limixbot 0.3.13 → 0.3.15

package/dist-server/package.json

@@ -1 +1 @@
-{"type":"module","version":"0.3.13"}
+{"type":"module","version":"0.3.15"}

package/dist-server/server/index.js

@@ -511,6 +511,7 @@ import { createBotPatchRoutes } from "./routes/bot-patch.js";
 import { createBotOrderRoutes } from "./routes/bot-order.js";
 import { createBotLifecycleRoutes } from "./routes/bot-lifecycle.js";
 import { createBotSkillsRoutes } from "./routes/bot-skills.js";
+import { startHubAutoSync } from "./limix-skill-hub.js";
 import { createSkillShareRoutes } from "./routes/skill-share.js";
 import { createTeamContextRoutes } from "./routes/team-context.js";
 import { createAppSuggestions } from "./host/app-suggestions.js";
@@ -12385,6 +12386,7 @@ ROUTES.push(createBotLifecycleRoutes({
     activeGroupTurnForBot, cancelGroupTurnOperations, runningTurnInstance, closeOpenApprovals, deleteBotWithLifecycle,
 }));
 ROUTES.push(createBotSkillsRoutes({ store, cfg, listBotSkills, readBotSkillFile, stagedSkillListing }));
+startHubAutoSync();
 ROUTES.push(createEmailRoutes({ service: emailService }));
 ROUTES.push(phones.routes);
 ROUTES.push(createSkillShareRoutes({ enabled: () => skillsHost.mode() !== "off", botExists: (id) => Boolean(store.bot(id)),

package/dist-server/server/limix-skill-hub.js

@@ -0,0 +1,264 @@
+// Limix Skill Hub client: keeps a cached copy of the hub catalog, installs a skill only after every file matches the
+// SHA-256 the catalog pins, and never installs scripts, binaries or MCP files unless the owner allows tools for that
+// one skill. Installed skills land DISABLED; the owner turns them on. Auto Sync (catalog refresh) is on by default,
+// Auto Install is off by default.
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { isSkillName } from "../shared/skill-md.js";
+import { writeFileAtomic } from "./atomic.js";
+import { DATA_DIR } from "./config.js";
+import { installLibrarySkill, readSkillLibraryIndex, retireLibrarySkill, setLibrarySkillReviewState } from "./skill-library.js";
+export const HUB_REPO = "leomieo/limix-skill-hub";
+const HUB_BRANCH = "main";
+const SYNC_MIN_GAP_MS = 20 * 60 * 60 * 1000;
+const FILE_MAX_BYTES = 1024 * 1024;
+const DEFAULT_SETTINGS = { autoSync: true, autoInstall: false, lastSync: null, lastError: null, etag: null };
+const hubDir = () => join(DATA_DIR, "skill-hub");
+const settingsFile = () => join(hubDir(), "settings.json");
+const catalogFile = () => join(hubDir(), "catalog.json");
+function readJson(file, fallback) {
+    try {
+        return JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch {
+        return fallback;
+    }
+}
+export function hubSettings() {
+    return { ...DEFAULT_SETTINGS, ...readJson(settingsFile(), {}) };
+}
+function saveSettings(next) {
+    mkdirSync(hubDir(), { recursive: true, mode: 0o700 });
+    writeFileAtomic(settingsFile(), JSON.stringify(next, null, 2), { mode: 0o600 });
+}
+export function hubCatalog() {
+    const body = readJson(catalogFile(), {});
+    return Array.isArray(body.skills) ? body.skills : [];
+}
+const rawUrl = (path) => `https://raw.githubusercontent.com/${HUB_REPO}/${HUB_BRANCH}/${path}`;
+async function fetchText(url, headers = {}) {
+    return fetch(url, { signal: AbortSignal.timeout(30_000), headers: { "User-Agent": "limix-bot", ...headers } });
+}
+let syncing = null;
+/** Refreshes the cached catalog (ETag, so an unchanged hub costs one tiny request). */
+export function syncHub() {
+    if (syncing)
+        return syncing;
+    syncing = (async () => {
+        const settings = hubSettings();
+        try {
+            const response = await fetchText(rawUrl("registry/catalog.json"), settings.etag && existsSync(catalogFile()) ? { "If-None-Match": settings.etag } : {});
+            if (response.status === 304) {
+                saveSettings({ ...settings, lastSync: new Date().toISOString(), lastError: null });
+                return { changed: false, count: hubCatalog().length };
+            }
+            if (!response.ok)
+                throw new Error(`Hub trả về ${response.status}`);
+            const text = await response.text();
+            const parsed = JSON.parse(text);
+            if (!Array.isArray(parsed.skills))
+                throw new Error("Danh mục Hub không đúng định dạng");
+            mkdirSync(hubDir(), { recursive: true, mode: 0o700 });
+            writeFileAtomic(catalogFile(), text, { mode: 0o600 });
+            saveSettings({ ...settings, etag: response.headers.get("etag"), lastSync: new Date().toISOString(), lastError: null });
+            if (settings.autoInstall)
+                await autoInstallEligible();
+            return { changed: true, count: parsed.skills.length };
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            saveSettings({ ...settings, lastError: message });
+            return { error: message };
+        }
+        finally {
+            syncing = null;
+        }
+    })();
+    return syncing;
+}
+const SCRIPT = /\.(py|js|mjs|cjs|ts|sh|bash|zsh|ps1|bat|cmd|rb|pl|php|go|rs|exe|dll|so|dylib|bin|jar|class|scr|msi|com|apk|dex|node|wasm)$/i;
+const MCP_FILE = /(^|\/)(\.mcp\.json|mcp\.json|mcp-servers?\.json|claude_desktop_config\.json)$/i;
+const isToolFile = (path) => SCRIPT.test(path) || MCP_FILE.test(path);
+const sha = (data) => createHash("sha256").update(data).digest("hex");
+export function hubSkillBlocked(entry) {
+    if (entry.area === "quarantine" || entry.security_status === "quarantined")
+        return "Skill nằm trong khu cách ly vì có mã nguy hiểm.";
+    if (entry.approval_status === "quarantined" || entry.approval_status === "rejected")
+        return "Skill bị từ chối.";
+    return null;
+}
+/** installed state of every catalog entry that came from the hub */
+function installedFromHub() {
+    const out = new Map();
+    for (const entry of Object.values(readSkillLibraryIndex())) {
+        const match = /^limix-hub:([a-z0-9-]+)@([0-9a-f]{64})/.exec(entry.source);
+        if (match)
+            out.set(match[1], { checksum: match[2], sha256: entry.sha256, reviewState: entry.reviewState });
+    }
+    return out;
+}
+export function hubSkills() {
+    const installed = installedFromHub();
+    const library = readSkillLibraryIndex();
+    return hubCatalog().map((entry) => {
+        const have = installed.get(entry.id);
+        return {
+            ...entry,
+            installed: Boolean(have),
+            // A same-named skill the owner imported by hand is not the hub's: never touched by sync.
+            enabled: have?.reviewState === "approved",
+            updateAvailable: Boolean(have && have.checksum !== entry.checksum),
+            blocked: hubSkillBlocked(entry) ?? (!have && library[entry.id] ? "Thư viện đã có kỹ năng cùng tên không đến từ Hub." : null),
+        };
+    });
+}
+export async function installHubSkill(id, options = {}) {
+    if (!isSkillName(id))
+        return { error: "Tên kỹ năng không hợp lệ" };
+    const entry = hubCatalog().find((e) => e.id === id);
+    if (!entry)
+        return { error: "Không thấy kỹ năng này trong danh mục Hub. Hãy đồng bộ lại." };
+    const blocked = hubSkillBlocked(entry);
+    if (blocked)
+        return { error: blocked };
+    const installed = installedFromHub().get(id);
+    const existing = readSkillLibraryIndex()[id];
+    if (existing && !installed)
+        return { error: "Thư viện đã có kỹ năng cùng tên không đến từ Hub." };
+    const wanted = Object.keys(entry.file_hashes).filter((path) => path !== "SKILL.md" && (options.allowTools || !isToolFile(path)));
+    const skipped = Object.keys(entry.file_hashes).filter((path) => path !== "SKILL.md" && !wanted.includes(path));
+    const files = [];
+    let skillMd = "";
+    for (const path of ["SKILL.md", ...wanted]) {
+        const expected = entry.file_hashes[path];
+        if (!expected)
+            return { error: `Danh mục thiếu mã kiểm tra cho ${path}` };
+        let response;
+        try {
+            response = await fetchText(rawUrl(`skills/${id}/${path}`));
+        }
+        catch (cause) {
+            return { error: `Không tải được ${path}: ${cause instanceof Error ? cause.message : String(cause)}` };
+        }
+        if (!response.ok)
+            return { error: `Không tải được ${path} (${response.status})` };
+        const bytes = new Uint8Array(await response.arrayBuffer());
+        if (bytes.byteLength > FILE_MAX_BYTES)
+            return { error: `${path} quá lớn` };
+        // Pinned content: a file the hub no longer serves as catalogued is refused, never installed.
+        if (sha(bytes) !== expected)
+            return { error: `${path} không khớp mã SHA-256 trong danh mục — đã dừng cài` };
+        if (path === "SKILL.md")
+            skillMd = new TextDecoder().decode(bytes);
+        else
+            files.push({ path, content: bytes });
+    }
+    if (installed) {
+        const retired = retireLibrarySkill(id, installed.sha256);
+        if ("error" in retired)
+            return { error: retired.error };
+        if ("stale" in retired)
+            return { error: "Kỹ năng đã bị sửa tay sau khi cài, không cập nhật đè." };
+    }
+    const result = installLibrarySkill({
+        name: id,
+        instructions: skillMd,
+        source: `limix-hub:${id}@${entry.checksum} (${entry.source.repository ?? "?"}@${(entry.source.commit ?? "").slice(0, 7)})`,
+        ...(entry.license ? { license: entry.license } : {}),
+        ...(entry.compatibility.text ? { compatibility: entry.compatibility.text } : {}),
+        ...(entry.tags.length ? { tags: entry.tags } : {}),
+        warnings: entry.notes,
+        skippedFiles: skipped,
+        reviewState: "disabled",
+        ...(files.length ? { files } : {}),
+    });
+    if ("error" in result)
+        return { error: result.error };
+    return { ok: true, skipped };
+}
+export function setHubSkillEnabled(id, enabled) {
+    if (!installedFromHub().has(id))
+        return { error: "Kỹ năng này chưa cài từ Hub" };
+    const entry = hubCatalog().find((e) => e.id === id);
+    if (enabled && entry && hubSkillBlocked(entry))
+        return { error: hubSkillBlocked(entry) };
+    const result = setLibrarySkillReviewState(id, enabled ? "approved" : "disabled");
+    return "error" in result ? { error: result.error } : { ok: true };
+}
+export function removeHubSkill(id) {
+    const installed = installedFromHub().get(id);
+    if (!installed)
+        return { error: "Kỹ năng này chưa cài từ Hub" };
+    const result = retireLibrarySkill(id, installed.sha256);
+    if ("error" in result)
+        return { error: result.error };
+    if ("stale" in result)
+        return { error: "Kỹ năng đã bị sửa tay sau khi cài, không gỡ tự động." };
+    return { ok: true }; // the bytes stay in the library archive, so a removal can be undone by hand
+}
+/** Auto Install (off by default): only excellent/recommended, approved, instructions-only skills; max 5 per sync. */
+async function autoInstallEligible() {
+    let budget = 5;
+    for (const skill of hubSkills()) {
+        if (budget <= 0)
+            return;
+        const eligible = !skill.blocked && skill.kind === "instructions-only" && skill.approval_status === "approved" && (skill.grade === "excellent" || skill.grade === "recommended");
+        if (!eligible || (skill.installed && !skill.updateAvailable))
+            continue;
+        budget -= 1;
+        const done = await installHubSkill(skill.id);
+        if ("ok" in done && skill.updateAvailable && skill.enabled)
+            setHubSkillEnabled(skill.id, true);
+    }
+}
+export async function handleLimixHub(method, path, body) {
+    const record = (body && typeof body === "object" ? body : {});
+    if (method === "GET" && path === "/api/limix/hub") {
+        return { status: 200, body: { repo: HUB_REPO, settings: hubSettings(), skills: hubSkills() } };
+    }
+    if (method === "POST" && path === "/api/limix/hub/sync") {
+        const result = await syncHub();
+        return "error" in result ? { status: 502, body: result } : { status: 200, body: result };
+    }
+    if (method === "POST" && path === "/api/limix/hub/settings") {
+        const current = hubSettings();
+        saveSettings({
+            ...current,
+            autoSync: typeof record.autoSync === "boolean" ? record.autoSync : current.autoSync,
+            autoInstall: typeof record.autoInstall === "boolean" ? record.autoInstall : current.autoInstall,
+        });
+        return { status: 200, body: { settings: hubSettings() } };
+    }
+    const id = typeof record.id === "string" ? record.id : "";
+    if (method === "POST" && (path === "/api/limix/hub/install" || path === "/api/limix/hub/update")) {
+        const result = await installHubSkill(id, { allowTools: record.allowTools === true });
+        return "error" in result ? { status: 422, body: result } : { status: 200, body: result };
+    }
+    if (method === "POST" && path === "/api/limix/hub/enable") {
+        const result = setHubSkillEnabled(id, record.enabled === true);
+        return "error" in result ? { status: 422, body: result } : { status: 200, body: result };
+    }
+    if (method === "POST" && path === "/api/limix/hub/remove") {
+        const result = removeHubSkill(id);
+        return "error" in result ? { status: 422, body: result } : { status: 200, body: result };
+    }
+    return null;
+}
+let started = false;
+/** Auto Sync: once soon after start, then checked every 30 minutes; it only runs when 20 h have passed. */
+export function startHubAutoSync() {
+    if (started)
+        return;
+    started = true;
+    const tick = () => {
+        const settings = hubSettings();
+        if (!settings.autoSync)
+            return;
+        if (settings.lastSync && Date.now() - Date.parse(settings.lastSync) < SYNC_MIN_GAP_MS)
+            return;
+        void syncHub();
+    };
+    setTimeout(tick, 60_000).unref();
+    setInterval(tick, 30 * 60 * 1000).unref();
+}

package/dist-server/server/routes/bot-skills.js

@@ -4,6 +4,8 @@ import { setNativeSkillEnabled } from "../native-skill-choices.js";
 import { botSkillTemplateSchema } from "../new-bot-defaults.js";
 import { fetchSkillFromSource } from "../skill-fetch.js";
 import { readLocalSkills } from "../limix-skill-folder.js";
+import { loadBundledSkills } from "../skill-library.js";
+import { handleLimixHub } from "../limix-skill-hub.js";
 import { skillImportSummary } from "../skill-folder.js";
 import { installLibrarySkill, librarySkillOptOuts, listLibrarySkills, readLibrarySkillFile, readSkillLibraryIndex, setLibrarySkillEveryBot, setLibrarySkillOptOut, setLibrarySkillReviewState, skillsLibraryEnabled, unassignLibrarySkill } from "../skill-library.js";
 import { installSkill, listBotSkillsWithOrigin, listStagedSkillWrites, parseSkillMd, removeSkill, scanSkillText, setSkillEnabled, } from "../skills.js";
@@ -12,6 +14,15 @@ export function createBotSkillsRoutes(deps) {
     const { store, cfg, listBotSkills, readBotSkillFile, stagedSkillListing } = deps;
     return async ({ req, res, url, path, method, json, readBody }) => {
         let m = null;
+        if (path.startsWith("/api/limix/hub")) {
+            const hub = await handleLimixHub(method, path, method === "POST" ? await readBody(req) : undefined);
+            if (hub)
+                return json(res, hub.status, hub.body);
+        }
+        if (method === "GET" && path === "/api/limix/bundled-skills") {
+            const skills = loadBundledSkills().map(({ manifest }) => ({ id: manifest.id, name: manifest.name, description: manifest.description, defaultEnabled: manifest.defaultEnabled, triggerTerms: manifest.triggerTerms }));
+            return json(res, 200, { skills });
+        }
         // Imports land DISABLED: a person enables one after reading SKILL.md and its scan warnings.
         m = path.match(/^\/api\/bots\/([\w-]+)\/skill-template$/);
         if (m && method === "POST") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "limixbot",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "description": "Run the Limix Bot server anywhere and pair your devices to it (Leox ৹ Limix AI)",
   "license": "Apache-2.0",
   "type": "module",