daemora 1.0.0-alpha.0

package/dist/server/routes/watchers.js

@@ -0,0 +1,143 @@
+/**
+ * Watchers API — CRUD for event watchers + template catalogue.
+ *
+ *   GET    /api/watchers              list all
+ *   POST   /api/watchers              create (from template or raw)
+ *   GET    /api/watchers/:id          fetch one
+ *   PATCH  /api/watchers/:id          update fields
+ *   DELETE /api/watchers/:id          remove
+ *   GET    /api/watchers/templates    list pre-configured templates
+ */
+import { WATCHER_TEMPLATES } from "../../webhooks/watcherTemplates.js";
+import { buildWebhookUrls } from "../../tunnels/urls.js";
+export function mountWatcherRoutes(app, deps) {
+    app.get("/api/watchers/templates", (_req, res) => {
+        res.json({ templates: WATCHER_TEMPLATES });
+    });
+    // Catalogue of integration-backed events the poller supports,
+    // filtered by the user's currently connected integrations so the UI
+    // never surfaces a trigger we can't actually fire. Params are
+    // described so the UI can render the right input fields.
+    app.get("/api/watchers/integration-events", (_req, res) => {
+        const connected = deps.integrations.getEnabled();
+        const catalogue = [
+            { integration: "twitter", event: "mention", label: "New @mention", description: "Fires when the authenticated user is mentioned in a tweet.", params: [] },
+            { integration: "twitter", event: "search", label: "Search match", description: "Fires on new tweets matching a query (supports operators).", params: [{ key: "query", label: "Search query", required: true, hint: "e.g. daemora OR #automation -is:retweet" }] },
+            { integration: "twitter", event: "new_follower", label: "New follower", description: "Fires when a new user follows you.", params: [] },
+            { integration: "youtube", event: "new_video", label: "New video on channel", description: "Fires when a new video is published on a channel.", params: [{ key: "channelId", label: "Channel ID", required: false, hint: "Leave blank for your own channel" }] },
+            { integration: "youtube", event: "new_comment", label: "New comment on video", description: "Fires on new comments on a specific video.", params: [{ key: "videoId", label: "Video ID", required: true }] },
+            { integration: "facebook", event: "new_page_post", label: "New post on page", description: "Fires when a new post is published on a Facebook page.", params: [{ key: "pageId", label: "Page ID", required: true }] },
+            { integration: "facebook", event: "new_comment", label: "New comment on page", description: "Fires on new comments on any post in a page's feed.", params: [{ key: "pageId", label: "Page ID", required: true }] },
+            { integration: "instagram", event: "new_media", label: "New media posted", description: "Fires when a new photo/video/carousel is published.", params: [{ key: "igUserId", label: "Instagram User ID", required: true }] },
+            { integration: "instagram", event: "new_comment", label: "New comment on media", description: "Fires on new comments across the account's media.", params: [{ key: "igUserId", label: "Instagram User ID", required: true }] },
+            { integration: "gmail", event: "new_email", label: "New email", description: "Fires when a new email matches the query (defaults to `in:inbox is:unread`).", params: [{ key: "query", label: "Gmail search query", required: false, hint: "e.g. from:boss@ OR label:vip -category:promotions" }] },
+            { integration: "google_calendar", event: "new_event", label: "New calendar event", description: "Fires when a new event appears on the calendar (from now forward).", params: [{ key: "calendarId", label: "Calendar ID", required: false, hint: "Leave blank for primary calendar" }] },
+            { integration: "google_calendar", event: "event_starting_soon", label: "Event starting soon", description: "Fires when an event starts within a window.", params: [{ key: "windowMinutes", label: "Minutes-before window", required: false, hint: "Default 15" }, { key: "calendarId", label: "Calendar ID", required: false, hint: "Leave blank for primary" }] },
+            { integration: "reddit", event: "subreddit_new", label: "New post in subreddit", description: "Fires on new posts to a subreddit.", params: [{ key: "subreddit", label: "Subreddit (no r/ prefix)", required: true }, { key: "limit", label: "Max per poll", required: false, hint: "Default 25" }] },
+            { integration: "reddit", event: "new_mention_reddit", label: "New u/ mention", description: "Fires when someone u-mentions you on Reddit.", params: [] },
+            { integration: "reddit", event: "new_inbox_item", label: "New inbox message", description: "Fires on new inbox items (replies, DMs, mentions).", params: [] },
+            { integration: "github", event: "new_issue", label: "New issue opened", description: "Fires when an open issue appears on a repo (excludes PRs).", params: [{ key: "repo", label: "Repository (owner/name)", required: true, hint: "e.g. vercel/next.js" }] },
+            { integration: "github", event: "new_pull_request", label: "New pull request", description: "Fires when a new PR is opened on a repo.", params: [{ key: "repo", label: "Repository (owner/name)", required: true }] },
+            { integration: "github", event: "new_release", label: "New release", description: "Fires when a repo publishes a new release.", params: [{ key: "repo", label: "Repository (owner/name)", required: true }] },
+            { integration: "github", event: "new_commit", label: "New commit on branch", description: "Fires on new commits to a repo (optionally a specific branch).", params: [{ key: "repo", label: "Repository (owner/name)", required: true }, { key: "branch", label: "Branch", required: false, hint: "Default: repo's default branch" }] },
+            { integration: "linkedin", event: "new_post_comment", label: "New comment on your post", description: "Fires when a user comments on one of your LinkedIn posts.", params: [{ key: "shareUrn", label: "Share URN", required: true, hint: "urn:li:share:… of the post to watch" }] },
+            { integration: "tiktok", event: "new_video_comment", label: "New comment on video", description: "Fires on new comments on a specific TikTok video.", params: [{ key: "videoId", label: "Video ID", required: true }] },
+            { integration: "tiktok", event: "new_follower", label: "Follower count increase", description: "Fires when the follower count ticks up (TikTok doesn't expose follower lists).", params: [] },
+        ];
+        const available = catalogue.filter((e) => connected.has(e.integration));
+        const unavailable = catalogue
+            .filter((e) => !connected.has(e.integration))
+            .map((e) => ({ integration: e.integration, reason: "not_connected" }));
+        res.json({ events: available, unavailableIntegrations: Array.from(new Set(unavailable.map((u) => u.integration))) });
+    });
+    app.get("/api/watchers", (_req, res) => {
+        res.json({ watchers: deps.watchers.list() });
+    });
+    app.post("/api/watchers", (req, res) => {
+        const body = (req.body ?? {});
+        const template = body.templateId ? WATCHER_TEMPLATES.find((t) => t.id === body.templateId) : undefined;
+        if (body.templateId && !template) {
+            return res.status(404).json({ error: `Template "${body.templateId}" not found.` });
+        }
+        const name = body.name ?? template?.name;
+        if (!name)
+            return res.status(400).json({ error: "`name` is required." });
+        const action = body.action ?? template?.action ?? "";
+        const patternObj = {
+            ...(template?.pattern ?? {}),
+            ...(body.pattern ?? {}),
+        };
+        const cooldownSeconds = body.cooldownSeconds ?? template?.cooldownSeconds ?? 0;
+        if (cooldownSeconds > 0)
+            patternObj["__cooldownSeconds"] = cooldownSeconds;
+        const triggerType = body.triggerType ?? "webhook";
+        const row = deps.watchers.create({
+            name,
+            triggerType,
+            action,
+            pattern: JSON.stringify(patternObj),
+            ...(body.channel ? { channel: body.channel } : {}),
+        });
+        deps.watcherRunner.reload();
+        // For webhook triggers, issue fresh bearer + HMAC secret so the
+        // caller can register the endpoint with a provider immediately.
+        // Plaintexts are returned ONCE; the store keeps only hashes/cipher.
+        let tokens;
+        let urls;
+        if (triggerType === "webhook") {
+            tokens = deps.webhookTokens.issue(row.id);
+            urls = buildWebhookUrls(deps.getPublicUrl(), row.id);
+        }
+        res.status(201).json({ watcher: row, ...(tokens ? { tokens } : {}), ...(urls ? { urls } : {}) });
+    });
+    app.get("/api/watchers/:id", (req, res) => {
+        const row = deps.watchers.get(req.params.id ?? "");
+        if (!row)
+            return res.status(404).json({ error: "Watcher not found." });
+        res.json({ watcher: row });
+    });
+    app.patch("/api/watchers/:id", (req, res) => {
+        const id = req.params.id ?? "";
+        const body = (req.body ?? {});
+        const patch = {
+            ...(body.name !== undefined ? { name: body.name } : {}),
+            ...(body.action !== undefined ? { action: body.action } : {}),
+            ...(body.channel !== undefined ? { channel: body.channel } : {}),
+            ...(body.pattern !== undefined ? { pattern: JSON.stringify(body.pattern) } : {}),
+            ...(body.enabled !== undefined ? { enabled: body.enabled } : {}),
+        };
+        const ok = deps.watchers.update(id, patch);
+        if (!ok)
+            return res.status(404).json({ error: "Watcher not found." });
+        deps.watcherRunner.reload();
+        res.json({ watcher: deps.watchers.get(id) });
+    });
+    app.delete("/api/watchers/:id", (req, res) => {
+        const id = req.params.id ?? "";
+        const ok = deps.watchers.delete(id);
+        if (!ok)
+            return res.status(404).json({ error: "Watcher not found." });
+        deps.webhookTokens.remove(id);
+        deps.watcherRunner.reload();
+        res.status(204).end();
+    });
+    // Rotate tokens — returns fresh plaintexts. Provider must be reconfigured.
+    app.post("/api/watchers/:id/token", (req, res) => {
+        const id = req.params.id ?? "";
+        const row = deps.watchers.get(id);
+        if (!row)
+            return res.status(404).json({ error: "Watcher not found" });
+        const tokens = deps.webhookTokens.issue(id);
+        const urls = buildWebhookUrls(deps.getPublicUrl(), id);
+        res.json({ tokens, urls });
+    });
+    // Revoke tokens — webhook endpoints for this watcher will 401 until re-issued.
+    app.delete("/api/watchers/:id/token", (req, res) => {
+        const id = req.params.id ?? "";
+        const ok = deps.webhookTokens.revoke(id);
+        if (!ok)
+            return res.status(404).json({ error: "No active tokens for this watcher." });
+        res.json({ ok: true });
+    });
+}
+//# sourceMappingURL=watchers.js.map

package/dist/server/routes/watchers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watchers.js","sourceRoot":"","sources":["../../../src/server/routes/watchers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,IAAgB;IAC/D,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,8DAA8D;IAC9D,oEAAoE;IACpE,8DAA8D;IAC9D,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,kCAAkC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;QACjD,MAAM,SAAS,GAMV;YACH,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,4DAA4D,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1J,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,4DAA4D,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,yCAAyC,EAAE,CAAC,EAAE;YACjQ,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,oCAAoC,EAAE,MAAM,EAAE,EAAE,EAAE;YACvI,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,mDAAmD,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,EAAE;YAC/P,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,4CAA4C,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE;YAC3M,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,wDAAwD,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE;YACpN,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,qDAAqD,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE;YAClN,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,qDAAqD,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE;YAC1N,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,mDAAmD,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE;YAC9N,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,8EAA8E,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAAC,EAAE;YAClS,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oEAAoE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,EAAE;YACxR,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,6CAA6C,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,EAAE;YAClW,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,oCAAoC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE;YACrS,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,8CAA8C,EAAE,MAAM,EAAE,EAAE,EAAE;YACxJ,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,oDAAoD,EAAE,MAAM,EAAE,EAAE,EAAE;YAC7J,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,4DAA4D,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,EAAE;YAC7P,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,0CAA0C,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE;YACrN,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,4CAA4C,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE;YAC7M,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,gEAAgE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,EAAE;YACtU,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,0BAA0B,EAAE,WAAW,EAAE,2DAA2D,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAAC,EAAE;YACnR,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,mDAAmD,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE;YACvN,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,yBAAyB,EAAE,WAAW,EAAE,gFAAgF,EAAE,MAAM,EAAE,EAAE,EAAE;SAC9L,CAAC;QACF,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,SAAS;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;aAC5C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAO3B,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,IAAI,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAEzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;QACrD,MAAM,UAAU,GAA4B;YAC1C,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;SACxB,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,EAAE,eAAe,IAAI,CAAC,CAAC;QAC/E,IAAI,eAAe,GAAG,CAAC;YAAE,UAAU,CAAC,mBAAmB,CAAC,GAAG,eAAe,CAAC;QAE3E,MAAM,WAAW,GAAI,IAA+E,CAAC,WAAW,IAAI,SAAS,CAAC;QAC9H,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/B,IAAI;YACJ,WAAW;YACX,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAE5B,gEAAgE;QAChE,gEAAgE;QAChE,oEAAoE;QACpE,IAAI,MAA0D,CAAC;QAC/D,IAAI,IAAqD,CAAC;QAC1D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1C,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAM3B,CAAC;QACF,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QACF,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,GAAG,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACtF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/Cleanup.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Cleanup — data retention sweeper.
+ *
+ * Deletes rows older than `retentionDays` from the high-churn tables
+ * (tasks, audit, costs) and stale sub-agent session rows. Main user
+ * sessions (no `--` in id) are preserved regardless of age.
+ *
+ * Configurable:
+ *   - retentionDays (constructor arg or CLEANUP_AFTER_DAYS env)
+ *   - `0` = never delete anything
+ *
+ * Intended to run daily via cron. A single sweep is cheap — SQLite
+ * handles 100k-row DELETE in tens of milliseconds on a WAL-backed DB.
+ */
+import type Database from "better-sqlite3";
+export interface CleanupStats {
+    readonly tasks: number;
+    readonly audit: number;
+    readonly costs: number;
+    readonly sessions: number;
+    readonly total: number;
+}
+export interface StorageStats {
+    readonly tasks: number;
+    readonly audit: number;
+    readonly costs: number;
+    readonly sessions: number;
+    readonly retentionDays: number | "never";
+}
+export declare class Cleanup {
+    private readonly db;
+    readonly retentionDays: number;
+    constructor(db: Database.Database, retentionDays?: number);
+    run(overrideDays?: number): CleanupStats;
+    /**
+     * Delete finished tasks (completed/failed) regardless of age. Useful
+     * when the user hits "clear history" in the UI.
+     */
+    deleteCompletedTasks(): number;
+    stats(): StorageStats;
+    private deleteOlderThan;
+    /**
+     * Sub-agent / crew sessions carry an id like `parent--child--…`.
+     * They pile up on active installs; main user sessions (no `--`)
+     * are always preserved regardless of age.
+     */
+    private deleteStaleSubSessions;
+    private count;
+}
+//# sourceMappingURL=Cleanup.d.ts.map

package/dist/services/Cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Cleanup.d.ts","sourceRoot":"","sources":["../../src/services/Cleanup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAQ3C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1C;AAED,qBAAa,OAAO;IAGN,OAAO,CAAC,QAAQ,CAAC,EAAE;IAF/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBAEF,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,MAAM;IAK1E,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY;IAgBxC;;;OAGG;IACH,oBAAoB,IAAI,MAAM;IAY9B,KAAK,IAAI,YAAY;IAYrB,OAAO,CAAC,eAAe;IAUvB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAkB9B,OAAO,CAAC,KAAK;CAQd"}

package/dist/services/Cleanup.js

@@ -0,0 +1,104 @@
+/**
+ * Cleanup — data retention sweeper.
+ *
+ * Deletes rows older than `retentionDays` from the high-churn tables
+ * (tasks, audit, costs) and stale sub-agent session rows. Main user
+ * sessions (no `--` in id) are preserved regardless of age.
+ *
+ * Configurable:
+ *   - retentionDays (constructor arg or CLEANUP_AFTER_DAYS env)
+ *   - `0` = never delete anything
+ *
+ * Intended to run daily via cron. A single sweep is cheap — SQLite
+ * handles 100k-row DELETE in tens of milliseconds on a WAL-backed DB.
+ */
+import { createLogger } from "../util/logger.js";
+const log = createLogger("cleanup");
+const DEFAULT_DAYS = 30;
+export class Cleanup {
+    db;
+    retentionDays;
+    constructor(db, retentionDays) {
+        this.db = db;
+        const envDays = Number.parseInt(process.env["CLEANUP_AFTER_DAYS"] ?? "", 10);
+        this.retentionDays = retentionDays ?? (Number.isFinite(envDays) ? envDays : DEFAULT_DAYS);
+    }
+    run(overrideDays) {
+        const days = overrideDays ?? this.retentionDays;
+        if (days <= 0)
+            return { tasks: 0, audit: 0, costs: 0, sessions: 0, total: 0 };
+        const cutoffMs = Date.now() - days * 24 * 60 * 60 * 1000;
+        const stats = {
+            tasks: this.deleteOlderThan("task_log", "created_at", cutoffMs),
+            audit: this.deleteOlderThan("audit_log", "created_at", cutoffMs),
+            costs: this.deleteOlderThan("cost_entries", "created_at", cutoffMs),
+            sessions: this.deleteStaleSubSessions(cutoffMs),
+        };
+        const total = stats.tasks + stats.audit + stats.costs + stats.sessions;
+        log.info({ ...stats, total, retentionDays: days }, "cleanup sweep complete");
+        return { ...stats, total };
+    }
+    /**
+     * Delete finished tasks (completed/failed) regardless of age. Useful
+     * when the user hits "clear history" in the UI.
+     */
+    deleteCompletedTasks() {
+        try {
+            const info = this.db.prepare(`DELETE FROM task_log WHERE status IN ('completed', 'failed', 'cancelled')`).run();
+            return info.changes;
+        }
+        catch (e) {
+            log.warn({ err: e.message }, "deleteCompletedTasks failed");
+            return 0;
+        }
+    }
+    stats() {
+        return {
+            tasks: this.count("task_log"),
+            audit: this.count("audit_log"),
+            costs: this.count("cost_entries"),
+            sessions: this.count("sessions"),
+            retentionDays: this.retentionDays > 0 ? this.retentionDays : "never",
+        };
+    }
+    // ── Internal ────────────────────────────────────────────────────────────
+    deleteOlderThan(table, col, cutoffMs) {
+        try {
+            return this.db.prepare(`DELETE FROM ${table} WHERE ${col} < ?`).run(cutoffMs).changes;
+        }
+        catch (e) {
+            // Table may not exist yet on a fresh DB — treat as 0 rows removed.
+            log.debug({ table, err: e.message }, "cleanup skipped (table missing?)");
+            return 0;
+        }
+    }
+    /**
+     * Sub-agent / crew sessions carry an id like `parent--child--…`.
+     * They pile up on active installs; main user sessions (no `--`)
+     * are always preserved regardless of age.
+     */
+    deleteStaleSubSessions(cutoffMs) {
+        try {
+            // Messages first (FK cascade usually handles it; being explicit is safe).
+            this.db.prepare(`DELETE FROM session_messages WHERE session_id IN (
+           SELECT id FROM sessions WHERE id LIKE '%--%' AND updated_at < ?
+         )`).run(cutoffMs);
+            const info = this.db.prepare(`DELETE FROM sessions WHERE id LIKE '%--%' AND updated_at < ?`).run(cutoffMs);
+            return info.changes;
+        }
+        catch (e) {
+            log.debug({ err: e.message }, "sub-session cleanup skipped");
+            return 0;
+        }
+    }
+    count(table) {
+        try {
+            const row = this.db.prepare(`SELECT COUNT(*) as n FROM ${table}`).get();
+            return row?.n ?? 0;
+        }
+        catch {
+            return 0;
+        }
+    }
+}
+//# sourceMappingURL=Cleanup.js.map

package/dist/services/Cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Cleanup.js","sourceRoot":"","sources":["../../src/services/Cleanup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAEpC,MAAM,YAAY,GAAG,EAAE,CAAC;AAkBxB,MAAM,OAAO,OAAO;IAGW;IAFpB,aAAa,CAAS;IAE/B,YAA6B,EAAqB,EAAE,aAAsB;QAA7C,OAAE,GAAF,EAAE,CAAmB;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC5F,CAAC;IAED,GAAG,CAAC,YAAqB;QACvB,MAAM,IAAI,GAAG,YAAY,IAAI,IAAI,CAAC,aAAa,CAAC;QAChD,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAE9E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACzD,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC;YAC/D,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC;YAChE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,YAAY,EAAE,QAAQ,CAAC;YACnE,QAAQ,EAAE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC;SAChD,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAC7E,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,oBAAoB;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,2EAA2E,CAC5E,CAAC,GAAG,EAAE,CAAC;YACR,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,6BAA6B,CAAC,CAAC;YACvE,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,KAAK;QACH,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YAC9B,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,aAAa,EAAE,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO;SACrE,CAAC;IACJ,CAAC;IAED,2EAA2E;IAEnE,eAAe,CAAC,KAAa,EAAE,GAAW,EAAE,QAAgB;QAClE,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,eAAe,KAAK,UAAU,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;QACxF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,mEAAmE;YACnE,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,kCAAkC,CAAC,CAAC;YACpF,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAAC,QAAgB;QAC7C,IAAI,CAAC;YACH,0EAA0E;YAC1E,IAAI,CAAC,EAAE,CAAC,OAAO,CACb;;WAEG,CACJ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,8DAA8D,CAC/D,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,6BAA6B,CAAC,CAAC;YACxE,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC,GAAG,EAA+B,CAAC;YACrG,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;CACF"}

package/dist/skills/SecurityScanner.d.ts

@@ -0,0 +1,18 @@
+/**
+ * SecurityScanner — detects prompt injection and exfiltration patterns
+ * in skill content and memory content. Shared by:
+ *   - SkillLoader (warns on load)
+ *   - skill_manage (rolls back writes)
+ *   - DeclarativeMemoryStore (rejects writes)
+ *
+ * Ported from hermes tools/memory_tool.py threat list + skills_guard.
+ * Patterns are conservative: false positives are preferred to false
+ * negatives because skill/memory content goes into the system prompt.
+ */
+export interface ScanResult {
+    readonly blocked: boolean;
+    readonly reason: string | null;
+    readonly pattern: string | null;
+}
+export declare function scanContent(content: string): ScanResult;
+//# sourceMappingURL=SecurityScanner.d.ts.map

package/dist/skills/SecurityScanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.d.ts","sourceRoot":"","sources":["../../src/skills/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiCH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAYvD"}

package/dist/skills/SecurityScanner.js

@@ -0,0 +1,49 @@
+/**
+ * SecurityScanner — detects prompt injection and exfiltration patterns
+ * in skill content and memory content. Shared by:
+ *   - SkillLoader (warns on load)
+ *   - skill_manage (rolls back writes)
+ *   - DeclarativeMemoryStore (rejects writes)
+ *
+ * Ported from hermes tools/memory_tool.py threat list + skills_guard.
+ * Patterns are conservative: false positives are preferred to false
+ * negatives because skill/memory content goes into the system prompt.
+ */
+const INVISIBLE_CHARS = [
+    "\u200B", "\u200C", "\u200D", "\u200E", "\u200F",
+    "\u202A", "\u202B", "\u202C", "\u202D", "\u202E",
+    "\u2060", "\u2061", "\u2062", "\u2063", "\u2064",
+    "\uFEFF",
+];
+const THREAT_PATTERNS = [
+    // Prompt injection
+    { re: /ignore\s+(previous|all|above|prior)\s+instructions/i, id: "prompt_injection" },
+    { re: /disregard\s+(your|all|above|prior)/i, id: "prompt_injection" },
+    { re: /forget\s+(your|all|prior|previous)\s+instructions/i, id: "prompt_injection" },
+    { re: /new\s+instructions\s*:/i, id: "prompt_injection" },
+    { re: /system\s+prompt\s*:/i, id: "role_hijack" },
+    { re: /you\s+are\s+now\s+/i, id: "role_hijack" },
+    { re: /<\s*system\s*>/i, id: "role_hijack" },
+    { re: /do\s+not\s+tell\s+the\s+user/i, id: "deception_hide" },
+    // Exfiltration via curl/wget with secrets
+    { re: /curl\s+[^\n]*\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, id: "exfil_curl" },
+    { re: /wget\s+[^\n]*\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, id: "exfil_wget" },
+    // Persistence via shell rc / ssh keys
+    { re: /authorized_keys/i, id: "ssh_backdoor" },
+    { re: /\$HOME\/\.ssh|~\/\.ssh/i, id: "ssh_access" },
+    { re: /\.bashrc|\.zshrc|\.profile/i, id: "shell_rc_write" },
+];
+export function scanContent(content) {
+    for (const ch of INVISIBLE_CHARS) {
+        if (content.includes(ch)) {
+            return { blocked: true, reason: "content contains invisible unicode", pattern: "invisible_unicode" };
+        }
+    }
+    for (const p of THREAT_PATTERNS) {
+        if (p.re.test(content)) {
+            return { blocked: true, reason: `matches threat pattern '${p.id}'`, pattern: p.id };
+        }
+    }
+    return { blocked: false, reason: null, pattern: null };
+}
+//# sourceMappingURL=SecurityScanner.js.map

package/dist/skills/SecurityScanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.js","sourceRoot":"","sources":["../../src/skills/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,eAAe,GAAG;IACtB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IAChD,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IAChD,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IAChD,QAAQ;CACT,CAAC;AAOF,MAAM,eAAe,GAA6B;IAChD,mBAAmB;IACnB,EAAE,EAAE,EAAE,qDAAqD,EAAE,EAAE,EAAE,kBAAkB,EAAE;IACrF,EAAE,EAAE,EAAE,qCAAqC,EAAE,EAAE,EAAE,kBAAkB,EAAE;IACrE,EAAE,EAAE,EAAE,oDAAoD,EAAE,EAAE,EAAE,kBAAkB,EAAE;IACpF,EAAE,EAAE,EAAE,yBAAyB,EAAE,EAAE,EAAE,kBAAkB,EAAE;IACzD,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,aAAa,EAAE;IACjD,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,aAAa,EAAE;IAChD,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,aAAa,EAAE;IAC5C,EAAE,EAAE,EAAE,+BAA+B,EAAE,EAAE,EAAE,gBAAgB,EAAE;IAC7D,0CAA0C;IAC1C,EAAE,EAAE,EAAE,kEAAkE,EAAE,EAAE,EAAE,YAAY,EAAE;IAC5F,EAAE,EAAE,EAAE,kEAAkE,EAAE,EAAE,EAAE,YAAY,EAAE;IAC5F,sCAAsC;IACtC,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,cAAc,EAAE;IAC9C,EAAE,EAAE,EAAE,yBAAyB,EAAE,EAAE,EAAE,YAAY,EAAE;IACnD,EAAE,EAAE,EAAE,6BAA6B,EAAE,EAAE,EAAE,gBAAgB,EAAE;CAC5D,CAAC;AAQF,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oCAAoC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;QACvG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACzD,CAAC"}

package/dist/skills/SkillLoader.d.ts

@@ -0,0 +1,45 @@
+/**
+ * SkillLoader — discovers skills from a root directory. Handles:
+ *
+ *   1. Standalone .md files:  skills/email.md (name from frontmatter)
+ *   2. Directories with SKILL.md:  skills/coding-agent/SKILL.md
+ *   3. Directories with skill.yaml + *.md: skills/camsnap/skill.yaml
+ *   4. Nested category directories: skills/mlops/training/axolotl/SKILL.md
+ *
+ * Never throws. Bad skills are reported in `skipped`, the rest load.
+ *
+ * Linked files (references/, templates/, scripts/, assets/) are
+ * discovered per-skill and surfaced through Skill.linkedFiles so
+ * skill_view can list them without another walk.
+ */
+import type { SkillLoadReport } from "./types.js";
+export declare class SkillLoader {
+    private readonly skillsRoot;
+    private readonly bodyCache;
+    private readonly snapshot;
+    private readonly extraRoots;
+    constructor(skillsRoot: string, snapshotPath?: string, extraRoots?: readonly string[]);
+    loadAll(): Promise<SkillLoadReport>;
+    /**
+     * True iff the on-disk snapshot's manifest matches the live tree.
+     * Callers can use this to decide whether to skip a full loadAll.
+     * Fast — just mtimes + sizes, no file parsing.
+     */
+    isFresh(): Promise<boolean>;
+    /**
+     * Walk `dir` recursively looking for either:
+     *   - Standalone *.md skill files
+     *   - Skill dirs containing SKILL.md / skill.md / skill.yaml / README.md
+     * When a skill dir is found we do NOT recurse into it (linked files
+     * live under that skill, not as separate skills).
+     */
+    private walk;
+    private looksLikeSkillDir;
+    private loadFromMd;
+    private loadFromDir;
+    private scanLinkedFiles;
+    private collectFiles;
+    private parseSkillFile;
+    private readBody;
+}
+//# sourceMappingURL=SkillLoader.d.ts.map

package/dist/skills/SkillLoader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SkillLoader.d.ts","sourceRoot":"","sources":["../../src/skills/SkillLoader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAWH,OAAO,KAAK,EAEM,eAAe,EAChC,MAAM,YAAY,CAAC;AAqBpB,qBAAa,WAAW;IAWpB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAV7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IAMrD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;gBAG5B,UAAU,EAAE,MAAM,EACnC,YAAY,CAAC,EAAE,MAAM,EACrB,UAAU,GAAE,SAAS,MAAM,EAAO;IAM9B,OAAO,IAAI,OAAO,CAAC,eAAe,CAAC;IA0BzC;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAOjC;;;;;;OAMG;YACW,IAAI;YAsCJ,iBAAiB;YASjB,UAAU;YAaV,WAAW;YA2CX,eAAe;YAoBf,YAAY;IAuB1B,OAAO,CAAC,cAAc;YAwDR,QAAQ;CAgBvB"}