limixbot 0.3.1 → 0.3.3

package/dist-server/openmausbot.js

@@ -8620,8 +8620,8 @@ child=null,removeTokenFile(tokenFile);let terminated=existing?terminateChild(exi
 ected. Try again to recover it.",endpoint_busy:"The secure connection is still being prepared. Try again in a moment.",endpoint_rate_limited:"The secure connection service is busy right now. Local Wi-Fi and Tailscale pairing still work; try again in {wait}.",update_required:"This version of Limix Bot can no longer make secure links. Update Limix Bot, then try again. Local Wi-Fi and Tailscale pairing still work.",endpoint_capacity:"Secure HTTPS links are temporarily full. Try again in {wait}, or \
 pair on this Wi-Fi or with Tailscale.",endpoint_unavailable:"The secure connection service could not finish setup. Local Wi-Fi and Tailscale pairing still work. If this keeps happening, contact support with the error reference.",endpoint_cleanup_pending:"The secure connection is still being removed. Try signing out again shortly.",control_plane_unavailable:"Secure access is not available right now. Local pairing still works.",internal_error:"The secure connection service had a problem. Local pai\
 ring still works; try again.",invalid_response:"The secure connection service returned an unexpected response. Try again.",request_failed:"The secure connection request could not be completed. Local pairing still works; try again."});function retryWait(retryAfterMs){let seconds=Math.ceil((retryAfterMs??0)/1e3);return seconds>0?seconds<90?`${seconds} seconds`:`${Math.round(seconds/60)} minutes`:"a few minutes"}function friendlyCompanionAccountError(error62){let code=error62 instanceof ControlPlaneError?
-error62.code:"",message5=(FRIENDLY_MESSAGES[code]??FRIENDLY_MESSAGES.request_failed).replace("{wait}",()=>retryWait(error62.retryAfterMs)),reference=error62 instanceof ControlPlaneError&&error62.requestId?` Reference: ${error62.requestId}.`:"";return`${message5}${reference}`}var DEFAULT_COMPANION_CONTROL_PLANE_URL="https://accounts.openmausbot.com",COMPANION_CLIENT_INSTANCE_FIELD="companionClientInstanceId",COMPANION_ACCOUNT_TOKEN_FIELD="companionAccountToken",COMPANION_ACCOUNT_USER_ID_FIELD="companionAccountUserId",COMPANION_ACCOUNT_EMAIL_FIELD="companionAccountEmail",COMPANION_INSTALLATION_ID_FIELD="companionInstallationId",COMPANION_INSTALLATION_CREDENTIAL_FIELD="companionInstallationCredential",COMPANION_INSTALLATION_EXPIRY_FIELD="companionInstallationCredential\
-ExpiresAt",COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD="companionAccountCleanupPending",COMPANION_ENDPOINT_RELEASE_PENDING_FIELD="companionEndpointReleasePending",COMPANION_ENDPOINT_PAUSED_FIELD="companionEndpointPaused",COMPANION_TUNNEL_RETIRED_FIELD="companionTunnelRetired",COMPANION_TUNNEL_WAITING_FIELD="companionTunnelWaiting",UUID=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,INSTALLATION_ID2=UUID,INSTALLATION_CREDENTIAL2=/^omb_install_[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}$/,
+error62.code:"",message5=(FRIENDLY_MESSAGES[code]??FRIENDLY_MESSAGES.request_failed).replace("{wait}",()=>retryWait(error62.retryAfterMs)),reference=error62 instanceof ControlPlaneError&&error62.requestId?` Reference: ${error62.requestId}.`:"";return`${message5}${reference}`}var DEFAULT_COMPANION_CONTROL_PLANE_URL="https://accounts.limixmedia.com",COMPANION_CLIENT_INSTANCE_FIELD="companionClientInstanceId",COMPANION_ACCOUNT_TOKEN_FIELD="companionAccountToken",COMPANION_ACCOUNT_USER_ID_FIELD="companionAccountUserId",COMPANION_ACCOUNT_EMAIL_FIELD="companionAccountEmail",COMPANION_INSTALLATION_ID_FIELD="companionInstallationId",COMPANION_INSTALLATION_CREDENTIAL_FIELD="companionInstallationCredential",COMPANION_INSTALLATION_EXPIRY_FIELD="companionInstallationCredentialE\
+xpiresAt",COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD="companionAccountCleanupPending",COMPANION_ENDPOINT_RELEASE_PENDING_FIELD="companionEndpointReleasePending",COMPANION_ENDPOINT_PAUSED_FIELD="companionEndpointPaused",COMPANION_TUNNEL_RETIRED_FIELD="companionTunnelRetired",COMPANION_TUNNEL_WAITING_FIELD="companionTunnelWaiting",UUID=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,INSTALLATION_ID2=UUID,INSTALLATION_CREDENTIAL2=/^omb_install_[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}$/,
 DEFAULT_HEALTH_CACHE_MS=3e4,DEFAULT_AUTO_RETRY_BASE_MS=10*6e4,DEFAULT_AUTO_RETRY_MAX_MS=360*6e4,DEFAULT_ENDPOINT_CHECK_INTERVAL_MS=15*6e4,DEFAULT_FIRST_ENDPOINT_CHECK_MS=2*6e4,DEFAULT_RELEASE_GRACE_MS=60*6e4,DEFAULT_RELEASE_JITTER_MS=180*6e4,REQUEST_WINDOW_MS=60*6e4,AUTO_RETRY_CODES=new Set(["endpoint_capacity","endpoint_rate_limited","endpoint_unavailable","endpoint_busy","network_unavailable","control_plane_unavailable","internal_error","rate_limited","credential_rotation_rate_limited"]),ENDPOINT_NEEDS_RECONCILE=new Set(
 ["deleting","deleted","error"]),WATCHDOG_CHECK_STATES=new Set(["starting","ready","retrying","error"]),CONNECTOR_FAILING_STATES=new Set(["retrying","error"]),defaultSetTimer=(callback,milliseconds)=>{let timer2=setTimeout(callback,milliseconds);return timer2.unref?.(),timer2},ownString=(document3,field)=>typeof document3?.[field]=="string"?document3[field]:"";function resolveCompanionControlPlaneURL({isPackaged,environment=process.env}={}){return Object.hasOwn(environment,"OMB_CONTROL_PLANE_URL")?
 normalizeControlPlaneURL(environment.OMB_CONTROL_PLANE_URL):isPackaged?DEFAULT_COMPANION_CONTROL_PLANE_URL:""}function companionAccountCleanupPending(credentials){return credentials?.[COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD]===!0}var companionTunnelRetired=credentials=>!!storedAccount(credentials)&&!managedCompanionTunnelAccess(credentials)&&credentials?.[COMPANION_TUNNEL_RETIRED_FIELD]===!0;function storedAccount(credentials){let email3=normalizeAccountEmail(ownString(credentials,COMPANION_ACCOUNT_EMAIL_FIELD)),
@@ -8651,26 +8651,26 @@ credential)&&await client.revokeInstallation(accountToken,installation.installat
 ...document3};return relayOnly==="retired"?next[COMPANION_TUNNEL_RETIRED_FIELD]=!0:delete next[COMPANION_TUNNEL_RETIRED_FIELD],relayOnly==="retired"||relayOnly==="full"?next[COMPANION_TUNNEL_WAITING_FIELD]=!0:delete next[COMPANION_TUNNEL_WAITING_FIELD],next}),withoutTunnel();try{await updateCredentials(document3=>withProvisionedAccount(document3,{accountToken,user,installation,provision:endpoint}))}catch(error62){throw await client.deleteEndpoint(installation.credential).catch(()=>{}),await client.
 revokeInstallation(accountToken,installation.installation.id).catch(()=>{}),error62}resetAutoRetry();let connection=await activatePersistedEndpoint();return phase=null,companionIsOn()&&connection&&["unavailable","error"].includes(connection.status)&&(phase={status:"error",email:user.email,endpoint:endpoint.endpoint.url,message:"The address is ready, but this app could not start its secure connection. Local pairing still works."}),settledState()},writeLog=line3=>{try{log2(line3)}catch{}},failAction=(error62,{
 email:email3,expiredSessionIsSignedOut=!1,signedOut=!1}={})=>{let message5=friendlyCompanionAccountError(error62);return writeLog(error62 instanceof ControlPlaneError?`companion account: setup failed code=${error62.code} status=${error62.status||"none"} ref=${error62.requestId||"none"}`:"companion account: setup failed on this computer (not a control-plane answer)"),phase={status:signedOut||expiredSessionIsSignedOut&&error62 instanceof ControlPlaneError&&error62.status===401?"signed-out":"error",
-email:email3,message:message5},message5},requestCode=rawEmail=>serialize(async()=>{if(!configured)throw new Error(FRIENDLY_MESSAGES.control_plane_unavailable);let email3=normalizeAccountEmail(rawEmail),requested;try{await requireHealthyControlPlane(),requested=await client.requestOTP(email3)}catch(error62){let message5=failAction(error62,{email:email3,signedOut:!0});throw new Error(message5)}return phase={status:"signed-out",email:requested.email},settledState()}),verifyCode=(rawEmail,rawCode)=>serialize(
-async()=>{if(!configured)throw new Error(FRIENDLY_MESSAGES.control_plane_unavailable);requestedAt=now();let email3=normalizeAccountEmail(rawEmail);phase={status:"connecting",email:email3};let verified;try{await requireHealthyControlPlane(),verified=await client.verifyOTP(email3,rawCode)}catch(error62){let message5=failAction(error62,{email:email3,signedOut:!0});throw new Error(message5)}let previous2=storedAccount(credentials()),refreshingPendingCleanup=!!(previous2&&previous2.userId===verified.
-user.id&&companionAccountCleanupPending(credentials())),authenticatedPersisted=!1;try{previous2&&previous2.userId!==verified.user.id&&await cleanupCurrentAccount();let existingIdentity=ownString(credentials(),COMPANION_CLIENT_INSTANCE_FIELD),clientInstanceId=UUID.test(existingIdentity)?existingIdentity:newClientInstanceId?.();if(!UUID.test(clientInstanceId??""))throw new Error("A stable computer identity could not be created");return await updateCredentials(document3=>withAuthenticatedAccount(document3,
-{...verified,clientInstanceId,preserveCleanupPending:refreshingPendingCleanup})),authenticatedPersisted=!0,refreshingPendingCleanup?(await cleanupCurrentAccount({markPending:!1}),settledState()):await provision(verified)}catch(error62){return authenticatedPersisted||await client.signOut(verified.accountToken).catch(()=>{}),failAction(error62,{email:authenticatedPersisted?verified.user.email:previous2?.email??email3,expiredSessionIsSignedOut:authenticatedPersisted}),authenticatedPersisted&&scheduleAutoRetry(
-error62),settledState()}}),retryWork=async()=>{if(!configured)return settledState();let account2=storedAccount(credentials());if(!account2)return phase=null,settledState();if(companionAccountCleanupPending(credentials())){phase={status:"connecting",email:account2.email};try{await requireHealthyControlPlane(),await cleanupCurrentAccount({markPending:!1})}catch(error62){failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0})}return settledState()}phase={status:"connecting",email:account2.
-email};try{return await requireHealthyControlPlane(),await provision({accountToken:account2.accountToken,user:{id:account2.userId,email:account2.email}})}catch(error62){return failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0}),scheduleAutoRetry(error62),settledState()}},retry=()=>serialize(async()=>(requestedAt=now(),retryWork())),reconcileIfEndpointGone=async({onGone=retryWork}={})=>{let document3=credentials(),account2=storedAccount(document3),access2=managedCompanionTunnelAccess(
-document3);if(!account2||!access2||!account2.installationCredential||companionAccountCleanupPending(document3)||typeof client.getEndpoint!="function")return null;lastEndpointCheck=now();let endpoint;try{endpoint=await client.getEndpoint(account2.installationCredential)}catch(error62){return error62 instanceof ControlPlaneError&&error62.status===401?onGone():null}return endpoint&&endpoint.url===access2.endpoint&&!ENDPOINT_NEEDS_RECONCILE.has(endpoint.status)?null:onGone()},endpointCheckDue=()=>lastEndpointCheck===
-null||now()-lastEndpointCheck>=endpointCheckIntervalMs/2,recoveryDue=({atLaunch=!1}={})=>{if(!autoRecover||!companionIsOn())return!1;if(atLaunch)return!0;if(autoRetryTimer!==null)return!1;let connection=managedConnectionState?.()??{};return WATCHDOG_CHECK_STATES.has(connection.status)&&endpointCheckDue()},requestedRecently=()=>requestedAt!==null&&now()-requestedAt<REQUEST_WINDOW_MS,savedAddress=document3=>normalizeManagedCompanionEndpoint(document3[MANAGED_COMPANION_ENDPOINT_FIELD]),phonesUnused=!1,
-currentNeed=async()=>{let answer=await Promise.resolve().then(()=>managedEndpointNeeded()).catch(()=>null);phonesUnused=answer===MANAGED_ENDPOINT_PHONES_UNUSED;let need=phonesUnused?!1:typeof answer=="boolean"?answer:null;return need===!1&&relay.capable()?!1:requestedRecently()?(phonesUnused=!1,!0):need},releaseScheduledAt=()=>{let at2=credentials()[MANAGED_COMPANION_RELEASE_AT_FIELD];return Number.isSafeInteger(at2)&&at2>0?at2:null},cancelRelease=async()=>{releaseScheduledAt()!==null&&await updateCredentials(
-document3=>{let next={...document3};return delete next[MANAGED_COMPANION_RELEASE_AT_FIELD],next})},releaseAddress=async()=>{let need=await currentNeed(),pause2=phonesUnused;if(need!==!1)return need&&await cancelRelease(),settledState();let document3=credentials(),account2=storedAccount(document3);if(!account2?.installationCredential||!managedCompanionTunnelAccess(document3)||companionAccountCleanupPending(document3))return settledState();await stopManagedEndpoint();let removalPending=!1;try{await client.
-deleteEndpoint(account2.installationCredential)}catch(error62){if(removalPending=error62 instanceof ControlPlaneError&&error62.code==="endpoint_cleanup_pending",!(removalPending||error62 instanceof ControlPlaneError&&error62.status===401))return writeLog(error62 instanceof ControlPlaneError?`companion account: could not give the secure address back code=${error62.code} status=${error62.status||"none"} ref=${error62.requestId||"none"}`:"companion account: could not give the secure address back (n\
-ot a control-plane answer)"),await activatePersistedEndpoint(),settledState()}return await updateCredentials(current=>({...withoutManagedCompanionTunnelAccess(current),...removalPending?{[COMPANION_ENDPOINT_RELEASE_PENDING_FIELD]:!0}:{},...pause2?{[COMPANION_ENDPOINT_PAUSED_FIELD]:!0}:{}})),resetAutoRetry(),phase=null,writeLog(pause2?"companion account: gave the secure address back; no paired phone was used in 30 days":"companion account: gave the secure address back; no device needs it"),settledState()},
-reviewAddress=async({atLaunch=!1}={})=>{let document3=credentials();if(!storedAccount(document3)||companionAccountCleanupPending(document3))return null;if(!managedCompanionTunnelAccess(document3)){let waiting2=document3[COMPANION_TUNNEL_WAITING_FIELD]===!0;return!savedAddress(document3)&&!waiting2||autoRetryTimer!==null?null:await currentNeed()===!0?retryWork():null}let need=await currentNeed();if(need!==!1)return need&&await cancelRelease(),need===null&&atLaunch?null:recoveryDue({atLaunch})?reconcileIfEndpointGone():
-null;let releaseAt=releaseScheduledAt();if(releaseAt!==null&&now()>=releaseAt)return releaseAddress();let connection=managedConnectionState?.()??{};if(companionIsOn()&&CONNECTOR_FAILING_STATES.has(connection.status)&&(atLaunch||endpointCheckDue())){let released=await reconcileIfEndpointGone({onGone:releaseAddress});if(released)return released}if(releaseAt===null||releaseAt-now()>releaseGraceMs+releaseJitterMs){let delay3=releaseGraceMs+Math.round(random()*releaseJitterMs);await updateCredentials(
-current=>managedCompanionTunnelAccess(current)?{...current,[MANAGED_COMPANION_RELEASE_AT_FIELD]:now()+delay3}:current),writeLog(`companion account: no device needs the secure address; giving it back in ${Math.round(delay3/6e4)} min`)}return null},retryIfWanted=async()=>requestedRecently()||savedAddress(credentials())&&await currentNeed()!==!1?retryWork():(resetAutoRetry(),phase?.status==="error"&&(phase=null),writeLog("companion account: stopped retrying; no device needs a secure address"),settledState());
-retryFromTimer=()=>serialize(onDemand?retryIfWanted:retryWork);let prepare=()=>serialize(async()=>{let document3=credentials();if(!configured||!companionIsOn()||!storedAccount(document3)||companionAccountCleanupPending(document3))return settledState();if(requestedAt=now(),!managedCompanionTunnelAccess(document3))return retryWork();await cancelRelease();let connection=managedConnectionState?.()??{};if(["stopped","unconfigured"].includes(connection.status))await activatePersistedEndpoint();else if(CONNECTOR_FAILING_STATES.
-has(connection.status)){let repaired=await reconcileIfEndpointGone();if(repaired)return repaired}return settledState()}),watchdogTick=()=>{if(watchdogTimer=null,!disposed&&(watchdogTimer=setTimer(watchdogTick,endpointCheckIntervalMs),phase?.status!=="signed-out")){if(onDemand){serialize(()=>reviewAddress()).catch(()=>{});return}recoveryDue()&&serialize(()=>reconcileIfEndpointGone()).catch(()=>{})}},startWatchdog=()=>{!(autoRecover||onDemand)||disposed||!configured||watchdogTimer!==null||(watchdogTimer=
-setTimer(watchdogTick,firstEndpointCheckMs))};return Object.freeze({state:async()=>(await probeControlPlane(),settledState()),requestCode,verifyCode,retry,prepare,signOut:()=>serialize(async()=>{if(resetAutoRetry(),!storedAccount(credentials()))return await clearAfterCleanup(),settledState();let email3=storedAccount(credentials())?.email;phase={status:"connecting",email:email3};try{return await cleanupCurrentAccount(),healthy=!0,lastHealthCheck=now(),settledState()}catch(error62){return failAction(
-error62,{email:email3}),settledState()}}),restore:()=>serialize(async()=>{if(!configured||(startWatchdog(),!await probeControlPlane({force:!0})))return settledState();if(companionAccountCleanupPending(credentials()))return retryWork();if(await ensureClientIdentity(),onDemand){let reviewed=await reviewAddress({atLaunch:!0});return reviewed||(phase=null,settledState())}let account2=storedAccount(credentials());if(account2&&!managedCompanionTunnelAccess(credentials()))return retryWork();if(autoRecover&&
-account2&&companionIsOn()){let reconciled=await reconcileIfEndpointGone();if(reconciled)return reconciled}return phase=null,settledState()}),dispose:()=>{disposed=!0,cancelAutoRetry(),watchdogTimer!==null&&clearTimer(watchdogTimer),watchdogTimer=null}})}var SIGNIN_CODE_TTL_MS=10*6e4;init_user_errors();function parseAllowList(value){return(value??"").split(/[,\s]+/).map(entry=>entry.trim().toLowerCase()).filter(Boolean)}var NOT_WELCOME={ok:!1,status:403,...userError("serverError.email.notAllowed")};init_decision_log();init_redact2();init_usage_ledger();import{appendFile as appendFile2,mkdir as mkdir2}from"node:fs/promises";import{basename as basename2,join as join2}from"node:path";var DIR2="admin-activity";var PRUNE_EVERY_MS2=60*6e4,writeQueues2=new Map,lastPrune2=new Map;function adminActivityFileFor(dataDir,at2){return join2(dataDir,DIR2,`${monthKey(at2)}.ndjson`)}async function writeRow(dataDir,row){let at2=new Date(row.at);await mkdir2(join2(dataDir,DIR2),{recursive:!0,mode:448}),await appendFile2(adminActivityFileFor(dataDir,at2),JSON.stringify(row)+`
+email:email3,message:message5},message5},requestCode=rawEmail=>serialize(async()=>{if(!configured)throw new Error(FRIENDLY_MESSAGES.control_plane_unavailable);let email3=normalizeAccountEmail(rawEmail),requested;try{await requireHealthyControlPlane(),requested=await client.requestOTP(email3)}catch(error62){let message5=failAction(error62,{email:email3,signedOut:!0});throw new Error(message5)}return phase={status:"signed-out",email:requested.email},settledState()}),signInFlow=(rawEmail,obtain)=>serialize(
+async()=>{if(!configured)throw new Error(FRIENDLY_MESSAGES.control_plane_unavailable);requestedAt=now();let email3=normalizeAccountEmail(rawEmail);phase={status:"connecting",email:email3};let verified;try{await requireHealthyControlPlane(),verified=await obtain(email3)}catch(error62){let message5=failAction(error62,{email:email3,signedOut:!0});throw new Error(message5)}let previous2=storedAccount(credentials()),refreshingPendingCleanup=!!(previous2&&previous2.userId===verified.user.id&&companionAccountCleanupPending(
+credentials())),authenticatedPersisted=!1;try{previous2&&previous2.userId!==verified.user.id&&await cleanupCurrentAccount();let existingIdentity=ownString(credentials(),COMPANION_CLIENT_INSTANCE_FIELD),clientInstanceId=UUID.test(existingIdentity)?existingIdentity:newClientInstanceId?.();if(!UUID.test(clientInstanceId??""))throw new Error("A stable computer identity could not be created");return await updateCredentials(document3=>withAuthenticatedAccount(document3,{...verified,clientInstanceId,preserveCleanupPending:refreshingPendingCleanup})),
+authenticatedPersisted=!0,refreshingPendingCleanup?(await cleanupCurrentAccount({markPending:!1}),settledState()):await provision(verified)}catch(error62){return authenticatedPersisted||await client.signOut(verified.accountToken).catch(()=>{}),failAction(error62,{email:authenticatedPersisted?verified.user.email:previous2?.email??email3,expiredSessionIsSignedOut:authenticatedPersisted}),authenticatedPersisted&&scheduleAutoRetry(error62),settledState()}}),verifyCode=(rawEmail,rawCode)=>signInFlow(
+rawEmail,email3=>client.verifyOTP(email3,rawCode)),connectLimix=credential=>signInFlow(credential.email,async()=>({accountToken:credential.bearer,user:{id:credential.userId,email:credential.email}})),retryWork=async()=>{if(!configured)return settledState();let account2=storedAccount(credentials());if(!account2)return phase=null,settledState();if(companionAccountCleanupPending(credentials())){phase={status:"connecting",email:account2.email};try{await requireHealthyControlPlane(),await cleanupCurrentAccount(
+{markPending:!1})}catch(error62){failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0})}return settledState()}phase={status:"connecting",email:account2.email};try{return await requireHealthyControlPlane(),await provision({accountToken:account2.accountToken,user:{id:account2.userId,email:account2.email}})}catch(error62){return failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0}),scheduleAutoRetry(error62),settledState()}},retry=()=>serialize(async()=>(requestedAt=
+now(),retryWork())),reconcileIfEndpointGone=async({onGone=retryWork}={})=>{let document3=credentials(),account2=storedAccount(document3),access2=managedCompanionTunnelAccess(document3);if(!account2||!access2||!account2.installationCredential||companionAccountCleanupPending(document3)||typeof client.getEndpoint!="function")return null;lastEndpointCheck=now();let endpoint;try{endpoint=await client.getEndpoint(account2.installationCredential)}catch(error62){return error62 instanceof ControlPlaneError&&
+error62.status===401?onGone():null}return endpoint&&endpoint.url===access2.endpoint&&!ENDPOINT_NEEDS_RECONCILE.has(endpoint.status)?null:onGone()},endpointCheckDue=()=>lastEndpointCheck===null||now()-lastEndpointCheck>=endpointCheckIntervalMs/2,recoveryDue=({atLaunch=!1}={})=>{if(!autoRecover||!companionIsOn())return!1;if(atLaunch)return!0;if(autoRetryTimer!==null)return!1;let connection=managedConnectionState?.()??{};return WATCHDOG_CHECK_STATES.has(connection.status)&&endpointCheckDue()},requestedRecently=()=>requestedAt!==
+null&&now()-requestedAt<REQUEST_WINDOW_MS,savedAddress=document3=>normalizeManagedCompanionEndpoint(document3[MANAGED_COMPANION_ENDPOINT_FIELD]),phonesUnused=!1,currentNeed=async()=>{let answer=await Promise.resolve().then(()=>managedEndpointNeeded()).catch(()=>null);phonesUnused=answer===MANAGED_ENDPOINT_PHONES_UNUSED;let need=phonesUnused?!1:typeof answer=="boolean"?answer:null;return need===!1&&relay.capable()?!1:requestedRecently()?(phonesUnused=!1,!0):need},releaseScheduledAt=()=>{let at2=credentials()[MANAGED_COMPANION_RELEASE_AT_FIELD];
+return Number.isSafeInteger(at2)&&at2>0?at2:null},cancelRelease=async()=>{releaseScheduledAt()!==null&&await updateCredentials(document3=>{let next={...document3};return delete next[MANAGED_COMPANION_RELEASE_AT_FIELD],next})},releaseAddress=async()=>{let need=await currentNeed(),pause2=phonesUnused;if(need!==!1)return need&&await cancelRelease(),settledState();let document3=credentials(),account2=storedAccount(document3);if(!account2?.installationCredential||!managedCompanionTunnelAccess(document3)||
+companionAccountCleanupPending(document3))return settledState();await stopManagedEndpoint();let removalPending=!1;try{await client.deleteEndpoint(account2.installationCredential)}catch(error62){if(removalPending=error62 instanceof ControlPlaneError&&error62.code==="endpoint_cleanup_pending",!(removalPending||error62 instanceof ControlPlaneError&&error62.status===401))return writeLog(error62 instanceof ControlPlaneError?`companion account: could not give the secure address back code=${error62.code}\
+ status=${error62.status||"none"} ref=${error62.requestId||"none"}`:"companion account: could not give the secure address back (not a control-plane answer)"),await activatePersistedEndpoint(),settledState()}return await updateCredentials(current=>({...withoutManagedCompanionTunnelAccess(current),...removalPending?{[COMPANION_ENDPOINT_RELEASE_PENDING_FIELD]:!0}:{},...pause2?{[COMPANION_ENDPOINT_PAUSED_FIELD]:!0}:{}})),resetAutoRetry(),phase=null,writeLog(pause2?"companion account: gave the secure\
+ address back; no paired phone was used in 30 days":"companion account: gave the secure address back; no device needs it"),settledState()},reviewAddress=async({atLaunch=!1}={})=>{let document3=credentials();if(!storedAccount(document3)||companionAccountCleanupPending(document3))return null;if(!managedCompanionTunnelAccess(document3)){let waiting2=document3[COMPANION_TUNNEL_WAITING_FIELD]===!0;return!savedAddress(document3)&&!waiting2||autoRetryTimer!==null?null:await currentNeed()===!0?retryWork():
+null}let need=await currentNeed();if(need!==!1)return need&&await cancelRelease(),need===null&&atLaunch?null:recoveryDue({atLaunch})?reconcileIfEndpointGone():null;let releaseAt=releaseScheduledAt();if(releaseAt!==null&&now()>=releaseAt)return releaseAddress();let connection=managedConnectionState?.()??{};if(companionIsOn()&&CONNECTOR_FAILING_STATES.has(connection.status)&&(atLaunch||endpointCheckDue())){let released=await reconcileIfEndpointGone({onGone:releaseAddress});if(released)return released}
+if(releaseAt===null||releaseAt-now()>releaseGraceMs+releaseJitterMs){let delay3=releaseGraceMs+Math.round(random()*releaseJitterMs);await updateCredentials(current=>managedCompanionTunnelAccess(current)?{...current,[MANAGED_COMPANION_RELEASE_AT_FIELD]:now()+delay3}:current),writeLog(`companion account: no device needs the secure address; giving it back in ${Math.round(delay3/6e4)} min`)}return null},retryIfWanted=async()=>requestedRecently()||savedAddress(credentials())&&await currentNeed()!==!1?
+retryWork():(resetAutoRetry(),phase?.status==="error"&&(phase=null),writeLog("companion account: stopped retrying; no device needs a secure address"),settledState());retryFromTimer=()=>serialize(onDemand?retryIfWanted:retryWork);let prepare=()=>serialize(async()=>{let document3=credentials();if(!configured||!companionIsOn()||!storedAccount(document3)||companionAccountCleanupPending(document3))return settledState();if(requestedAt=now(),!managedCompanionTunnelAccess(document3))return retryWork();await cancelRelease();
+let connection=managedConnectionState?.()??{};if(["stopped","unconfigured"].includes(connection.status))await activatePersistedEndpoint();else if(CONNECTOR_FAILING_STATES.has(connection.status)){let repaired=await reconcileIfEndpointGone();if(repaired)return repaired}return settledState()}),watchdogTick=()=>{if(watchdogTimer=null,!disposed&&(watchdogTimer=setTimer(watchdogTick,endpointCheckIntervalMs),phase?.status!=="signed-out")){if(onDemand){serialize(()=>reviewAddress()).catch(()=>{});return}
+recoveryDue()&&serialize(()=>reconcileIfEndpointGone()).catch(()=>{})}},startWatchdog=()=>{!(autoRecover||onDemand)||disposed||!configured||watchdogTimer!==null||(watchdogTimer=setTimer(watchdogTick,firstEndpointCheckMs))};return Object.freeze({state:async()=>(await probeControlPlane(),settledState()),requestCode,verifyCode,connectLimix,retry,prepare,signOut:()=>serialize(async()=>{if(resetAutoRetry(),!storedAccount(credentials()))return await clearAfterCleanup(),settledState();let email3=storedAccount(
+credentials())?.email;phase={status:"connecting",email:email3};try{return await cleanupCurrentAccount(),healthy=!0,lastHealthCheck=now(),settledState()}catch(error62){return failAction(error62,{email:email3}),settledState()}}),restore:()=>serialize(async()=>{if(!configured||(startWatchdog(),!await probeControlPlane({force:!0})))return settledState();if(companionAccountCleanupPending(credentials()))return retryWork();if(await ensureClientIdentity(),onDemand){let reviewed=await reviewAddress({atLaunch:!0});
+return reviewed||(phase=null,settledState())}let account2=storedAccount(credentials());if(account2&&!managedCompanionTunnelAccess(credentials()))return retryWork();if(autoRecover&&account2&&companionIsOn()){let reconciled=await reconcileIfEndpointGone();if(reconciled)return reconciled}return phase=null,settledState()}),dispose:()=>{disposed=!0,cancelAutoRetry(),watchdogTimer!==null&&clearTimer(watchdogTimer),watchdogTimer=null}})}var SIGNIN_CODE_TTL_MS=10*6e4;init_user_errors();function parseAllowList(value){return(value??"").split(/[,\s]+/).map(entry=>entry.trim().toLowerCase()).filter(Boolean)}var NOT_WELCOME={ok:!1,status:403,...userError("serverError.email.notAllowed")};init_decision_log();init_redact2();init_usage_ledger();import{appendFile as appendFile2,mkdir as mkdir2}from"node:fs/promises";import{basename as basename2,join as join2}from"node:path";var DIR2="admin-activity";var PRUNE_EVERY_MS2=60*6e4,writeQueues2=new Map,lastPrune2=new Map;function adminActivityFileFor(dataDir,at2){return join2(dataDir,DIR2,`${monthKey(at2)}.ndjson`)}async function writeRow(dataDir,row){let at2=new Date(row.at);await mkdir2(join2(dataDir,DIR2),{recursive:!0,mode:448}),await appendFile2(adminActivityFileFor(dataDir,at2),JSON.stringify(row)+`
 `,{mode:384}),at2.getTime()-(lastPrune2.get(dataDir)??0)>=PRUNE_EVERY_MS2&&(lastPrune2.set(dataDir,at2.getTime()),await pruneMonthFiles(join2(dataDir,DIR2),boundRetentionDays(),at2))}function appendAdminAction(dataDir,row){let record12={...row,at:row.at??new Date().toISOString(),...row.before?{before:auditValues(row.before)}:{},...row.after?{after:auditValues(row.after)}:{}},queued=(writeQueues2.get(dataDir)??Promise.resolve()).then(()=>writeRow(dataDir,record12)).catch(()=>{});writeQueues2.set(
 dataDir,queued),queued.finally(()=>{writeQueues2.get(dataDir)===queued&&writeQueues2.delete(dataDir)})}async function flushAdminActivity(dataDir){await writeQueues2.get(dataDir)}var SECRET_PARTS=["token","secret","password","passwd","passphrase","credential","authorization","cookie","bearer","apikey","api_key"],OPAQUE_MAP=/^(?:headers|env|environment)$/i,MAX_VALUE_CHARS=2e3,HIDDEN="[hidden]";function isSecretName2(name){let lower=name.toLowerCase();return lower.endsWith("tokens")?!1:SECRET_PARTS.some(part=>lower.includes(part))?!0:/(?:^|[_.-])keys?$/.test(lower)||/[a-z]Keys?$/.test(name)}function isSecretParameter(name){
 if(name==="-k"||name==="-K")return!0;let bare=name.replace(/^-+/,"");return isSecretName2(bare)||/^(?:auth|sig|signature|pass|pwd|code)$/i.test(bare)}function keyLikeSegment(segment){return(segment.match(/[A-Za-z0-9]{16,}/g)??[]).some(run6=>/\d/.test(run6)&&/[A-Za-z]/.test(run6))}function maskUrlSecrets(text13){return text13.replace(/\b([a-z][\w+.-]*:\/\/)([^\s/?#]*)([^\s?#]*)([^\s]*)/gi,(_all,scheme,authority2,path3,rest)=>{let at2=authority2.lastIndexOf("@"),host2=at2>=0?`${HIDDEN}@${authority2.

package/dist-server/package.json

@@ -1 +1 @@
-{"type":"module","version":"0.3.1"}
+{"type":"module","version":"0.3.3"}

package/dist-server/pair-cli.js

@@ -8619,8 +8619,8 @@ child=null,removeTokenFile(tokenFile);let terminated=existing?terminateChild(exi
 ected. Try again to recover it.",endpoint_busy:"The secure connection is still being prepared. Try again in a moment.",endpoint_rate_limited:"The secure connection service is busy right now. Local Wi-Fi and Tailscale pairing still work; try again in {wait}.",update_required:"This version of Limix Bot can no longer make secure links. Update Limix Bot, then try again. Local Wi-Fi and Tailscale pairing still work.",endpoint_capacity:"Secure HTTPS links are temporarily full. Try again in {wait}, or \
 pair on this Wi-Fi or with Tailscale.",endpoint_unavailable:"The secure connection service could not finish setup. Local Wi-Fi and Tailscale pairing still work. If this keeps happening, contact support with the error reference.",endpoint_cleanup_pending:"The secure connection is still being removed. Try signing out again shortly.",control_plane_unavailable:"Secure access is not available right now. Local pairing still works.",internal_error:"The secure connection service had a problem. Local pai\
 ring still works; try again.",invalid_response:"The secure connection service returned an unexpected response. Try again.",request_failed:"The secure connection request could not be completed. Local pairing still works; try again."});function retryWait(retryAfterMs){let seconds=Math.ceil((retryAfterMs??0)/1e3);return seconds>0?seconds<90?`${seconds} seconds`:`${Math.round(seconds/60)} minutes`:"a few minutes"}function friendlyCompanionAccountError(error62){let code=error62 instanceof ControlPlaneError?
-error62.code:"",message5=(FRIENDLY_MESSAGES[code]??FRIENDLY_MESSAGES.request_failed).replace("{wait}",()=>retryWait(error62.retryAfterMs)),reference=error62 instanceof ControlPlaneError&&error62.requestId?` Reference: ${error62.requestId}.`:"";return`${message5}${reference}`}var DEFAULT_COMPANION_CONTROL_PLANE_URL="https://accounts.openmausbot.com",COMPANION_CLIENT_INSTANCE_FIELD="companionClientInstanceId",COMPANION_ACCOUNT_TOKEN_FIELD="companionAccountToken",COMPANION_ACCOUNT_USER_ID_FIELD="companionAccountUserId",COMPANION_ACCOUNT_EMAIL_FIELD="companionAccountEmail",COMPANION_INSTALLATION_ID_FIELD="companionInstallationId",COMPANION_INSTALLATION_CREDENTIAL_FIELD="companionInstallationCredential",COMPANION_INSTALLATION_EXPIRY_FIELD="companionInstallationCredential\
-ExpiresAt",COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD="companionAccountCleanupPending",COMPANION_ENDPOINT_RELEASE_PENDING_FIELD="companionEndpointReleasePending",COMPANION_ENDPOINT_PAUSED_FIELD="companionEndpointPaused",COMPANION_TUNNEL_RETIRED_FIELD="companionTunnelRetired",COMPANION_TUNNEL_WAITING_FIELD="companionTunnelWaiting",UUID=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,INSTALLATION_ID2=UUID,INSTALLATION_CREDENTIAL2=/^omb_install_[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}$/,
+error62.code:"",message5=(FRIENDLY_MESSAGES[code]??FRIENDLY_MESSAGES.request_failed).replace("{wait}",()=>retryWait(error62.retryAfterMs)),reference=error62 instanceof ControlPlaneError&&error62.requestId?` Reference: ${error62.requestId}.`:"";return`${message5}${reference}`}var DEFAULT_COMPANION_CONTROL_PLANE_URL="https://accounts.limixmedia.com",COMPANION_CLIENT_INSTANCE_FIELD="companionClientInstanceId",COMPANION_ACCOUNT_TOKEN_FIELD="companionAccountToken",COMPANION_ACCOUNT_USER_ID_FIELD="companionAccountUserId",COMPANION_ACCOUNT_EMAIL_FIELD="companionAccountEmail",COMPANION_INSTALLATION_ID_FIELD="companionInstallationId",COMPANION_INSTALLATION_CREDENTIAL_FIELD="companionInstallationCredential",COMPANION_INSTALLATION_EXPIRY_FIELD="companionInstallationCredentialE\
+xpiresAt",COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD="companionAccountCleanupPending",COMPANION_ENDPOINT_RELEASE_PENDING_FIELD="companionEndpointReleasePending",COMPANION_ENDPOINT_PAUSED_FIELD="companionEndpointPaused",COMPANION_TUNNEL_RETIRED_FIELD="companionTunnelRetired",COMPANION_TUNNEL_WAITING_FIELD="companionTunnelWaiting",UUID=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,INSTALLATION_ID2=UUID,INSTALLATION_CREDENTIAL2=/^omb_install_[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}$/,
 DEFAULT_HEALTH_CACHE_MS=3e4,DEFAULT_AUTO_RETRY_BASE_MS=10*6e4,DEFAULT_AUTO_RETRY_MAX_MS=360*6e4,DEFAULT_ENDPOINT_CHECK_INTERVAL_MS=15*6e4,DEFAULT_FIRST_ENDPOINT_CHECK_MS=2*6e4,DEFAULT_RELEASE_GRACE_MS=60*6e4,DEFAULT_RELEASE_JITTER_MS=180*6e4,REQUEST_WINDOW_MS=60*6e4,AUTO_RETRY_CODES=new Set(["endpoint_capacity","endpoint_rate_limited","endpoint_unavailable","endpoint_busy","network_unavailable","control_plane_unavailable","internal_error","rate_limited","credential_rotation_rate_limited"]),ENDPOINT_NEEDS_RECONCILE=new Set(
 ["deleting","deleted","error"]),WATCHDOG_CHECK_STATES=new Set(["starting","ready","retrying","error"]),CONNECTOR_FAILING_STATES=new Set(["retrying","error"]),defaultSetTimer=(callback,milliseconds)=>{let timer2=setTimeout(callback,milliseconds);return timer2.unref?.(),timer2},ownString=(document3,field)=>typeof document3?.[field]=="string"?document3[field]:"";function resolveCompanionControlPlaneURL({isPackaged,environment=process.env}={}){return Object.hasOwn(environment,"OMB_CONTROL_PLANE_URL")?
 normalizeControlPlaneURL(environment.OMB_CONTROL_PLANE_URL):isPackaged?DEFAULT_COMPANION_CONTROL_PLANE_URL:""}function companionAccountCleanupPending(credentials){return credentials?.[COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD]===!0}var companionTunnelRetired=credentials=>!!storedAccount(credentials)&&!managedCompanionTunnelAccess(credentials)&&credentials?.[COMPANION_TUNNEL_RETIRED_FIELD]===!0;function storedAccount(credentials){let email3=normalizeAccountEmail(ownString(credentials,COMPANION_ACCOUNT_EMAIL_FIELD)),
@@ -8650,26 +8650,26 @@ credential)&&await client.revokeInstallation(accountToken,installation.installat
 ...document3};return relayOnly==="retired"?next[COMPANION_TUNNEL_RETIRED_FIELD]=!0:delete next[COMPANION_TUNNEL_RETIRED_FIELD],relayOnly==="retired"||relayOnly==="full"?next[COMPANION_TUNNEL_WAITING_FIELD]=!0:delete next[COMPANION_TUNNEL_WAITING_FIELD],next}),withoutTunnel();try{await updateCredentials(document3=>withProvisionedAccount(document3,{accountToken,user,installation,provision:endpoint}))}catch(error62){throw await client.deleteEndpoint(installation.credential).catch(()=>{}),await client.
 revokeInstallation(accountToken,installation.installation.id).catch(()=>{}),error62}resetAutoRetry();let connection=await activatePersistedEndpoint();return phase=null,companionIsOn()&&connection&&["unavailable","error"].includes(connection.status)&&(phase={status:"error",email:user.email,endpoint:endpoint.endpoint.url,message:"The address is ready, but this app could not start its secure connection. Local pairing still works."}),settledState()},writeLog=line3=>{try{log2(line3)}catch{}},failAction=(error62,{
 email:email3,expiredSessionIsSignedOut=!1,signedOut=!1}={})=>{let message5=friendlyCompanionAccountError(error62);return writeLog(error62 instanceof ControlPlaneError?`companion account: setup failed code=${error62.code} status=${error62.status||"none"} ref=${error62.requestId||"none"}`:"companion account: setup failed on this computer (not a control-plane answer)"),phase={status:signedOut||expiredSessionIsSignedOut&&error62 instanceof ControlPlaneError&&error62.status===401?"signed-out":"error",
-email:email3,message:message5},message5},requestCode=rawEmail=>serialize(async()=>{if(!configured)throw new Error(FRIENDLY_MESSAGES.control_plane_unavailable);let email3=normalizeAccountEmail(rawEmail),requested;try{await requireHealthyControlPlane(),requested=await client.requestOTP(email3)}catch(error62){let message5=failAction(error62,{email:email3,signedOut:!0});throw new Error(message5)}return phase={status:"signed-out",email:requested.email},settledState()}),verifyCode=(rawEmail,rawCode)=>serialize(
-async()=>{if(!configured)throw new Error(FRIENDLY_MESSAGES.control_plane_unavailable);requestedAt=now();let email3=normalizeAccountEmail(rawEmail);phase={status:"connecting",email:email3};let verified;try{await requireHealthyControlPlane(),verified=await client.verifyOTP(email3,rawCode)}catch(error62){let message5=failAction(error62,{email:email3,signedOut:!0});throw new Error(message5)}let previous2=storedAccount(credentials()),refreshingPendingCleanup=!!(previous2&&previous2.userId===verified.
-user.id&&companionAccountCleanupPending(credentials())),authenticatedPersisted=!1;try{previous2&&previous2.userId!==verified.user.id&&await cleanupCurrentAccount();let existingIdentity=ownString(credentials(),COMPANION_CLIENT_INSTANCE_FIELD),clientInstanceId=UUID.test(existingIdentity)?existingIdentity:newClientInstanceId?.();if(!UUID.test(clientInstanceId??""))throw new Error("A stable computer identity could not be created");return await updateCredentials(document3=>withAuthenticatedAccount(document3,
-{...verified,clientInstanceId,preserveCleanupPending:refreshingPendingCleanup})),authenticatedPersisted=!0,refreshingPendingCleanup?(await cleanupCurrentAccount({markPending:!1}),settledState()):await provision(verified)}catch(error62){return authenticatedPersisted||await client.signOut(verified.accountToken).catch(()=>{}),failAction(error62,{email:authenticatedPersisted?verified.user.email:previous2?.email??email3,expiredSessionIsSignedOut:authenticatedPersisted}),authenticatedPersisted&&scheduleAutoRetry(
-error62),settledState()}}),retryWork=async()=>{if(!configured)return settledState();let account2=storedAccount(credentials());if(!account2)return phase=null,settledState();if(companionAccountCleanupPending(credentials())){phase={status:"connecting",email:account2.email};try{await requireHealthyControlPlane(),await cleanupCurrentAccount({markPending:!1})}catch(error62){failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0})}return settledState()}phase={status:"connecting",email:account2.
-email};try{return await requireHealthyControlPlane(),await provision({accountToken:account2.accountToken,user:{id:account2.userId,email:account2.email}})}catch(error62){return failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0}),scheduleAutoRetry(error62),settledState()}},retry=()=>serialize(async()=>(requestedAt=now(),retryWork())),reconcileIfEndpointGone=async({onGone=retryWork}={})=>{let document3=credentials(),account2=storedAccount(document3),access2=managedCompanionTunnelAccess(
-document3);if(!account2||!access2||!account2.installationCredential||companionAccountCleanupPending(document3)||typeof client.getEndpoint!="function")return null;lastEndpointCheck=now();let endpoint;try{endpoint=await client.getEndpoint(account2.installationCredential)}catch(error62){return error62 instanceof ControlPlaneError&&error62.status===401?onGone():null}return endpoint&&endpoint.url===access2.endpoint&&!ENDPOINT_NEEDS_RECONCILE.has(endpoint.status)?null:onGone()},endpointCheckDue=()=>lastEndpointCheck===
-null||now()-lastEndpointCheck>=endpointCheckIntervalMs/2,recoveryDue=({atLaunch=!1}={})=>{if(!autoRecover||!companionIsOn())return!1;if(atLaunch)return!0;if(autoRetryTimer!==null)return!1;let connection=managedConnectionState?.()??{};return WATCHDOG_CHECK_STATES.has(connection.status)&&endpointCheckDue()},requestedRecently=()=>requestedAt!==null&&now()-requestedAt<REQUEST_WINDOW_MS,savedAddress=document3=>normalizeManagedCompanionEndpoint(document3[MANAGED_COMPANION_ENDPOINT_FIELD]),phonesUnused=!1,
-currentNeed=async()=>{let answer=await Promise.resolve().then(()=>managedEndpointNeeded()).catch(()=>null);phonesUnused=answer===MANAGED_ENDPOINT_PHONES_UNUSED;let need=phonesUnused?!1:typeof answer=="boolean"?answer:null;return need===!1&&relay.capable()?!1:requestedRecently()?(phonesUnused=!1,!0):need},releaseScheduledAt=()=>{let at2=credentials()[MANAGED_COMPANION_RELEASE_AT_FIELD];return Number.isSafeInteger(at2)&&at2>0?at2:null},cancelRelease=async()=>{releaseScheduledAt()!==null&&await updateCredentials(
-document3=>{let next={...document3};return delete next[MANAGED_COMPANION_RELEASE_AT_FIELD],next})},releaseAddress=async()=>{let need=await currentNeed(),pause2=phonesUnused;if(need!==!1)return need&&await cancelRelease(),settledState();let document3=credentials(),account2=storedAccount(document3);if(!account2?.installationCredential||!managedCompanionTunnelAccess(document3)||companionAccountCleanupPending(document3))return settledState();await stopManagedEndpoint();let removalPending=!1;try{await client.
-deleteEndpoint(account2.installationCredential)}catch(error62){if(removalPending=error62 instanceof ControlPlaneError&&error62.code==="endpoint_cleanup_pending",!(removalPending||error62 instanceof ControlPlaneError&&error62.status===401))return writeLog(error62 instanceof ControlPlaneError?`companion account: could not give the secure address back code=${error62.code} status=${error62.status||"none"} ref=${error62.requestId||"none"}`:"companion account: could not give the secure address back (n\
-ot a control-plane answer)"),await activatePersistedEndpoint(),settledState()}return await updateCredentials(current=>({...withoutManagedCompanionTunnelAccess(current),...removalPending?{[COMPANION_ENDPOINT_RELEASE_PENDING_FIELD]:!0}:{},...pause2?{[COMPANION_ENDPOINT_PAUSED_FIELD]:!0}:{}})),resetAutoRetry(),phase=null,writeLog(pause2?"companion account: gave the secure address back; no paired phone was used in 30 days":"companion account: gave the secure address back; no device needs it"),settledState()},
-reviewAddress=async({atLaunch=!1}={})=>{let document3=credentials();if(!storedAccount(document3)||companionAccountCleanupPending(document3))return null;if(!managedCompanionTunnelAccess(document3)){let waiting2=document3[COMPANION_TUNNEL_WAITING_FIELD]===!0;return!savedAddress(document3)&&!waiting2||autoRetryTimer!==null?null:await currentNeed()===!0?retryWork():null}let need=await currentNeed();if(need!==!1)return need&&await cancelRelease(),need===null&&atLaunch?null:recoveryDue({atLaunch})?reconcileIfEndpointGone():
-null;let releaseAt=releaseScheduledAt();if(releaseAt!==null&&now()>=releaseAt)return releaseAddress();let connection=managedConnectionState?.()??{};if(companionIsOn()&&CONNECTOR_FAILING_STATES.has(connection.status)&&(atLaunch||endpointCheckDue())){let released=await reconcileIfEndpointGone({onGone:releaseAddress});if(released)return released}if(releaseAt===null||releaseAt-now()>releaseGraceMs+releaseJitterMs){let delay3=releaseGraceMs+Math.round(random()*releaseJitterMs);await updateCredentials(
-current=>managedCompanionTunnelAccess(current)?{...current,[MANAGED_COMPANION_RELEASE_AT_FIELD]:now()+delay3}:current),writeLog(`companion account: no device needs the secure address; giving it back in ${Math.round(delay3/6e4)} min`)}return null},retryIfWanted=async()=>requestedRecently()||savedAddress(credentials())&&await currentNeed()!==!1?retryWork():(resetAutoRetry(),phase?.status==="error"&&(phase=null),writeLog("companion account: stopped retrying; no device needs a secure address"),settledState());
-retryFromTimer=()=>serialize(onDemand?retryIfWanted:retryWork);let prepare=()=>serialize(async()=>{let document3=credentials();if(!configured||!companionIsOn()||!storedAccount(document3)||companionAccountCleanupPending(document3))return settledState();if(requestedAt=now(),!managedCompanionTunnelAccess(document3))return retryWork();await cancelRelease();let connection=managedConnectionState?.()??{};if(["stopped","unconfigured"].includes(connection.status))await activatePersistedEndpoint();else if(CONNECTOR_FAILING_STATES.
-has(connection.status)){let repaired=await reconcileIfEndpointGone();if(repaired)return repaired}return settledState()}),watchdogTick=()=>{if(watchdogTimer=null,!disposed&&(watchdogTimer=setTimer(watchdogTick,endpointCheckIntervalMs),phase?.status!=="signed-out")){if(onDemand){serialize(()=>reviewAddress()).catch(()=>{});return}recoveryDue()&&serialize(()=>reconcileIfEndpointGone()).catch(()=>{})}},startWatchdog=()=>{!(autoRecover||onDemand)||disposed||!configured||watchdogTimer!==null||(watchdogTimer=
-setTimer(watchdogTick,firstEndpointCheckMs))};return Object.freeze({state:async()=>(await probeControlPlane(),settledState()),requestCode,verifyCode,retry,prepare,signOut:()=>serialize(async()=>{if(resetAutoRetry(),!storedAccount(credentials()))return await clearAfterCleanup(),settledState();let email3=storedAccount(credentials())?.email;phase={status:"connecting",email:email3};try{return await cleanupCurrentAccount(),healthy=!0,lastHealthCheck=now(),settledState()}catch(error62){return failAction(
-error62,{email:email3}),settledState()}}),restore:()=>serialize(async()=>{if(!configured||(startWatchdog(),!await probeControlPlane({force:!0})))return settledState();if(companionAccountCleanupPending(credentials()))return retryWork();if(await ensureClientIdentity(),onDemand){let reviewed=await reviewAddress({atLaunch:!0});return reviewed||(phase=null,settledState())}let account2=storedAccount(credentials());if(account2&&!managedCompanionTunnelAccess(credentials()))return retryWork();if(autoRecover&&
-account2&&companionIsOn()){let reconciled=await reconcileIfEndpointGone();if(reconciled)return reconciled}return phase=null,settledState()}),dispose:()=>{disposed=!0,cancelAutoRetry(),watchdogTimer!==null&&clearTimer(watchdogTimer),watchdogTimer=null}})}var SIGNIN_CODE_TTL_MS=10*6e4;init_user_errors();function parseAllowList(value){return(value??"").split(/[,\s]+/).map(entry=>entry.trim().toLowerCase()).filter(Boolean)}var NOT_WELCOME={ok:!1,status:403,...userError("serverError.email.notAllowed")};init_decision_log();init_redact2();init_usage_ledger();import{appendFile as appendFile2,mkdir as mkdir2}from"node:fs/promises";import{basename as basename2,join as join2}from"node:path";var DIR2="admin-activity";var PRUNE_EVERY_MS2=60*6e4,writeQueues2=new Map,lastPrune2=new Map;function adminActivityFileFor(dataDir,at2){return join2(dataDir,DIR2,`${monthKey(at2)}.ndjson`)}async function writeRow(dataDir,row){let at2=new Date(row.at);await mkdir2(join2(dataDir,DIR2),{recursive:!0,mode:448}),await appendFile2(adminActivityFileFor(dataDir,at2),JSON.stringify(row)+`
+email:email3,message:message5},message5},requestCode=rawEmail=>serialize(async()=>{if(!configured)throw new Error(FRIENDLY_MESSAGES.control_plane_unavailable);let email3=normalizeAccountEmail(rawEmail),requested;try{await requireHealthyControlPlane(),requested=await client.requestOTP(email3)}catch(error62){let message5=failAction(error62,{email:email3,signedOut:!0});throw new Error(message5)}return phase={status:"signed-out",email:requested.email},settledState()}),signInFlow=(rawEmail,obtain)=>serialize(
+async()=>{if(!configured)throw new Error(FRIENDLY_MESSAGES.control_plane_unavailable);requestedAt=now();let email3=normalizeAccountEmail(rawEmail);phase={status:"connecting",email:email3};let verified;try{await requireHealthyControlPlane(),verified=await obtain(email3)}catch(error62){let message5=failAction(error62,{email:email3,signedOut:!0});throw new Error(message5)}let previous2=storedAccount(credentials()),refreshingPendingCleanup=!!(previous2&&previous2.userId===verified.user.id&&companionAccountCleanupPending(
+credentials())),authenticatedPersisted=!1;try{previous2&&previous2.userId!==verified.user.id&&await cleanupCurrentAccount();let existingIdentity=ownString(credentials(),COMPANION_CLIENT_INSTANCE_FIELD),clientInstanceId=UUID.test(existingIdentity)?existingIdentity:newClientInstanceId?.();if(!UUID.test(clientInstanceId??""))throw new Error("A stable computer identity could not be created");return await updateCredentials(document3=>withAuthenticatedAccount(document3,{...verified,clientInstanceId,preserveCleanupPending:refreshingPendingCleanup})),
+authenticatedPersisted=!0,refreshingPendingCleanup?(await cleanupCurrentAccount({markPending:!1}),settledState()):await provision(verified)}catch(error62){return authenticatedPersisted||await client.signOut(verified.accountToken).catch(()=>{}),failAction(error62,{email:authenticatedPersisted?verified.user.email:previous2?.email??email3,expiredSessionIsSignedOut:authenticatedPersisted}),authenticatedPersisted&&scheduleAutoRetry(error62),settledState()}}),verifyCode=(rawEmail,rawCode)=>signInFlow(
+rawEmail,email3=>client.verifyOTP(email3,rawCode)),connectLimix=credential=>signInFlow(credential.email,async()=>({accountToken:credential.bearer,user:{id:credential.userId,email:credential.email}})),retryWork=async()=>{if(!configured)return settledState();let account2=storedAccount(credentials());if(!account2)return phase=null,settledState();if(companionAccountCleanupPending(credentials())){phase={status:"connecting",email:account2.email};try{await requireHealthyControlPlane(),await cleanupCurrentAccount(
+{markPending:!1})}catch(error62){failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0})}return settledState()}phase={status:"connecting",email:account2.email};try{return await requireHealthyControlPlane(),await provision({accountToken:account2.accountToken,user:{id:account2.userId,email:account2.email}})}catch(error62){return failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0}),scheduleAutoRetry(error62),settledState()}},retry=()=>serialize(async()=>(requestedAt=
+now(),retryWork())),reconcileIfEndpointGone=async({onGone=retryWork}={})=>{let document3=credentials(),account2=storedAccount(document3),access2=managedCompanionTunnelAccess(document3);if(!account2||!access2||!account2.installationCredential||companionAccountCleanupPending(document3)||typeof client.getEndpoint!="function")return null;lastEndpointCheck=now();let endpoint;try{endpoint=await client.getEndpoint(account2.installationCredential)}catch(error62){return error62 instanceof ControlPlaneError&&
+error62.status===401?onGone():null}return endpoint&&endpoint.url===access2.endpoint&&!ENDPOINT_NEEDS_RECONCILE.has(endpoint.status)?null:onGone()},endpointCheckDue=()=>lastEndpointCheck===null||now()-lastEndpointCheck>=endpointCheckIntervalMs/2,recoveryDue=({atLaunch=!1}={})=>{if(!autoRecover||!companionIsOn())return!1;if(atLaunch)return!0;if(autoRetryTimer!==null)return!1;let connection=managedConnectionState?.()??{};return WATCHDOG_CHECK_STATES.has(connection.status)&&endpointCheckDue()},requestedRecently=()=>requestedAt!==
+null&&now()-requestedAt<REQUEST_WINDOW_MS,savedAddress=document3=>normalizeManagedCompanionEndpoint(document3[MANAGED_COMPANION_ENDPOINT_FIELD]),phonesUnused=!1,currentNeed=async()=>{let answer=await Promise.resolve().then(()=>managedEndpointNeeded()).catch(()=>null);phonesUnused=answer===MANAGED_ENDPOINT_PHONES_UNUSED;let need=phonesUnused?!1:typeof answer=="boolean"?answer:null;return need===!1&&relay.capable()?!1:requestedRecently()?(phonesUnused=!1,!0):need},releaseScheduledAt=()=>{let at2=credentials()[MANAGED_COMPANION_RELEASE_AT_FIELD];
+return Number.isSafeInteger(at2)&&at2>0?at2:null},cancelRelease=async()=>{releaseScheduledAt()!==null&&await updateCredentials(document3=>{let next={...document3};return delete next[MANAGED_COMPANION_RELEASE_AT_FIELD],next})},releaseAddress=async()=>{let need=await currentNeed(),pause2=phonesUnused;if(need!==!1)return need&&await cancelRelease(),settledState();let document3=credentials(),account2=storedAccount(document3);if(!account2?.installationCredential||!managedCompanionTunnelAccess(document3)||
+companionAccountCleanupPending(document3))return settledState();await stopManagedEndpoint();let removalPending=!1;try{await client.deleteEndpoint(account2.installationCredential)}catch(error62){if(removalPending=error62 instanceof ControlPlaneError&&error62.code==="endpoint_cleanup_pending",!(removalPending||error62 instanceof ControlPlaneError&&error62.status===401))return writeLog(error62 instanceof ControlPlaneError?`companion account: could not give the secure address back code=${error62.code}\
+ status=${error62.status||"none"} ref=${error62.requestId||"none"}`:"companion account: could not give the secure address back (not a control-plane answer)"),await activatePersistedEndpoint(),settledState()}return await updateCredentials(current=>({...withoutManagedCompanionTunnelAccess(current),...removalPending?{[COMPANION_ENDPOINT_RELEASE_PENDING_FIELD]:!0}:{},...pause2?{[COMPANION_ENDPOINT_PAUSED_FIELD]:!0}:{}})),resetAutoRetry(),phase=null,writeLog(pause2?"companion account: gave the secure\
+ address back; no paired phone was used in 30 days":"companion account: gave the secure address back; no device needs it"),settledState()},reviewAddress=async({atLaunch=!1}={})=>{let document3=credentials();if(!storedAccount(document3)||companionAccountCleanupPending(document3))return null;if(!managedCompanionTunnelAccess(document3)){let waiting2=document3[COMPANION_TUNNEL_WAITING_FIELD]===!0;return!savedAddress(document3)&&!waiting2||autoRetryTimer!==null?null:await currentNeed()===!0?retryWork():
+null}let need=await currentNeed();if(need!==!1)return need&&await cancelRelease(),need===null&&atLaunch?null:recoveryDue({atLaunch})?reconcileIfEndpointGone():null;let releaseAt=releaseScheduledAt();if(releaseAt!==null&&now()>=releaseAt)return releaseAddress();let connection=managedConnectionState?.()??{};if(companionIsOn()&&CONNECTOR_FAILING_STATES.has(connection.status)&&(atLaunch||endpointCheckDue())){let released=await reconcileIfEndpointGone({onGone:releaseAddress});if(released)return released}
+if(releaseAt===null||releaseAt-now()>releaseGraceMs+releaseJitterMs){let delay3=releaseGraceMs+Math.round(random()*releaseJitterMs);await updateCredentials(current=>managedCompanionTunnelAccess(current)?{...current,[MANAGED_COMPANION_RELEASE_AT_FIELD]:now()+delay3}:current),writeLog(`companion account: no device needs the secure address; giving it back in ${Math.round(delay3/6e4)} min`)}return null},retryIfWanted=async()=>requestedRecently()||savedAddress(credentials())&&await currentNeed()!==!1?
+retryWork():(resetAutoRetry(),phase?.status==="error"&&(phase=null),writeLog("companion account: stopped retrying; no device needs a secure address"),settledState());retryFromTimer=()=>serialize(onDemand?retryIfWanted:retryWork);let prepare=()=>serialize(async()=>{let document3=credentials();if(!configured||!companionIsOn()||!storedAccount(document3)||companionAccountCleanupPending(document3))return settledState();if(requestedAt=now(),!managedCompanionTunnelAccess(document3))return retryWork();await cancelRelease();
+let connection=managedConnectionState?.()??{};if(["stopped","unconfigured"].includes(connection.status))await activatePersistedEndpoint();else if(CONNECTOR_FAILING_STATES.has(connection.status)){let repaired=await reconcileIfEndpointGone();if(repaired)return repaired}return settledState()}),watchdogTick=()=>{if(watchdogTimer=null,!disposed&&(watchdogTimer=setTimer(watchdogTick,endpointCheckIntervalMs),phase?.status!=="signed-out")){if(onDemand){serialize(()=>reviewAddress()).catch(()=>{});return}
+recoveryDue()&&serialize(()=>reconcileIfEndpointGone()).catch(()=>{})}},startWatchdog=()=>{!(autoRecover||onDemand)||disposed||!configured||watchdogTimer!==null||(watchdogTimer=setTimer(watchdogTick,firstEndpointCheckMs))};return Object.freeze({state:async()=>(await probeControlPlane(),settledState()),requestCode,verifyCode,connectLimix,retry,prepare,signOut:()=>serialize(async()=>{if(resetAutoRetry(),!storedAccount(credentials()))return await clearAfterCleanup(),settledState();let email3=storedAccount(
+credentials())?.email;phase={status:"connecting",email:email3};try{return await cleanupCurrentAccount(),healthy=!0,lastHealthCheck=now(),settledState()}catch(error62){return failAction(error62,{email:email3}),settledState()}}),restore:()=>serialize(async()=>{if(!configured||(startWatchdog(),!await probeControlPlane({force:!0})))return settledState();if(companionAccountCleanupPending(credentials()))return retryWork();if(await ensureClientIdentity(),onDemand){let reviewed=await reviewAddress({atLaunch:!0});
+return reviewed||(phase=null,settledState())}let account2=storedAccount(credentials());if(account2&&!managedCompanionTunnelAccess(credentials()))return retryWork();if(autoRecover&&account2&&companionIsOn()){let reconciled=await reconcileIfEndpointGone();if(reconciled)return reconciled}return phase=null,settledState()}),dispose:()=>{disposed=!0,cancelAutoRetry(),watchdogTimer!==null&&clearTimer(watchdogTimer),watchdogTimer=null}})}var SIGNIN_CODE_TTL_MS=10*6e4;init_user_errors();function parseAllowList(value){return(value??"").split(/[,\s]+/).map(entry=>entry.trim().toLowerCase()).filter(Boolean)}var NOT_WELCOME={ok:!1,status:403,...userError("serverError.email.notAllowed")};init_decision_log();init_redact2();init_usage_ledger();import{appendFile as appendFile2,mkdir as mkdir2}from"node:fs/promises";import{basename as basename2,join as join2}from"node:path";var DIR2="admin-activity";var PRUNE_EVERY_MS2=60*6e4,writeQueues2=new Map,lastPrune2=new Map;function adminActivityFileFor(dataDir,at2){return join2(dataDir,DIR2,`${monthKey(at2)}.ndjson`)}async function writeRow(dataDir,row){let at2=new Date(row.at);await mkdir2(join2(dataDir,DIR2),{recursive:!0,mode:448}),await appendFile2(adminActivityFileFor(dataDir,at2),JSON.stringify(row)+`
 `,{mode:384}),at2.getTime()-(lastPrune2.get(dataDir)??0)>=PRUNE_EVERY_MS2&&(lastPrune2.set(dataDir,at2.getTime()),await pruneMonthFiles(join2(dataDir,DIR2),boundRetentionDays(),at2))}function appendAdminAction(dataDir,row){let record12={...row,at:row.at??new Date().toISOString(),...row.before?{before:auditValues(row.before)}:{},...row.after?{after:auditValues(row.after)}:{}},queued=(writeQueues2.get(dataDir)??Promise.resolve()).then(()=>writeRow(dataDir,record12)).catch(()=>{});writeQueues2.set(
 dataDir,queued),queued.finally(()=>{writeQueues2.get(dataDir)===queued&&writeQueues2.delete(dataDir)})}async function flushAdminActivity(dataDir){await writeQueues2.get(dataDir)}var SECRET_PARTS=["token","secret","password","passwd","passphrase","credential","authorization","cookie","bearer","apikey","api_key"],OPAQUE_MAP=/^(?:headers|env|environment)$/i,MAX_VALUE_CHARS=2e3,HIDDEN="[hidden]";function isSecretName2(name){let lower=name.toLowerCase();return lower.endsWith("tokens")?!1:SECRET_PARTS.some(part=>lower.includes(part))?!0:/(?:^|[_.-])keys?$/.test(lower)||/[a-z]Keys?$/.test(name)}function isSecretParameter(name){
 if(name==="-k"||name==="-K")return!0;let bare=name.replace(/^-+/,"");return isSecretName2(bare)||/^(?:auth|sig|signature|pass|pwd|code)$/i.test(bare)}function keyLikeSegment(segment){return(segment.match(/[A-Za-z0-9]{16,}/g)??[]).some(run6=>/\d/.test(run6)&&/[A-Za-z]/.test(run6))}function maskUrlSecrets(text13){return text13.replace(/\b([a-z][\w+.-]*:\/\/)([^\s/?#]*)([^\s?#]*)([^\s]*)/gi,(_all,scheme,authority2,path3,rest)=>{let at2=authority2.lastIndexOf("@"),host2=at2>=0?`${HIDDEN}@${authority2.

package/dist-server/server/index.js

@@ -11933,7 +11933,7 @@ function configStatus() {
         decider: describeDecider(cfg), helpers: describeHelpers(cfg),
         imageGen: avatarImageStatus(cfg), savedKeys: nestedKeyStatus(cfg),
         live: liveSettingsFor(cfg),
-        profile: CLOUD_TEAM ? NOBODY_PROFILE : { name: cfg.profile?.name ?? "", email: cfg.profile?.email ?? "", aboutMe: cfg.profile?.aboutMe ?? "", ...(cfg.profile?.avatarUrl ? { avatarUrl: cfg.profile.avatarUrl } : {}) },
+        profile: CLOUD_TEAM ? NOBODY_PROFILE : { name: cfg.profile?.name || process.env.LIMIX_ACCOUNT_NAME || "", email: cfg.profile?.email || process.env.LIMIX_ACCOUNT_EMAIL || "", aboutMe: cfg.profile?.aboutMe ?? "", ...(cfg.profile?.avatarUrl ? { avatarUrl: cfg.profile.avatarUrl } : {}) },
         managedPolicy: managedPolicy.summary(),
         ...(CLOUD_HOME ? { cloudHome: true } : {}), ...(CLOUD_TEAM ? { team: { id: CLOUD_TEAM.id, name: CLOUD_TEAM.name, ...(CLOUD_HOME ? { cloudPage: `${CLOUD_HOME.adminOrigin}/cloud` } : {}) } } : {}),
         language: appLanguage() ?? "", computerName: cfg.computerName ?? "", everyBotRules: cfg.everyBotRules ?? "",

package/dist-server/server/limix-skill-folder.js

@@ -0,0 +1,72 @@
+// Limix Bot: skills kept in a folder on this computer (no internet needed). The folder is either one skill (it has a
+// SKILL.md) or a folder of skills (each direct subfolder with a SKILL.md). Same limits and checks as a GitHub import:
+// the files go through installSkill(), which scans them and leaves the skill switched off until the owner reads it.
+import { lstatSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { basename, isAbsolute, join } from "node:path";
+import { planSkillFolder } from "./skill-folder.js";
+const MAX_ENTRIES = 400;
+const MAX_DEPTH = 8;
+function listEntries(root) {
+    const out = [];
+    const walk = (dir, prefix, depth) => {
+        if (depth > MAX_DEPTH || out.length > MAX_ENTRIES)
+            return;
+        for (const name of readdirSync(dir)) {
+            if (out.length > MAX_ENTRIES)
+                return;
+            const absolute = join(dir, name);
+            const path = prefix ? `${prefix}/${name}` : name;
+            const info = lstatSync(absolute);
+            if (info.isSymbolicLink())
+                out.push({ path, kind: "link", size: 0, absolute });
+            else if (info.isDirectory()) {
+                out.push({ path, kind: "folder", size: 0, absolute });
+                walk(absolute, path, depth + 1);
+            }
+            else if (info.isFile()) {
+                out.push({ path, kind: "file", size: info.size, executable: process.platform !== "win32" && (info.mode & 0o111) !== 0, absolute });
+            }
+        }
+    };
+    walk(root, "", 1);
+    return out;
+}
+function readOne(dir) {
+    const { take, skipped } = planSkillFolder(listEntries(dir));
+    if (take[0]?.path !== "SKILL.md")
+        throw new Error(`no SKILL.md in ${basename(dir)}`);
+    const files = take
+        .filter((entry) => entry.kind === "file")
+        .map((entry) => ({ path: entry.path, content: readFileSync(entry.absolute), executable: entry.executable === true }));
+    return { source: `local:${basename(dir)}`, files, skipped };
+}
+export function readLocalSkills(folder) {
+    try {
+        if (!isAbsolute(folder) || !statSync(folder).isDirectory())
+            return { error: "Choose a folder on this computer." };
+        const dirs = [];
+        const has = (dir) => { try {
+            return statSync(join(dir, "SKILL.md")).isFile();
+        }
+        catch {
+            return false;
+        } };
+        if (has(folder))
+            dirs.push(folder);
+        else
+            for (const name of readdirSync(folder)) {
+                const sub = join(folder, name);
+                try {
+                    if (statSync(sub).isDirectory() && has(sub))
+                        dirs.push(sub);
+                }
+                catch { /* skip unreadable */ }
+            }
+        if (!dirs.length)
+            return { error: "No SKILL.md found in that folder or in its subfolders." };
+        return { skills: dirs.slice(0, 50).map(readOne) };
+    }
+    catch (error) {
+        return { error: error instanceof Error ? error.message : "Could not read that folder." };
+    }
+}

package/dist-server/server/routes/bot-skills.js

@@ -3,6 +3,7 @@ import { setImportedSkillEnabled } from "../imported-skills.js";
 import { setNativeSkillEnabled } from "../native-skill-choices.js";
 import { botSkillTemplateSchema } from "../new-bot-defaults.js";
 import { fetchSkillFromSource } from "../skill-fetch.js";
+import { readLocalSkills } from "../limix-skill-folder.js";
 import { skillImportSummary } from "../skill-folder.js";
 import { installLibrarySkill, librarySkillOptOuts, listLibrarySkills, readLibrarySkillFile, readSkillLibraryIndex, setLibrarySkillEveryBot, setLibrarySkillOptOut, setLibrarySkillReviewState, skillsLibraryEnabled, unassignLibrarySkill } from "../skill-library.js";
 import { installSkill, listBotSkillsWithOrigin, listStagedSkillWrites, parseSkillMd, removeSkill, scanSkillText, setSkillEnabled, } from "../skills.js";
@@ -62,7 +63,7 @@ export function createBotSkillsRoutes(deps) {
             const parsed = z.object({ source: z.string().min(1).max(2000) }).safeParse(await readBody(req));
             if (!parsed.success)
                 return json(res, 400, { error: "source must be a GitHub or skills.sh URL, or owner/repo" });
-            const fetched = await fetchSkillFromSource(parsed.data.source);
+            const fetched = parsed.data.source.startsWith("local-folder:") ? readLocalSkills(parsed.data.source.slice("local-folder:".length)) : await fetchSkillFromSource(parsed.data.source);
             if ("error" in fetched)
                 return json(res, 422, { error: fetched.error });
             const results = fetched.skills.map((skill) => ({ skill, result: installSkill(m[1], skill.source, skill.files, skill.github) }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "limixbot",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Run the Limix Bot server anywhere and pair your devices to it (Leox ৹ Limix AI)",
   "license": "Apache-2.0",
   "type": "module",