botmux 2.86.0 → 2.87.0

package/dist/dashboard-web/index.html

@@ -25,6 +25,7 @@
         <a href="#/workflows" data-route="workflows"><svg viewBox="0 0 16 16" aria-hidden="true"><circle cx="3.4" cy="8" r="1.9"/><circle cx="12.6" cy="3.6" r="1.9"/><circle cx="12.6" cy="12.4" r="1.9"/><path d="M5.2 7.2l5.6-2.8M5.2 8.8l5.6 2.8"/></svg><span data-i18n="nav.workflows">工作流(beta)</span></a>
         <a href="#/groups" data-route="groups"><svg viewBox="0 0 16 16" aria-hidden="true"><circle cx="5.6" cy="5.8" r="2.4"/><circle cx="11" cy="6.8" r="1.9"/><path d="M1.8 13.2c.5-2.4 2-3.6 3.8-3.6s3.3 1.2 3.8 3.6M9.8 12.6c.4-1.7 1.5-2.6 2.8-2.6 1 0 1.9.5 2.4 1.6"/></svg><span data-i18n="nav.groups">群组</span></a>
         <a href="#/schedules" data-route="schedules"><svg viewBox="0 0 16 16" aria-hidden="true"><circle cx="8" cy="8" r="6.2"/><path d="M8 4.5V8l2.4 1.6"/></svg><span data-i18n="nav.schedules">定时</span></a>
+        <a href="#/whiteboards" data-route="whiteboards"><svg viewBox="0 0 16 16" aria-hidden="true"><rect x="2.2" y="2.2" width="11.6" height="11.6" rx="2"/><path d="M4.8 5.2h6.4M4.8 8h6.4M4.8 10.8h4"/></svg><span>白板</span></a>
         <a href="#/roles" data-route="roles"><svg viewBox="0 0 16 16" aria-hidden="true"><path d="M8 1.8l5.2 2v3.4c0 3.4-2.2 5.9-5.2 7-3-1.1-5.2-3.6-5.2-7V3.8z"/><path d="M5.8 8l1.6 1.6 2.8-3"/></svg><span data-i18n="nav.roles">角色管理</span></a>
         <a href="#/bot-defaults" data-route="bot-defaults"><svg viewBox="0 0 16 16" aria-hidden="true"><rect x="2.5" y="5" width="11" height="8" rx="2"/><circle cx="5.8" cy="9" r="1"/><circle cx="10.2" cy="9" r="1"/><path d="M8 5V2.5M5.5 13v1.2M10.5 13v1.2"/></svg><span data-i18n="nav.botDefaults">Bot 配置</span></a>
         <a href="#/skills" data-route="skills"><svg viewBox="0 0 16 16" aria-hidden="true"><path d="M3 2.5h10v3H3zM3 7h10v6.5H3z"/><path d="M5.4 9.2h5.2M5.4 11.2h3.8"/></svg><span data-i18n="nav.skills">Skills</span></a>

package/dist/dashboard-web/style.css

@@ -157,6 +157,20 @@ a { color: inherit; }
   color: var(--accent-strong);
 }
 
+/* Red dot on the Settings nav when a newer botmux version is available. */
+.sidebar-nav a.nav-has-update { position: relative; }
+.sidebar-nav a.nav-has-update::after {
+  content: "";
+  position: absolute;
+  top: 7px;
+  right: 8px;
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  background: var(--danger);
+  box-shadow: 0 0 0 2px var(--surface);
+}
+
 .sidebar-foot {
   margin-top: auto;
   padding: 10px 8px 4px;
@@ -2228,6 +2242,21 @@ input.row-select,
 }
 .bd-section-note { margin: 6px 0 0; color: var(--muted); font-size: 12px; line-height: 1.5; }
 
+/* ── Version & update card ── */
+.update-version { display: flex; align-items: center; flex-wrap: wrap; gap: 8px; margin: 0 0 12px; }
+.update-badge { font-size: 12px; font-weight: 600; padding: 2px 8px; border-radius: 999px; }
+.update-badge-new { color: var(--accent-strong); background: var(--accent-soft); }
+.update-badge-ok { color: var(--success); background: var(--success-soft); }
+.update-actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 12px; }
+.update-install-list { margin: 6px 0 0; padding-left: 18px; font-size: 12px; line-height: 1.6; }
+.update-install-list code { font-size: 11px; }
+.update-install-list small { color: var(--muted); }
+.update-changelog { margin-top: 14px; display: flex; flex-direction: column; gap: 8px; }
+.update-release { border: 1px solid var(--border-soft); border-radius: 8px; padding: 8px 12px; background: var(--surface-muted); }
+.update-release > summary { cursor: pointer; font-size: 13px; display: flex; align-items: baseline; gap: 8px; flex-wrap: wrap; }
+.update-release > summary small { color: var(--muted); font-size: 11px; }
+.update-release-body { margin: 8px 0 0; white-space: pre-wrap; word-break: break-word; font-size: 12px; line-height: 1.5; max-height: 320px; overflow: auto; color: var(--fg); }
+
 /* A lighter sub-group inside a bd-section (e.g. 主动开工 lives under 新群 Oncall).
    Separated by a soft top rule + indent so it reads as "part of this block". */
 .bd-subsection {
@@ -4179,6 +4208,19 @@ button.contrast:hover { background: var(--danger-soft); border-color: var(--dang
   min-width: 0;
 }
 
+.skills-source-control {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) auto;
+  gap: 8px;
+  align-items: center;
+}
+
+.skills-source-control button {
+  min-height: 36px;
+  padding: 0 13px;
+  white-space: nowrap;
+}
+
 .skills-main-panel,
 .skills-bot-grid {
   display: grid;
@@ -4323,7 +4365,27 @@ button.contrast:hover { background: var(--danger-soft); border-color: var(--dang
   line-height: 1.45;
   overflow-wrap: anywhere;
 }
-.skills-row small { color: var(--muted); font-family: var(--mono); font-size: 11px; overflow-wrap: anywhere; }
+.skills-row small {
+  color: var(--muted);
+  font-family: var(--mono);
+  font-size: 11px;
+  overflow-wrap: anywhere;
+}
+
+.skills-source-badge {
+  display: inline-flex;
+  align-items: center;
+  width: fit-content;
+  max-width: 100%;
+  min-height: 22px;
+  margin-top: 4px;
+  padding: 2px 7px;
+  border: 1px solid var(--border-soft);
+  border-radius: 999px;
+  background: var(--surface-muted);
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
 
 .skills-card-actions {
   display: grid;
@@ -4758,6 +4820,213 @@ button.contrast:hover { background: var(--danger-soft); border-color: var(--dang
   align-self: start;
 }
 
+.skills-discovery-dialog {
+  width: min(860px, calc(100vw - 44px));
+  max-height: min(760px, calc(100vh - 64px));
+  padding: 0;
+  border: 1px solid var(--border-soft);
+  border-radius: 14px;
+  background: var(--surface);
+  box-shadow: var(--modal-shadow);
+  color: var(--fg);
+}
+
+.skills-discovery-dialog::backdrop {
+  background: color-mix(in srgb, #0b1524 42%, transparent);
+  backdrop-filter: blur(4px);
+}
+
+.skills-discovery-dialog article {
+  display: grid;
+  grid-template-rows: auto minmax(0, 1fr) auto;
+  max-height: inherit;
+}
+
+.skills-discovery-dialog header {
+  display: grid;
+  gap: 5px;
+  padding: 18px 20px 12px;
+  border-bottom: 1px solid var(--border-soft);
+}
+
+.skills-discovery-dialog h3,
+.skills-discovery-dialog p {
+  margin: 0;
+}
+
+.skills-discovery-dialog h3 {
+  font-size: 17px;
+}
+
+.skills-discovery-dialog p {
+  color: var(--muted);
+  font-size: 12.5px;
+  line-height: 1.5;
+}
+
+.skills-discovery-body {
+  display: grid;
+  gap: 12px;
+  min-height: 0;
+  max-height: 520px;
+  overflow: auto;
+  padding: 16px 20px;
+}
+
+.skills-discovery-tabs {
+  display: flex;
+  gap: 8px;
+  align-items: center;
+  min-height: 40px;
+  overflow-x: auto;
+  overflow-y: hidden;
+  padding-bottom: 2px;
+  scrollbar-width: thin;
+}
+
+.skills-discovery-tabs button {
+  display: grid;
+  grid-template-columns: auto auto;
+  gap: 8px;
+  align-items: center;
+  flex: 0 0 auto;
+  min-height: 38px;
+  padding: 0 12px;
+  border-radius: 999px;
+  text-transform: uppercase;
+}
+
+.skills-discovery-tabs button.selected {
+  border-color: color-mix(in srgb, var(--accent) 72%, var(--border-soft));
+  background: color-mix(in srgb, var(--accent) 10%, var(--surface));
+  color: var(--fg);
+  box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--accent) 35%, transparent);
+}
+
+.skills-discovery-tabs strong {
+  font-size: 12px;
+}
+
+.skills-discovery-tabs small {
+  color: var(--muted);
+  font-size: 11px;
+  font-weight: 700;
+  text-transform: none;
+}
+
+.skills-discovery-path {
+  min-width: 0;
+  padding: 7px 10px;
+  border-radius: 8px;
+  background: color-mix(in srgb, var(--surface-muted) 70%, transparent);
+}
+
+.skills-discovery-path code {
+  display: block;
+  overflow: hidden;
+  color: var(--muted);
+  font-size: 12px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.skills-discovery-group {
+  display: grid;
+  gap: 8px;
+}
+
+.skills-discovery-group[hidden] {
+  display: none;
+}
+
+.skills-discovery-group header {
+  display: grid;
+  grid-template-columns: auto minmax(0, 1fr);
+  gap: 8px;
+  align-items: center;
+  padding: 0;
+  border: 0;
+}
+
+.skills-discovery-group strong {
+  text-transform: uppercase;
+  color: var(--fg);
+  font-size: 12px;
+}
+
+.skills-discovery-group code {
+  overflow: hidden;
+  color: var(--muted);
+  font-size: 11px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.skills-discovery-list {
+  display: grid;
+  gap: 7px;
+}
+
+.skills-discovery-row {
+  display: grid;
+  grid-template-columns: auto minmax(0, 1fr) auto;
+  gap: 10px;
+  align-items: start;
+  min-height: 54px;
+  padding: 10px 12px;
+  border: 1px solid var(--border-soft);
+  border-radius: 8px;
+  background: var(--surface-muted);
+  cursor: pointer;
+}
+
+.skills-discovery-row input {
+  margin-top: 3px;
+}
+
+.skills-discovery-row span {
+  display: grid;
+  gap: 3px;
+  min-width: 0;
+}
+
+.skills-discovery-row strong {
+  overflow: hidden;
+  color: var(--fg);
+  font-size: 13px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.skills-discovery-row small {
+  display: -webkit-box;
+  -webkit-line-clamp: 2;
+  -webkit-box-orient: vertical;
+  overflow: hidden;
+  color: var(--muted);
+  font-size: 12px;
+  line-height: 1.4;
+}
+
+.skills-discovery-row em {
+  align-self: center;
+  color: var(--muted);
+  font-size: 11px;
+  font-style: normal;
+  font-weight: 700;
+}
+
+.skills-discovery-row.installed {
+  opacity: 0.68;
+  cursor: default;
+}
+
+.skills-discovery-dialog footer {
+  justify-content: end;
+  padding: 12px 20px 16px;
+  border-top: 1px solid var(--border-soft);
+}
+
 .skills-policy-controls [data-bot-status] {
   grid-column: 1 / -1;
 }
@@ -4803,6 +5072,7 @@ button.contrast:hover { background: var(--danger-soft); border-color: var(--dang
   }
   .skills-side-rail,
   .skills-install-grid,
+  .skills-source-control,
   .skills-section-head-row,
   .skills-overview,
   .skills-metric-strip,

package/dist/dashboard.js

@@ -27,15 +27,24 @@ import { BotOnboardingManager } from './dashboard/bot-onboarding.js';
 import { CLI_SELECT_OPTIONS, resolveCliSelection, isTtadkWrapper, ttadkAcceptsModel, TTADK_DEFAULT_MODEL, TTADK_MODEL_SUGGESTIONS, } from './setup/cli-selection.js';
 import { invalidWorkingDirs } from './utils/working-dir.js';
 import { mergeDashboardConfig, mergeGlobalConfig, mergeMaintenanceConfig, parseMaintenancePatch, readGlobalConfig, setGlobalLocale } from './global-config.js';
+import { deleteWhiteboard, listWhiteboards, readWhiteboard, whiteboardEnabled } from './services/whiteboard-store.js';
 import { isLocale } from './i18n/types.js';
-import { isLocalDevInstall } from './utils/install-info.js';
+import { isLocalDevInstall, botmuxVersion } from './utils/install-info.js';
+import { checkNode, detectBotmuxInstalls, resolveCurrentVersion } from './utils/install-diagnostics.js';
+import { fetchLatestVersion, fetchReleasesSince, isNewerVersion } from './core/update-check.js';
+import { GITHUB_REPO } from './core/restart-report.js';
+import { spawnDetachedRestart, npmGlobalUpdateLockTarget } from './core/maintenance.js';
+import { writeRestartIntent } from './services/restart-intent-store.js';
+import { withFileLock } from './utils/file-lock.js';
+import { spawn } from 'node:child_process';
 import { listTeamReports, readTeamBoard, setTeamBoardEntry } from './services/team-board-store.js';
 import { hd2dAssetPath, hd2dStatus, startHd2dDownload } from './dashboard/hd2d-assets.js';
-import { readSkillRegistry, removeInstalledSkill, updateInstalledSkillAsync, } from './services/skill-registry-store.js';
+import { installLocalSkillLinks, readSkillRegistry, removeInstalledSkill, updateInstalledSkillAsync, } from './services/skill-registry-store.js';
 import { redactGitUrlCredentials } from './core/skills/sources.js';
 import { loadBotConfigs } from './bot-registry.js';
+import { discoverNativeCliSkillGroups } from './core/skills/discovery.js';
 import { analyzeSkillReferences } from './core/skills/references.js';
-import { installDashboardSkill, parseDashboardSkillInstallRequest } from './dashboard/skill-install-request.js';
+import { installDashboardSkill, parseDashboardSkillInstallRequest, parseInstallLocalLinksSources, MAX_LOCAL_LINK_SOURCES } from './dashboard/skill-install-request.js';
 import { botDefaultsPayload, botSummaryPayload } from './dashboard/bot-payload.js';
 import { isValidRoleProfileId } from './services/role-profile-store.js';
 import { mergeSafeInsightOverviews } from './services/insight/report.js';
@@ -116,6 +125,7 @@ function resolveDashboardSettings() {
         repoPickerMode: global.repoPickerMode ?? 'all',
         maintenance: global.maintenance ?? {},
         localDevInstall: isLocalDevInstall(),
+        whiteboard: { enabled: global.whiteboard?.enabled === true },
     };
 }
 async function readJsonBody(req) {
@@ -125,6 +135,67 @@ async function readJsonBody(req) {
     const raw = Buffer.concat(chunks).toString('utf8').trim();
     return raw ? JSON.parse(raw) : {};
 }
+/** Fast in-process guard against double-clicks within this dashboard process.
+ *  Cross-process serialization against the maintenance auto-update (a different
+ *  process) is handled separately by the shared file lock in the run route. */
+let updateInFlight = false;
+// Cache the upstream version/changelog lookups so the nav-badge check + the
+// Settings card don't hammer the npm registry / GitHub on every page load.
+// GitHub's unauthenticated API is only 60 req/h per IP, so caching the changelog
+// also keeps us from exhausting it. Failures cache briefly so they self-heal.
+const LATEST_TTL_MS = 30 * 60_000;
+const CHANGELOG_TTL_MS = 15 * 60_000;
+const FAILURE_TTL_MS = 60_000;
+let latestVersionCache = null;
+let changelogCache = null;
+async function cachedLatestVersion(now = Date.now()) {
+    const ttl = latestVersionCache?.value ? LATEST_TTL_MS : FAILURE_TTL_MS;
+    if (latestVersionCache && now - latestVersionCache.at < ttl)
+        return latestVersionCache.value;
+    const value = await fetchLatestVersion();
+    latestVersionCache = { value, at: now };
+    return value;
+}
+async function cachedChangelog(current, now = Date.now()) {
+    const ttl = changelogCache?.value.ok ? CHANGELOG_TTL_MS : FAILURE_TTL_MS;
+    if (changelogCache && changelogCache.key === current && now - changelogCache.at < ttl)
+        return changelogCache.value;
+    const value = await fetchReleasesSince(current);
+    changelogCache = { key: current, value, at: now };
+    return value;
+}
+/**
+ * Run `npm install -g botmux@latest` for the manual-update flow WITHOUT blocking
+ * the event loop (async spawn, not execSync — the dashboard must keep serving
+ * during the ~10-30s install). Resolves on exit 0; rejects with the tail of
+ * stdout/stderr on a non-zero exit, spawn error, or 3-minute timeout. Args are
+ * a fixed literal — no shell interpolation of untrusted input.
+ */
+function runNpmInstallLatest() {
+    return new Promise((resolve, reject) => {
+        const child = spawn('npm', ['install', '-g', 'botmux@latest'], {
+            env: process.env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            shell: process.platform === 'win32', // resolve npm.cmd on Windows
+        });
+        let tail = '';
+        const capture = (d) => { tail = (tail + d.toString()).slice(-2000); };
+        child.stdout?.on('data', capture);
+        child.stderr?.on('data', capture);
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            reject(new Error('npm install timed out after 180s'));
+        }, 180_000);
+        child.on('error', (e) => { clearTimeout(timer); reject(e); });
+        child.on('exit', (code) => {
+            clearTimeout(timer);
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`npm exited ${code}: ${tail.trim().slice(-500)}`));
+        });
+    });
+}
 /**
  * Attach to one daemon: hydrate its sessions/schedules into the aggregator,
  * THEN open the SSE subscription. Order matters — hydrating after subscribe
@@ -507,12 +578,33 @@ function sanitizeSkillForDashboard(skill) {
         source: { ...skill.source, url: redactGitUrlCredentials(skill.source.url) },
     };
 }
+function dashboardSkillCliIds() {
+    const ids = new Set();
+    try {
+        for (const cliId of configuredCliIds().values())
+            ids.add(cliId);
+    }
+    catch {
+        // Fall back to daemon descriptors below when persistent config is unavailable.
+    }
+    for (const bot of registry.list()) {
+        if (bot.cliId)
+            ids.add(bot.cliId);
+    }
+    return [...ids];
+}
 function dashboardSkillsPayload() {
     const globalSkills = readGlobalConfig().skills ?? {};
+    const nativeSkillGroups = discoverNativeCliSkillGroups(dashboardSkillCliIds())
+        .map(group => ({
+        ...group,
+        skills: group.skills.map(sanitizeSkillForDashboard),
+    }));
     return {
         skills: Object.values(readSkillRegistry().skills)
             .sort((a, b) => a.name.localeCompare(b.name))
             .map(sanitizeSkillForDashboard),
+        nativeSkillGroups,
         trustProjectSkills: globalSkills.trustProjectSkills ?? 'off',
         delivery: globalSkills.delivery ?? 'auto',
     };
@@ -774,6 +866,16 @@ const server = createServer(async (req, res) => {
                 mergeGlobalConfig({ repoPickerMode: v });
                 touched = true;
             }
+            if ('whiteboard' in body) {
+                const raw = body.whiteboard;
+                if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+                    return jsonRes(res, 400, { ok: false, error: 'invalid_whiteboard' });
+                const wb = raw;
+                if (typeof wb.enabled !== 'boolean')
+                    return jsonRes(res, 400, { ok: false, error: 'invalid_whiteboard_enabled' });
+                mergeGlobalConfig({ whiteboard: { enabled: wb.enabled } });
+                touched = true;
+            }
             if ('maintenance' in body) {
                 const r = parseMaintenancePatch(body.maintenance);
                 if (!r.ok)
@@ -813,6 +915,96 @@ const server = createServer(async (req, res) => {
                 return jsonRes(res, 400, { ok: false, error: 'empty_patch' });
             return jsonRes(res, 200, { ok: true, settings: resolveDashboardSettings() });
         }
+        // ─── Version & manual update ─────────────────────────────────────────────
+        // `npm install -g` and a host restart are privileged: none of these paths
+        // are on PUBLIC_READ_PATHS, so decideDashboardAuth already 401s an
+        // unauthenticated caller (in both normal and public-read mode). The explicit
+        // `authed` guards on the two mutations are defense-in-depth for host actions.
+        if (req.method === 'GET' && url.pathname === '/api/update/status') {
+            const current = resolveCurrentVersion();
+            // Compare against the npm `latest` dist-tag (always stable; the update
+            // button installs `@latest`). isNewerVersion uses semver precedence, so a
+            // canary running AHEAD of the latest stable (e.g. 2.87.0-canary.0 vs
+            // 2.86.0) is NOT flagged behind — exactly the canary case we want.
+            const latest = await cachedLatestVersion();
+            return jsonRes(res, 200, {
+                current,
+                latest,
+                behind: !!latest && isNewerVersion(latest, current),
+                localDevInstall: isLocalDevInstall(),
+                node: checkNode(),
+                installs: detectBotmuxInstalls(),
+            });
+        }
+        if (req.method === 'GET' && url.pathname === '/api/update/changelog') {
+            const current = resolveCurrentVersion();
+            const result = await cachedChangelog(current);
+            return jsonRes(res, 200, {
+                current,
+                ok: result.ok,
+                rateLimited: result.rateLimited === true,
+                releases: result.releases,
+                releasesUrl: `https://github.com/${GITHUB_REPO}/releases`,
+            });
+        }
+        if (req.method === 'POST' && url.pathname === '/api/update/run') {
+            if (!authed)
+                return jsonRes(res, 401, { ok: false, error: 'unauthorized' });
+            if (isLocalDevInstall())
+                return jsonRes(res, 400, { ok: false, error: 'local_dev_no_update' });
+            const node = checkNode();
+            if (!node.ok)
+                return jsonRes(res, 400, { ok: false, error: 'node_too_old', node });
+            if (updateInFlight)
+                return jsonRes(res, 409, { ok: false, error: 'update_in_flight' });
+            updateInFlight = true;
+            const oldVersion = botmuxVersion();
+            // Acquire the shared cross-process lock so a scheduled maintenance
+            // auto-update (running in the bot-0 daemon) can't `npm install -g` at the
+            // same time. `acquired` distinguishes "lock held by maintenance" (409)
+            // from "npm itself failed" (500). Short wait: don't block the request on a
+            // full in-progress install — report busy fast.
+            let acquired = false;
+            try {
+                await withFileLock(npmGlobalUpdateLockTarget(), async () => {
+                    acquired = true;
+                    await runNpmInstallLatest();
+                }, { maxWaitMs: 2_000 });
+            }
+            catch (e) {
+                if (!acquired)
+                    return jsonRes(res, 409, { ok: false, error: 'update_in_flight' });
+                return jsonRes(res, 500, { ok: false, error: 'npm_failed', detail: e instanceof Error ? e.message : String(e) });
+            }
+            finally {
+                updateInFlight = false;
+            }
+            const newVersion = botmuxVersion();
+            return jsonRes(res, 200, { ok: true, oldVersion, newVersion, changed: newVersion !== oldVersion });
+        }
+        if (req.method === 'POST' && url.pathname === '/api/update/restart') {
+            if (!authed)
+                return jsonRes(res, 401, { ok: false, error: 'unauthorized' });
+            let body = {};
+            try {
+                const parsed = await readJsonBody(req);
+                if (parsed && typeof parsed === 'object')
+                    body = parsed;
+            }
+            catch { /* empty / bad body → plain restart */ }
+            const upd = body.update && typeof body.update === 'object' ? body.update : null;
+            // After a manual update, leave an `update` breadcrumb so the fresh daemon
+            // DMs the owner the changelog (reuses the restart-report pipeline). A plain
+            // restart leaves none here; cmdRestart writes a `manual` breadcrumb itself.
+            if (upd && typeof upd.oldVersion === 'string' && typeof upd.newVersion === 'string' && upd.oldVersion !== upd.newVersion) {
+                try {
+                    writeRestartIntent({ kind: 'update', oldVersion: upd.oldVersion, newVersion: upd.newVersion, at: new Date().toISOString() });
+                }
+                catch { /* breadcrumb is best-effort */ }
+            }
+            spawnDetachedRestart('dashboard');
+            return jsonRes(res, 200, { ok: true });
+        }
         if (req.method === 'GET' && url.pathname === '/api/skills') {
             return jsonRes(res, 200, dashboardSkillsPayload());
         }
@@ -865,6 +1057,30 @@ const server = createServer(async (req, res) => {
                 return jsonRes(res, 400, { ok: false, error: redactGitUrlCredentials(err?.message ?? String(err)) });
             }
         }
+        if (req.method === 'POST' && url.pathname === '/api/skills/install-local-links') {
+            let parsed;
+            try {
+                parsed = await readJsonBody(req);
+            }
+            catch {
+                return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+            }
+            const sources = parseInstallLocalLinksSources(parsed);
+            if (sources.length === 0)
+                return jsonRes(res, 400, { ok: false, error: 'sources_required' });
+            if (sources.length > MAX_LOCAL_LINK_SOURCES)
+                return jsonRes(res, 400, { ok: false, error: 'too_many_sources' });
+            try {
+                const skills = installLocalSkillLinks(sources);
+                // Frontend re-fetches /api/skills (refresh()) after success, so we keep
+                // the response lean — no need to spread a full dashboardSkillsPayload()
+                // (which would re-run the native-skill discovery scan a second time).
+                return jsonRes(res, 200, { ok: true, installed: skills.map(sanitizeSkillForDashboard) });
+            }
+            catch (err) {
+                return jsonRes(res, 400, { ok: false, error: redactGitUrlCredentials(err?.message ?? String(err)) });
+            }
+        }
         let mSkillJob;
         if (req.method === 'GET' && (mSkillJob = url.pathname.match(/^\/api\/skills\/jobs\/([^/]+)$/))) {
             const job = skillJobs.get(decodeURIComponent(mSkillJob[1]));
@@ -908,6 +1124,28 @@ const server = createServer(async (req, res) => {
                 ...dashboardSkillsPayload(),
             });
         }
+        if (req.method === 'GET' && url.pathname === '/api/whiteboards') {
+            return jsonRes(res, 200, { enabled: whiteboardEnabled(), whiteboards: listWhiteboards() });
+        }
+        const mWhiteboard = url.pathname.match(/^\/api\/whiteboards\/([^/]+)$/);
+        if (req.method === 'GET' && mWhiteboard) {
+            try {
+                const id = decodeURIComponent(mWhiteboard[1]);
+                return jsonRes(res, 200, { enabled: whiteboardEnabled(), id, content: readWhiteboard(id, { allowDisabled: true }) });
+            }
+            catch (err) {
+                return jsonRes(res, 404, { ok: false, error: err?.message ?? 'whiteboard_not_found' });
+            }
+        }
+        if (req.method === 'DELETE' && mWhiteboard) {
+            try {
+                const id = decodeURIComponent(mWhiteboard[1]);
+                return jsonRes(res, 200, deleteWhiteboard(id));
+            }
+            catch (err) {
+                return jsonRes(res, 400, { ok: false, error: err?.message ?? 'whiteboard_delete_failed' });
+            }
+        }
         if (await handleConnectorApi(req, res, url)) {
             return;
         }
@@ -1658,6 +1896,24 @@ const server = createServer(async (req, res) => {
             res.end(await upstream.text());
             return;
         }
+        // PUT /api/bots/:appId/env — proxy to that bot's daemon. Body
+        // `{ env: string }` (raw JSON text; '' = clear).
+        let mBotEnv;
+        if (req.method === 'PUT' && (mBotEnv = url.pathname.match(/^\/api\/bots\/([^/]+)\/env$/))) {
+            const appId = decodeURIComponent(mBotEnv[1]);
+            const chunks = [];
+            for await (const c of req)
+                chunks.push(c);
+            const raw = Buffer.concat(chunks).toString('utf8') || '{}';
+            const upstream = await proxyToDaemon(appId, `/api/bot-env`, {
+                method: 'PUT',
+                headers: { 'content-type': 'application/json' },
+                body: raw,
+            });
+            res.writeHead(upstream.status, { 'content-type': 'application/json' });
+            res.end(await upstream.text());
+            return;
+        }
         // PUT /api/bots/:appId/sandbox — proxy to that bot's daemon. Body `{ enabled: boolean }`.
         let mBotSandbox;
         if (req.method === 'PUT' && (mBotSandbox = url.pathname.match(/^\/api\/bots\/([^/]+)\/sandbox$/))) {