limixbot 0.3.12 → 0.3.15

package/dist-server/openmausbot.js

@@ -8655,22 +8655,23 @@ email:email3,message:message5},message5},requestCode=rawEmail=>serialize(async()
 async()=>{if(!configured)throw new Error(FRIENDLY_MESSAGES.control_plane_unavailable);requestedAt=now();let email3=normalizeAccountEmail(rawEmail);phase={status:"connecting",email:email3};let verified;try{await requireHealthyControlPlane(),verified=await obtain(email3)}catch(error62){let message5=failAction(error62,{email:email3,signedOut:!0});throw new Error(message5)}let previous2=storedAccount(credentials()),refreshingPendingCleanup=!!(previous2&&previous2.userId===verified.user.id&&companionAccountCleanupPending(
 credentials())),authenticatedPersisted=!1;try{previous2&&previous2.userId!==verified.user.id&&await cleanupCurrentAccount();let existingIdentity=ownString(credentials(),COMPANION_CLIENT_INSTANCE_FIELD),clientInstanceId=UUID.test(existingIdentity)?existingIdentity:newClientInstanceId?.();if(!UUID.test(clientInstanceId??""))throw new Error("A stable computer identity could not be created");return await updateCredentials(document3=>withAuthenticatedAccount(document3,{...verified,clientInstanceId,preserveCleanupPending:refreshingPendingCleanup})),
 authenticatedPersisted=!0,refreshingPendingCleanup?(await cleanupCurrentAccount({markPending:!1}),settledState()):await provision(verified)}catch(error62){return authenticatedPersisted||await client.signOut(verified.accountToken).catch(()=>{}),failAction(error62,{email:authenticatedPersisted?verified.user.email:previous2?.email??email3,expiredSessionIsSignedOut:authenticatedPersisted}),authenticatedPersisted&&scheduleAutoRetry(error62),settledState()}}),verifyCode=(rawEmail,rawCode)=>signInFlow(
-rawEmail,email3=>client.verifyOTP(email3,rawCode)),connectLimix=credential=>signInFlow(credential.email,async()=>({accountToken:credential.bearer,user:{id:credential.userId,email:credential.email}})),retryWork=async()=>{if(!configured)return settledState();let account2=storedAccount(credentials());if(!account2)return phase=null,settledState();if(companionAccountCleanupPending(credentials())){phase={status:"connecting",email:account2.email};try{await requireHealthyControlPlane(),await cleanupCurrentAccount(
-{markPending:!1})}catch(error62){failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0})}return settledState()}phase={status:"connecting",email:account2.email};try{return await requireHealthyControlPlane(),await provision({accountToken:account2.accountToken,user:{id:account2.userId,email:account2.email}})}catch(error62){return failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0}),scheduleAutoRetry(error62),settledState()}},retry=()=>serialize(async()=>(requestedAt=
-now(),retryWork())),reconcileIfEndpointGone=async({onGone=retryWork}={})=>{let document3=credentials(),account2=storedAccount(document3),access2=managedCompanionTunnelAccess(document3);if(!account2||!access2||!account2.installationCredential||companionAccountCleanupPending(document3)||typeof client.getEndpoint!="function")return null;lastEndpointCheck=now();let endpoint;try{endpoint=await client.getEndpoint(account2.installationCredential)}catch(error62){return error62 instanceof ControlPlaneError&&
-error62.status===401?onGone():null}return endpoint&&endpoint.url===access2.endpoint&&!ENDPOINT_NEEDS_RECONCILE.has(endpoint.status)?null:onGone()},endpointCheckDue=()=>lastEndpointCheck===null||now()-lastEndpointCheck>=endpointCheckIntervalMs/2,recoveryDue=({atLaunch=!1}={})=>{if(!autoRecover||!companionIsOn())return!1;if(atLaunch)return!0;if(autoRetryTimer!==null)return!1;let connection=managedConnectionState?.()??{};return WATCHDOG_CHECK_STATES.has(connection.status)&&endpointCheckDue()},requestedRecently=()=>requestedAt!==
-null&&now()-requestedAt<REQUEST_WINDOW_MS,savedAddress=document3=>normalizeManagedCompanionEndpoint(document3[MANAGED_COMPANION_ENDPOINT_FIELD]),phonesUnused=!1,currentNeed=async()=>{let answer=await Promise.resolve().then(()=>managedEndpointNeeded()).catch(()=>null);phonesUnused=answer===MANAGED_ENDPOINT_PHONES_UNUSED;let need=phonesUnused?!1:typeof answer=="boolean"?answer:null;return need===!1&&relay.capable()?!1:requestedRecently()?(phonesUnused=!1,!0):need},releaseScheduledAt=()=>{let at2=credentials()[MANAGED_COMPANION_RELEASE_AT_FIELD];
-return Number.isSafeInteger(at2)&&at2>0?at2:null},cancelRelease=async()=>{releaseScheduledAt()!==null&&await updateCredentials(document3=>{let next={...document3};return delete next[MANAGED_COMPANION_RELEASE_AT_FIELD],next})},releaseAddress=async()=>{let need=await currentNeed(),pause2=phonesUnused;if(need!==!1)return need&&await cancelRelease(),settledState();let document3=credentials(),account2=storedAccount(document3);if(!account2?.installationCredential||!managedCompanionTunnelAccess(document3)||
-companionAccountCleanupPending(document3))return settledState();await stopManagedEndpoint();let removalPending=!1;try{await client.deleteEndpoint(account2.installationCredential)}catch(error62){if(removalPending=error62 instanceof ControlPlaneError&&error62.code==="endpoint_cleanup_pending",!(removalPending||error62 instanceof ControlPlaneError&&error62.status===401))return writeLog(error62 instanceof ControlPlaneError?`companion account: could not give the secure address back code=${error62.code}\
- status=${error62.status||"none"} ref=${error62.requestId||"none"}`:"companion account: could not give the secure address back (not a control-plane answer)"),await activatePersistedEndpoint(),settledState()}return await updateCredentials(current=>({...withoutManagedCompanionTunnelAccess(current),...removalPending?{[COMPANION_ENDPOINT_RELEASE_PENDING_FIELD]:!0}:{},...pause2?{[COMPANION_ENDPOINT_PAUSED_FIELD]:!0}:{}})),resetAutoRetry(),phase=null,writeLog(pause2?"companion account: gave the secure\
- address back; no paired phone was used in 30 days":"companion account: gave the secure address back; no device needs it"),settledState()},reviewAddress=async({atLaunch=!1}={})=>{let document3=credentials();if(!storedAccount(document3)||companionAccountCleanupPending(document3))return null;if(!managedCompanionTunnelAccess(document3)){let waiting2=document3[COMPANION_TUNNEL_WAITING_FIELD]===!0;return!savedAddress(document3)&&!waiting2||autoRetryTimer!==null?null:await currentNeed()===!0?retryWork():
-null}let need=await currentNeed();if(need!==!1)return need&&await cancelRelease(),need===null&&atLaunch?null:recoveryDue({atLaunch})?reconcileIfEndpointGone():null;let releaseAt=releaseScheduledAt();if(releaseAt!==null&&now()>=releaseAt)return releaseAddress();let connection=managedConnectionState?.()??{};if(companionIsOn()&&CONNECTOR_FAILING_STATES.has(connection.status)&&(atLaunch||endpointCheckDue())){let released=await reconcileIfEndpointGone({onGone:releaseAddress});if(released)return released}
-if(releaseAt===null||releaseAt-now()>releaseGraceMs+releaseJitterMs){let delay3=releaseGraceMs+Math.round(random()*releaseJitterMs);await updateCredentials(current=>managedCompanionTunnelAccess(current)?{...current,[MANAGED_COMPANION_RELEASE_AT_FIELD]:now()+delay3}:current),writeLog(`companion account: no device needs the secure address; giving it back in ${Math.round(delay3/6e4)} min`)}return null},retryIfWanted=async()=>requestedRecently()||savedAddress(credentials())&&await currentNeed()!==!1?
-retryWork():(resetAutoRetry(),phase?.status==="error"&&(phase=null),writeLog("companion account: stopped retrying; no device needs a secure address"),settledState());retryFromTimer=()=>serialize(onDemand?retryIfWanted:retryWork);let prepare=()=>serialize(async()=>{let document3=credentials();if(!configured||!companionIsOn()||!storedAccount(document3)||companionAccountCleanupPending(document3))return settledState();if(requestedAt=now(),!managedCompanionTunnelAccess(document3))return retryWork();await cancelRelease();
-let connection=managedConnectionState?.()??{};if(["stopped","unconfigured"].includes(connection.status))await activatePersistedEndpoint();else if(CONNECTOR_FAILING_STATES.has(connection.status)){let repaired=await reconcileIfEndpointGone();if(repaired)return repaired}return settledState()}),watchdogTick=()=>{if(watchdogTimer=null,!disposed&&(watchdogTimer=setTimer(watchdogTick,endpointCheckIntervalMs),phase?.status!=="signed-out")){if(onDemand){serialize(()=>reviewAddress()).catch(()=>{});return}
-recoveryDue()&&serialize(()=>reconcileIfEndpointGone()).catch(()=>{})}},startWatchdog=()=>{!(autoRecover||onDemand)||disposed||!configured||watchdogTimer!==null||(watchdogTimer=setTimer(watchdogTick,firstEndpointCheckMs))};return Object.freeze({state:async()=>(await probeControlPlane(),settledState()),requestCode,verifyCode,connectLimix,retry,prepare,signOut:()=>serialize(async()=>{if(resetAutoRetry(),!storedAccount(credentials()))return await clearAfterCleanup(),settledState();let email3=storedAccount(
-credentials())?.email;phase={status:"connecting",email:email3};try{return await cleanupCurrentAccount(),healthy=!0,lastHealthCheck=now(),settledState()}catch(error62){return failAction(error62,{email:email3}),settledState()}}),restore:()=>serialize(async()=>{if(!configured||(startWatchdog(),!await probeControlPlane({force:!0})))return settledState();if(companionAccountCleanupPending(credentials()))return retryWork();if(await ensureClientIdentity(),onDemand){let reviewed=await reviewAddress({atLaunch:!0});
-return reviewed||(phase=null,settledState())}let account2=storedAccount(credentials());if(account2&&!managedCompanionTunnelAccess(credentials()))return retryWork();if(autoRecover&&account2&&companionIsOn()){let reconciled=await reconcileIfEndpointGone();if(reconciled)return reconciled}return phase=null,settledState()}),dispose:()=>{disposed=!0,cancelAutoRetry(),watchdogTimer!==null&&clearTimer(watchdogTimer),watchdogTimer=null}})}var SIGNIN_CODE_TTL_MS=10*6e4;init_user_errors();function parseAllowList(value){return(value??"").split(/[,\s]+/).map(entry=>entry.trim().toLowerCase()).filter(Boolean)}var NOT_WELCOME={ok:!1,status:403,...userError("serverError.email.notAllowed")};init_decision_log();init_redact2();init_usage_ledger();import{appendFile as appendFile2,mkdir as mkdir2}from"node:fs/promises";import{basename as basename2,join as join2}from"node:path";var DIR2="admin-activity";var PRUNE_EVERY_MS2=60*6e4,writeQueues2=new Map,lastPrune2=new Map;function adminActivityFileFor(dataDir,at2){return join2(dataDir,DIR2,`${monthKey(at2)}.ndjson`)}async function writeRow(dataDir,row){let at2=new Date(row.at);await mkdir2(join2(dataDir,DIR2),{recursive:!0,mode:448}),await appendFile2(adminActivityFileFor(dataDir,at2),JSON.stringify(row)+`
+rawEmail,email3=>client.verifyOTP(email3,rawCode)),connectLimix=credential=>signInFlow(credential.email,async()=>({accountToken:credential.bearer,user:{id:credential.userId,email:credential.email}})),forgetForeign=()=>serialize(async()=>{let document3=credentials(),account2=storedAccount(document3);if(!account2)return!1;let access2=managedCompanionTunnelAccess(document3),host2="";try{host2=access2?.endpoint?new URL(access2.endpoint).hostname:""}catch{host2=""}return account2.userId.startsWith("l\
+imix:")&&(!host2||host2.endsWith(".limixmedia.com"))?!1:(await clearAfterCleanup(),!0)}),retryWork=async()=>{if(!configured)return settledState();let account2=storedAccount(credentials());if(!account2)return phase=null,settledState();if(companionAccountCleanupPending(credentials())){phase={status:"connecting",email:account2.email};try{await requireHealthyControlPlane(),await cleanupCurrentAccount({markPending:!1})}catch(error62){failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0})}
+return settledState()}phase={status:"connecting",email:account2.email};try{return await requireHealthyControlPlane(),await provision({accountToken:account2.accountToken,user:{id:account2.userId,email:account2.email}})}catch(error62){return failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0}),scheduleAutoRetry(error62),settledState()}},retry=()=>serialize(async()=>(requestedAt=now(),retryWork())),reconcileIfEndpointGone=async({onGone=retryWork}={})=>{let document3=credentials(),
+account2=storedAccount(document3),access2=managedCompanionTunnelAccess(document3);if(!account2||!access2||!account2.installationCredential||companionAccountCleanupPending(document3)||typeof client.getEndpoint!="function")return null;lastEndpointCheck=now();let endpoint;try{endpoint=await client.getEndpoint(account2.installationCredential)}catch(error62){return error62 instanceof ControlPlaneError&&error62.status===401?onGone():null}return endpoint&&endpoint.url===access2.endpoint&&!ENDPOINT_NEEDS_RECONCILE.
+has(endpoint.status)?null:onGone()},endpointCheckDue=()=>lastEndpointCheck===null||now()-lastEndpointCheck>=endpointCheckIntervalMs/2,recoveryDue=({atLaunch=!1}={})=>{if(!autoRecover||!companionIsOn())return!1;if(atLaunch)return!0;if(autoRetryTimer!==null)return!1;let connection=managedConnectionState?.()??{};return WATCHDOG_CHECK_STATES.has(connection.status)&&endpointCheckDue()},requestedRecently=()=>requestedAt!==null&&now()-requestedAt<REQUEST_WINDOW_MS,savedAddress=document3=>normalizeManagedCompanionEndpoint(
+document3[MANAGED_COMPANION_ENDPOINT_FIELD]),phonesUnused=!1,currentNeed=async()=>{let answer=await Promise.resolve().then(()=>managedEndpointNeeded()).catch(()=>null);phonesUnused=answer===MANAGED_ENDPOINT_PHONES_UNUSED;let need=phonesUnused?!1:typeof answer=="boolean"?answer:null;return need===!1&&relay.capable()?!1:requestedRecently()?(phonesUnused=!1,!0):need},releaseScheduledAt=()=>{let at2=credentials()[MANAGED_COMPANION_RELEASE_AT_FIELD];return Number.isSafeInteger(at2)&&at2>0?at2:null},cancelRelease=async()=>{
+releaseScheduledAt()!==null&&await updateCredentials(document3=>{let next={...document3};return delete next[MANAGED_COMPANION_RELEASE_AT_FIELD],next})},releaseAddress=async()=>{let need=await currentNeed(),pause2=phonesUnused;if(need!==!1)return need&&await cancelRelease(),settledState();let document3=credentials(),account2=storedAccount(document3);if(!account2?.installationCredential||!managedCompanionTunnelAccess(document3)||companionAccountCleanupPending(document3))return settledState();await stopManagedEndpoint();
+let removalPending=!1;try{await client.deleteEndpoint(account2.installationCredential)}catch(error62){if(removalPending=error62 instanceof ControlPlaneError&&error62.code==="endpoint_cleanup_pending",!(removalPending||error62 instanceof ControlPlaneError&&error62.status===401))return writeLog(error62 instanceof ControlPlaneError?`companion account: could not give the secure address back code=${error62.code} status=${error62.status||"none"} ref=${error62.requestId||"none"}`:"companion account: co\
+uld not give the secure address back (not a control-plane answer)"),await activatePersistedEndpoint(),settledState()}return await updateCredentials(current=>({...withoutManagedCompanionTunnelAccess(current),...removalPending?{[COMPANION_ENDPOINT_RELEASE_PENDING_FIELD]:!0}:{},...pause2?{[COMPANION_ENDPOINT_PAUSED_FIELD]:!0}:{}})),resetAutoRetry(),phase=null,writeLog(pause2?"companion account: gave the secure address back; no paired phone was used in 30 days":"companion account: gave the secure ad\
+dress back; no device needs it"),settledState()},reviewAddress=async({atLaunch=!1}={})=>{let document3=credentials();if(!storedAccount(document3)||companionAccountCleanupPending(document3))return null;if(!managedCompanionTunnelAccess(document3)){let waiting2=document3[COMPANION_TUNNEL_WAITING_FIELD]===!0;return!savedAddress(document3)&&!waiting2||autoRetryTimer!==null?null:await currentNeed()===!0?retryWork():null}let need=await currentNeed();if(need!==!1)return need&&await cancelRelease(),need===
+null&&atLaunch?null:recoveryDue({atLaunch})?reconcileIfEndpointGone():null;let releaseAt=releaseScheduledAt();if(releaseAt!==null&&now()>=releaseAt)return releaseAddress();let connection=managedConnectionState?.()??{};if(companionIsOn()&&CONNECTOR_FAILING_STATES.has(connection.status)&&(atLaunch||endpointCheckDue())){let released=await reconcileIfEndpointGone({onGone:releaseAddress});if(released)return released}if(releaseAt===null||releaseAt-now()>releaseGraceMs+releaseJitterMs){let delay3=releaseGraceMs+
+Math.round(random()*releaseJitterMs);await updateCredentials(current=>managedCompanionTunnelAccess(current)?{...current,[MANAGED_COMPANION_RELEASE_AT_FIELD]:now()+delay3}:current),writeLog(`companion account: no device needs the secure address; giving it back in ${Math.round(delay3/6e4)} min`)}return null},retryIfWanted=async()=>requestedRecently()||savedAddress(credentials())&&await currentNeed()!==!1?retryWork():(resetAutoRetry(),phase?.status==="error"&&(phase=null),writeLog("companion accoun\
+t: stopped retrying; no device needs a secure address"),settledState());retryFromTimer=()=>serialize(onDemand?retryIfWanted:retryWork);let prepare=()=>serialize(async()=>{let document3=credentials();if(!configured||!companionIsOn()||!storedAccount(document3)||companionAccountCleanupPending(document3))return settledState();if(requestedAt=now(),!managedCompanionTunnelAccess(document3))return retryWork();await cancelRelease();let connection=managedConnectionState?.()??{};if(["stopped","unconfigured"].
+includes(connection.status))await activatePersistedEndpoint();else if(CONNECTOR_FAILING_STATES.has(connection.status)){let repaired=await reconcileIfEndpointGone();if(repaired)return repaired}return settledState()}),watchdogTick=()=>{if(watchdogTimer=null,!disposed&&(watchdogTimer=setTimer(watchdogTick,endpointCheckIntervalMs),phase?.status!=="signed-out")){if(onDemand){serialize(()=>reviewAddress()).catch(()=>{});return}recoveryDue()&&serialize(()=>reconcileIfEndpointGone()).catch(()=>{})}},startWatchdog=()=>{
+!(autoRecover||onDemand)||disposed||!configured||watchdogTimer!==null||(watchdogTimer=setTimer(watchdogTick,firstEndpointCheckMs))};return Object.freeze({state:async()=>(await probeControlPlane(),settledState()),requestCode,verifyCode,connectLimix,forgetForeign,retry,prepare,signOut:()=>serialize(async()=>{if(resetAutoRetry(),!storedAccount(credentials()))return await clearAfterCleanup(),settledState();let email3=storedAccount(credentials())?.email;phase={status:"connecting",email:email3};try{return await cleanupCurrentAccount(),
+healthy=!0,lastHealthCheck=now(),settledState()}catch(error62){return failAction(error62,{email:email3}),settledState()}}),restore:()=>serialize(async()=>{if(!configured||(startWatchdog(),!await probeControlPlane({force:!0})))return settledState();if(companionAccountCleanupPending(credentials()))return retryWork();if(await ensureClientIdentity(),onDemand){let reviewed=await reviewAddress({atLaunch:!0});return reviewed||(phase=null,settledState())}let account2=storedAccount(credentials());if(account2&&
+!managedCompanionTunnelAccess(credentials()))return retryWork();if(autoRecover&&account2&&companionIsOn()){let reconciled=await reconcileIfEndpointGone();if(reconciled)return reconciled}return phase=null,settledState()}),dispose:()=>{disposed=!0,cancelAutoRetry(),watchdogTimer!==null&&clearTimer(watchdogTimer),watchdogTimer=null}})}var SIGNIN_CODE_TTL_MS=10*6e4;init_user_errors();function parseAllowList(value){return(value??"").split(/[,\s]+/).map(entry=>entry.trim().toLowerCase()).filter(Boolean)}var NOT_WELCOME={ok:!1,status:403,...userError("serverError.email.notAllowed")};init_decision_log();init_redact2();init_usage_ledger();import{appendFile as appendFile2,mkdir as mkdir2}from"node:fs/promises";import{basename as basename2,join as join2}from"node:path";var DIR2="admin-activity";var PRUNE_EVERY_MS2=60*6e4,writeQueues2=new Map,lastPrune2=new Map;function adminActivityFileFor(dataDir,at2){return join2(dataDir,DIR2,`${monthKey(at2)}.ndjson`)}async function writeRow(dataDir,row){let at2=new Date(row.at);await mkdir2(join2(dataDir,DIR2),{recursive:!0,mode:448}),await appendFile2(adminActivityFileFor(dataDir,at2),JSON.stringify(row)+`
 `,{mode:384}),at2.getTime()-(lastPrune2.get(dataDir)??0)>=PRUNE_EVERY_MS2&&(lastPrune2.set(dataDir,at2.getTime()),await pruneMonthFiles(join2(dataDir,DIR2),boundRetentionDays(),at2))}function appendAdminAction(dataDir,row){let record12={...row,at:row.at??new Date().toISOString(),...row.before?{before:auditValues(row.before)}:{},...row.after?{after:auditValues(row.after)}:{}},queued=(writeQueues2.get(dataDir)??Promise.resolve()).then(()=>writeRow(dataDir,record12)).catch(()=>{});writeQueues2.set(
 dataDir,queued),queued.finally(()=>{writeQueues2.get(dataDir)===queued&&writeQueues2.delete(dataDir)})}async function flushAdminActivity(dataDir){await writeQueues2.get(dataDir)}var SECRET_PARTS=["token","secret","password","passwd","passphrase","credential","authorization","cookie","bearer","apikey","api_key"],OPAQUE_MAP=/^(?:headers|env|environment)$/i,MAX_VALUE_CHARS=2e3,HIDDEN="[hidden]";function isSecretName2(name){let lower=name.toLowerCase();return lower.endsWith("tokens")?!1:SECRET_PARTS.some(part=>lower.includes(part))?!0:/(?:^|[_.-])keys?$/.test(lower)||/[a-z]Keys?$/.test(name)}function isSecretParameter(name){
 if(name==="-k"||name==="-K")return!0;let bare=name.replace(/^-+/,"");return isSecretName2(bare)||/^(?:auth|sig|signature|pass|pwd|code)$/i.test(bare)}function keyLikeSegment(segment){return(segment.match(/[A-Za-z0-9]{16,}/g)??[]).some(run6=>/\d/.test(run6)&&/[A-Za-z]/.test(run6))}function maskUrlSecrets(text13){return text13.replace(/\b([a-z][\w+.-]*:\/\/)([^\s/?#]*)([^\s?#]*)([^\s]*)/gi,(_all,scheme,authority2,path3,rest)=>{let at2=authority2.lastIndexOf("@"),host2=at2>=0?`${HIDDEN}@${authority2.

package/dist-server/package.json

@@ -1 +1 @@
-{"type":"module","version":"0.3.12"}
+{"type":"module","version":"0.3.15"}

package/dist-server/pair-cli.js

@@ -8654,22 +8654,23 @@ email:email3,message:message5},message5},requestCode=rawEmail=>serialize(async()
 async()=>{if(!configured)throw new Error(FRIENDLY_MESSAGES.control_plane_unavailable);requestedAt=now();let email3=normalizeAccountEmail(rawEmail);phase={status:"connecting",email:email3};let verified;try{await requireHealthyControlPlane(),verified=await obtain(email3)}catch(error62){let message5=failAction(error62,{email:email3,signedOut:!0});throw new Error(message5)}let previous2=storedAccount(credentials()),refreshingPendingCleanup=!!(previous2&&previous2.userId===verified.user.id&&companionAccountCleanupPending(
 credentials())),authenticatedPersisted=!1;try{previous2&&previous2.userId!==verified.user.id&&await cleanupCurrentAccount();let existingIdentity=ownString(credentials(),COMPANION_CLIENT_INSTANCE_FIELD),clientInstanceId=UUID.test(existingIdentity)?existingIdentity:newClientInstanceId?.();if(!UUID.test(clientInstanceId??""))throw new Error("A stable computer identity could not be created");return await updateCredentials(document3=>withAuthenticatedAccount(document3,{...verified,clientInstanceId,preserveCleanupPending:refreshingPendingCleanup})),
 authenticatedPersisted=!0,refreshingPendingCleanup?(await cleanupCurrentAccount({markPending:!1}),settledState()):await provision(verified)}catch(error62){return authenticatedPersisted||await client.signOut(verified.accountToken).catch(()=>{}),failAction(error62,{email:authenticatedPersisted?verified.user.email:previous2?.email??email3,expiredSessionIsSignedOut:authenticatedPersisted}),authenticatedPersisted&&scheduleAutoRetry(error62),settledState()}}),verifyCode=(rawEmail,rawCode)=>signInFlow(
-rawEmail,email3=>client.verifyOTP(email3,rawCode)),connectLimix=credential=>signInFlow(credential.email,async()=>({accountToken:credential.bearer,user:{id:credential.userId,email:credential.email}})),retryWork=async()=>{if(!configured)return settledState();let account2=storedAccount(credentials());if(!account2)return phase=null,settledState();if(companionAccountCleanupPending(credentials())){phase={status:"connecting",email:account2.email};try{await requireHealthyControlPlane(),await cleanupCurrentAccount(
-{markPending:!1})}catch(error62){failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0})}return settledState()}phase={status:"connecting",email:account2.email};try{return await requireHealthyControlPlane(),await provision({accountToken:account2.accountToken,user:{id:account2.userId,email:account2.email}})}catch(error62){return failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0}),scheduleAutoRetry(error62),settledState()}},retry=()=>serialize(async()=>(requestedAt=
-now(),retryWork())),reconcileIfEndpointGone=async({onGone=retryWork}={})=>{let document3=credentials(),account2=storedAccount(document3),access2=managedCompanionTunnelAccess(document3);if(!account2||!access2||!account2.installationCredential||companionAccountCleanupPending(document3)||typeof client.getEndpoint!="function")return null;lastEndpointCheck=now();let endpoint;try{endpoint=await client.getEndpoint(account2.installationCredential)}catch(error62){return error62 instanceof ControlPlaneError&&
-error62.status===401?onGone():null}return endpoint&&endpoint.url===access2.endpoint&&!ENDPOINT_NEEDS_RECONCILE.has(endpoint.status)?null:onGone()},endpointCheckDue=()=>lastEndpointCheck===null||now()-lastEndpointCheck>=endpointCheckIntervalMs/2,recoveryDue=({atLaunch=!1}={})=>{if(!autoRecover||!companionIsOn())return!1;if(atLaunch)return!0;if(autoRetryTimer!==null)return!1;let connection=managedConnectionState?.()??{};return WATCHDOG_CHECK_STATES.has(connection.status)&&endpointCheckDue()},requestedRecently=()=>requestedAt!==
-null&&now()-requestedAt<REQUEST_WINDOW_MS,savedAddress=document3=>normalizeManagedCompanionEndpoint(document3[MANAGED_COMPANION_ENDPOINT_FIELD]),phonesUnused=!1,currentNeed=async()=>{let answer=await Promise.resolve().then(()=>managedEndpointNeeded()).catch(()=>null);phonesUnused=answer===MANAGED_ENDPOINT_PHONES_UNUSED;let need=phonesUnused?!1:typeof answer=="boolean"?answer:null;return need===!1&&relay.capable()?!1:requestedRecently()?(phonesUnused=!1,!0):need},releaseScheduledAt=()=>{let at2=credentials()[MANAGED_COMPANION_RELEASE_AT_FIELD];
-return Number.isSafeInteger(at2)&&at2>0?at2:null},cancelRelease=async()=>{releaseScheduledAt()!==null&&await updateCredentials(document3=>{let next={...document3};return delete next[MANAGED_COMPANION_RELEASE_AT_FIELD],next})},releaseAddress=async()=>{let need=await currentNeed(),pause2=phonesUnused;if(need!==!1)return need&&await cancelRelease(),settledState();let document3=credentials(),account2=storedAccount(document3);if(!account2?.installationCredential||!managedCompanionTunnelAccess(document3)||
-companionAccountCleanupPending(document3))return settledState();await stopManagedEndpoint();let removalPending=!1;try{await client.deleteEndpoint(account2.installationCredential)}catch(error62){if(removalPending=error62 instanceof ControlPlaneError&&error62.code==="endpoint_cleanup_pending",!(removalPending||error62 instanceof ControlPlaneError&&error62.status===401))return writeLog(error62 instanceof ControlPlaneError?`companion account: could not give the secure address back code=${error62.code}\
- status=${error62.status||"none"} ref=${error62.requestId||"none"}`:"companion account: could not give the secure address back (not a control-plane answer)"),await activatePersistedEndpoint(),settledState()}return await updateCredentials(current=>({...withoutManagedCompanionTunnelAccess(current),...removalPending?{[COMPANION_ENDPOINT_RELEASE_PENDING_FIELD]:!0}:{},...pause2?{[COMPANION_ENDPOINT_PAUSED_FIELD]:!0}:{}})),resetAutoRetry(),phase=null,writeLog(pause2?"companion account: gave the secure\
- address back; no paired phone was used in 30 days":"companion account: gave the secure address back; no device needs it"),settledState()},reviewAddress=async({atLaunch=!1}={})=>{let document3=credentials();if(!storedAccount(document3)||companionAccountCleanupPending(document3))return null;if(!managedCompanionTunnelAccess(document3)){let waiting2=document3[COMPANION_TUNNEL_WAITING_FIELD]===!0;return!savedAddress(document3)&&!waiting2||autoRetryTimer!==null?null:await currentNeed()===!0?retryWork():
-null}let need=await currentNeed();if(need!==!1)return need&&await cancelRelease(),need===null&&atLaunch?null:recoveryDue({atLaunch})?reconcileIfEndpointGone():null;let releaseAt=releaseScheduledAt();if(releaseAt!==null&&now()>=releaseAt)return releaseAddress();let connection=managedConnectionState?.()??{};if(companionIsOn()&&CONNECTOR_FAILING_STATES.has(connection.status)&&(atLaunch||endpointCheckDue())){let released=await reconcileIfEndpointGone({onGone:releaseAddress});if(released)return released}
-if(releaseAt===null||releaseAt-now()>releaseGraceMs+releaseJitterMs){let delay3=releaseGraceMs+Math.round(random()*releaseJitterMs);await updateCredentials(current=>managedCompanionTunnelAccess(current)?{...current,[MANAGED_COMPANION_RELEASE_AT_FIELD]:now()+delay3}:current),writeLog(`companion account: no device needs the secure address; giving it back in ${Math.round(delay3/6e4)} min`)}return null},retryIfWanted=async()=>requestedRecently()||savedAddress(credentials())&&await currentNeed()!==!1?
-retryWork():(resetAutoRetry(),phase?.status==="error"&&(phase=null),writeLog("companion account: stopped retrying; no device needs a secure address"),settledState());retryFromTimer=()=>serialize(onDemand?retryIfWanted:retryWork);let prepare=()=>serialize(async()=>{let document3=credentials();if(!configured||!companionIsOn()||!storedAccount(document3)||companionAccountCleanupPending(document3))return settledState();if(requestedAt=now(),!managedCompanionTunnelAccess(document3))return retryWork();await cancelRelease();
-let connection=managedConnectionState?.()??{};if(["stopped","unconfigured"].includes(connection.status))await activatePersistedEndpoint();else if(CONNECTOR_FAILING_STATES.has(connection.status)){let repaired=await reconcileIfEndpointGone();if(repaired)return repaired}return settledState()}),watchdogTick=()=>{if(watchdogTimer=null,!disposed&&(watchdogTimer=setTimer(watchdogTick,endpointCheckIntervalMs),phase?.status!=="signed-out")){if(onDemand){serialize(()=>reviewAddress()).catch(()=>{});return}
-recoveryDue()&&serialize(()=>reconcileIfEndpointGone()).catch(()=>{})}},startWatchdog=()=>{!(autoRecover||onDemand)||disposed||!configured||watchdogTimer!==null||(watchdogTimer=setTimer(watchdogTick,firstEndpointCheckMs))};return Object.freeze({state:async()=>(await probeControlPlane(),settledState()),requestCode,verifyCode,connectLimix,retry,prepare,signOut:()=>serialize(async()=>{if(resetAutoRetry(),!storedAccount(credentials()))return await clearAfterCleanup(),settledState();let email3=storedAccount(
-credentials())?.email;phase={status:"connecting",email:email3};try{return await cleanupCurrentAccount(),healthy=!0,lastHealthCheck=now(),settledState()}catch(error62){return failAction(error62,{email:email3}),settledState()}}),restore:()=>serialize(async()=>{if(!configured||(startWatchdog(),!await probeControlPlane({force:!0})))return settledState();if(companionAccountCleanupPending(credentials()))return retryWork();if(await ensureClientIdentity(),onDemand){let reviewed=await reviewAddress({atLaunch:!0});
-return reviewed||(phase=null,settledState())}let account2=storedAccount(credentials());if(account2&&!managedCompanionTunnelAccess(credentials()))return retryWork();if(autoRecover&&account2&&companionIsOn()){let reconciled=await reconcileIfEndpointGone();if(reconciled)return reconciled}return phase=null,settledState()}),dispose:()=>{disposed=!0,cancelAutoRetry(),watchdogTimer!==null&&clearTimer(watchdogTimer),watchdogTimer=null}})}var SIGNIN_CODE_TTL_MS=10*6e4;init_user_errors();function parseAllowList(value){return(value??"").split(/[,\s]+/).map(entry=>entry.trim().toLowerCase()).filter(Boolean)}var NOT_WELCOME={ok:!1,status:403,...userError("serverError.email.notAllowed")};init_decision_log();init_redact2();init_usage_ledger();import{appendFile as appendFile2,mkdir as mkdir2}from"node:fs/promises";import{basename as basename2,join as join2}from"node:path";var DIR2="admin-activity";var PRUNE_EVERY_MS2=60*6e4,writeQueues2=new Map,lastPrune2=new Map;function adminActivityFileFor(dataDir,at2){return join2(dataDir,DIR2,`${monthKey(at2)}.ndjson`)}async function writeRow(dataDir,row){let at2=new Date(row.at);await mkdir2(join2(dataDir,DIR2),{recursive:!0,mode:448}),await appendFile2(adminActivityFileFor(dataDir,at2),JSON.stringify(row)+`
+rawEmail,email3=>client.verifyOTP(email3,rawCode)),connectLimix=credential=>signInFlow(credential.email,async()=>({accountToken:credential.bearer,user:{id:credential.userId,email:credential.email}})),forgetForeign=()=>serialize(async()=>{let document3=credentials(),account2=storedAccount(document3);if(!account2)return!1;let access2=managedCompanionTunnelAccess(document3),host2="";try{host2=access2?.endpoint?new URL(access2.endpoint).hostname:""}catch{host2=""}return account2.userId.startsWith("l\
+imix:")&&(!host2||host2.endsWith(".limixmedia.com"))?!1:(await clearAfterCleanup(),!0)}),retryWork=async()=>{if(!configured)return settledState();let account2=storedAccount(credentials());if(!account2)return phase=null,settledState();if(companionAccountCleanupPending(credentials())){phase={status:"connecting",email:account2.email};try{await requireHealthyControlPlane(),await cleanupCurrentAccount({markPending:!1})}catch(error62){failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0})}
+return settledState()}phase={status:"connecting",email:account2.email};try{return await requireHealthyControlPlane(),await provision({accountToken:account2.accountToken,user:{id:account2.userId,email:account2.email}})}catch(error62){return failAction(error62,{email:account2.email,expiredSessionIsSignedOut:!0}),scheduleAutoRetry(error62),settledState()}},retry=()=>serialize(async()=>(requestedAt=now(),retryWork())),reconcileIfEndpointGone=async({onGone=retryWork}={})=>{let document3=credentials(),
+account2=storedAccount(document3),access2=managedCompanionTunnelAccess(document3);if(!account2||!access2||!account2.installationCredential||companionAccountCleanupPending(document3)||typeof client.getEndpoint!="function")return null;lastEndpointCheck=now();let endpoint;try{endpoint=await client.getEndpoint(account2.installationCredential)}catch(error62){return error62 instanceof ControlPlaneError&&error62.status===401?onGone():null}return endpoint&&endpoint.url===access2.endpoint&&!ENDPOINT_NEEDS_RECONCILE.
+has(endpoint.status)?null:onGone()},endpointCheckDue=()=>lastEndpointCheck===null||now()-lastEndpointCheck>=endpointCheckIntervalMs/2,recoveryDue=({atLaunch=!1}={})=>{if(!autoRecover||!companionIsOn())return!1;if(atLaunch)return!0;if(autoRetryTimer!==null)return!1;let connection=managedConnectionState?.()??{};return WATCHDOG_CHECK_STATES.has(connection.status)&&endpointCheckDue()},requestedRecently=()=>requestedAt!==null&&now()-requestedAt<REQUEST_WINDOW_MS,savedAddress=document3=>normalizeManagedCompanionEndpoint(
+document3[MANAGED_COMPANION_ENDPOINT_FIELD]),phonesUnused=!1,currentNeed=async()=>{let answer=await Promise.resolve().then(()=>managedEndpointNeeded()).catch(()=>null);phonesUnused=answer===MANAGED_ENDPOINT_PHONES_UNUSED;let need=phonesUnused?!1:typeof answer=="boolean"?answer:null;return need===!1&&relay.capable()?!1:requestedRecently()?(phonesUnused=!1,!0):need},releaseScheduledAt=()=>{let at2=credentials()[MANAGED_COMPANION_RELEASE_AT_FIELD];return Number.isSafeInteger(at2)&&at2>0?at2:null},cancelRelease=async()=>{
+releaseScheduledAt()!==null&&await updateCredentials(document3=>{let next={...document3};return delete next[MANAGED_COMPANION_RELEASE_AT_FIELD],next})},releaseAddress=async()=>{let need=await currentNeed(),pause2=phonesUnused;if(need!==!1)return need&&await cancelRelease(),settledState();let document3=credentials(),account2=storedAccount(document3);if(!account2?.installationCredential||!managedCompanionTunnelAccess(document3)||companionAccountCleanupPending(document3))return settledState();await stopManagedEndpoint();
+let removalPending=!1;try{await client.deleteEndpoint(account2.installationCredential)}catch(error62){if(removalPending=error62 instanceof ControlPlaneError&&error62.code==="endpoint_cleanup_pending",!(removalPending||error62 instanceof ControlPlaneError&&error62.status===401))return writeLog(error62 instanceof ControlPlaneError?`companion account: could not give the secure address back code=${error62.code} status=${error62.status||"none"} ref=${error62.requestId||"none"}`:"companion account: co\
+uld not give the secure address back (not a control-plane answer)"),await activatePersistedEndpoint(),settledState()}return await updateCredentials(current=>({...withoutManagedCompanionTunnelAccess(current),...removalPending?{[COMPANION_ENDPOINT_RELEASE_PENDING_FIELD]:!0}:{},...pause2?{[COMPANION_ENDPOINT_PAUSED_FIELD]:!0}:{}})),resetAutoRetry(),phase=null,writeLog(pause2?"companion account: gave the secure address back; no paired phone was used in 30 days":"companion account: gave the secure ad\
+dress back; no device needs it"),settledState()},reviewAddress=async({atLaunch=!1}={})=>{let document3=credentials();if(!storedAccount(document3)||companionAccountCleanupPending(document3))return null;if(!managedCompanionTunnelAccess(document3)){let waiting2=document3[COMPANION_TUNNEL_WAITING_FIELD]===!0;return!savedAddress(document3)&&!waiting2||autoRetryTimer!==null?null:await currentNeed()===!0?retryWork():null}let need=await currentNeed();if(need!==!1)return need&&await cancelRelease(),need===
+null&&atLaunch?null:recoveryDue({atLaunch})?reconcileIfEndpointGone():null;let releaseAt=releaseScheduledAt();if(releaseAt!==null&&now()>=releaseAt)return releaseAddress();let connection=managedConnectionState?.()??{};if(companionIsOn()&&CONNECTOR_FAILING_STATES.has(connection.status)&&(atLaunch||endpointCheckDue())){let released=await reconcileIfEndpointGone({onGone:releaseAddress});if(released)return released}if(releaseAt===null||releaseAt-now()>releaseGraceMs+releaseJitterMs){let delay3=releaseGraceMs+
+Math.round(random()*releaseJitterMs);await updateCredentials(current=>managedCompanionTunnelAccess(current)?{...current,[MANAGED_COMPANION_RELEASE_AT_FIELD]:now()+delay3}:current),writeLog(`companion account: no device needs the secure address; giving it back in ${Math.round(delay3/6e4)} min`)}return null},retryIfWanted=async()=>requestedRecently()||savedAddress(credentials())&&await currentNeed()!==!1?retryWork():(resetAutoRetry(),phase?.status==="error"&&(phase=null),writeLog("companion accoun\
+t: stopped retrying; no device needs a secure address"),settledState());retryFromTimer=()=>serialize(onDemand?retryIfWanted:retryWork);let prepare=()=>serialize(async()=>{let document3=credentials();if(!configured||!companionIsOn()||!storedAccount(document3)||companionAccountCleanupPending(document3))return settledState();if(requestedAt=now(),!managedCompanionTunnelAccess(document3))return retryWork();await cancelRelease();let connection=managedConnectionState?.()??{};if(["stopped","unconfigured"].
+includes(connection.status))await activatePersistedEndpoint();else if(CONNECTOR_FAILING_STATES.has(connection.status)){let repaired=await reconcileIfEndpointGone();if(repaired)return repaired}return settledState()}),watchdogTick=()=>{if(watchdogTimer=null,!disposed&&(watchdogTimer=setTimer(watchdogTick,endpointCheckIntervalMs),phase?.status!=="signed-out")){if(onDemand){serialize(()=>reviewAddress()).catch(()=>{});return}recoveryDue()&&serialize(()=>reconcileIfEndpointGone()).catch(()=>{})}},startWatchdog=()=>{
+!(autoRecover||onDemand)||disposed||!configured||watchdogTimer!==null||(watchdogTimer=setTimer(watchdogTick,firstEndpointCheckMs))};return Object.freeze({state:async()=>(await probeControlPlane(),settledState()),requestCode,verifyCode,connectLimix,forgetForeign,retry,prepare,signOut:()=>serialize(async()=>{if(resetAutoRetry(),!storedAccount(credentials()))return await clearAfterCleanup(),settledState();let email3=storedAccount(credentials())?.email;phase={status:"connecting",email:email3};try{return await cleanupCurrentAccount(),
+healthy=!0,lastHealthCheck=now(),settledState()}catch(error62){return failAction(error62,{email:email3}),settledState()}}),restore:()=>serialize(async()=>{if(!configured||(startWatchdog(),!await probeControlPlane({force:!0})))return settledState();if(companionAccountCleanupPending(credentials()))return retryWork();if(await ensureClientIdentity(),onDemand){let reviewed=await reviewAddress({atLaunch:!0});return reviewed||(phase=null,settledState())}let account2=storedAccount(credentials());if(account2&&
+!managedCompanionTunnelAccess(credentials()))return retryWork();if(autoRecover&&account2&&companionIsOn()){let reconciled=await reconcileIfEndpointGone();if(reconciled)return reconciled}return phase=null,settledState()}),dispose:()=>{disposed=!0,cancelAutoRetry(),watchdogTimer!==null&&clearTimer(watchdogTimer),watchdogTimer=null}})}var SIGNIN_CODE_TTL_MS=10*6e4;init_user_errors();function parseAllowList(value){return(value??"").split(/[,\s]+/).map(entry=>entry.trim().toLowerCase()).filter(Boolean)}var NOT_WELCOME={ok:!1,status:403,...userError("serverError.email.notAllowed")};init_decision_log();init_redact2();init_usage_ledger();import{appendFile as appendFile2,mkdir as mkdir2}from"node:fs/promises";import{basename as basename2,join as join2}from"node:path";var DIR2="admin-activity";var PRUNE_EVERY_MS2=60*6e4,writeQueues2=new Map,lastPrune2=new Map;function adminActivityFileFor(dataDir,at2){return join2(dataDir,DIR2,`${monthKey(at2)}.ndjson`)}async function writeRow(dataDir,row){let at2=new Date(row.at);await mkdir2(join2(dataDir,DIR2),{recursive:!0,mode:448}),await appendFile2(adminActivityFileFor(dataDir,at2),JSON.stringify(row)+`
 `,{mode:384}),at2.getTime()-(lastPrune2.get(dataDir)??0)>=PRUNE_EVERY_MS2&&(lastPrune2.set(dataDir,at2.getTime()),await pruneMonthFiles(join2(dataDir,DIR2),boundRetentionDays(),at2))}function appendAdminAction(dataDir,row){let record12={...row,at:row.at??new Date().toISOString(),...row.before?{before:auditValues(row.before)}:{},...row.after?{after:auditValues(row.after)}:{}},queued=(writeQueues2.get(dataDir)??Promise.resolve()).then(()=>writeRow(dataDir,record12)).catch(()=>{});writeQueues2.set(
 dataDir,queued),queued.finally(()=>{writeQueues2.get(dataDir)===queued&&writeQueues2.delete(dataDir)})}async function flushAdminActivity(dataDir){await writeQueues2.get(dataDir)}var SECRET_PARTS=["token","secret","password","passwd","passphrase","credential","authorization","cookie","bearer","apikey","api_key"],OPAQUE_MAP=/^(?:headers|env|environment)$/i,MAX_VALUE_CHARS=2e3,HIDDEN="[hidden]";function isSecretName2(name){let lower=name.toLowerCase();return lower.endsWith("tokens")?!1:SECRET_PARTS.some(part=>lower.includes(part))?!0:/(?:^|[_.-])keys?$/.test(lower)||/[a-z]Keys?$/.test(name)}function isSecretParameter(name){
 if(name==="-k"||name==="-K")return!0;let bare=name.replace(/^-+/,"");return isSecretName2(bare)||/^(?:auth|sig|signature|pass|pwd|code)$/i.test(bare)}function keyLikeSegment(segment){return(segment.match(/[A-Za-z0-9]{16,}/g)??[]).some(run6=>/\d/.test(run6)&&/[A-Za-z]/.test(run6))}function maskUrlSecrets(text13){return text13.replace(/\b([a-z][\w+.-]*:\/\/)([^\s/?#]*)([^\s?#]*)([^\s]*)/gi,(_all,scheme,authority2,path3,rest)=>{let at2=authority2.lastIndexOf("@"),host2=at2>=0?`${HIDDEN}@${authority2.

package/dist-server/server/index.js

@@ -511,6 +511,7 @@ import { createBotPatchRoutes } from "./routes/bot-patch.js";
 import { createBotOrderRoutes } from "./routes/bot-order.js";
 import { createBotLifecycleRoutes } from "./routes/bot-lifecycle.js";
 import { createBotSkillsRoutes } from "./routes/bot-skills.js";
+import { startHubAutoSync } from "./limix-skill-hub.js";
 import { createSkillShareRoutes } from "./routes/skill-share.js";
 import { createTeamContextRoutes } from "./routes/team-context.js";
 import { createAppSuggestions } from "./host/app-suggestions.js";
@@ -12385,6 +12386,7 @@ ROUTES.push(createBotLifecycleRoutes({
     activeGroupTurnForBot, cancelGroupTurnOperations, runningTurnInstance, closeOpenApprovals, deleteBotWithLifecycle,
 }));
 ROUTES.push(createBotSkillsRoutes({ store, cfg, listBotSkills, readBotSkillFile, stagedSkillListing }));
+startHubAutoSync();
 ROUTES.push(createEmailRoutes({ service: emailService }));
 ROUTES.push(phones.routes);
 ROUTES.push(createSkillShareRoutes({ enabled: () => skillsHost.mode() !== "off", botExists: (id) => Boolean(store.bot(id)),

package/dist-server/server/limix-skill-hub.js

@@ -0,0 +1,264 @@
+// Limix Skill Hub client: keeps a cached copy of the hub catalog, installs a skill only after every file matches the
+// SHA-256 the catalog pins, and never installs scripts, binaries or MCP files unless the owner allows tools for that
+// one skill. Installed skills land DISABLED; the owner turns them on. Auto Sync (catalog refresh) is on by default,
+// Auto Install is off by default.
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { isSkillName } from "../shared/skill-md.js";
+import { writeFileAtomic } from "./atomic.js";
+import { DATA_DIR } from "./config.js";
+import { installLibrarySkill, readSkillLibraryIndex, retireLibrarySkill, setLibrarySkillReviewState } from "./skill-library.js";
+export const HUB_REPO = "leomieo/limix-skill-hub";
+const HUB_BRANCH = "main";
+const SYNC_MIN_GAP_MS = 20 * 60 * 60 * 1000;
+const FILE_MAX_BYTES = 1024 * 1024;
+const DEFAULT_SETTINGS = { autoSync: true, autoInstall: false, lastSync: null, lastError: null, etag: null };
+const hubDir = () => join(DATA_DIR, "skill-hub");
+const settingsFile = () => join(hubDir(), "settings.json");
+const catalogFile = () => join(hubDir(), "catalog.json");
+function readJson(file, fallback) {
+    try {
+        return JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch {
+        return fallback;
+    }
+}
+export function hubSettings() {
+    return { ...DEFAULT_SETTINGS, ...readJson(settingsFile(), {}) };
+}
+function saveSettings(next) {
+    mkdirSync(hubDir(), { recursive: true, mode: 0o700 });
+    writeFileAtomic(settingsFile(), JSON.stringify(next, null, 2), { mode: 0o600 });
+}
+export function hubCatalog() {
+    const body = readJson(catalogFile(), {});
+    return Array.isArray(body.skills) ? body.skills : [];
+}
+const rawUrl = (path) => `https://raw.githubusercontent.com/${HUB_REPO}/${HUB_BRANCH}/${path}`;
+async function fetchText(url, headers = {}) {
+    return fetch(url, { signal: AbortSignal.timeout(30_000), headers: { "User-Agent": "limix-bot", ...headers } });
+}
+let syncing = null;
+/** Refreshes the cached catalog (ETag, so an unchanged hub costs one tiny request). */
+export function syncHub() {
+    if (syncing)
+        return syncing;
+    syncing = (async () => {
+        const settings = hubSettings();
+        try {
+            const response = await fetchText(rawUrl("registry/catalog.json"), settings.etag && existsSync(catalogFile()) ? { "If-None-Match": settings.etag } : {});
+            if (response.status === 304) {
+                saveSettings({ ...settings, lastSync: new Date().toISOString(), lastError: null });
+                return { changed: false, count: hubCatalog().length };
+            }
+            if (!response.ok)
+                throw new Error(`Hub trả về ${response.status}`);
+            const text = await response.text();
+            const parsed = JSON.parse(text);
+            if (!Array.isArray(parsed.skills))
+                throw new Error("Danh mục Hub không đúng định dạng");
+            mkdirSync(hubDir(), { recursive: true, mode: 0o700 });
+            writeFileAtomic(catalogFile(), text, { mode: 0o600 });
+            saveSettings({ ...settings, etag: response.headers.get("etag"), lastSync: new Date().toISOString(), lastError: null });
+            if (settings.autoInstall)
+                await autoInstallEligible();
+            return { changed: true, count: parsed.skills.length };
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            saveSettings({ ...settings, lastError: message });
+            return { error: message };
+        }
+        finally {
+            syncing = null;
+        }
+    })();
+    return syncing;
+}
+const SCRIPT = /\.(py|js|mjs|cjs|ts|sh|bash|zsh|ps1|bat|cmd|rb|pl|php|go|rs|exe|dll|so|dylib|bin|jar|class|scr|msi|com|apk|dex|node|wasm)$/i;
+const MCP_FILE = /(^|\/)(\.mcp\.json|mcp\.json|mcp-servers?\.json|claude_desktop_config\.json)$/i;
+const isToolFile = (path) => SCRIPT.test(path) || MCP_FILE.test(path);
+const sha = (data) => createHash("sha256").update(data).digest("hex");
+export function hubSkillBlocked(entry) {
+    if (entry.area === "quarantine" || entry.security_status === "quarantined")
+        return "Skill nằm trong khu cách ly vì có mã nguy hiểm.";
+    if (entry.approval_status === "quarantined" || entry.approval_status === "rejected")
+        return "Skill bị từ chối.";
+    return null;
+}
+/** installed state of every catalog entry that came from the hub */
+function installedFromHub() {
+    const out = new Map();
+    for (const entry of Object.values(readSkillLibraryIndex())) {
+        const match = /^limix-hub:([a-z0-9-]+)@([0-9a-f]{64})/.exec(entry.source);
+        if (match)
+            out.set(match[1], { checksum: match[2], sha256: entry.sha256, reviewState: entry.reviewState });
+    }
+    return out;
+}
+export function hubSkills() {
+    const installed = installedFromHub();
+    const library = readSkillLibraryIndex();
+    return hubCatalog().map((entry) => {
+        const have = installed.get(entry.id);
+        return {
+            ...entry,
+            installed: Boolean(have),
+            // A same-named skill the owner imported by hand is not the hub's: never touched by sync.
+            enabled: have?.reviewState === "approved",
+            updateAvailable: Boolean(have && have.checksum !== entry.checksum),
+            blocked: hubSkillBlocked(entry) ?? (!have && library[entry.id] ? "Thư viện đã có kỹ năng cùng tên không đến từ Hub." : null),
+        };
+    });
+}
+export async function installHubSkill(id, options = {}) {
+    if (!isSkillName(id))
+        return { error: "Tên kỹ năng không hợp lệ" };
+    const entry = hubCatalog().find((e) => e.id === id);
+    if (!entry)
+        return { error: "Không thấy kỹ năng này trong danh mục Hub. Hãy đồng bộ lại." };
+    const blocked = hubSkillBlocked(entry);
+    if (blocked)
+        return { error: blocked };
+    const installed = installedFromHub().get(id);
+    const existing = readSkillLibraryIndex()[id];
+    if (existing && !installed)
+        return { error: "Thư viện đã có kỹ năng cùng tên không đến từ Hub." };
+    const wanted = Object.keys(entry.file_hashes).filter((path) => path !== "SKILL.md" && (options.allowTools || !isToolFile(path)));
+    const skipped = Object.keys(entry.file_hashes).filter((path) => path !== "SKILL.md" && !wanted.includes(path));
+    const files = [];
+    let skillMd = "";
+    for (const path of ["SKILL.md", ...wanted]) {
+        const expected = entry.file_hashes[path];
+        if (!expected)
+            return { error: `Danh mục thiếu mã kiểm tra cho ${path}` };
+        let response;
+        try {
+            response = await fetchText(rawUrl(`skills/${id}/${path}`));
+        }
+        catch (cause) {
+            return { error: `Không tải được ${path}: ${cause instanceof Error ? cause.message : String(cause)}` };
+        }
+        if (!response.ok)
+            return { error: `Không tải được ${path} (${response.status})` };
+        const bytes = new Uint8Array(await response.arrayBuffer());
+        if (bytes.byteLength > FILE_MAX_BYTES)
+            return { error: `${path} quá lớn` };
+        // Pinned content: a file the hub no longer serves as catalogued is refused, never installed.
+        if (sha(bytes) !== expected)
+            return { error: `${path} không khớp mã SHA-256 trong danh mục — đã dừng cài` };
+        if (path === "SKILL.md")
+            skillMd = new TextDecoder().decode(bytes);
+        else
+            files.push({ path, content: bytes });
+    }
+    if (installed) {
+        const retired = retireLibrarySkill(id, installed.sha256);
+        if ("error" in retired)
+            return { error: retired.error };
+        if ("stale" in retired)
+            return { error: "Kỹ năng đã bị sửa tay sau khi cài, không cập nhật đè." };
+    }
+    const result = installLibrarySkill({
+        name: id,
+        instructions: skillMd,
+        source: `limix-hub:${id}@${entry.checksum} (${entry.source.repository ?? "?"}@${(entry.source.commit ?? "").slice(0, 7)})`,
+        ...(entry.license ? { license: entry.license } : {}),
+        ...(entry.compatibility.text ? { compatibility: entry.compatibility.text } : {}),
+        ...(entry.tags.length ? { tags: entry.tags } : {}),
+        warnings: entry.notes,
+        skippedFiles: skipped,
+        reviewState: "disabled",
+        ...(files.length ? { files } : {}),
+    });
+    if ("error" in result)
+        return { error: result.error };
+    return { ok: true, skipped };
+}
+export function setHubSkillEnabled(id, enabled) {
+    if (!installedFromHub().has(id))
+        return { error: "Kỹ năng này chưa cài từ Hub" };
+    const entry = hubCatalog().find((e) => e.id === id);
+    if (enabled && entry && hubSkillBlocked(entry))
+        return { error: hubSkillBlocked(entry) };
+    const result = setLibrarySkillReviewState(id, enabled ? "approved" : "disabled");
+    return "error" in result ? { error: result.error } : { ok: true };
+}
+export function removeHubSkill(id) {
+    const installed = installedFromHub().get(id);
+    if (!installed)
+        return { error: "Kỹ năng này chưa cài từ Hub" };
+    const result = retireLibrarySkill(id, installed.sha256);
+    if ("error" in result)
+        return { error: result.error };
+    if ("stale" in result)
+        return { error: "Kỹ năng đã bị sửa tay sau khi cài, không gỡ tự động." };
+    return { ok: true }; // the bytes stay in the library archive, so a removal can be undone by hand
+}
+/** Auto Install (off by default): only excellent/recommended, approved, instructions-only skills; max 5 per sync. */
+async function autoInstallEligible() {
+    let budget = 5;
+    for (const skill of hubSkills()) {
+        if (budget <= 0)
+            return;
+        const eligible = !skill.blocked && skill.kind === "instructions-only" && skill.approval_status === "approved" && (skill.grade === "excellent" || skill.grade === "recommended");
+        if (!eligible || (skill.installed && !skill.updateAvailable))
+            continue;
+        budget -= 1;
+        const done = await installHubSkill(skill.id);
+        if ("ok" in done && skill.updateAvailable && skill.enabled)
+            setHubSkillEnabled(skill.id, true);
+    }
+}
+export async function handleLimixHub(method, path, body) {
+    const record = (body && typeof body === "object" ? body : {});
+    if (method === "GET" && path === "/api/limix/hub") {
+        return { status: 200, body: { repo: HUB_REPO, settings: hubSettings(), skills: hubSkills() } };
+    }
+    if (method === "POST" && path === "/api/limix/hub/sync") {
+        const result = await syncHub();
+        return "error" in result ? { status: 502, body: result } : { status: 200, body: result };
+    }
+    if (method === "POST" && path === "/api/limix/hub/settings") {
+        const current = hubSettings();
+        saveSettings({
+            ...current,
+            autoSync: typeof record.autoSync === "boolean" ? record.autoSync : current.autoSync,
+            autoInstall: typeof record.autoInstall === "boolean" ? record.autoInstall : current.autoInstall,
+        });
+        return { status: 200, body: { settings: hubSettings() } };
+    }
+    const id = typeof record.id === "string" ? record.id : "";
+    if (method === "POST" && (path === "/api/limix/hub/install" || path === "/api/limix/hub/update")) {
+        const result = await installHubSkill(id, { allowTools: record.allowTools === true });
+        return "error" in result ? { status: 422, body: result } : { status: 200, body: result };
+    }
+    if (method === "POST" && path === "/api/limix/hub/enable") {
+        const result = setHubSkillEnabled(id, record.enabled === true);
+        return "error" in result ? { status: 422, body: result } : { status: 200, body: result };
+    }
+    if (method === "POST" && path === "/api/limix/hub/remove") {
+        const result = removeHubSkill(id);
+        return "error" in result ? { status: 422, body: result } : { status: 200, body: result };
+    }
+    return null;
+}
+let started = false;
+/** Auto Sync: once soon after start, then checked every 30 minutes; it only runs when 20 h have passed. */
+export function startHubAutoSync() {
+    if (started)
+        return;
+    started = true;
+    const tick = () => {
+        const settings = hubSettings();
+        if (!settings.autoSync)
+            return;
+        if (settings.lastSync && Date.now() - Date.parse(settings.lastSync) < SYNC_MIN_GAP_MS)
+            return;
+        void syncHub();
+    };
+    setTimeout(tick, 60_000).unref();
+    setInterval(tick, 30 * 60 * 1000).unref();
+}

package/dist-server/server/routes/bot-skills.js

@@ -4,6 +4,8 @@ import { setNativeSkillEnabled } from "../native-skill-choices.js";
 import { botSkillTemplateSchema } from "../new-bot-defaults.js";
 import { fetchSkillFromSource } from "../skill-fetch.js";
 import { readLocalSkills } from "../limix-skill-folder.js";
+import { loadBundledSkills } from "../skill-library.js";
+import { handleLimixHub } from "../limix-skill-hub.js";
 import { skillImportSummary } from "../skill-folder.js";
 import { installLibrarySkill, librarySkillOptOuts, listLibrarySkills, readLibrarySkillFile, readSkillLibraryIndex, setLibrarySkillEveryBot, setLibrarySkillOptOut, setLibrarySkillReviewState, skillsLibraryEnabled, unassignLibrarySkill } from "../skill-library.js";
 import { installSkill, listBotSkillsWithOrigin, listStagedSkillWrites, parseSkillMd, removeSkill, scanSkillText, setSkillEnabled, } from "../skills.js";
@@ -12,6 +14,15 @@ export function createBotSkillsRoutes(deps) {
     const { store, cfg, listBotSkills, readBotSkillFile, stagedSkillListing } = deps;
     return async ({ req, res, url, path, method, json, readBody }) => {
         let m = null;
+        if (path.startsWith("/api/limix/hub")) {
+            const hub = await handleLimixHub(method, path, method === "POST" ? await readBody(req) : undefined);
+            if (hub)
+                return json(res, hub.status, hub.body);
+        }
+        if (method === "GET" && path === "/api/limix/bundled-skills") {
+            const skills = loadBundledSkills().map(({ manifest }) => ({ id: manifest.id, name: manifest.name, description: manifest.description, defaultEnabled: manifest.defaultEnabled, triggerTerms: manifest.triggerTerms }));
+            return json(res, 200, { skills });
+        }
         // Imports land DISABLED: a person enables one after reading SKILL.md and its scan warnings.
         m = path.match(/^\/api\/bots\/([\w-]+)\/skill-template$/);
         if (m && method === "POST") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "limixbot",
-  "version": "0.3.12",
+  "version": "0.3.15",
   "description": "Run the Limix Bot server anywhere and pair your devices to it (Leox ৹ Limix AI)",
   "license": "Apache-2.0",
   "type": "module",