limixbot 0.3.23 → 0.3.25

package/dist-server/openmausbot.js

@@ -4193,7 +4193,7 @@ string(),skillManifestEntrySchema),stagedSkillWriteSchema=external_exports.objec
 /^[a-f0-9]{64}$/).optional(),warnings:external_exports.array(external_exports.string()),skippedFiles:external_exports.array(external_exports.string()),createdAt:external_exports.string(),baseSha256:external_exports.string().regex(/^[a-f0-9]{64}$/).optional(),baseAppliedStageId:external_exports.string().optional()}).superRefine((entry,ctx)=>{entry.action==="update"&&(!entry.baseSha256||!entry.baseAppliedStageId)&&ctx.addIssue({code:"custom",message:"updated skills require their reviewed base revi\
 sion"})}),stagedStoreSchema=external_exports.object({writes:external_exports.record(external_exports.string(),stagedSkillWriteSchema)})}});import{dirname as dirname29,isAbsolute as isAbsolute14,join as join64,resolve as resolve22}from"node:path";var IMPORTED_SKILLS_DIR,INDEX_PATH,sha256Hex,entrySchema,indexSchema,choicesSchema2,init_imported_skills=__esm({"server/imported-skills.ts"(){"use strict";init_zod();init_skill_fit();init_skill_md();init_atomic();init_config3();init_skill_storage();init_skills();IMPORTED_SKILLS_DIR=join64(DATA_DIR,"imported-skills"),INDEX_PATH=join64(DATA_DIR,"skill-state","imported-skills.json"),sha256Hex=
 external_exports.string().regex(/^[a-f0-9]{64}$/),entrySchema=external_exports.object({description:external_exports.string(),source:external_exports.enum(["claudeCode","codex"]),root:external_exports.string(),origin:external_exports.string(),label:external_exports.string(),sha256:sha256Hex,filesSha256:sha256Hex,importedAt:external_exports.string(),warnings:external_exports.array(external_exports.string()),license:external_exports.string().optional(),compatibility:external_exports.string().optional()}),
-indexSchema=external_exports.record(external_exports.string(),entrySchema),choicesSchema2=external_exports.object({off:external_exports.array(external_exports.string()),on:external_exports.record(external_exports.string(),sha256Hex).default({}),listed:external_exports.array(external_exports.string()).optional()})}});function parseToml(source){let text13=source.charCodeAt(0)===65279?source.slice(1):source,i2=0,root=table(),current=root,fail3=message5=>{throw new TomlError(`line ${text13.slice(0,i2).split(`
+indexSchema=external_exports.record(external_exports.string(),entrySchema),choicesSchema2=external_exports.object({off:external_exports.array(external_exports.string()),on:external_exports.record(external_exports.string(),sha256Hex).default({}),listed:external_exports.array(external_exports.string()).optional(),picked:external_exports.array(external_exports.string()).optional()})}});function parseToml(source){let text13=source.charCodeAt(0)===65279?source.slice(1):source,i2=0,root=table(),current=root,fail3=message5=>{throw new TomlError(`line ${text13.slice(0,i2).split(`
 `).length}: ${message5}`)},spaces=()=>{for(;text13[i2]===" "||text13[i2]==="	";)i2++},comment=()=>{if(text13[i2]==="#")for(;i2<text13.length&&text13[i2]!==`
 `;)i2++},newline=()=>{if(text13[i2]===`
 `)i2+=1;else if(text13[i2]==="\r"&&text13[i2+1]===`

package/dist-server/package.json

@@ -1 +1 @@
-{"type":"module","version":"0.3.23"}
+{"type":"module","version":"0.3.25"}

package/dist-server/pair-cli.js

@@ -4192,7 +4192,7 @@ string(),skillManifestEntrySchema),stagedSkillWriteSchema=external_exports.objec
 /^[a-f0-9]{64}$/).optional(),warnings:external_exports.array(external_exports.string()),skippedFiles:external_exports.array(external_exports.string()),createdAt:external_exports.string(),baseSha256:external_exports.string().regex(/^[a-f0-9]{64}$/).optional(),baseAppliedStageId:external_exports.string().optional()}).superRefine((entry,ctx)=>{entry.action==="update"&&(!entry.baseSha256||!entry.baseAppliedStageId)&&ctx.addIssue({code:"custom",message:"updated skills require their reviewed base revi\
 sion"})}),stagedStoreSchema=external_exports.object({writes:external_exports.record(external_exports.string(),stagedSkillWriteSchema)})}});import{dirname as dirname29,isAbsolute as isAbsolute14,join as join64,resolve as resolve22}from"node:path";var IMPORTED_SKILLS_DIR,INDEX_PATH,sha256Hex,entrySchema,indexSchema,choicesSchema2,init_imported_skills=__esm({"server/imported-skills.ts"(){"use strict";init_zod();init_skill_fit();init_skill_md();init_atomic();init_config3();init_skill_storage();init_skills();IMPORTED_SKILLS_DIR=join64(DATA_DIR,"imported-skills"),INDEX_PATH=join64(DATA_DIR,"skill-state","imported-skills.json"),sha256Hex=
 external_exports.string().regex(/^[a-f0-9]{64}$/),entrySchema=external_exports.object({description:external_exports.string(),source:external_exports.enum(["claudeCode","codex"]),root:external_exports.string(),origin:external_exports.string(),label:external_exports.string(),sha256:sha256Hex,filesSha256:sha256Hex,importedAt:external_exports.string(),warnings:external_exports.array(external_exports.string()),license:external_exports.string().optional(),compatibility:external_exports.string().optional()}),
-indexSchema=external_exports.record(external_exports.string(),entrySchema),choicesSchema2=external_exports.object({off:external_exports.array(external_exports.string()),on:external_exports.record(external_exports.string(),sha256Hex).default({}),listed:external_exports.array(external_exports.string()).optional()})}});function parseToml(source){let text13=source.charCodeAt(0)===65279?source.slice(1):source,i2=0,root=table(),current=root,fail3=message5=>{throw new TomlError(`line ${text13.slice(0,i2).split(`
+indexSchema=external_exports.record(external_exports.string(),entrySchema),choicesSchema2=external_exports.object({off:external_exports.array(external_exports.string()),on:external_exports.record(external_exports.string(),sha256Hex).default({}),listed:external_exports.array(external_exports.string()).optional(),picked:external_exports.array(external_exports.string()).optional()})}});function parseToml(source){let text13=source.charCodeAt(0)===65279?source.slice(1):source,i2=0,root=table(),current=root,fail3=message5=>{throw new TomlError(`line ${text13.slice(0,i2).split(`
 `).length}: ${message5}`)},spaces=()=>{for(;text13[i2]===" "||text13[i2]==="	";)i2++},comment=()=>{if(text13[i2]==="#")for(;i2<text13.length&&text13[i2]!==`
 `;)i2++},newline=()=>{if(text13[i2]===`
 `)i2+=1;else if(text13[i2]==="\r"&&text13[i2+1]===`

package/dist-server/server/imported-skills.js

@@ -47,6 +47,8 @@ const choicesSchema = z.object({
     off: z.array(z.string()),
     on: z.record(z.string(), sha256Hex).default({}),
     listed: z.array(z.string()).optional(),
+    /** Limix Bot: skills from this computer are off for a bot until a person adds one from its store. */
+    picked: z.array(z.string()).optional(),
 });
 /** Every imported skill by name; empty when there are none or the index cannot be trusted. */
 export function readImportedSkills() {
@@ -279,6 +281,8 @@ export function storeImportedSkills(inputs) {
 function enabledFor(name, entry, choices) {
     if (choices.off.includes(name))
         return false;
+    if (!(choices.picked ?? []).includes(name))
+        return false;
     return entry.warnings.length === 0 || choices.on[name] === entry.filesSha256;
 }
 const comparable = (path) => {
@@ -361,9 +365,10 @@ export function setImportedSkillEnabled(botId, name, enabled) {
     const off = choices.off.filter((other) => other !== name);
     const { [name]: _read, ...on } = choices.on;
     const listed = choices.listed?.filter((other) => other !== name);
+    const picked = (choices.picked ?? []).filter((other) => other !== name);
     const next = enabled
-        ? { off, on: entry.warnings.length ? { ...on, [name]: entry.filesSha256 } : on, ...(listed ? { listed: [...listed, name].sort() } : {}) }
-        : { off: [...off, name].sort(), on, ...(listed ? { listed } : {}) };
+        ? { off, on: entry.warnings.length ? { ...on, [name]: entry.filesSha256 } : on, ...(listed ? { listed: [...listed, name].sort() } : {}), picked: [...picked, name].sort() }
+        : { off: [...off, name].sort(), on, ...(listed ? { listed } : {}), picked };
     mkdirSync(dirname(choicesPath(botId)), { recursive: true, mode: 0o700 });
     writeFileAtomic(choicesPath(botId), `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
     return importedSkillListings(botId, new Set()).find((skill) => skill.name === name);

package/dist-server/server/index.js

@@ -442,7 +442,7 @@ import { AGENTS_NODE_FLAG, SPAWNED_PROXIES } from "./proxy-paths.js";
 import { agentsProxyLaunch, agentsToolBridgeEnv, applyAgentsBridge, bridgedToolTitle, turnEngine } from "./agents-bridge-switch.js";
 import { agentsServerEnv, botDrivenConversation, COMPUTER_OFF_REFUSAL, computerPickRefusal, directTurnKind, roomSkillsRefusal } from "./agents-turn.js";
 import { harnessMcpTokenEnv } from "./harness-mcp-token.js";
-import { loadBundledSkills, loadUserSkills, mergeSkills, renderSkillInstructions, selectBundledSkills, skillsLibraryEnabled, readSkillLibraryIndex, } from "./skill-library.js";
+import { loadBundledSkills, loadUserSkills, mergeSkills, renderSkillInstructions, skillsLibraryEnabled, readSkillLibraryIndex, } from "./skill-library.js";
 import { runSkillsLibraryBootSweep } from "./skills-library-migration.js";
 import { installedPlaybookInstructions } from "./installed-playbooks.js";
 import { picture as sharedPicture } from "./package-export.js";
@@ -512,6 +512,7 @@ import { createBotOrderRoutes } from "./routes/bot-order.js";
 import { createBotLifecycleRoutes } from "./routes/bot-lifecycle.js";
 import { createBotSkillsRoutes } from "./routes/bot-skills.js";
 import { startHubAutoSync } from "./limix-skill-hub.js";
+import { limixBundledFor, limixSelectBundled, limixSkillDefaultsMigration } from "./limix-skill-store.js";
 import { createSkillShareRoutes } from "./routes/skill-share.js";
 import { createTeamContextRoutes } from "./routes/team-context.js";
 import { createAppSuggestions } from "./host/app-suggestions.js";
@@ -661,7 +662,7 @@ const CLOUD_ENV = { ...process.env, ...CLOUD_SECRETS };
 const CLOUD_HOME = cloudHomeConfiguration(CLOUD_ENV);
 const CLOUD_TEAM = CLOUD_HOME?.team ?? null, CLOUD_PERSONAL = CLOUD_HOME !== null && CLOUD_TEAM === null, TEAM_LABEL = CLOUD_TEAM ? { label: CLOUD_TEAM.name } : {};
 /** The language set on this server, else (on a Team Cloud) the team's default from the Admin. threadLanguage: the one a line in a conversation is written in, its one person's, else the place's (server/server-lines.ts). */
-const appLanguage = () => cfg.language ?? CLOUD_TEAM?.language;
+const appLanguage = () => cfg.language ?? CLOUD_TEAM?.language ?? (process.env.OMB_UI_LANGUAGE?.trim() || undefined);
 const personLanguages = createPersonLanguages({ dataDir: DATA_DIR, configured: appLanguage, privateTo: (threadId) => teamHost.privateTo(threadId) });
 const threadLanguage = personLanguages.forThread;
 setConversationLanguage(threadLanguage);
@@ -1436,6 +1437,7 @@ function resyncOpenCodeProviderKeys() {
 const firstEngineRead = holdUntilFirstEngineRead();
 await registry.load(providerConfigs(), decorateHostedProvider);
 const bundledSkills = loadBundledSkills();
+limixSkillDefaultsMigration();
 const availableSkills = () => mergeSkills(bundledSkills, loadUserSkills(join(DATA_DIR, "skills")));
 /** Every turn the engine can mount it, whatever its words: they pick only the skill's instructions. A Cloud home or a hosted workspace has no USB port. */
 const usbPhoneOffered = (instance, skills) => instance.adapter.capabilities.phoneMcp === true &&
@@ -8084,8 +8086,8 @@ async function beginTurn(botId, text, opts) {
                 handoffs.begin(threadId, dispatchClaimId, dispatchContext.handoff);
             const integrations = {};
             let browser = null;
-            const skills = availableSkills(), phoneOffered = usbPhoneOffered(instance, skills) && !proactive.fence.confines(threadId) && !botApiThread(threadId);
-            const selectedSkills = selectBundledSkills(providerText, [
+            const skills = limixBundledFor(bot.id, availableSkills()), phoneOffered = usbPhoneOffered(instance, skills) && !proactive.fence.confines(threadId) && !botApiThread(threadId);
+            const selectedSkills = limixSelectBundled(providerText, [
                 ...(phoneOffered ? ["phoneMcp"] : []),
                 ...(skillAuthoring ? ["skillAuthoring"] : []),
             ], skills);
@@ -10048,8 +10050,8 @@ setupRetry = 0) {
             : undefined, bot.id);
         const roomContext = roomWindow.text;
         const turnImages = usesNativeImageInput ? [...burstImages, ...resolvedLatestImages.images, ...await videoFramesWithin(burstImages.length + resolvedLatestImages.images.length, resolvedLatestImages.videos)] : [];
-        const skills = availableSkills(), phoneOffered = usbPhoneOffered(instance, skills);
-        const selectedSkills = mergeSkills(selectBundledSkills(roomContext, phoneOffered ? ["phoneMcp"] : [], skills), selectBundledSkills(latestUser?.text ?? "", skillAuthoring ? ["skillAuthoring"] : [], skills));
+        const skills = limixBundledFor(bot.id, availableSkills()), phoneOffered = usbPhoneOffered(instance, skills);
+        const selectedSkills = mergeSkills(limixSelectBundled(roomContext, phoneOffered ? ["phoneMcp"] : [], skills), limixSelectBundled(latestUser?.text ?? "", skillAuthoring ? ["skillAuthoring"] : [], skills));
         if (phoneOffered)
             integrations.phone = phoneIntegration(bot.id, threadId, internalGeneration);
         try {

package/dist-server/server/initial-greeting.js

@@ -6,6 +6,7 @@ const GREETINGS = {
     es: (name, person) => `Hola${person ? ` ${person}` : ""}, soy ${name}. ¿Qué te gustaría que hiciera?`,
     "pt-br": (name, person) => `Oi${person ? ` ${person}` : ""}, eu sou ${name}. O que você gostaria que eu fizesse?`,
     ko: (name, person) => `안녕하세요${person ? `, ${person}님` : ""}. 저는 ${name}입니다. 무엇을 도와드릴까요?`,
+    vi: (name, person) => `Xin chào${person ? ` ${person}` : ""}, mình là ${name}. Bạn muốn mình giúp việc gì?`,
     "zh-tw": (name, person) => `嗨${person ? ` ${person}` : ""}，我是 ${name}。你想要我幫你做什麼？`,
 };
 /** What the bot says the moment Set me up is pressed: no model is asked, so it is written here. */
@@ -14,6 +15,7 @@ const SETUP_REQUEST_LINES = {
     es: "Genial. Cuéntame con tus propias palabras en qué te gustaría que te ayude y me prepararé para ello. Por ejemplo: \"ordena mi bandeja de entrada cada mañana\" o \"investiga a nuestros competidores cada semana\".",
     "pt-br": "Ótimo. Me conte com suas palavras em que você gostaria de ajuda e eu me preparo para isso. Por exemplo: \"organize minha caixa de entrada toda manhã\" ou \"pesquise nossos concorrentes toda semana\".",
     ko: "좋아요. 도움이 필요한 일을 편하게 말씀해 주시면 거기에 맞게 제가 설정할게요. 예: \"매일 아침 받은편지함 정리해 줘\", \"매주 경쟁사 조사해 줘\".",
+    vi: "Tuyệt. Bạn cứ kể bằng lời của mình về việc cần giúp, mình sẽ tự thiết lập để làm việc đó. Ví dụ: \"sắp xếp hộp thư của tôi mỗi sáng\" hoặc \"tìm hiểu đối thủ của chúng tôi mỗi tuần\".",
     "zh-tw": "好的。用你自己的話告訴我想要幫忙的事，我會照著設定好自己。例如：「每天早上整理我的收件匣」或「每週研究我們的競爭對手」。",
 };
 /** The answers a blank bot's greeting offers on its setup card. Picking one sets the bot up for its words, as
@@ -27,6 +29,8 @@ const SETUP_CHOICES = {
         "Reservas, compras e tarefas", "Dados, planilhas e relatórios"],
     ko: ["리서치와 주제 깊이 파고들기", "이것저것 지켜보기", "이메일, 캘린더, 메시지",
         "예약, 쇼핑, 심부름", "데이터, 스프레드시트, 보고서"],
+    vi: ["Nghiên cứu và tìm hiểu sâu một chủ đề", "Theo dõi mọi việc giúp tôi", "Email, lịch và tin nhắn",
+        "Đặt chỗ, mua sắm và việc vặt", "Dữ liệu, bảng tính và báo cáo"],
     "zh-tw": ["研究與深入探討主題", "幫我留意各種事情", "電子郵件、行事曆和訊息",
         "預約、購物和跑腿", "資料、試算表和報告"],
 };

package/dist-server/server/limix-bot-library.js

@@ -0,0 +1,184 @@
+// Limix bot templates: the "Bot dựng sẵn" list in Templates comes from github.com/leomieo/limix-bot-teams.
+// GET /api/limix/bots reads only the light list in catalog.json (cached ten minutes); GET /api/limix/bots/<id> fetches
+// that one bot's file when the person presses "Dùng mẫu". Everything is checked here before it reaches the page, and a
+// template only describes who the bot is: its routines always arrive paused and nothing is connected for the person.
+import { MASCOT_BODY_IDS } from "../shared/mascot-bodies.js";
+import { MAUS_COLOR_NAMES } from "../shared/wire.js";
+const TEAM_LIBRARY_RAW_ROOT = "https://raw.githubusercontent.com/leomieo/limix-bot-teams/main";
+const LIST_TTL_MS = 10 * 60 * 1000;
+const MAX_CATALOG_BYTES = 256_000;
+const MAX_BOT_BYTES = 64_000;
+const CATEGORIES = ["everyday", "work", "writing", "design", "sales", "personal"];
+const ID = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const NOTE_PATH = /^(?:MEMORY\.md|memory\/[a-z0-9][a-z0-9-]{0,63}\.md)$/;
+const TIME = /^(?:[01]\d|2[0-3]):[0-5]\d$/;
+const isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+function text(value, field, max, allowEmpty = false) {
+    if (typeof value !== "string" || (!allowEmpty && !value.trim()))
+        throw new Error(`${field} is required`);
+    const trimmed = value.trim();
+    if (trimmed.length > max)
+        throw new Error(`${field} is too long`);
+    return trimmed;
+}
+function look(value, field) {
+    if (!isRecord(value))
+        throw new Error(`${field} is invalid`);
+    const color = text(value.color, `${field}.color`, 20);
+    const mascotBody = text(value.mascotBody, `${field}.mascotBody`, 20);
+    if (!MAUS_COLOR_NAMES.includes(color))
+        throw new Error(`${field}.color is not a known colour`);
+    if (!MASCOT_BODY_IDS.includes(mascotBody))
+        throw new Error(`${field}.mascotBody is not a known shape`);
+    return { color, mascotBody };
+}
+function category(value, field) {
+    const found = CATEGORIES.find((entry) => entry === value);
+    if (!found)
+        throw new Error(`${field} is not a known category`);
+    return found;
+}
+function apps(value, field) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > 10)
+        throw new Error(`${field} is invalid`);
+    return value.map((app, index) => {
+        const slug = text(app, `${field}[${index}]`, 40);
+        if (!/^[a-z0-9][a-z0-9_-]*$/.test(slug))
+            throw new Error(`${field}[${index}] is invalid`);
+        return slug;
+    });
+}
+export function parseBotListing(value) {
+    if (!isRecord(value) || value.format !== "openmaus.catalog" || value.version !== 1)
+        throw new Error("Danh sách mẫu không đúng định dạng");
+    if (value.bots === undefined)
+        return [];
+    if (!Array.isArray(value.bots) || value.bots.length > 200)
+        throw new Error("Danh sách bot mẫu không hợp lệ");
+    const seen = new Set();
+    const out = [];
+    value.bots.forEach((raw, index) => {
+        const field = `bots[${index}]`;
+        try {
+            if (!isRecord(raw))
+                throw new Error(`${field} is invalid`);
+            const id = text(raw.id, `${field}.id`, 64);
+            if (!ID.test(id) || seen.has(id))
+                throw new Error(`${field}.id is invalid`);
+            const routines = typeof raw.routines === "number" && Number.isSafeInteger(raw.routines) && raw.routines >= 0 && raw.routines <= 10 ? raw.routines : 0;
+            out.push({
+                id, name: text(raw.name, `${field}.name`, 40), title: text(raw.title, `${field}.title`, 80),
+                category: category(raw.category, `${field}.category`), description: text(raw.description, `${field}.description`, 300),
+                try: text(raw.try, `${field}.try`, 200), look: look(raw.look, `${field}.look`), apps: apps(raw.apps, `${field}.apps`), routines,
+            });
+            seen.add(id);
+        }
+        catch {
+            // One broken entry hides that entry only; the rest of the list still shows.
+        }
+    });
+    return out;
+}
+export function parseLibraryBot(value, expectedId) {
+    if (!isRecord(value) || value.format !== "limix.bot" || value.version !== 1)
+        throw new Error("Tệp bot mẫu không đúng định dạng");
+    const id = text(value.id, "id", 64);
+    if (id !== expectedId)
+        throw new Error("Tệp bot mẫu không khớp với danh sách");
+    if (!Array.isArray(value.tryAsking) || value.tryAsking.length === 0 || value.tryAsking.length > 6)
+        throw new Error("tryAsking is invalid");
+    const bot = {
+        id, category: category(value.category, "category"), name: text(value.name, "name", 40), title: text(value.title, "title", 80),
+        description: text(value.description, "description", 300), soul: text(value.soul, "soul", 8_000), look: look(value.look, "look"),
+        tryAsking: value.tryAsking.map((line, index) => text(line, `tryAsking[${index}]`, 200)), apps: apps(value.apps, "apps"),
+    };
+    if (value.notes !== undefined) {
+        if (!isRecord(value.notes) || Object.keys(value.notes).length > 6)
+            throw new Error("notes is invalid");
+        bot.notes = {};
+        for (const [path, note] of Object.entries(value.notes)) {
+            if (!NOTE_PATH.test(path))
+                throw new Error(`notes path ${path} is not allowed`);
+            bot.notes[path] = text(note, `notes.${path}`, 8_000) + "\n";
+        }
+    }
+    if (value.routines !== undefined) {
+        if (!Array.isArray(value.routines) || value.routines.length > 5)
+            throw new Error("routines is invalid");
+        bot.routines = value.routines.map((raw, index) => {
+            const field = `routines[${index}]`;
+            if (!isRecord(raw) || !isRecord(raw.schedule) || raw.schedule.type !== "daily")
+                throw new Error(`${field} is invalid`);
+            const time = text(raw.schedule.time, `${field}.schedule.time`, 5);
+            if (!TIME.test(time))
+                throw new Error(`${field}.schedule.time is invalid`);
+            const weekdays = raw.schedule.weekdays;
+            if (!Array.isArray(weekdays) || weekdays.length === 0 || weekdays.length > 7 || weekdays.some((day) => !Number.isInteger(day) || day < 0 || day > 6)) {
+                throw new Error(`${field}.schedule.weekdays is invalid`);
+            }
+            // Paused, always: the person turns a routine on after reading it.
+            return { name: text(raw.name, `${field}.name`, 80), prompt: text(raw.prompt, `${field}.prompt`, 2_000),
+                schedule: { type: "daily", time, weekdays: [...new Set(weekdays)].sort() }, enabled: false, overlap: "skip" };
+        });
+    }
+    if (value.skills !== undefined) {
+        if (!Array.isArray(value.skills) || value.skills.length > 20 || value.skills.some((name) => typeof name !== "string" || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name) || name.length > 64)) {
+            throw new Error("skills is invalid");
+        }
+        bot.skills = [...new Set(value.skills)];
+    }
+    return bot;
+}
+async function fetchJson(url, maxBytes) {
+    const response = await fetch(url, { headers: { accept: "application/json, text/plain;q=0.9" }, redirect: "error", signal: AbortSignal.timeout(10_000) });
+    if (!response.ok)
+        throw new Error(`GitHub trả lỗi HTTP ${response.status}`);
+    const raw = await response.text();
+    if (Buffer.byteLength(raw) > maxBytes)
+        throw new Error("Tệp mẫu quá lớn");
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new Error("GitHub không trả về JSON hợp lệ");
+    }
+}
+let cached = null;
+/** `fresh`: the "Cập nhật" button. Skips this cache and GitHub's (raw files are cached there for about five minutes). */
+async function listing(fresh = false) {
+    if (!fresh && cached && Date.now() - cached.at < LIST_TTL_MS)
+        return cached.bots;
+    try {
+        const bots = parseBotListing(await fetchJson(`${TEAM_LIBRARY_RAW_ROOT}/catalog.json${fresh ? `?t=${Date.now()}` : ""}`, MAX_CATALOG_BYTES));
+        cached = { at: Date.now(), bots };
+        return bots;
+    }
+    catch (error) {
+        if (cached)
+            return cached.bots; // an older list beats none while GitHub is unreachable
+        throw error;
+    }
+}
+/** GET /api/limix/bots, POST /api/limix/bots/refresh and GET /api/limix/bots/<id>. Null for any other path. */
+export async function handleLimixBotLibrary(method, path) {
+    try {
+        if (method === "POST" && path === "/api/limix/bots/refresh")
+            return { status: 200, body: { bots: await listing(true) } };
+        if (method !== "GET")
+            return null;
+        if (path === "/api/limix/bots")
+            return { status: 200, body: { bots: await listing() } };
+        const match = path.match(/^\/api\/limix\/bots\/([a-z0-9][a-z0-9-]{0,63})$/);
+        if (!match)
+            return null;
+        const id = match[1];
+        if (!(await listing()).some((bot) => bot.id === id))
+            return { status: 404, body: { error: "Không có bot mẫu này" } };
+        return { status: 200, body: { bot: parseLibraryBot(await fetchJson(`${TEAM_LIBRARY_RAW_ROOT}/bots/${id}.json?t=${Date.now()}`, MAX_BOT_BYTES), id) } };
+    }
+    catch (error) {
+        return { status: 502, body: { error: error instanceof Error ? error.message : String(error) } };
+    }
+}

package/dist-server/server/limix-skill-hub.js

@@ -1,6 +1,6 @@
 // Limix Skill Hub client: keeps a cached copy of the hub catalog, installs a skill only after every file matches the
 // SHA-256 the catalog pins, and never installs scripts, binaries or MCP files unless the owner allows tools for that
-// one skill. Installed skills land DISABLED; the owner turns them on. Auto Sync (catalog refresh) is on by default,
+// one skill. Installed skills wait in the store ("Kho Kĩ Năng (Skills)"), switched on but on no bot until one is added to it. Auto Sync (catalog refresh) is on by default,
 // Auto Install is off by default.
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
@@ -171,7 +171,7 @@ export async function installHubSkill(id, options = {}) {
         ...(entry.tags.length ? { tags: entry.tags } : {}),
         warnings: entry.notes,
         skippedFiles: skipped,
-        reviewState: "disabled",
+        reviewState: "approved",
         ...(files.length ? { files } : {}),
     });
     if ("error" in result)

package/dist-server/server/limix-skill-store.js

@@ -0,0 +1,179 @@
+// Limix Bot: skills are chosen per bot. A new bot starts with only Limix's core skills (learning new skills, reading
+// links with Agent Reach, operating Windows, the phone helpers) plus the skills it learns itself; everything else waits
+// in the store ("Kho Kĩ Năng (Skills)") until a person adds it to one bot. Settings → Kĩ Năng (Skills) only downloads and
+// installs skills into the store; it never turns a skill on for every bot.
+//
+// Three kinds of skill can be added to a bot from the store:
+//   bundled  — shipped in skills/<id> (ui-ux-pro-max, data-dashboards…): the bot's picks live in
+//              <data>/skill-state/<bot>/limix-bundled.json; core ones are always on and cannot be removed.
+//   library  — installed from the Limix Skill Hub or pasted in Settings: the bot's assignedSkills.
+//   imported — brought in from this computer's Claude Code or Codex: the bot's own switch (opt-in in Limix).
+// `/name` calls any skill the bot has, bundled ones included (limixSelectBundled).
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { isSkillName } from "../shared/skill-md.js";
+import { writeFileAtomic } from "./atomic.js";
+import { DATA_DIR } from "./config.js";
+import { importedSkillListings, setImportedSkillEnabled } from "./imported-skills.js";
+import { listLibrarySkills, loadBundledSkills, mergeSkills, readSkillLibraryIndex, selectBundledSkills, setLibrarySkillEveryBot, setLibrarySkillOptOut, setLibrarySkillReviewState, unassignLibrarySkill, } from "./skill-library.js";
+/** Always on for every bot. "Learning new skills" itself is the skill-authoring feature, on for every bot already. */
+export const LIMIX_CORE_SKILLS = new Set([
+    "create-verification-skill", "agent-reach", "windows-computer-automation", "phone-connection", "phone-harness",
+]);
+const BOT_ID = /^[\w-]+$/;
+const picksPath = (botId) => join(DATA_DIR, "skill-state", botId, "limix-bundled.json");
+export function bundledPicks(botId) {
+    if (!BOT_ID.test(botId))
+        return new Set();
+    try {
+        const parsed = JSON.parse(readFileSync(picksPath(botId), "utf8"));
+        return new Set(Array.isArray(parsed) ? parsed.filter((name) => typeof name === "string" && isSkillName(name)) : []);
+    }
+    catch {
+        return new Set();
+    }
+}
+function setBundledPick(botId, id, on) {
+    if (!BOT_ID.test(botId) || !isSkillName(id))
+        return;
+    const picks = bundledPicks(botId);
+    if (picks.has(id) === on)
+        return;
+    if (on)
+        picks.add(id);
+    else
+        picks.delete(id);
+    mkdirSync(join(DATA_DIR, "skill-state", botId), { recursive: true, mode: 0o700 });
+    writeFileAtomic(picksPath(botId), `${JSON.stringify([...picks].sort(), null, 2)}\n`, { mode: 0o600 });
+}
+/** The shipped skills one bot has: the core ones and the ones a person added to it. */
+export function limixBundledFor(botId, skills) {
+    const picks = bundledPicks(botId);
+    return skills.filter(({ manifest }) => LIMIX_CORE_SKILLS.has(manifest.id) || picks.has(manifest.id));
+}
+const slashCalled = (text, id) => new RegExp(`(^|\\s)/${id.replace(/[-]/g, "\\-")}(?=$|[\\s.,:;!?])`, "m").test(text);
+/** selectBundledSkills, plus every skill of `skills` the text calls by `/id`. */
+export function limixSelectBundled(text, capabilities, skills) {
+    const available = new Set(capabilities);
+    const called = skills.filter(({ manifest }) => manifest.requiredCapabilities.every((capability) => available.has(capability)) && slashCalled(text, manifest.id));
+    return mergeSkills(selectBundledSkills(text, available, skills), called);
+}
+/** The bot's shipped skills as rows of its Skills page. */
+export function limixBundledListings(botId) {
+    return limixBundledFor(botId, loadBundledSkills()).map(({ manifest }) => ({
+        name: manifest.id, description: manifest.description, enabled: true, editable: false,
+        source: LIMIX_CORE_SKILLS.has(manifest.id) ? "Kĩ năng gốc của Limix Bot" : "Kho Kĩ Năng (Skills) · có sẵn",
+        sha256: "", importedAt: "", warnings: [], skippedFiles: [], origin: "bundled", core: LIMIX_CORE_SKILLS.has(manifest.id),
+    }));
+}
+/** A bot's switch for one of its shipped skills: off takes an added one away; a core one stays. Null: not shipped. */
+export function limixBundledSwitch(botId, name, enabled) {
+    if (!loadBundledSkills().some(({ manifest }) => manifest.id === name))
+        return null;
+    if (LIMIX_CORE_SKILLS.has(name)) {
+        return enabled ? { status: 200, body: { skill: limixBundledListings(botId).find((skill) => skill.name === name) } }
+            : { status: 409, body: { error: "Kĩ năng gốc của Limix Bot luôn bật cho mọi bot." } };
+    }
+    setBundledPick(botId, name, enabled);
+    return { status: 200, body: { skill: { ...limixBundledListings(botId).find((skill) => skill.name === name), name, enabled } } };
+}
+function storeItems(bots, botId) {
+    const bot = bots.bot(botId);
+    const assigned = new Set(bot.assignedSkills ?? []);
+    const picks = bundledPicks(botId);
+    const items = new Map();
+    for (const { manifest } of loadBundledSkills()) {
+        const core = LIMIX_CORE_SKILLS.has(manifest.id);
+        items.set(manifest.id, { name: manifest.id, description: manifest.description, kind: "bundled", added: core || picks.has(manifest.id), core, ready: true, warnings: 0, source: "Có sẵn trong Limix Bot" });
+    }
+    for (const skill of listLibrarySkills()) {
+        if (items.has(skill.name))
+            continue;
+        const intact = !skill.warnings.some((warning) => warning.includes("enablement is blocked"));
+        items.set(skill.name, {
+            name: skill.name, description: skill.description, kind: "library", added: assigned.has(skill.name) && skill.enabled, core: false,
+            ready: intact, warnings: skill.warnings.length, source: skill.source.startsWith("limix-hub:") ? "Thư viện kĩ năng Limix" : "Đã cài trong Cài đặt",
+        });
+    }
+    for (const skill of importedSkillListings(botId, new Set())) {
+        if (items.has(skill.name))
+            continue;
+        items.set(skill.name, { name: skill.name, description: skill.description, kind: "imported", added: skill.enabled, core: false, ready: true, warnings: skill.warnings.length, source: skill.source || "Từ máy tính này" });
+    }
+    return [...items.values()].sort((a, b) => Number(b.core) - Number(a.core) || a.name.localeCompare(b.name));
+}
+/** Add one skill to one bot, or take it away. `kind` may be left out: the store finds the name. */
+export function limixStoreSet(bots, botId, name, add, kind) {
+    const bot = bots.bot(botId);
+    if (!bot)
+        return { error: "Không tìm thấy bot." };
+    if (!isSkillName(name))
+        return { error: "Tên kĩ năng không hợp lệ." };
+    const item = storeItems(bots, botId).find((entry) => entry.name === name && (!kind || entry.kind === kind));
+    if (!item)
+        return { error: `Kho chưa có kĩ năng "${name}".` };
+    if (item.kind === "bundled") {
+        if (item.core)
+            return add ? { ok: true } : { error: "Kĩ năng gốc của Limix Bot luôn bật cho mọi bot." };
+        setBundledPick(botId, name, add);
+        return { ok: true };
+    }
+    if (item.kind === "imported") {
+        const result = setImportedSkillEnabled(botId, name, add);
+        return "error" in result ? { error: result.error } : { ok: true };
+    }
+    const assigned = bot.assignedSkills ?? [];
+    if (add) {
+        // Adding from the store is the person's choice for this bot, so a skill installed but not yet switched on is switched on.
+        const listing = listLibrarySkills().find((skill) => skill.name === name);
+        if (listing && !listing.enabled) {
+            const approved = setLibrarySkillReviewState(name, "approved");
+            if ("error" in approved)
+                return { error: approved.error };
+        }
+        setLibrarySkillOptOut(botId, name, false);
+        if (!assigned.includes(name))
+            bots.patchBot(botId, { assignedSkills: [...assigned, name] });
+        return { ok: true };
+    }
+    const result = unassignLibrarySkill(botId, name, assigned);
+    if ("unassigned" in result && result.assignedSkills)
+        bots.patchBot(botId, { assignedSkills: result.assignedSkills });
+    return { ok: true };
+}
+/** GET /api/limix/skill-store/<bot> lists the store for that bot; POST {name, add, kind?} adds or takes away one skill. */
+export function handleLimixSkillStore(bots, method, path, body) {
+    const m = path.match(/^\/api\/limix\/skill-store\/([\w-]+)$/);
+    if (!m)
+        return null;
+    const botId = m[1];
+    if (!bots.bot(botId))
+        return { status: 404, body: { error: "Không tìm thấy bot." } };
+    if (method === "GET")
+        return { status: 200, body: { skills: storeItems(bots, botId) } };
+    if (method === "POST") {
+        const raw = (body && typeof body === "object" ? body : {});
+        const kind = raw.kind === "bundled" || raw.kind === "library" || raw.kind === "imported" ? raw.kind : undefined;
+        if (typeof raw.name !== "string" || typeof raw.add !== "boolean")
+            return { status: 400, body: { error: "Cần tên kĩ năng và add." } };
+        const result = limixStoreSet(bots, botId, raw.name, raw.add, kind);
+        return "error" in result ? { status: 422, body: result } : { status: 200, body: { skills: storeItems(bots, botId) } };
+    }
+    return { status: 405, body: { error: "method not allowed" } };
+}
+/** Once: skills that earlier versions turned on for every bot go back to the store. */
+export function limixSkillDefaultsMigration() {
+    const marker = join(DATA_DIR, "skill-state", "limix-skill-defaults-v1.json");
+    if (existsSync(marker))
+        return;
+    try {
+        for (const [name, entry] of Object.entries(readSkillLibraryIndex()))
+            if (entry.everyBot)
+                setLibrarySkillEveryBot(name, false);
+        mkdirSync(join(DATA_DIR, "skill-state"), { recursive: true, mode: 0o700 });
+        writeFileAtomic(marker, `${JSON.stringify({ at: new Date().toISOString() })}\n`, { mode: 0o600 });
+    }
+    catch {
+        // Retried at the next start.
+    }
+}

package/dist-server/server/routes/bot-skills.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { handleLimixBotLibrary } from "../limix-bot-library.js";
 import { setImportedSkillEnabled } from "../imported-skills.js";
 import { setNativeSkillEnabled } from "../native-skill-choices.js";
 import { botSkillTemplateSchema } from "../new-bot-defaults.js";
@@ -6,6 +7,7 @@ import { fetchSkillFromSource } from "../skill-fetch.js";
 import { readLocalSkills } from "../limix-skill-folder.js";
 import { loadBundledSkills } from "../skill-library.js";
 import { handleLimixHub } from "../limix-skill-hub.js";
+import { handleLimixSkillStore, LIMIX_CORE_SKILLS, limixBundledListings, limixBundledSwitch } from "../limix-skill-store.js";
 import { skillImportSummary } from "../skill-folder.js";
 import { installLibrarySkill, librarySkillOptOuts, listLibrarySkills, readLibrarySkillFile, readSkillLibraryIndex, setLibrarySkillEveryBot, setLibrarySkillOptOut, setLibrarySkillReviewState, skillsLibraryEnabled, unassignLibrarySkill } from "../skill-library.js";
 import { installSkill, listBotSkillsWithOrigin, listStagedSkillWrites, parseSkillMd, removeSkill, scanSkillText, setSkillEnabled, } from "../skills.js";
@@ -14,13 +16,23 @@ export function createBotSkillsRoutes(deps) {
     const { store, cfg, listBotSkills, readBotSkillFile, stagedSkillListing } = deps;
     return async ({ req, res, url, path, method, json, readBody }) => {
         let m = null;
+        if (path.startsWith("/api/limix/bots")) {
+            const library = await handleLimixBotLibrary(method, path);
+            if (library)
+                return json(res, library.status, library.body);
+        }
         if (path.startsWith("/api/limix/hub")) {
             const hub = await handleLimixHub(method, path, method === "POST" ? await readBody(req) : undefined);
             if (hub)
                 return json(res, hub.status, hub.body);
         }
+        if (path.startsWith("/api/limix/skill-store/")) {
+            const skillStore = handleLimixSkillStore(store, method, path, method === "POST" ? await readBody(req) : undefined);
+            if (skillStore)
+                return json(res, skillStore.status, skillStore.body);
+        }
         if (method === "GET" && path === "/api/limix/bundled-skills") {
-            const skills = loadBundledSkills().map(({ manifest }) => ({ id: manifest.id, name: manifest.name, description: manifest.description, defaultEnabled: manifest.defaultEnabled, triggerTerms: manifest.triggerTerms }));
+            const skills = loadBundledSkills().map(({ manifest }) => ({ id: manifest.id, name: manifest.name, description: manifest.description, defaultEnabled: manifest.defaultEnabled, triggerTerms: manifest.triggerTerms, core: LIMIX_CORE_SKILLS.has(manifest.id) }));
             return json(res, 200, { skills });
         }
         // Imports land DISABLED: a person enables one after reading SKILL.md and its scan warnings.
@@ -57,14 +69,15 @@ export function createBotSkillsRoutes(deps) {
                 const { skills, library } = listBotSkillsWithOrigin(m[1], store.bot(m[1]).assignedSkills);
                 const names = new Set(skills.map((skill) => skill.name));
                 return json(res, 200, {
-                    skills: [...skills, ...listBotSkills(bot, threadId).filter((skill) => !names.has(skill.name))],
+                    skills: [...skills, ...listBotSkills(bot, threadId).filter((skill) => !names.has(skill.name)),
+                        ...limixBundledListings(bot.id).filter((skill) => !names.has(skill.name) && !listBotSkills(bot, threadId).some((other) => other.name === skill.name))],
                     library,
                     assignedSkills: store.bot(m[1]).assignedSkills,
                     staged: listStagedSkillWrites(m[1]).map(stagedSkillListing),
                 });
             }
             return json(res, 200, {
-                skills: listBotSkills(bot, threadId),
+                skills: [...listBotSkills(bot, threadId), ...limixBundledListings(bot.id)],
                 staged: listStagedSkillWrites(m[1]).map(stagedSkillListing),
             });
         }
@@ -115,8 +128,12 @@ export function createBotSkillsRoutes(deps) {
                 return json(res, 200, { skill });
             }
             const result = setSkillEnabled(m[1], m[2], parsed.data.enabled);
-            if ("error" in result)
+            if ("error" in result) {
+                const shipped = limixBundledSwitch(m[1], m[2], parsed.data.enabled);
+                if (shipped)
+                    return json(res, shipped.status, shipped.body);
                 return json(res, 404, { error: result.error });
+            }
             return json(res, 200, { skill: result });
         }
         if (m && method === "DELETE") {

package/dist-server/server/routes/teams.js

@@ -159,7 +159,7 @@ export function createTeamRoutes(deps) {
         }
         if (method === "GET" && path === "/api/team-library/catalog") {
             try {
-                return json(res, 200, await fetchTeamCatalog());
+                return json(res, 200, await fetchTeamCatalog(url.searchParams.get("fresh") ? ((input, init) => fetch(`${String(input)}?t=${Date.now()}`, init)) : fetch));
             }
             catch (error) {
                 return json(res, 502, { error: error instanceof Error ? error.message : "The team library is unavailable" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "limixbot",
-  "version": "0.3.23",
+  "version": "0.3.25",
   "description": "Run the Limix Bot server anywhere and pair your devices to it (Leox ৹ Limix AI)",
   "license": "Apache-2.0",
   "type": "module",