSkillsProvider();\n    return c.json({ ok: true, payload: info });\n  });\n\n  /** All registered marketplace providers (built-in + extension-contributed). */\n  authenticated.get('/api/skills/marketplace/providers', async (c) => {\n    const [providers, current] = await Promise.all([\n      service.marketplace.getSkillsProviders(),\n      service.marketplace.getSkillsProvider(),\n    ]);\n    return c.json({ ok: true, payload: { providers, current: current.provider } });\n  });\n\n  authenticated.get('/api/skills/marketplace/categories', async (c) => {\n    const provider = parseMarketplaceProviderQuery(c.req.query('provider'));\n    try {\n      const payload = await service.marketplace.fetchSkillsCategories(provider);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Marketplace categories failed' },\n        502,\n      );\n    }\n  });\n\n  authenticated.get('/api/skills/marketplace/packages/:pkgName', async (c) => {\n    const raw = c.req.param('pkgName');\n    if (!raw) {\n      return c.json({ ok: false, error: 'Missing package name' }, 400);\n    }\n    let pkgName: string;\n    try {\n      pkgName = decodeURIComponent(raw);\n    } catch {\n      return c.json({ ok: false, error: 'Invalid package name' }, 400);\n    }\n    try {\n      const provider = parseMarketplaceProviderQuery(c.req.query('provider'));\n      const payload = await service.marketplace.fetchSkillsPackageDetail(pkgName, provider);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Marketplace request failed' },\n        502,\n      );\n    }\n  });\n\n  authenticated.post('/api/skills/marketplace/install', async (c) => {\n    let body: { name?: unknown; version?: unknown; overwrite?: unknown; provider?: unknown };\n    try {\n      body = (await c.req.json()) as typeof body;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const name = typeof body.name === 'string' ? body.name.trim() : '';\n    const version = typeof body.version === 'string' ? body.version.trim() : undefined;\n    const overwrite =\n      body.overwrite === true ||\n      body.overwrite === 'true' ||\n      body.overwrite === '1';\n    const provider = parseMarketplaceProviderQuery(\n      typeof body.provider === 'string' ? body.provider : undefined,\n    );\n    if (!name) {\n      return c.json({ ok: false, error: 'Expected { name: string, version?: string, overwrite?: boolean }' }, 400);\n    }\n    try {\n      const payload = await service.marketplace.installSkill({ name, version, overwrite, provider });\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Install failed' },\n        400,\n      );\n    }\n  });\n\n  authenticated.post('/api/skills/upload', async (c) => {\n    let body: Record<string, unknown>;\n    try {\n      body = await c.req.parseBody({ all: true });\n    } catch {\n      return c.json({ ok: false, error: 'Invalid multipart body' }, 400);\n    }\n    const file = body['file'];\n    if (!file || typeof file !== 'object') {\n      return c.json({ ok: false, error: 'Missing file field' }, 400);\n    }\n    let buf: Buffer;\n    if (file instanceof File) {\n      buf = Buffer.from(await file.arrayBuffer());\n    } else if (typeof (file as Blob).arrayBuffer === 'function') {\n      buf = Buffer.from(await (file as Blob).arrayBuffer());\n    } else {\n      return c.json({ ok: false, error: 'Invalid file upload' }, 400);\n    }\n    const skillIdRaw = body['skillId'];\n    const overwriteRaw = body['overwrite'];\n    const skillId = typeof skillIdRaw === 'string' && skillIdRaw.trim() ? skillIdRaw.trim() : undefined;\n    const overwrite =\n      overwriteRaw === 'true' ||\n      overwriteRaw === true ||\n      overwriteRaw === '1';\n\n    try {\n      const result = service.marketplace.installSkillZip(buf, { skillId, overwrite });\n      return c.json({ ok: true, payload: result });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Install failed' },\n        400,\n      );\n    }\n  });\n\n  authenticated.delete('/api/skills/:id', (c) => {\n    const id = c.req.param('id');\n    if (!id) {\n      return c.json({ ok: false, error: 'Missing id' }, 400);\n    }\n    try {\n      service.marketplace.deleteSkill(id);\n      return c.json({ ok: true });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Delete failed' },\n        400,\n      );\n    }\n  });\n}\n"],"mappings":";;;;;;;;AASA,SAAS,8BAA8B,KAA6C;CAClF,MAAM,IAAI,KAAK,MAAM,CAAC,aAAa;AACnC,KAAI,KAAK,qBAAqB,EAAE,CAAE,QAAO;;AAI3C,SAAgB,6BAA6B,eAAqB,MAAoC;CACpG,MAAM,EAAE,YAAY;AAIpB,eAAc,IAAI,kBAAkB,MAAM;EACxC,MAAM,MAAM,gBAAgB,MAAM;EAClC,MAAM,WAAW,IACd,QAAQ,QAAQ,IAAI,MAAM,SAAS,SAAS,IAAI,IAAI,MAAM,SAAS,UAAU,CAAC,CAC9E,KAAK,SAAS;GACb,IAAI,IAAI;GACR,MAAM,IAAI;GACV,SAAS,IAAI,WAAW,EAAE;GAC1B,aAAa,IAAI;GACjB,UAAU,IAAI;GACd,OAAO,IAAI;GACX,aAAa,IAAI,eAAe;GAChC,UAAU,IAAI,YAAY,EAAE;GAC7B,EAAE;EACL,MAAM,oBAAoB,IACvB,QAAQ,QAAQ,IAAI,aAAa,YAAY,CAC7C,KAAK,SAAS;GACb,IAAI,IAAI;GACR,MAAM,IAAI;GACV,aAAa,IAAI;GACjB,aAAa,IAAI,GAAG,WAAW,OAAO,GAAG,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,KAAA;GACjE,EAAE;AACL,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;IAAE;IAAU;IAAmB;GAAE,CAAC;GACrE;AAEF,eAAc,IAAI,uBAAuB,OAAO,MAAM;EACpD,MAAM,aAAa,EAAE,IAAI,MAAM,aAAa,EAAE,MAAM,IAAI;AACxD,MAAI;GAQF,MAAM,UAAU,MAAM,mBAAmB,MADvB,eANA,iCAChB,QAAQ,WAAW,EACnB,YACA,MACA,qBAAqB,WAAW,CAEQ,CAAC,CACE;AAC7C,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IACE,IAAI;IACJ,OAAO;KACL,MAAM;KACN,SAAS,eAAe,QAAQ,IAAI,UAAU;KAC/C;IACF,EACD,IACD;;GAEH;AAIF,eAAc,IAAI,qBAAqB,MAAM;EAC3C,MAAM,UAAU,EAAE,IAAI,MAAM,UAAU,EAAE,MAAM,IAAI,QAAQ,WAAW,CAAC,QAAQ,WAAW;EACzF,MAAM,UAAU,QAAQ,YAAY,kBAAkB,QAAQ;AAC9D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAEF,eAAc,IAAI,gBAAgB,MAAM;EACtC,MAAM,UAAU,QAAQ,YAAY,cAAc;AAClD,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAEF,eAAc,IAAI,uBAAuB,MAAM;EAC7C,MAAM,UAAU,QAAQ,YAAY,oBAAoB;AACxD,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAEF,eAAc,IAAI,mCAAmC,MAAM;EACzD,MAAM,MAAM,EAAE,IAAI,MAAM,YAAY;AACpC,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAsB,EAAE,IAAI;EAEhE,IAAI;AACJ,MAAI;AACF,eAAY,mBAAmB,IAAI;UAC7B;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAsB,EAAE,IAAI;;EAEhE,MAAM,OAAO,QAAQ,YAAY,uBAAuB,UAAU;AAClE,MAAI,CAAC,KACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAmB,EAAE,IAAI;AAE7D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAM,CAAC;GAC1C;AAEF,eAAc,KAAK,uBAAuB,MAAM;AAC9C,UAAQ,YAAY,cAAc;AAClC,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,MAAM,uBAAuB,OAAO,MAAM;EACtD,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,UAAU,MAAM,GAAG;EAC/E,MAAM,UAAU,KAAK;AACrB,MAAI,CAAC,aAAa,OAAO,YAAY,UACnC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAoD,EAAE,IAAI;AAE9F,MAAI;AACF,WAAQ,YAAY,kBAAkB,WAAW,QAAQ;AACzD,UAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;WACpB,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAiB,EAC1E,IACD;;GAEH;AAEF,eAAc,IAAI,2BAA2B,OAAO,MAAM;EACxD,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,MAAM,IAAI;EACtC,MAAM,UAAU,EAAE,IAAI,MAAM,OAAO;EACnC,MAAM,cAAc,EAAE,IAAI,MAAM,WAAW;EAC3C,MAAM,UAAU,EAAE,IAAI,MAAM,OAAO;EACnC,MAAM,OAAO,WAAW,QAAQ,YAAY,KAAK,KAAK,IAAI,GAAG,OAAO,QAAQ,IAAI,EAAE,GAAG,KAAA;EACrF,MAAM,WACJ,eAAe,QAAQ,gBAAgB,KACnC,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,OAAO,YAAY,IAAI,GAAG,CAAC,GACpD,KAAA;EACN,MAAM,OACJ,YAAY,YAAY,YAAY,cAAc,UAAU,KAAA;EAC9D,MAAM,WAAW,EAAE,IAAI,MAAM,WAAW,EAAE,MAAM,IAAI;EACpD,MAAM,WAAW,8BAA8B,EAAE,IAAI,MAAM,WAAW,CAAC;AACvE,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,mBACxC;IACE,GAAG,KAAK,KAAA;IACR;IACA;IACA;IACA,UAAU,YAAY,KAAA;IACvB,EACD,SACD;AACD,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAA8B,EACvF,IACD;;GAEH;AAEF,eAAc,IAAI,oCAAoC,OAAO,MAAM;EACjE,MAAM,OAAO,MAAM,QAAQ,YAAY,mBAAmB;AAC1D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAM,CAAC;GAC1C;;AAGF,eAAc,IAAI,qCAAqC,OAAO,MAAM;EAClE,MAAM,CAAC,WAAW,WAAW,MAAM,QAAQ,IAAI,CAC7C,QAAQ,YAAY,oBAAoB,EACxC,QAAQ,YAAY,mBAAmB,CACxC,CAAC;AACF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;IAAE;IAAW,SAAS,QAAQ;IAAU;GAAE,CAAC;GAC9E;AAEF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,WAAW,8BAA8B,EAAE,IAAI,MAAM,WAAW,CAAC;AACvE,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,sBAAsB,SAAS;AACzE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAiC,EAC1F,IACD;;GAEH;AAEF,eAAc,IAAI,6CAA6C,OAAO,MAAM;EAC1E,MAAM,MAAM,EAAE,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwB,EAAE,IAAI;EAElE,IAAI;AACJ,MAAI;AACF,aAAU,mBAAmB,IAAI;UAC3B;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAwB,EAAE,IAAI;;AAElE,MAAI;GACF,MAAM,WAAW,8BAA8B,EAAE,IAAI,MAAM,WAAW,CAAC;GACvE,MAAM,UAAU,MAAM,QAAQ,YAAY,yBAAyB,SAAS,SAAS;AACrF,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAA8B,EACvF,IACD;;GAEH;AAEF,eAAc,KAAK,mCAAmC,OAAO,MAAM;EACjE,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,MAAM,GAAG;EAChE,MAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,MAAM,GAAG,KAAA;EACzE,MAAM,YACJ,KAAK,cAAc,QACnB,KAAK,cAAc,UACnB,KAAK,cAAc;EACrB,MAAM,WAAW,8BACf,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW,KAAA,EACrD;AACD,MAAI,CAAC,KACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAoE,EAAE,IAAI;AAE9G,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,aAAa;IAAE;IAAM;IAAS;IAAW;IAAU,CAAC;AAC9F,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAkB,EAC3E,IACD;;GAEH;AAEF,eAAc,KAAK,sBAAsB,OAAO,MAAM;EACpD,IAAI;AACJ,MAAI;AACF,UAAO,MAAM,EAAE,IAAI,UAAU,EAAE,KAAK,MAAM,CAAC;UACrC;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAA0B,EAAE,IAAI;;EAEpE,MAAM,OAAO,KAAK;AAClB,MAAI,CAAC,QAAQ,OAAO,SAAS,SAC3B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAsB,EAAE,IAAI;EAEhE,IAAI;AACJ,MAAI,gBAAgB,KAClB,OAAM,OAAO,KAAK,MAAM,KAAK,aAAa,CAAC;WAClC,OAAQ,KAAc,gBAAgB,WAC/C,OAAM,OAAO,KAAK,MAAO,KAAc,aAAa,CAAC;MAErD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAuB,EAAE,IAAI;EAEjE,MAAM,aAAa,KAAK;EACxB,MAAM,eAAe,KAAK;EAC1B,MAAM,UAAU,OAAO,eAAe,YAAY,WAAW,MAAM,GAAG,WAAW,MAAM,GAAG,KAAA;EAC1F,MAAM,YACJ,iBAAiB,UACjB,iBAAiB,QACjB,iBAAiB;AAEnB,MAAI;GACF,MAAM,SAAS,QAAQ,YAAY,gBAAgB,KAAK;IAAE;IAAS;IAAW,CAAC;AAC/E,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,SAAS;IAAQ,CAAC;WACrC,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAkB,EAC3E,IACD;;GAEH;AAEF,eAAc,OAAO,oBAAoB,MAAM;EAC7C,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK;AAC5B,MAAI,CAAC,GACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAc,EAAE,IAAI;AAExD,MAAI;AACF,WAAQ,YAAY,YAAY,GAAG;AACnC,UAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;WACpB,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAiB,EAC1E,IACD;;GAEH"}
+{"version":3,"file":"commands-skills.js","names":[],"sources":["../../../../../src/gateway/hono/routes/commands-skills.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport { commandRegistry } from '../../../chat-commands/index.js';\nimport { isRegisteredProvider } from '../../../agent/skills/skills-marketplace.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\nimport { effectiveWorkspacePathForSession } from '../../../session/session-workspace.js';\nimport { getProjectForSession } from '../../../projects/workspace.js';\nimport { buildReviewContext, resolveGitRoot } from '../../../review/review-git.js';\nimport {\n  isSkillInstallTarget,\n  type SkillInstallTarget,\n} from '../../../agent/skills/install-target.js';\n\nfunction parseMarketplaceProviderQuery(raw: string | undefined): string | undefined {\n  const v = raw?.trim().toLowerCase();\n  if (v && isRegisteredProvider(v)) return v;\n  return undefined;\n}\n\nfunction optionalTrimmedString(value: unknown): string | undefined {\n  return typeof value === 'string' && value.trim() ? value.trim() : undefined;\n}\n\nfunction optionalBoolean(value: unknown): boolean | undefined {\n  if (value === true || value === 'true' || value === '1') return true;\n  if (value === false || value === 'false' || value === '0') return false;\n  return undefined;\n}\n\nfunction optionalSkillInstallTarget(value: unknown): SkillInstallTarget | undefined {\n  if (value == null || value === '') return undefined;\n  return isSkillInstallTarget(value) ? value : undefined;\n}\n\nfunction skillHubInstallStatus(err: unknown): 400 | 409 | 502 {\n  const message = err instanceof Error ? err.message : String(err);\n  if (message.includes('already exists')) return 409;\n  if (\n    message.startsWith('HTTP ') ||\n    message.includes('fetching archive') ||\n    message.includes('git clone failed') ||\n    message.includes('Git operation failed')\n  ) {\n    return 502;\n  }\n  return 400;\n}\n\nexport function registerCommandsSkillsRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service } = deps;\n\n  // ========== Chat slash commands (CommandRegistry) ==========\n\n  authenticated.get('/api/commands', (c) => {\n    const all = commandRegistry.list();\n    const commands = all\n      .filter((cmd) => cmd.scope.includes('global') || cmd.scope.includes('private'))\n      .map((cmd) => ({\n        id: cmd.id,\n        name: cmd.name,\n        aliases: cmd.aliases ?? [],\n        description: cmd.description,\n        category: cmd.category,\n        scope: cmd.scope,\n        acceptsArgs: cmd.acceptsArgs ?? false,\n        examples: cmd.examples ?? [],\n      }));\n    const extensionCommands = all\n      .filter((cmd) => cmd.category === 'extension')\n      .map((cmd) => ({\n        id: cmd.id,\n        name: cmd.name,\n        description: cmd.description,\n        extensionId: cmd.id.startsWith('ext.') ? cmd.id.split('.')[1] : undefined,\n      }));\n    return c.json({ ok: true, payload: { commands, extensionCommands } });\n  });\n\n  authenticated.get('/api/review/context', async (c) => {\n    const sessionKey = c.req.query('sessionKey')?.trim() || 'agent:main:main';\n    try {\n      const workspace = effectiveWorkspacePathForSession(\n        service.getConfig(),\n        sessionKey,\n        null,\n        getProjectForSession(sessionKey),\n      );\n      const cwd = await resolveGitRoot(workspace);\n      const payload = await buildReviewContext(cwd);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        {\n          ok: false,\n          error: {\n            code: 'REVIEW_CONTEXT_FAILED',\n            message: err instanceof Error ? err.message : 'Failed to load review context',\n          },\n        },\n        400,\n      );\n    }\n  });\n\n  // ========== Skills (managed global skills under ~/.xopc/skills) ==========\n\n  authenticated.get('/api/chat/skills', (c) => {\n    const agentId = c.req.query('agentId')?.trim() || service.getConfig().agents?.default || 'main';\n    const payload = service.marketplace.getAgentSkillsApi(agentId);\n    return c.json({ ok: true, payload });\n  });\n\n  authenticated.get('/api/chat/capabilities', (c) => {\n    const payload = service.agentService.getCapabilityCatalog(c.req.query('sessionKey')?.trim());\n    return c.json({ ok: true, payload });\n  });\n\n  authenticated.get('/api/skills', (c) => {\n    const payload = service.marketplace.getSkillsApi();\n    return c.json({ ok: true, payload });\n  });\n\n  authenticated.get('/api/skills/status', (c) => {\n    const payload = service.marketplace.getSkillsStatusApi();\n    return c.json({ ok: true, payload });\n  });\n\n  authenticated.get('/api/skills/:skillName/content', (c) => {\n    const raw = c.req.param('skillName');\n    if (!raw) {\n      return c.json({ ok: false, error: 'Missing skill name' }, 400);\n    }\n    let skillName: string;\n    try {\n      skillName = decodeURIComponent(raw);\n    } catch {\n      return c.json({ ok: false, error: 'Invalid skill name' }, 400);\n    }\n    const data = service.marketplace.getSkillMarkdownSource(skillName);\n    if (!data) {\n      return c.json({ ok: false, error: 'Skill not found' }, 404);\n    }\n    return c.json({ ok: true, payload: data });\n  });\n\n  authenticated.post('/api/skills/reload', (c) => {\n    service.marketplace.reloadSkills();\n    return c.json({ ok: true });\n  });\n\n  authenticated.patch('/api/skills/enabled', async (c) => {\n    let body: { skillName?: unknown; enabled?: unknown };\n    try {\n      body = (await c.req.json()) as { skillName?: unknown; enabled?: unknown };\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const skillName = typeof body.skillName === 'string' ? body.skillName.trim() : '';\n    const enabled = body.enabled;\n    if (!skillName || typeof enabled !== 'boolean') {\n      return c.json({ ok: false, error: 'Expected { skillName: string, enabled: boolean }' }, 400);\n    }\n    try {\n      service.marketplace.patchSkillEnabled(skillName, enabled);\n      return c.json({ ok: true });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Update failed' },\n        400,\n      );\n    }\n  });\n\n  authenticated.get('/api/skills/marketplace', async (c) => {\n    const q = c.req.query('q')?.trim() ?? '';\n    const pageRaw = c.req.query('page');\n    const pageSizeRaw = c.req.query('pageSize');\n    const sortRaw = c.req.query('sort');\n    const page = pageRaw != null && pageRaw !== '' ? Math.max(1, Number(pageRaw) || 1) : undefined;\n    const pageSize =\n      pageSizeRaw != null && pageSizeRaw !== ''\n        ? Math.min(50, Math.max(1, Number(pageSizeRaw) || 20))\n        : undefined;\n    const sort =\n      sortRaw === 'newest' || sortRaw === 'downloads' ? sortRaw : undefined;\n    const category = c.req.query('category')?.trim() ?? '';\n    const provider = parseMarketplaceProviderQuery(c.req.query('provider'));\n    try {\n      const payload = await service.marketplace.fetchSkillsCatalog(\n        {\n          q: q || undefined,\n          page,\n          pageSize,\n          sort,\n          category: category || undefined,\n        },\n        provider,\n      );\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Marketplace request failed' },\n        502,\n      );\n    }\n  });\n\n  authenticated.get('/api/skills/marketplace/provider', async (c) => {\n    const info = await service.marketplace.getSkillsProvider();\n    return c.json({ ok: true, payload: info });\n  });\n\n  /** All registered marketplace providers (built-in + extension-contributed). */\n  authenticated.get('/api/skills/marketplace/providers', async (c) => {\n    const [providers, current] = await Promise.all([\n      service.marketplace.getSkillsProviders(),\n      service.marketplace.getSkillsProvider(),\n    ]);\n    return c.json({ ok: true, payload: { providers, current: current.provider } });\n  });\n\n  authenticated.get('/api/skills/marketplace/categories', async (c) => {\n    const provider = parseMarketplaceProviderQuery(c.req.query('provider'));\n    try {\n      const payload = await service.marketplace.fetchSkillsCategories(provider);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Marketplace categories failed' },\n        502,\n      );\n    }\n  });\n\n  authenticated.get('/api/skills/marketplace/packages/:pkgName', async (c) => {\n    const raw = c.req.param('pkgName');\n    if (!raw) {\n      return c.json({ ok: false, error: 'Missing package name' }, 400);\n    }\n    let pkgName: string;\n    try {\n      pkgName = decodeURIComponent(raw);\n    } catch {\n      return c.json({ ok: false, error: 'Invalid package name' }, 400);\n    }\n    try {\n      const provider = parseMarketplaceProviderQuery(c.req.query('provider'));\n      const payload = await service.marketplace.fetchSkillsPackageDetail(pkgName, provider);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Marketplace request failed' },\n        502,\n      );\n    }\n  });\n\n  authenticated.post('/api/skills/marketplace/install', async (c) => {\n    let body: {\n      name?: unknown;\n      version?: unknown;\n      overwrite?: unknown;\n      provider?: unknown;\n      target?: unknown;\n    };\n    try {\n      body = (await c.req.json()) as typeof body;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const name = typeof body.name === 'string' ? body.name.trim() : '';\n    const version = typeof body.version === 'string' ? body.version.trim() : undefined;\n    const overwrite =\n      body.overwrite === true ||\n      body.overwrite === 'true' ||\n      body.overwrite === '1';\n    const provider = parseMarketplaceProviderQuery(\n      typeof body.provider === 'string' ? body.provider : undefined,\n    );\n    const target = optionalSkillInstallTarget(body.target);\n    if (body.target != null && !target) {\n      return c.json({ ok: false, error: 'Expected target to be \"workspace\" or \"global\"' }, 400);\n    }\n    if (!name) {\n      return c.json({ ok: false, error: 'Expected { name: string, version?: string, overwrite?: boolean }' }, 400);\n    }\n    try {\n      const payload = await service.marketplace.installSkill({ name, version, overwrite, provider, target });\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Install failed' },\n        400,\n      );\n    }\n  });\n\n  authenticated.post('/api/skills/hub/install', async (c) => {\n    let body: Record<string, unknown>;\n    try {\n      body = (await c.req.json()) as Record<string, unknown>;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n\n    const source = optionalTrimmedString(body.source);\n    if (!source) {\n      return c.json({ ok: false, error: 'Expected { source: string }' }, 400);\n    }\n    const target = optionalSkillInstallTarget(body.target);\n    if (body.target != null && body.target !== '' && !target) {\n      return c.json({ ok: false, error: 'Expected target to be \"workspace\" or \"global\"' }, 400);\n    }\n\n    try {\n      const payload = await service.marketplace.installSkillFromSource({\n        source,\n        ref: optionalTrimmedString(body.ref),\n        path: optionalTrimmedString(body.path),\n        skillId: optionalTrimmedString(body.skillId),\n        target,\n        force: optionalBoolean(body.force) ?? false,\n        strictScan: optionalBoolean(body.strictScan) ?? false,\n      });\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Install failed' },\n        skillHubInstallStatus(err),\n      );\n    }\n  });\n\n  authenticated.post('/api/skills/upload', async (c) => {\n    let body: Record<string, unknown>;\n    try {\n      body = await c.req.parseBody({ all: true });\n    } catch {\n      return c.json({ ok: false, error: 'Invalid multipart body' }, 400);\n    }\n    const file = body['file'];\n    if (!file || typeof file !== 'object') {\n      return c.json({ ok: false, error: 'Missing file field' }, 400);\n    }\n    let buf: Buffer;\n    if (file instanceof File) {\n      buf = Buffer.from(await file.arrayBuffer());\n    } else if (typeof (file as Blob).arrayBuffer === 'function') {\n      buf = Buffer.from(await (file as Blob).arrayBuffer());\n    } else {\n      return c.json({ ok: false, error: 'Invalid file upload' }, 400);\n    }\n    const skillIdRaw = body['skillId'];\n    const overwriteRaw = body['overwrite'];\n    const skillId = typeof skillIdRaw === 'string' && skillIdRaw.trim() ? skillIdRaw.trim() : undefined;\n    const overwrite =\n      overwriteRaw === 'true' ||\n      overwriteRaw === true ||\n      overwriteRaw === '1';\n    const targetRaw = body['target'];\n    const target = optionalSkillInstallTarget(targetRaw);\n    if (targetRaw != null && targetRaw !== '' && !target) {\n      return c.json({ ok: false, error: 'Expected target to be \"workspace\" or \"global\"' }, 400);\n    }\n\n    try {\n      const result = service.marketplace.installSkillZip(buf, { skillId, overwrite, target });\n      return c.json({ ok: true, payload: result });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Install failed' },\n        400,\n      );\n    }\n  });\n\n  authenticated.delete('/api/skills/:id', (c) => {\n    const id = c.req.param('id');\n    if (!id) {\n      return c.json({ ok: false, error: 'Missing id' }, 400);\n    }\n    const targetRaw = c.req.query('target');\n    const target = optionalSkillInstallTarget(targetRaw);\n    if (targetRaw != null && targetRaw !== '' && !target) {\n      return c.json({ ok: false, error: 'Expected target to be \"workspace\" or \"global\"' }, 400);\n    }\n    try {\n      service.marketplace.deleteSkill(id, target);\n      return c.json({ ok: true });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Delete failed' },\n        400,\n      );\n    }\n  });\n}\n"],"mappings":";;;;;;;;;AAaA,SAAS,8BAA8B,KAA6C;CAClF,MAAM,IAAI,KAAK,MAAM,CAAC,aAAa;AACnC,KAAI,KAAK,qBAAqB,EAAE,CAAE,QAAO;;AAI3C,SAAS,sBAAsB,OAAoC;AACjE,QAAO,OAAO,UAAU,YAAY,MAAM,MAAM,GAAG,MAAM,MAAM,GAAG,KAAA;;AAGpE,SAAS,gBAAgB,OAAqC;AAC5D,KAAI,UAAU,QAAQ,UAAU,UAAU,UAAU,IAAK,QAAO;AAChE,KAAI,UAAU,SAAS,UAAU,WAAW,UAAU,IAAK,QAAO;;AAIpE,SAAS,2BAA2B,OAAgD;AAClF,KAAI,SAAS,QAAQ,UAAU,GAAI,QAAO,KAAA;AAC1C,QAAO,qBAAqB,MAAM,GAAG,QAAQ,KAAA;;AAG/C,SAAS,sBAAsB,KAA+B;CAC5D,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,KAAI,QAAQ,SAAS,iBAAiB,CAAE,QAAO;AAC/C,KACE,QAAQ,WAAW,QAAQ,IAC3B,QAAQ,SAAS,mBAAmB,IACpC,QAAQ,SAAS,mBAAmB,IACpC,QAAQ,SAAS,uBAAuB,CAExC,QAAO;AAET,QAAO;;AAGT,SAAgB,6BAA6B,eAAqB,MAAoC;CACpG,MAAM,EAAE,YAAY;AAIpB,eAAc,IAAI,kBAAkB,MAAM;EACxC,MAAM,MAAM,gBAAgB,MAAM;EAClC,MAAM,WAAW,IACd,QAAQ,QAAQ,IAAI,MAAM,SAAS,SAAS,IAAI,IAAI,MAAM,SAAS,UAAU,CAAC,CAC9E,KAAK,SAAS;GACb,IAAI,IAAI;GACR,MAAM,IAAI;GACV,SAAS,IAAI,WAAW,EAAE;GAC1B,aAAa,IAAI;GACjB,UAAU,IAAI;GACd,OAAO,IAAI;GACX,aAAa,IAAI,eAAe;GAChC,UAAU,IAAI,YAAY,EAAE;GAC7B,EAAE;EACL,MAAM,oBAAoB,IACvB,QAAQ,QAAQ,IAAI,aAAa,YAAY,CAC7C,KAAK,SAAS;GACb,IAAI,IAAI;GACR,MAAM,IAAI;GACV,aAAa,IAAI;GACjB,aAAa,IAAI,GAAG,WAAW,OAAO,GAAG,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,KAAA;GACjE,EAAE;AACL,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;IAAE;IAAU;IAAmB;GAAE,CAAC;GACrE;AAEF,eAAc,IAAI,uBAAuB,OAAO,MAAM;EACpD,MAAM,aAAa,EAAE,IAAI,MAAM,aAAa,EAAE,MAAM,IAAI;AACxD,MAAI;GAQF,MAAM,UAAU,MAAM,mBAAmB,MADvB,eANA,iCAChB,QAAQ,WAAW,EACnB,YACA,MACA,qBAAqB,WAAW,CAEQ,CAAC,CACE;AAC7C,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IACE,IAAI;IACJ,OAAO;KACL,MAAM;KACN,SAAS,eAAe,QAAQ,IAAI,UAAU;KAC/C;IACF,EACD,IACD;;GAEH;AAIF,eAAc,IAAI,qBAAqB,MAAM;EAC3C,MAAM,UAAU,EAAE,IAAI,MAAM,UAAU,EAAE,MAAM,IAAI,QAAQ,WAAW,CAAC,QAAQ,WAAW;EACzF,MAAM,UAAU,QAAQ,YAAY,kBAAkB,QAAQ;AAC9D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAEF,eAAc,IAAI,2BAA2B,MAAM;EACjD,MAAM,UAAU,QAAQ,aAAa,qBAAqB,EAAE,IAAI,MAAM,aAAa,EAAE,MAAM,CAAC;AAC5F,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAEF,eAAc,IAAI,gBAAgB,MAAM;EACtC,MAAM,UAAU,QAAQ,YAAY,cAAc;AAClD,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAEF,eAAc,IAAI,uBAAuB,MAAM;EAC7C,MAAM,UAAU,QAAQ,YAAY,oBAAoB;AACxD,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAEF,eAAc,IAAI,mCAAmC,MAAM;EACzD,MAAM,MAAM,EAAE,IAAI,MAAM,YAAY;AACpC,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAsB,EAAE,IAAI;EAEhE,IAAI;AACJ,MAAI;AACF,eAAY,mBAAmB,IAAI;UAC7B;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAsB,EAAE,IAAI;;EAEhE,MAAM,OAAO,QAAQ,YAAY,uBAAuB,UAAU;AAClE,MAAI,CAAC,KACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAmB,EAAE,IAAI;AAE7D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAM,CAAC;GAC1C;AAEF,eAAc,KAAK,uBAAuB,MAAM;AAC9C,UAAQ,YAAY,cAAc;AAClC,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,MAAM,uBAAuB,OAAO,MAAM;EACtD,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,UAAU,MAAM,GAAG;EAC/E,MAAM,UAAU,KAAK;AACrB,MAAI,CAAC,aAAa,OAAO,YAAY,UACnC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAoD,EAAE,IAAI;AAE9F,MAAI;AACF,WAAQ,YAAY,kBAAkB,WAAW,QAAQ;AACzD,UAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;WACpB,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAiB,EAC1E,IACD;;GAEH;AAEF,eAAc,IAAI,2BAA2B,OAAO,MAAM;EACxD,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,MAAM,IAAI;EACtC,MAAM,UAAU,EAAE,IAAI,MAAM,OAAO;EACnC,MAAM,cAAc,EAAE,IAAI,MAAM,WAAW;EAC3C,MAAM,UAAU,EAAE,IAAI,MAAM,OAAO;EACnC,MAAM,OAAO,WAAW,QAAQ,YAAY,KAAK,KAAK,IAAI,GAAG,OAAO,QAAQ,IAAI,EAAE,GAAG,KAAA;EACrF,MAAM,WACJ,eAAe,QAAQ,gBAAgB,KACnC,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,OAAO,YAAY,IAAI,GAAG,CAAC,GACpD,KAAA;EACN,MAAM,OACJ,YAAY,YAAY,YAAY,cAAc,UAAU,KAAA;EAC9D,MAAM,WAAW,EAAE,IAAI,MAAM,WAAW,EAAE,MAAM,IAAI;EACpD,MAAM,WAAW,8BAA8B,EAAE,IAAI,MAAM,WAAW,CAAC;AACvE,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,mBACxC;IACE,GAAG,KAAK,KAAA;IACR;IACA;IACA;IACA,UAAU,YAAY,KAAA;IACvB,EACD,SACD;AACD,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAA8B,EACvF,IACD;;GAEH;AAEF,eAAc,IAAI,oCAAoC,OAAO,MAAM;EACjE,MAAM,OAAO,MAAM,QAAQ,YAAY,mBAAmB;AAC1D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAM,CAAC;GAC1C;;AAGF,eAAc,IAAI,qCAAqC,OAAO,MAAM;EAClE,MAAM,CAAC,WAAW,WAAW,MAAM,QAAQ,IAAI,CAC7C,QAAQ,YAAY,oBAAoB,EACxC,QAAQ,YAAY,mBAAmB,CACxC,CAAC;AACF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;IAAE;IAAW,SAAS,QAAQ;IAAU;GAAE,CAAC;GAC9E;AAEF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,WAAW,8BAA8B,EAAE,IAAI,MAAM,WAAW,CAAC;AACvE,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,sBAAsB,SAAS;AACzE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAiC,EAC1F,IACD;;GAEH;AAEF,eAAc,IAAI,6CAA6C,OAAO,MAAM;EAC1E,MAAM,MAAM,EAAE,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwB,EAAE,IAAI;EAElE,IAAI;AACJ,MAAI;AACF,aAAU,mBAAmB,IAAI;UAC3B;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAwB,EAAE,IAAI;;AAElE,MAAI;GACF,MAAM,WAAW,8BAA8B,EAAE,IAAI,MAAM,WAAW,CAAC;GACvE,MAAM,UAAU,MAAM,QAAQ,YAAY,yBAAyB,SAAS,SAAS;AACrF,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAA8B,EACvF,IACD;;GAEH;AAEF,eAAc,KAAK,mCAAmC,OAAO,MAAM;EACjE,IAAI;AAOJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,MAAM,GAAG;EAChE,MAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,MAAM,GAAG,KAAA;EACzE,MAAM,YACJ,KAAK,cAAc,QACnB,KAAK,cAAc,UACnB,KAAK,cAAc;EACrB,MAAM,WAAW,8BACf,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW,KAAA,EACrD;EACD,MAAM,SAAS,2BAA2B,KAAK,OAAO;AACtD,MAAI,KAAK,UAAU,QAAQ,CAAC,OAC1B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAiD,EAAE,IAAI;AAE3F,MAAI,CAAC,KACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAoE,EAAE,IAAI;AAE9G,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,aAAa;IAAE;IAAM;IAAS;IAAW;IAAU;IAAQ,CAAC;AACtG,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAkB,EAC3E,IACD;;GAEH;AAEF,eAAc,KAAK,2BAA2B,OAAO,MAAM;EACzD,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAG1D,MAAM,SAAS,sBAAsB,KAAK,OAAO;AACjD,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAA+B,EAAE,IAAI;EAEzE,MAAM,SAAS,2BAA2B,KAAK,OAAO;AACtD,MAAI,KAAK,UAAU,QAAQ,KAAK,WAAW,MAAM,CAAC,OAChD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAiD,EAAE,IAAI;AAG3F,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,uBAAuB;IAC/D;IACA,KAAK,sBAAsB,KAAK,IAAI;IACpC,MAAM,sBAAsB,KAAK,KAAK;IACtC,SAAS,sBAAsB,KAAK,QAAQ;IAC5C;IACA,OAAO,gBAAgB,KAAK,MAAM,IAAI;IACtC,YAAY,gBAAgB,KAAK,WAAW,IAAI;IACjD,CAAC;AACF,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAkB,EAC3E,sBAAsB,IAAI,CAC3B;;GAEH;AAEF,eAAc,KAAK,sBAAsB,OAAO,MAAM;EACpD,IAAI;AACJ,MAAI;AACF,UAAO,MAAM,EAAE,IAAI,UAAU,EAAE,KAAK,MAAM,CAAC;UACrC;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAA0B,EAAE,IAAI;;EAEpE,MAAM,OAAO,KAAK;AAClB,MAAI,CAAC,QAAQ,OAAO,SAAS,SAC3B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAsB,EAAE,IAAI;EAEhE,IAAI;AACJ,MAAI,gBAAgB,KAClB,OAAM,OAAO,KAAK,MAAM,KAAK,aAAa,CAAC;WAClC,OAAQ,KAAc,gBAAgB,WAC/C,OAAM,OAAO,KAAK,MAAO,KAAc,aAAa,CAAC;MAErD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAuB,EAAE,IAAI;EAEjE,MAAM,aAAa,KAAK;EACxB,MAAM,eAAe,KAAK;EAC1B,MAAM,UAAU,OAAO,eAAe,YAAY,WAAW,MAAM,GAAG,WAAW,MAAM,GAAG,KAAA;EAC1F,MAAM,YACJ,iBAAiB,UACjB,iBAAiB,QACjB,iBAAiB;EACnB,MAAM,YAAY,KAAK;EACvB,MAAM,SAAS,2BAA2B,UAAU;AACpD,MAAI,aAAa,QAAQ,cAAc,MAAM,CAAC,OAC5C,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAiD,EAAE,IAAI;AAG3F,MAAI;GACF,MAAM,SAAS,QAAQ,YAAY,gBAAgB,KAAK;IAAE;IAAS;IAAW;IAAQ,CAAC;AACvF,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,SAAS;IAAQ,CAAC;WACrC,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAkB,EAC3E,IACD;;GAEH;AAEF,eAAc,OAAO,oBAAoB,MAAM;EAC7C,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK;AAC5B,MAAI,CAAC,GACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAc,EAAE,IAAI;EAExD,MAAM,YAAY,EAAE,IAAI,MAAM,SAAS;EACvC,MAAM,SAAS,2BAA2B,UAAU;AACpD,MAAI,aAAa,QAAQ,cAAc,MAAM,CAAC,OAC5C,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAiD,EAAE,IAAI;AAE3F,MAAI;AACF,WAAQ,YAAY,YAAY,IAAI,OAAO;AAC3C,UAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;WACpB,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAiB,EAC1E,IACD;;GAEH"}

package/dist/src/gateway/hono/routes/connectors.js

@@ -2,12 +2,12 @@ import { createConnectorSetupSecretRequest, submitConnectorSetupSecret } from ".
 import { executeComposioTool, getComposioToolkitScope, listComposioConnections, listComposioTools, setComposioToolkitScope, startComposioAuthorize } from "../../../connectors/composio.js";
 import { listConnectorProviders } from "../../../connectors/providers.js";
 import { getConnectorDefinition, listConnectorCatalog } from "../../../connectors/catalog.js";
-import { appendComposioTriggerEvent, listComposioTriggerEvents } from "../../../connectors/composio-triggers.js";
 import { recordConnectorHealthUsage } from "../../../connectors/usage.js";
 import { getConnectorInstance, listConnectorInstances } from "../../../connectors/instances.js";
-import { previewConnectorDefinition, testConnectorInstance } from "../../../connectors/health.js";
 import { completeConnectorOAuth, startConnectorOAuth } from "../../../connectors/oauth.js";
 import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
+import { appendComposioTriggerEvent, listComposioTriggerEvents } from "../../../connectors/composio-triggers.js";
+import { previewConnectorDefinition, testConnectorInstance } from "../../../connectors/health.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";
 import { isConnectorRegistrySource, listConnectorRegistries, searchConnectorRegistries } from "../../../connectors/registries/search.js";
 //#region src/gateway/hono/routes/connectors.ts

package/dist/src/gateway/hono/routes/goals.js

@@ -1,6 +1,8 @@
 import { buildSessionKey, init_session_key, sanitizeSegment } from "../../../routing/session-key.js";
 import { getDefaultAgentId, init_resolve_route } from "../../../routing/resolve-route.js";
 import { GoalService, normalizeGoalUiLocale } from "../../../goals/goal-service.js";
+import { draftGoalContract } from "../../../goals/goal-contract-draft.js";
+import { reviewGoalEvidenceRequirement } from "../../../goals/goal-evidence-review.js";
 import "../../../goals/index.js";
 import { createWorkflowCatalog } from "../../../agent/workflow/catalog.js";
 import { resolveProjectAgentId } from "../../../projects/project-agent.js";
@@ -25,6 +27,27 @@ function parseBodyGoalStatus(raw) {
 function parsePriority(raw) {
 	return raw === "low" || raw === "normal" || raw === "high" ? raw : void 0;
 }
+function parseGoalContract(raw) {
+	if (raw === void 0) return void 0;
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const value = raw;
+	const list = (candidate) => {
+		if (candidate === void 0) return void 0;
+		if (!Array.isArray(candidate) || candidate.some((item) => typeof item !== "string")) return void 0;
+		return candidate.map((item) => item.trim()).filter(Boolean).slice(0, 20);
+	};
+	const evidencePlan = list(value.evidencePlan);
+	const criteria = list(value.criteria);
+	if (value.evidencePlan !== void 0 && !evidencePlan || value.criteria !== void 0 && !criteria) return null;
+	if (value.objective !== void 0 && typeof value.objective !== "string") return null;
+	if (value.scopeBoundary !== void 0 && typeof value.scopeBoundary !== "string") return null;
+	return {
+		objective: typeof value.objective === "string" ? value.objective.trim() : void 0,
+		scopeBoundary: typeof value.scopeBoundary === "string" ? value.scopeBoundary.trim() : void 0,
+		evidencePlan,
+		criteria
+	};
+}
 function maxBase64CharsForBinary(maxBinaryBytes) {
 	return 4 * Math.ceil(maxBinaryBytes / 3);
 }
@@ -259,6 +282,11 @@ function registerGoalsRoutes(authenticated, deps) {
 			ok: false,
 			error: "Missing title"
 		}, 400);
+		const contract = parseGoalContract(body.contract);
+		if (contract === null) return c.json({
+			ok: false,
+			error: "Invalid goal contract"
+		}, 400);
 		const sessionKey = typeof body.sessionKey === "string" && body.sessionKey.trim() ? body.sessionKey.trim() : void 0;
 		const contextMessage = parseUserTurnInput(body.contextMessage) ?? { text: "" };
 		const attachmentError = validateUserTurnAttachments(contextMessage.attachments);
@@ -291,6 +319,7 @@ function registerGoalsRoutes(authenticated, deps) {
 			uiLocale: normalizeGoalUiLocale(body.uiLocale),
 			source: body.source === "cli" || body.source === "cron" || body.source === "workflow" || body.source === "channel" || body.source === "api" ? body.source : "chat",
 			projectId,
+			contract,
 			config: cfg()
 		});
 		goals.setContextMessage({
@@ -303,6 +332,59 @@ function registerGoalsRoutes(authenticated, deps) {
 			goal: goals.get(goal.id)
 		});
 	});
+	authenticated.post("/api/goals/contract/draft", async (c) => {
+		const body = await c.req.json().catch(() => ({}));
+		const title = typeof body.title === "string" ? body.title.trim() : "";
+		if (!title) return c.json({
+			ok: false,
+			error: "Missing title"
+		}, 400);
+		const parsed = parseGoalContract({ criteria: body.criteria });
+		if (!parsed) return c.json({
+			ok: false,
+			error: "Invalid acceptance criteria"
+		}, 400);
+		const modelRef = typeof body.modelRef === "string" && body.modelRef.trim() ? body.modelRef.trim() : typeof body.judgeModelRef === "string" && body.judgeModelRef.trim() ? body.judgeModelRef.trim() : cfg()?.goals?.judgeModelRef;
+		const result = await draftGoalContract({
+			title,
+			context: typeof body.context === "string" ? body.context : void 0,
+			criteria: parsed.criteria,
+			uiLocale: normalizeGoalUiLocale(body.uiLocale),
+			modelRef
+		});
+		return c.json({
+			ok: true,
+			...result
+		});
+	});
+	authenticated.get("/api/goals/:goalId/contract", async (c) => {
+		const goal = goals.get(c.req.param("goalId"));
+		if (!goal) return c.json({
+			ok: false,
+			error: "Goal not found"
+		}, 404);
+		return c.json({
+			ok: true,
+			contract: goal.contract ?? null
+		});
+	});
+	authenticated.put("/api/goals/:goalId/contract", async (c) => {
+		const contract = parseGoalContract(await c.req.json().catch(() => ({})));
+		if (!contract) return c.json({
+			ok: false,
+			error: "Invalid goal contract"
+		}, 400);
+		const goal = goals.setContract(c.req.param("goalId"), contract);
+		if (!goal) return c.json({
+			ok: false,
+			error: "Goal not found"
+		}, 404);
+		return c.json({
+			ok: true,
+			goal,
+			contract: goal.contract
+		});
+	});
 	authenticated.get("/api/goals/:goalId/workflow-runs", async (c) => {
 		const goalId = c.req.param("goalId");
 		const goal = goals.get(goalId);
@@ -607,8 +689,16 @@ function registerGoalsRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.post("/api/goals/:goalId/complete", async (c) => {
-		const before = goals.get(c.req.param("goalId"));
-		const goal = goals.complete(c.req.param("goalId"));
+		const goalId = c.req.param("goalId");
+		const before = goals.get(goalId);
+		const readiness = goals.getCompletionReadiness(goalId);
+		if (readiness && !readiness.ready) return c.json({
+			ok: false,
+			error: "Goal completion evidence is still required",
+			missingEvidence: readiness.missingEvidence,
+			pendingApproval: readiness.pendingApproval
+		}, 409);
+		const goal = goals.complete(goalId);
 		if (!goal) return c.json({
 			ok: false,
 			error: "Goal not found"
@@ -733,6 +823,17 @@ function registerGoalsRoutes(authenticated, deps) {
 			evidence: goals.listEvidence(goalId, parseLimit(c.req.query("limit"), 100))
 		});
 	});
+	authenticated.get("/api/goals/:goalId/evidence-requirements", async (c) => {
+		const goalId = c.req.param("goalId");
+		if (!goals.get(goalId)) return c.json({
+			ok: false,
+			error: "Goal not found"
+		}, 404);
+		return c.json({
+			ok: true,
+			requirements: goals.listEvidenceRequirements(goalId)
+		});
+	});
 	authenticated.post("/api/goals/:goalId/evidence", async (c) => {
 		const goalId = c.req.param("goalId");
 		if (!goals.get(goalId)) return c.json({
@@ -742,6 +843,7 @@ function registerGoalsRoutes(authenticated, deps) {
 		const body = await c.req.json().catch(() => ({}));
 		const title = typeof body.title === "string" ? body.title.trim() : "";
 		const kind = body.kind;
+		const requirementId = typeof body.requirementId === "string" ? body.requirementId.trim() : "";
 		if (!title) return c.json({
 			ok: false,
 			error: "Missing title"
@@ -750,6 +852,10 @@ function registerGoalsRoutes(authenticated, deps) {
 			ok: false,
 			error: "Invalid evidence kind"
 		}, 400);
+		if (requirementId && !goals.listEvidenceRequirements(goalId).some((item) => item.id === requirementId)) return c.json({
+			ok: false,
+			error: "Evidence requirement not found"
+		}, 404);
 		const evidence = goals.addEvidence({
 			goalId,
 			runId: typeof body.runId === "string" ? body.runId : void 0,
@@ -759,9 +865,112 @@ function registerGoalsRoutes(authenticated, deps) {
 			uri: typeof body.uri === "string" ? body.uri : void 0,
 			data: body.data
 		});
+		const requirement = requirementId ? goals.linkEvidenceRequirement({
+			goalId,
+			requirementId,
+			evidenceId: evidence.id,
+			linkedBy: "user"
+		}) : void 0;
+		return c.json({
+			ok: true,
+			evidence: {
+				...evidence,
+				requirementIds: requirement ? [requirement.id] : []
+			},
+			requirement
+		});
+	});
+	authenticated.post("/api/goals/:goalId/evidence-requirements/:requirementId/link", async (c) => {
+		const goalId = c.req.param("goalId");
+		const body = await c.req.json().catch(() => ({}));
+		const evidenceId = typeof body.evidenceId === "string" ? body.evidenceId.trim() : "";
+		if (!evidenceId) return c.json({
+			ok: false,
+			error: "Missing evidence id"
+		}, 400);
+		const requirement = goals.linkEvidenceRequirement({
+			goalId,
+			requirementId: c.req.param("requirementId"),
+			evidenceId,
+			linkedBy: "user"
+		});
+		if (!requirement) return c.json({
+			ok: false,
+			error: "Evidence requirement or evidence not found"
+		}, 404);
+		return c.json({
+			ok: true,
+			requirement
+		});
+	});
+	authenticated.post("/api/goals/:goalId/evidence-requirements/:requirementId/review", async (c) => {
+		const goalId = c.req.param("goalId");
+		const goal = goals.get(goalId);
+		if (!goal) return c.json({
+			ok: false,
+			error: "Goal not found"
+		}, 404);
+		const requirement = goal.evidenceRequirements.find((item) => item.id === c.req.param("requirementId"));
+		if (!requirement) return c.json({
+			ok: false,
+			error: "Evidence requirement not found"
+		}, 404);
+		const body = await c.req.json().catch(() => ({}));
+		const evidenceById = new Map(goals.listEvidence(goalId, 500).map((item) => [item.id, item]));
+		const review = await reviewGoalEvidenceRequirement({
+			requirement,
+			evidence: requirement.evidenceIds.flatMap((id) => {
+				const item = evidenceById.get(id);
+				return item ? [item] : [];
+			}),
+			modelRef: typeof body.modelRef === "string" && body.modelRef.trim() ? body.modelRef.trim() : goal.judgeModelRef
+		});
+		const status = review.verdict === "approved" ? "ai_verified" : review.verdict === "rejected" ? "rejected" : "pending";
+		const updated = goals.reviewEvidenceRequirement({
+			goalId,
+			requirementId: requirement.id,
+			status,
+			reason: review.reason,
+			confidence: review.confidence,
+			reviewedBy: review.generated ? "ai" : "system"
+		});
+		return c.json({
+			ok: true,
+			requirement: updated,
+			review
+		});
+	});
+	authenticated.post("/api/goals/:goalId/evidence-requirements/:requirementId/approve", async (c) => {
+		const goalId = c.req.param("goalId");
+		const body = await c.req.json().catch(() => ({}));
+		const existing = goals.get(goalId);
+		if (!existing) return c.json({
+			ok: false,
+			error: "Goal not found"
+		}, 404);
+		const existingRequirement = existing.evidenceRequirements.find((item) => item.id === c.req.param("requirementId"));
+		if (!existingRequirement) return c.json({
+			ok: false,
+			error: "Evidence requirement not found"
+		}, 404);
+		if (existingRequirement.evidenceIds.length === 0) return c.json({
+			ok: false,
+			error: "Link evidence before approving this requirement"
+		}, 409);
+		const requirement = goals.reviewEvidenceRequirement({
+			goalId,
+			requirementId: c.req.param("requirementId"),
+			status: "approved",
+			reason: typeof body.reason === "string" && body.reason.trim() ? body.reason.trim() : "Approved by a user after reviewing the linked evidence.",
+			reviewedBy: "user"
+		});
+		if (!requirement) return c.json({
+			ok: false,
+			error: "Evidence requirement not found"
+		}, 404);
 		return c.json({
 			ok: true,
-			evidence
+			requirement
 		});
 	});
 	authenticated.post("/api/goals/:goalId/checklist", async (c) => {