botmux 3.11.0 → 3.12.1

package/dist/dashboard.js

@@ -11,7 +11,7 @@ import { logger } from './utils/logger.js';
 import { gracefulProcessExitCode } from './pm2-graceful-exit.js';
 import { config, isWildcardBindHost } from './config.js';
 import { listenWithProbe } from './utils/listen-with-probe.js';
-import { generateToken, parseCookie, buildSetCookie, verifyHmac, cliAuthBind, decideDashboardAuth, loadPersistedToken, loadOrCreatePersistedToken, persistToken, loadDashboardSecret, loadOrCreateDashboardSecret, } from './dashboard/auth.js';
+import { parseCookie, buildSetCookie, verifyHmac, cliAuthBind, decideDashboardAuth, loadPersistedToken, loadOrCreatePersistedToken, rotatePersistedToken, loadDashboardSecret, loadOrCreateDashboardSecret, } from './dashboard/auth.js';
 import { DaemonRegistry, botsRosterSignature } from './dashboard/registry.js';
 import { Aggregator, subscribeDaemon } from './dashboard/aggregator.js';
 import { createSessionPresentationCoordinator } from './dashboard/session-presentation.js';
@@ -62,14 +62,17 @@ import { listTeamReports, readTeamBoard, setTeamBoardEntry } from './services/te
 import { createCliAdapterSync } from './adapters/cli/registry.js';
 import { hd2dAssetPath, hd2dStatus, startHd2dDownload } from './dashboard/hd2d-assets.js';
 import { buildSkillInstallAuditSummary, installLocalSkillLinks, readSkillRegistry, removeInstalledSkill, removeInstalledSkills, updateInstalledSkillAsync, } from './services/skill-registry-store.js';
+import { readSkillPackRegistry } from './services/skill-pack-store.js';
+import { cloneSkillPack, createSkillPack, deleteSkillPack, getSkillPack, listSkillPacks, updateSkillPack, SkillPackStoreError, } from './services/skill-pack-store.js';
 import { redactGitUrlCredentials } from './core/skills/sources.js';
+import { enrichPackForDashboard, enrichPacksForDashboard, sanitizeSkillForDashboard, } from './dashboard/skill-pack-response.js';
 import { effectiveDefaultWorkingDir, getBot, loadBotConfigs, parseBotConfigsFromText } from './bot-registry.js';
 import { addChatToFeedGroup, createFeedGroup, FEED_GROUP_SCOPES, FeedGroupApiError, listFeedGroups } from './dashboard/feed-groups.js';
 import { generateAuthUrl, handleCallbackUrl, isCallbackUrl } from './utils/user-token.js';
 import { findEntryIndex, readRawConfig, requireConfigPath, writeRawConfigAtomic } from './services/config-store.js';
 import { emitCodexNotifierOutboxItem, installCodexNotifierHook, isCodexNotifierWorkerStateFresh, isCodexNotifierHookInstalled, listCodexNotifierOutbox, readCodexNotifierWorkerState, resolveCodexNotifierConfig, runCodexSideConversationMonitor, runCodexNotifierWorkerSupervisor, } from './features/codex-notifier/index.js';
 import { discoverNativeCliSkillGroups } from './core/skills/discovery.js';
-import { analyzeSkillReferences } from './core/skills/references.js';
+import { analyzeSkillReferences, packsContainingSkill } from './core/skills/references.js';
 import { discoverDashboardSkills, installDashboardSkill, parseDashboardSkillInstallRequest, parseInstallLocalLinksSources, MAX_LOCAL_LINK_SOURCES } from './dashboard/skill-install-request.js';
 import { botDefaultsPayload, botSummaryPayload, brandMapByAppId } from './dashboard/bot-payload.js';
 import { handleVcMeetingConsumerProfilesGet, handleVcMeetingConsumerProfilesPut, } from './dashboard/vc-consumer-profiles-api.js';
@@ -104,6 +107,15 @@ import { resolveEffectivePluginIds, updateBotPluginOverride } from './core/plugi
 import { assertPluginBindingTransition, describePluginDependencyError } from './core/plugins/dependencies.js';
 import { inspectGatewayEntry } from './core/plugins/mcp/gateway-installer.js';
 import { fetchDaemonIpc } from './core/daemon-ipc-auth.js';
+import { buildDashboardSummary, parseDashboardSummaryRows, } from './dashboard/dashboard-summary.js';
+import { createDashboardSummaryEndpoint } from './dashboard/dashboard-summary-endpoint.js';
+import { scrubWorkflowWorkerEnv } from './utils/child-env.js';
+// The dashboard is an independent long-lived PM2 app and can be resurrected
+// from a stale dump.pm2 without passing through cli.ts pm2Env(). Its start/stop
+// and detached-restart children inherit process.env, so a leaked workflow
+// marker would make those CLI commands fail at the workflow safety gate before
+// they can reach their own cleanup boundary.
+scrubWorkflowWorkerEnv(process.env);
 const SECRET_PATH = dashboardSecretPath();
 const TOKEN_PATH = join(homedir(), '.botmux', '.dashboard-token');
 /** Per-daemon budget for the cross-daemon insight overview fan-out — bounds
@@ -113,7 +125,8 @@ const BOTS_JSON_PATH = join(homedir(), '.botmux', 'bots.json');
 const REGISTRY_DIR = join(resolveBotmuxDataDir(), 'dashboard-daemons');
 // The dashboard probes upward if its configured port is busy (e.g. a second
 // botmux instance on this host). The actually-bound port is persisted here so
-// the `botmux dashboard` CLI can reach /__cli/rotate without guessing.
+// the `botmux dashboard` CLI can reach /__cli/current, /__cli/ensure, and
+// /__cli/rotate without guessing.
 const PORT_PATH = join(homedir(), '.botmux', '.dashboard-port');
 function loadOrCreateSecret() {
     let existing;
@@ -137,15 +150,21 @@ function loadOrCreateSecret() {
         process.exit(1);
     }
 }
-// The active dashboard token is persisted to disk so a previously-issued
-// dashboard URL survives `botmux restart`. A platform-bound dashboard creates
-// the first token on startup; only `botmux dashboard` (the /__cli/rotate
-// endpoint) replaces it and thereby invalidates the old link.
-// The start/restart hint reads it via the non-rotating /__cli/current endpoint
-// so it can show the live link without invalidating it.
-let activeToken = loadPersistedToken(TOKEN_PATH);
+// The persisted file is the active-token authority. Reading it at each use
+// keeps multiple dashboard processes coherent: first creation converges under
+// a file lock, and an explicit rotation is observed by every process without a
+// restart. `/__cli/current` remains a strictly read-only probe.
+function currentDashboardToken() {
+    try {
+        return loadPersistedToken(TOKEN_PATH);
+    }
+    catch (error) {
+        logger.warn(`[dashboard] Failed to read token from ${TOKEN_PATH}: ${error.message}`);
+        return null;
+    }
+}
 // The port we actually bound (may differ from config.dashboard.port after an
-// EADDRINUSE probe). Used for the rotation-URL and persisted for the CLI.
+// EADDRINUSE probe). Used for token-bearing URLs and persisted for the CLI.
 let boundDashboardPort = config.dashboard.port;
 const SECRET = loadOrCreateSecret();
 function tcpPortAvailable(host, port) {
@@ -220,7 +239,7 @@ aggregator.on(sessionPresentation.onEvent);
 // 调试终端（owner-only 裸 bash）。默认工作目录取当前所有 session 的工作目录去重，
 // 让 owner 从熟悉的目录起终端复现问题；都没有时模块内退回 homedir。
 const debugTerminalManager = createDebugTerminalManager({
-    getActiveToken: () => activeToken,
+    getActiveToken: currentDashboardToken,
     defaultWorkingDirs: () => {
         const dirs = new Set();
         for (const s of aggregator.getSessions()) {
@@ -1032,9 +1051,9 @@ const groupsActionDeps = {
 // ─── PR2 C8: Route B internal API (`/__daemon/*`) ───────────────────────────
 // HMAC + loopback + ts ±60s + nonce TTL, signed-request envelope = full
 // (ts, nonce, method, pathWithQuery, sha256(body)). Reuses `.dashboard-secret`
-// for the HMAC key — the same secret `/__cli/rotate` already uses — but the
-// signing material is wider so a `/__cli/rotate` signature cannot be replayed
-// here and vice versa (different protocols, same secret, no cross-replay).
+// for the HMAC key — the same secret the `/__cli/*` protocol uses — but the
+// signing material is wider so a CLI signature cannot be replayed here and
+// vice versa (different protocols, same secret, no cross-replay).
 //
 // SECRET fail-closed: `loadOrCreateSecret()` returns a 32-byte base64url
 // string and never empty; we still guard below at server-startup time.
@@ -1751,7 +1770,7 @@ async function handlePluginManagementApi(req, res, url) {
     return false;
 }
 // ─── HTTP routing ────────────────────────────────────────────────────────────
-function authedToken(req, url) {
+function authedToken(req, url, activeToken) {
     const q = url.searchParams.get('t');
     if (q && q === activeToken)
         return q;
@@ -2294,16 +2313,13 @@ function startSkillJob(type, run) {
     })());
     return job;
 }
-function sanitizeSkillForDashboard(skill) {
-    if (skill.source.type !== 'git')
-        return skill;
-    return {
-        ...skill,
-        source: { ...skill.source, url: redactGitUrlCredentials(skill.source.url) },
-    };
-}
 function dashboardSkillCliIds() {
     const ids = new Set();
+    // Always scan all known CLI skill dirs, not just configured bots — users may
+    // want to discover codex/trae/... skills even before creating a bot for them.
+    const allCliIds = ['claude-code', 'seed', 'relay', 'aiden', 'coco', 'codex', 'codex-app', 'cursor', 'gemini', 'genius', 'opencode', 'antigravity', 'mtr', 'hermes', 'mira', 'mir', 'traex', 'pi', 'copilot', 'oh-my-pi', 'kimi', 'grok', 'kiro-cli', 'riff'];
+    for (const cliId of allCliIds)
+        ids.add(cliId);
     try {
         for (const cliId of configuredCliIds().values())
             ids.add(cliId);
@@ -2333,6 +2349,76 @@ function dashboardSkillsPayload() {
         delivery: globalSkills.delivery ?? 'auto',
     };
 }
+// --- Skill pack dashboard helpers ------------------------------------------
+function loadBotConfigsSafe() {
+    try {
+        return loadBotConfigs();
+    }
+    catch {
+        return [];
+    }
+}
+function botsReferencingPack(packId, bots) {
+    const selector = `pack:${packId}`;
+    return bots
+        .filter((bot) => Array.isArray(bot.skills?.include) && bot.skills.include.includes(selector))
+        .map((bot) => ({ larkAppId: bot.larkAppId, botName: bot.name ?? bot.larkAppId }))
+        .sort((a, b) => a.botName.localeCompare(b.botName));
+}
+function parsePackInput(body) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        throw new SkillPackStoreError({ code: 'SKILL_PACK_INVALID', reason: 'body must be an object' });
+    const b = body;
+    return {
+        id: typeof b.id === 'string' ? b.id : '',
+        name: typeof b.name === 'string' ? b.name : '',
+        description: typeof b.description === 'string' ? b.description : undefined,
+        tags: Array.isArray(b.tags) ? b.tags : undefined,
+        include: Array.isArray(b.include) ? b.include : [],
+    };
+}
+function parsePackUpdate(body) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        throw new SkillPackStoreError({ code: 'SKILL_PACK_INVALID', reason: 'body must be an object' });
+    const b = body;
+    return {
+        name: typeof b.name === 'string' ? b.name : undefined,
+        description: b.description === null ? null : typeof b.description === 'string' ? b.description : undefined,
+        tags: b.tags === null ? null : Array.isArray(b.tags) ? b.tags : undefined,
+        include: Array.isArray(b.include) ? b.include : undefined,
+        expectedRevision: typeof b.expectedRevision === 'number' ? b.expectedRevision : undefined,
+    };
+}
+function packErrorStatus(err) {
+    if (err instanceof SkillPackStoreError) {
+        switch (err.detail.code) {
+            case 'SKILL_PACK_NOT_FOUND': return 404;
+            case 'SKILL_PACK_ID_CONFLICT': return 409;
+            case 'SKILL_PACK_REVISION_CONFLICT': return 409;
+            case 'SKILL_PACK_IN_USE': return 409;
+            default: return 400;
+        }
+    }
+    return 400;
+}
+function packErrorBody(err) {
+    if (err instanceof SkillPackStoreError) {
+        const d = err.detail;
+        const body = { ok: false, error: d.code };
+        if (d.code === 'SKILL_PACK_REVISION_CONFLICT')
+            body.current = d.current;
+        if (d.code === 'SKILL_PACK_INVALID')
+            body.reason = d.reason;
+        if (d.code === 'SKILL_PACK_INVALID_SELECTOR')
+            body.selector = d.selector;
+        return body;
+    }
+    return {
+        ok: false,
+        error: 'internal_error',
+        detail: redactGitUrlCredentials(err instanceof Error ? err.message : String(err)),
+    };
+}
 function mergeSkillReferenceBot(refs, ref) {
     const current = refs.get(ref.larkAppId);
     if (!current) {
@@ -2344,11 +2430,18 @@ function mergeSkillReferenceBot(refs, ref) {
 async function dashboardSkillReferencesMany(skillNames) {
     const uniqueNames = [...new Set(skillNames)];
     const refsBySkill = new Map(uniqueNames.map(name => [name, new Map()]));
+    let packs;
+    try {
+        packs = readSkillPackRegistry().packs;
+    }
+    catch {
+        // packs.json may be absent; fall back to direct-only analysis.
+    }
     try {
         const configuredBots = loadBotConfigs();
         for (const name of uniqueNames) {
             const refs = refsBySkill.get(name);
-            for (const ref of analyzeSkillReferences(name, { bots: configuredBots }).bots)
+            for (const ref of analyzeSkillReferences(name, { bots: configuredBots, packs }).bots)
                 mergeSkillReferenceBot(refs, ref);
         }
     }
@@ -2374,15 +2467,16 @@ async function dashboardSkillReferencesMany(skillNames) {
     const availableOnlineConfigs = onlineConfigs.filter(config => config !== null);
     for (const name of uniqueNames) {
         const refs = refsBySkill.get(name);
-        for (const ref of analyzeSkillReferences(name, { bots: availableOnlineConfigs }).bots)
+        for (const ref of analyzeSkillReferences(name, { bots: availableOnlineConfigs, packs }).bots)
             mergeSkillReferenceBot(refs, ref);
     }
     return new Map([...refsBySkill].map(([name, refs]) => [name, {
             bots: [...refs.values()].sort((a, b) => a.botName.localeCompare(b.botName)),
+            packs: packsContainingSkill(name, packs),
         }]));
 }
 async function dashboardSkillReferences(skillName) {
-    return (await dashboardSkillReferencesMany([skillName])).get(skillName) ?? { bots: [] };
+    return (await dashboardSkillReferencesMany([skillName])).get(skillName) ?? { bots: [], packs: [] };
 }
 /** Extract the sessionId from a terminal path `/s/<sessionId>[/...]`. Returns
  *  the first path segment after `/s/` (stops at the next `/`; query/hash are
@@ -2393,6 +2487,52 @@ function parseTerminalSessionId(pathname) {
     const seg = pathname.slice(3).split('/')[0];
     return seg || undefined;
 }
+/**
+ * Read every currently-online daemon directly for the public dashboard
+ * summary. The regular aggregator intentionally retains offline
+ * rows for operator history, so using it here would make an offline bot's old
+ * sessions or schedules look live. A failed or malformed daemon snapshot
+ * rejects the whole projection instead of silently turning missing data into
+ * zeroes.
+ */
+async function liveDashboardSummary() {
+    const daemons = registry.list();
+    const configuredBots = loadBotConfigs();
+    const snapshots = await Promise.all(daemons.map(async (daemon) => {
+        const [sessionsResponse, schedulesResponse] = await Promise.all([
+            fetchDaemonIpc(daemon.ipcPort, '/api/sessions', {
+                signal: AbortSignal.timeout(2_000),
+            }),
+            fetchDaemonIpc(daemon.ipcPort, '/api/schedules', {
+                signal: AbortSignal.timeout(2_000),
+            }),
+        ]);
+        if (!sessionsResponse.ok || !schedulesResponse.ok) {
+            throw new Error('daemon_snapshot_http_error');
+        }
+        const [sessionsBody, schedulesBody] = await Promise.all([
+            sessionsResponse.json(),
+            schedulesResponse.json(),
+        ]);
+        return parseDashboardSummaryRows({
+            sessions: sessionsBody.sessions,
+            schedules: schedulesBody.schedules,
+        });
+    }));
+    return buildDashboardSummary({
+        generatedAt: new Date(),
+        configuredBotAppIds: configuredBots.map(bot => bot.larkAppId),
+        onlineBotAppIds: daemons.map(daemon => daemon.larkAppId),
+        sessions: snapshots.flatMap(snapshot => snapshot.sessions),
+        schedules: snapshots.flatMap(snapshot => snapshot.schedules),
+    });
+}
+const dashboardSummaryEndpoint = createDashboardSummaryEndpoint({
+    load: liveDashboardSummary,
+    onError: error => {
+        logger.warn(`[dashboard-summary] live snapshot unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    },
+});
 const server = createServer(async (req, res) => {
     try {
         const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
@@ -2411,7 +2551,8 @@ const server = createServer(async (req, res) => {
         // outside the browser auth gate so packaged desktop apps can decide whether
         // this runtime speaks their dashboard protocol before loading the SPA.
         if (req.method === 'GET' && url.pathname === '/__desktop/compat') {
-            const presentedToken = authedToken(req, url);
+            const activeToken = currentDashboardToken();
+            const presentedToken = authedToken(req, url, activeToken);
             const boundMachineId = activeToken && presentedToken === activeToken
                 ? readPlatformBinding()?.machineId
                 : null;
@@ -2473,32 +2614,53 @@ const server = createServer(async (req, res) => {
         if (await daemonInternalApi.handle(req, res, url)) {
             return;
         }
-        // CLI rotate (HMAC + loopback only) — for `botmux dashboard`. Mints a fresh
-        // token, invalidating any previously-issued link.
+        // CLI rotate (HMAC + loopback only) — for `botmux dashboard rotate`.
+        // Publish the new token only after a durable write succeeds.
         if (req.method === 'POST' && url.pathname === '/__cli/rotate') {
             const gate = verifyCliRequest(req, url.pathname);
             if (!gate.ok)
                 return jsonRes(res, gate.status, gate.body);
-            activeToken = generateToken();
             try {
-                persistToken(TOKEN_PATH, activeToken);
+                const token = rotatePersistedToken(TOKEN_PATH);
+                return jsonRes(res, 200, dashboardUrlsFor(token));
             }
             catch (e) {
                 logger.warn(`[dashboard] Failed to persist token to ${TOKEN_PATH}: ${e.message}`);
+                return jsonRes(res, 500, { error: 'token_persist_failed' });
             }
-            return jsonRes(res, 200, dashboardUrlsFor(activeToken));
         }
-        // CLI read current URL (HMAC + loopback only) — for the start/restart hint.
-        // Unlike /__cli/rotate this does NOT mint a token, so an already-issued
-        // dashboard link survives restart untouched. 404 → no token has ever been
-        // minted (caller falls back to suggesting `botmux dashboard`).
+        // CLI get-or-create URL (HMAC + loopback only). Existing links survive
+        // untouched; the first caller atomically creates and persists a token.
+        if (req.method === 'POST' && url.pathname === '/__cli/ensure') {
+            const gate = verifyCliRequest(req, url.pathname);
+            if (!gate.ok)
+                return jsonRes(res, gate.status, gate.body);
+            try {
+                const token = loadOrCreatePersistedToken(TOKEN_PATH);
+                return jsonRes(res, 200, dashboardUrlsFor(token));
+            }
+            catch (e) {
+                logger.warn(`[dashboard] Failed to ensure token at ${TOKEN_PATH}: ${e.message}`);
+                return jsonRes(res, 500, { error: 'token_persist_failed' });
+            }
+        }
+        // CLI read current URL (HMAC + loopback only) — for start/restart hints and
+        // safe port discovery. This never mints a token.
         if (req.method === 'POST' && url.pathname === '/__cli/current') {
             const gate = verifyCliRequest(req, url.pathname);
             if (!gate.ok)
                 return jsonRes(res, gate.status, gate.body);
-            if (!activeToken)
+            let token;
+            try {
+                token = loadPersistedToken(TOKEN_PATH);
+            }
+            catch (e) {
+                logger.warn(`[dashboard] Failed to read token from ${TOKEN_PATH}: ${e.message}`);
+                return jsonRes(res, 500, { error: 'token_unavailable' });
+            }
+            if (!token)
                 return jsonRes(res, 404, { error: 'no_active_token' });
-            return jsonRes(res, 200, dashboardUrlsFor(activeToken));
+            return jsonRes(res, 200, dashboardUrlsFor(token));
         }
         // CLI 通知绑定变化（HMAC + loopback）——`botmux bind` 写完绑定后捅一下，立即重连平台，
         // 无需重启 daemon，也不依赖 fs.watch。
@@ -2521,7 +2683,8 @@ const server = createServer(async (req, res) => {
             startPlatformTunnelIfBound();
             return jsonRes(res, 200, { ok: true });
         }
-        const presentedToken = authedToken(req, url);
+        const activeToken = currentDashboardToken();
+        const presentedToken = authedToken(req, url, activeToken);
         const globalDashboardConfig = readGlobalConfig().dashboard;
         const decision = decideDashboardAuth({
             method: req.method ?? 'GET',
@@ -2659,6 +2822,12 @@ const server = createServer(async (req, res) => {
             return jsonRes(res, 200, startHd2dDownload());
         }
         // ─── Public API (cookie/token already validated above) ──────────────────
+        if (req.method === 'GET' && url.pathname === '/api/dashboard/v1/summary') {
+            const result = await dashboardSummaryEndpoint.get({ authenticated: authed });
+            for (const [name, value] of Object.entries(result.headers))
+                res.setHeader(name, value);
+            return jsonRes(res, result.status, result.body);
+        }
         if (await handleResourceMonitorApi(req, res, url, resourceMonitor)) {
             return;
         }
@@ -3256,10 +3425,14 @@ const server = createServer(async (req, res) => {
             if (missing.length > 0)
                 return jsonRes(res, 400, { ok: false, error: 'skill_not_installed', missing });
             const referencesBySkill = await dashboardSkillReferencesMany(names);
-            const references = names.map(name => ({ name, refs: referencesBySkill.get(name) ?? { bots: [] } }));
+            const references = names.map(name => ({ name, refs: referencesBySkill.get(name) ?? { bots: [], packs: [] } }));
             const affectedSkills = references
-                .filter(item => item.refs.bots.length > 0)
-                .map(item => ({ name: item.name, affectedBots: item.refs.bots }));
+                .filter(item => item.refs.bots.length > 0 || item.refs.packs.length > 0)
+                .map(item => ({
+                name: item.name,
+                affectedBots: item.refs.bots,
+                affectedPacks: item.refs.packs,
+            }));
             if (body.force !== true && affectedSkills.length > 0) {
                 return jsonRes(res, 409, {
                     ok: false,
@@ -3390,11 +3563,12 @@ const server = createServer(async (req, res) => {
             if (!readSkillRegistry().skills[name])
                 return jsonRes(res, 400, { ok: false, error: 'skill_not_installed' });
             const refs = await dashboardSkillReferences(name);
-            if (!force && refs.bots.length > 0) {
+            if (!force && (refs.bots.length > 0 || refs.packs.length > 0)) {
                 return jsonRes(res, 409, {
                     ok: false,
                     error: 'skill_in_use',
                     affectedBots: refs.bots,
+                    affectedPacks: refs.packs,
                 });
             }
             const r = removeInstalledSkill(name);
@@ -3403,9 +3577,103 @@ const server = createServer(async (req, res) => {
             return jsonRes(res, 200, {
                 ok: true,
                 affectedBots: refs.bots,
+                affectedPacks: refs.packs,
                 ...dashboardSkillsPayload(),
             });
         }
+        // --- Skill pack CRUD ---------------------------------------------------
+        if (req.method === 'GET' && url.pathname === '/api/skill-packs') {
+            const registrySkills = readSkillRegistry().skills;
+            const bots = loadBotConfigsSafe();
+            const packs = enrichPacksForDashboard(listSkillPacks(), registrySkills, (packId) => botsReferencingPack(packId, bots));
+            return jsonRes(res, 200, { ok: true, packs });
+        }
+        if (req.method === 'POST' && url.pathname === '/api/skill-packs') {
+            let body;
+            try {
+                body = await readJsonBody(req);
+            }
+            catch {
+                return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+            }
+            try {
+                const input = parsePackInput(body);
+                const pack = createSkillPack(input);
+                return jsonRes(res, 201, { ok: true, pack });
+            }
+            catch (err) {
+                return jsonRes(res, packErrorStatus(err), packErrorBody(err));
+            }
+        }
+        let mPack;
+        if (req.method === 'GET' && (mPack = url.pathname.match(/^\/api\/skill-packs\/([^/]+)$/))) {
+            const id = decodeURIComponent(mPack[1]);
+            const pack = getSkillPack(id);
+            if (!pack)
+                return jsonRes(res, 404, { ok: false, error: 'SKILL_PACK_NOT_FOUND' });
+            const registrySkills = readSkillRegistry().skills;
+            const bots = loadBotConfigsSafe();
+            return jsonRes(res, 200, {
+                ok: true,
+                pack: enrichPackForDashboard(pack, registrySkills, botsReferencingPack(pack.id, bots)),
+            });
+        }
+        if (req.method === 'PUT' && (mPack = url.pathname.match(/^\/api\/skill-packs\/([^/]+)$/))) {
+            const id = decodeURIComponent(mPack[1]);
+            let body;
+            try {
+                body = await readJsonBody(req);
+            }
+            catch {
+                return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+            }
+            try {
+                const input = parsePackUpdate(body);
+                const pack = updateSkillPack(id, input);
+                return jsonRes(res, 200, { ok: true, pack });
+            }
+            catch (err) {
+                return jsonRes(res, packErrorStatus(err), packErrorBody(err));
+            }
+        }
+        if (req.method === 'DELETE' && (mPack = url.pathname.match(/^\/api\/skill-packs\/([^/]+)$/))) {
+            const id = decodeURIComponent(mPack[1]);
+            const force = url.searchParams.get('force') === '1';
+            const pack = getSkillPack(id);
+            if (!pack)
+                return jsonRes(res, 404, { ok: false, error: 'SKILL_PACK_NOT_FOUND' });
+            const refs = botsReferencingPack(id, loadBotConfigsSafe());
+            if (!force && refs.length > 0) {
+                return jsonRes(res, 409, { ok: false, error: 'SKILL_PACK_IN_USE', references: refs });
+            }
+            try {
+                deleteSkillPack(id);
+                return jsonRes(res, 200, { ok: true, references: refs });
+            }
+            catch (err) {
+                return jsonRes(res, packErrorStatus(err), packErrorBody(err));
+            }
+        }
+        if (req.method === 'POST' && (mPack = url.pathname.match(/^\/api\/skill-packs\/([^/]+)\/clone$/))) {
+            const id = decodeURIComponent(mPack[1]);
+            let body;
+            try {
+                body = await readJsonBody(req);
+            }
+            catch {
+                return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+            }
+            const newId = typeof body?.id === 'string' ? body.id.trim() : '';
+            if (!newId)
+                return jsonRes(res, 400, { ok: false, error: 'id_required' });
+            try {
+                const pack = cloneSkillPack(id, newId);
+                return jsonRes(res, 201, { ok: true, pack });
+            }
+            catch (err) {
+                return jsonRes(res, packErrorStatus(err), packErrorBody(err));
+            }
+        }
         if (req.method === 'GET' && url.pathname === '/api/whiteboards') {
             return jsonRes(res, 200, { enabled: whiteboardEnabled(), whiteboards: listWhiteboards() });
         }
@@ -5482,15 +5750,16 @@ function startPlatformTunnelIfBound() {
         const binding = readPlatformBinding();
         if (!binding)
             return;
-        if (!activeToken) {
-            activeToken = loadOrCreatePersistedToken(TOKEN_PATH);
+        const existingToken = currentDashboardToken();
+        loadOrCreatePersistedToken(TOKEN_PATH);
+        if (!existingToken) {
             logger.info('[platform-tunnel] 已初始化 dashboard token');
         }
         const version = readBotmuxVersion();
         platformTunnel = startPlatformTunnelClient({
             binding,
             getDashboardPort: () => boundDashboardPort,
-            getDashboardToken: () => activeToken,
+            getDashboardToken: currentDashboardToken,
             getVersion: () => version,
             getBots: () => readPlatformBotsInfo(),
             getTeamSyncRev: () => getPlatformTeamSyncRev(config.session.dataDir),