morpheus-cli 0.9.23 → 0.9.30

package/dist/channels/telegram.js

@@ -266,13 +266,42 @@ export class TelegramAdapter {
                     // Send "typing" status
                     await ctx.sendChatAction('typing');
                     const sessionId = await this.getSessionForUser(userId);
-                    // Process with Agent
-                    const response = await this.oracle.chat(text, undefined, false, {
+                    // Process with Agent - with a 30s timeout to avoid blocking the bot's update loop.
+                    const CHAT_TIMEOUT_MS = 30000;
+                    let timeoutTriggered = false;
+                    const chatPromise = this.oracle.chat(text, undefined, false, {
                         origin_channel: 'telegram',
                         session_id: sessionId,
                         origin_message_id: String(ctx.message.message_id),
                         origin_user_id: userId,
                     });
+                    const response = await Promise.race([
+                        chatPromise,
+                        new Promise((resolve) => setTimeout(() => {
+                            timeoutTriggered = true;
+                            resolve(null);
+                        }, CHAT_TIMEOUT_MS))
+                    ]);
+                    if (timeoutTriggered) {
+                        await ctx.reply("⏳ I'm still working on that, it's taking a bit longer than usual. I'll send the response as soon as it's ready!");
+                        // Wait for actual response in background
+                        const finalResponse = await chatPromise;
+                        if (finalResponse) {
+                            const rich = await toTelegramRichText(finalResponse);
+                            for (const chunk of rich.chunks) {
+                                try {
+                                    await ctx.reply(chunk, { parse_mode: rich.parse_mode });
+                                }
+                                catch {
+                                    const plain = stripHtmlTags(chunk).slice(0, 4096);
+                                    if (plain)
+                                        await ctx.reply(plain);
+                                }
+                            }
+                            this.display.log(`Responded to @${user} (delayed): ${finalResponse.slice(0, 50)}...`, { source: 'Telegram' });
+                        }
+                        return;
+                    }
                     if (response) {
                         const rich = await toTelegramRichText(response);
                         for (const chunk of rich.chunks) {
@@ -285,7 +314,7 @@ export class TelegramAdapter {
                                     await ctx.reply(plain);
                             }
                         }
-                        this.display.log(`Responded to @${user}: ${response}`, { source: 'Telegram' });
+                        this.display.log(`Responded to @${user}: ${response.slice(0, 50)}...`, { source: 'Telegram' });
                     }
                 }
                 catch (error) {
@@ -389,126 +418,33 @@ export class TelegramAdapter {
                     await ctx.reply(`🎤 Transcription: "${text}"`);
                     await ctx.sendChatAction('typing');
                     const sessionId = await this.getSessionForUser(userId);
-                    // Process with Agent
-                    const response = await this.oracle.chat(text, usage, true, {
+                    // Process with Agent - with a 30s timeout to avoid blocking the bot's update loop.
+                    const CHAT_TIMEOUT_MS = 30000;
+                    let timeoutTriggered = false;
+                    const chatPromise = this.oracle.chat(text, usage, true, {
                         origin_channel: 'telegram',
                         session_id: sessionId,
                         origin_message_id: String(ctx.message.message_id),
                         origin_user_id: userId,
                     });
-                    // if (listeningMsg) {
-                    //   try {
-                    //     await ctx.telegram.deleteMessage(ctx.chat.id, listeningMsg.message_id);
-                    //   } catch (e) {
-                    //     // Ignore delete error
-                    //   }
-                    // }
-                    if (response) {
-                        const ttsConfig = config.audio.tts;
-                        if (ttsConfig?.enabled && this.ttsTelephonist?.synthesize) {
-                            // TTS path: synthesize and send as voice message
-                            let ttsFilePath = null;
-                            const ttsStart = Date.now();
-                            try {
-                                this.display.startActivity('telephonist', 'Synthesizing TTS...');
-                                const ttsApiKey = getUsableApiKey(ttsConfig.apiKey) ||
-                                    getUsableApiKey(config.audio.apiKey) ||
-                                    (config.llm.provider === (ttsConfig.provider === 'google' ? 'gemini' : ttsConfig.provider)
-                                        ? getUsableApiKey(config.llm.api_key) : undefined);
-                                const ttsResult = await this.ttsTelephonist.synthesize(response, ttsApiKey || '', ttsConfig.voice, ttsConfig.style_prompt);
-                                ttsFilePath = ttsResult.filePath;
-                                const ttsDurationMs = Date.now() - ttsStart;
-                                this.display.endActivity('telephonist', true);
-                                // OGG/Opus → replyWithVoice; everything else (mp3, wav) → replyWithAudio
-                                const isOgg = ttsResult.mimeType.includes('ogg') || ttsResult.mimeType.includes('opus');
-                                if (isOgg) {
-                                    await ctx.replyWithVoice({ source: ttsFilePath });
-                                }
-                                else {
-                                    await ctx.replyWithAudio({ source: ttsFilePath });
-                                }
-                                this.display.log(`Responded to @${user} (TTS audio)`, { source: 'Telegram' });
-                                // Audit TTS success
-                                try {
-                                    const auditSessionId = await this.getSessionForUser(userId);
-                                    AuditRepository.getInstance().insert({
-                                        session_id: auditSessionId,
-                                        event_type: 'telephonist',
-                                        agent: 'telephonist',
-                                        provider: ttsConfig.provider,
-                                        model: ttsConfig.model,
-                                        input_tokens: ttsResult.usage.input_tokens || null,
-                                        output_tokens: ttsResult.usage.output_tokens || null,
-                                        duration_ms: ttsDurationMs,
-                                        status: 'success',
-                                        metadata: {
-                                            operation: 'tts',
-                                            characters: response.length,
-                                            voice: ttsConfig.voice,
-                                            user,
-                                        },
-                                    });
-                                }
-                                catch {
-                                    // Audit failure never breaks the main flow
-                                }
-                            }
-                            catch (ttsError) {
-                                this.display.endActivity('telephonist', false);
-                                const ttsDetail = ttsError?.message || String(ttsError);
-                                this.display.log(`TTS synthesis failed for @${user}: ${ttsDetail} — falling back to text`, { source: 'Telephonist', level: 'warning' });
-                                // Audit TTS failure
-                                try {
-                                    const auditSessionId = await this.getSessionForUser(userId);
-                                    AuditRepository.getInstance().insert({
-                                        session_id: auditSessionId,
-                                        event_type: 'telephonist',
-                                        agent: 'telephonist',
-                                        provider: ttsConfig.provider,
-                                        model: ttsConfig.model,
-                                        duration_ms: Date.now() - ttsStart,
-                                        status: 'error',
-                                        metadata: { operation: 'tts', error: ttsDetail, user },
-                                    });
-                                }
-                                catch {
-                                    // Audit failure never breaks the main flow
-                                }
-                                // Fallback to text
-                                const rich = await toTelegramRichText(response);
-                                for (const chunk of rich.chunks) {
-                                    try {
-                                        await ctx.reply(chunk, { parse_mode: rich.parse_mode });
-                                    }
-                                    catch {
-                                        const plain = stripHtmlTags(chunk).slice(0, 4096);
-                                        if (plain)
-                                            await ctx.reply(plain);
-                                    }
-                                }
-                            }
-                            finally {
-                                // Cleanup TTS temp file
-                                if (ttsFilePath) {
-                                    await fs.promises.unlink(ttsFilePath).catch(() => { });
-                                }
-                            }
-                        }
-                        else {
-                            // Text path (TTS disabled)
-                            const rich = await toTelegramRichText(response);
-                            for (const chunk of rich.chunks) {
-                                try {
-                                    await ctx.reply(chunk, { parse_mode: rich.parse_mode });
-                                }
-                                catch {
-                                    const plain = stripHtmlTags(chunk).slice(0, 4096);
-                                    if (plain)
-                                        await ctx.reply(plain);
-                                }
-                            }
-                            this.display.log(`Responded to @${user} (via audio)`, { source: 'Telegram' });
+                    const response = await Promise.race([
+                        chatPromise,
+                        new Promise((resolve) => setTimeout(() => {
+                            timeoutTriggered = true;
+                            resolve(null);
+                        }, CHAT_TIMEOUT_MS))
+                    ]);
+                    if (timeoutTriggered) {
+                        await ctx.reply("⏳ I'm still working on that, it's taking a bit longer than usual. I'll send the response as soon as it's ready!");
+                        // Wait for actual response in background
+                        const finalResponse = await chatPromise;
+                        if (finalResponse) {
+                            await this.handleAgentResponse(ctx, finalResponse, config, user, userId);
                         }
+                        return;
+                    }
+                    if (response) {
+                        await this.handleAgentResponse(ctx, response, config, user, userId);
                     }
                 }
                 catch (error) {
@@ -876,11 +812,17 @@ export class TelegramAdapter {
                     ctx.answerCbQuery(`Error: ${error.message}`).catch(() => { });
                 }
             });
-            this.bot.launch().catch((err) => {
-                if (this.isConnected) {
-                    this.display.log(`Telegram bot error: ${err}`, { source: 'Telegram', level: 'error' });
+            // Global error handler to prevent crashes on long-running tasks or network errors
+            this.bot.catch((err, ctx) => {
+                const updateId = ctx?.update?.update_id;
+                const errorMsg = err?.message || String(err);
+                this.display.log(`Unhandled Telegram error (Update: ${updateId}): ${errorMsg}`, { source: 'Telegram', level: 'error' });
+                // If it's a timeout error, notify the user if possible
+                if (errorMsg.includes('timeout') || errorMsg.includes('90000')) {
+                    ctx.reply("⏳ Sorry, that request is taking longer than expected. I'm still working on it, but the connection timed out. I'll notify you once it's done.").catch(() => { });
                 }
             });
+            this.launchBot();
             this.isConnected = true;
             // Check if there's a restart notification to send
             this.checkAndSendRestartNotification().catch((err) => {
@@ -1955,4 +1897,107 @@ How can I assist you today?`;
             await ctx.reply('An error occurred while retrieving the list of MCP servers\\. Please check the logs for more details\\.', { parse_mode: 'MarkdownV2' });
         }
     }
+    launchBot() {
+        if (!this.bot)
+            return;
+        this.bot.launch().catch((err) => {
+            this.display.log(`Telegram bot error: ${err.message || String(err)}`, { source: 'Telegram', level: 'error' });
+            if (this.isConnected) {
+                this.display.log('Attempting to restart Telegram bot in 5 seconds...', { source: 'Telegram', level: 'info' });
+                setTimeout(() => {
+                    if (this.isConnected)
+                        this.launchBot();
+                }, 5000);
+            }
+        });
+    }
+    async handleAgentResponse(ctx, response, config, user, userId) {
+        const ttsConfig = config.audio.tts;
+        if (ttsConfig?.enabled && this.ttsTelephonist?.synthesize) {
+            // TTS path: synthesize and send as voice message
+            let ttsFilePath = null;
+            const ttsStart = Date.now();
+            try {
+                this.display.startActivity('telephonist', 'Synthesizing TTS...');
+                const ttsApiKey = getUsableApiKey(ttsConfig.apiKey) ||
+                    getUsableApiKey(config.audio.apiKey) ||
+                    (config.llm.provider === (ttsConfig.provider === 'google' ? 'gemini' : ttsConfig.provider)
+                        ? getUsableApiKey(config.llm.api_key) : undefined);
+                const ttsResult = await this.ttsTelephonist.synthesize(response, ttsApiKey || '', ttsConfig.voice, ttsConfig.style_prompt);
+                ttsFilePath = ttsResult.filePath;
+                const ttsDurationMs = Date.now() - ttsStart;
+                this.display.endActivity('telephonist', true);
+                // OGG/Opus → replyWithVoice; everything else (mp3, wav) → replyWithAudio
+                const isOgg = ttsResult.mimeType.includes('ogg') || ttsResult.mimeType.includes('opus');
+                if (isOgg) {
+                    await ctx.replyWithVoice({ source: ttsFilePath });
+                }
+                else {
+                    await ctx.replyWithAudio({ source: ttsFilePath });
+                }
+                this.display.log(`Responded to @${user} (TTS audio)`, { source: 'Telegram' });
+                // Audit TTS success
+                try {
+                    const auditSessionId = await this.getSessionForUser(userId);
+                    AuditRepository.getInstance().insert({
+                        session_id: auditSessionId,
+                        event_type: 'telephonist',
+                        agent: 'telephonist',
+                        provider: ttsConfig.provider,
+                        model: ttsConfig.model,
+                        input_tokens: ttsResult.usage.input_tokens || null,
+                        output_tokens: ttsResult.usage.output_tokens || null,
+                        duration_ms: ttsDurationMs,
+                        status: 'success',
+                        metadata: {
+                            operation: 'tts',
+                            characters: response.length,
+                            voice: ttsConfig.voice,
+                            user,
+                        },
+                    });
+                }
+                catch {
+                    // Audit failure never breaks the main flow
+                }
+            }
+            catch (ttsError) {
+                this.display.endActivity('telephonist', false);
+                const ttsDetail = ttsError?.message || String(ttsError);
+                this.display.log(`TTS synthesis failed for @${user}: ${ttsDetail} — falling back to text`, { source: 'Telephonist', level: 'warning' });
+                // Fallback to text
+                const rich = await toTelegramRichText(response);
+                for (const chunk of rich.chunks) {
+                    try {
+                        await ctx.reply(chunk, { parse_mode: rich.parse_mode });
+                    }
+                    catch {
+                        const plain = stripHtmlTags(chunk).slice(0, 4096);
+                        if (plain)
+                            await ctx.reply(plain);
+                    }
+                }
+            }
+            finally {
+                if (ttsFilePath) {
+                    await fs.promises.unlink(ttsFilePath).catch(() => { });
+                }
+            }
+        }
+        else {
+            // Text path
+            const rich = await toTelegramRichText(response);
+            for (const chunk of rich.chunks) {
+                try {
+                    await ctx.reply(chunk, { parse_mode: rich.parse_mode });
+                }
+                catch {
+                    const plain = stripHtmlTags(chunk).slice(0, 4096);
+                    if (plain)
+                        await ctx.reply(plain);
+                }
+            }
+            this.display.log(`Responded to @${user}`, { source: 'Telegram' });
+        }
+    }
 }

package/dist/cli/commands/restart.js

@@ -9,6 +9,7 @@ import { renderBanner } from '../utils/render.js';
 import { TelegramAdapter } from '../../channels/telegram.js';
 import { ChannelRegistry } from '../../channels/registry.js';
 import { PATHS } from '../../config/paths.js';
+import { SkillRegistry } from '../../runtime/skills/index.js';
 import { Oracle } from '../../runtime/oracle.js';
 import { ProviderError } from '../../runtime/errors.js';
 import { HttpServer } from '../../http/server.js';
@@ -17,6 +18,12 @@ import { TaskWorker } from '../../runtime/tasks/worker.js';
 import { TaskNotifier } from '../../runtime/tasks/notifier.js';
 import { Link } from '../../runtime/subagents/link/link.js';
 import { LinkWorker } from '../../runtime/subagents/link/worker.js';
+import { ServiceContainer, SERVICE_KEYS } from '../../runtime/container.js';
+import { ChannelNotifierAdapter } from '../../runtime/adapters/ChannelNotifierAdapter.js';
+import { SQLiteTaskEnqueuerAdapter } from '../../runtime/adapters/SQLiteTaskEnqueuerAdapter.js';
+import { SQLiteChatHistoryAdapter } from '../../runtime/adapters/SQLiteChatHistoryAdapter.js';
+import { LangChainProviderAdapter } from '../../runtime/adapters/LangChainProviderAdapter.js';
+import { AuditRepositoryAdapter } from '../../runtime/adapters/AuditRepositoryAdapter.js';
 export const restartCommand = new Command('restart')
     .description('Restart the Morpheus agent')
     .option('--ui', 'Enable web UI', true)
@@ -67,11 +74,31 @@ export const restartCommand = new Command('restart')
         const config = await configManager.load();
         // Initialize persistent logging
         await display.initialize(config.logging);
+        // ── Composition Root ─────────────────────────────────────────────────────
+        // Register port adapters in the ServiceContainer so consumers can
+        // depend on interfaces instead of concrete implementations.
+        ServiceContainer.register(SERVICE_KEYS.notifier, new ChannelNotifierAdapter());
+        ServiceContainer.register(SERVICE_KEYS.taskEnqueuer, new SQLiteTaskEnqueuerAdapter());
+        ServiceContainer.register(SERVICE_KEYS.chatHistory, new SQLiteChatHistoryAdapter());
+        ServiceContainer.register(SERVICE_KEYS.providerFactory, new LangChainProviderAdapter());
+        ServiceContainer.register(SERVICE_KEYS.auditEmitter, new AuditRepositoryAdapter());
+        // ─────────────────────────────────────────────────────────────────────────
         display.log(chalk.green(`Morpheus Agent (${config.agent.name}) starting...`), { source: 'Zaion' });
         display.log(chalk.gray(`PID: ${process.pid}`), { source: 'Zaion' });
         if (options.ui) {
             display.log(chalk.blue(`Web UI enabled to port ${options.port}`), { source: 'Zaion' });
         }
+        // Initialize SkillRegistry before Oracle (so skills are available in system prompt)
+        try {
+            const skillRegistry = SkillRegistry.getInstance();
+            await skillRegistry.load();
+            const loadedSkills = skillRegistry.getAll();
+            const enabledCount = skillRegistry.getEnabled().length;
+            display.log(chalk.green(`✓ Skills loaded: ${loadedSkills.length} total, ${enabledCount} enabled`), { source: 'Skills' });
+        }
+        catch (err) {
+            display.log(chalk.yellow(`Skills initialization warning: ${err.message}`), { source: 'Skills' });
+        }
         // Initialize Oracle
         const oracle = new Oracle(config);
         try {

package/dist/cli/commands/start.js

@@ -133,6 +133,15 @@ export const startCommand = new Command('start')
         const config = await configManager.load();
         // Initialize persistent logging
         await display.initialize(config.logging);
+        // ── Composition Root ─────────────────────────────────────────────────────
+        // Register port adapters in the ServiceContainer so consumers can
+        // depend on interfaces instead of concrete implementations.
+        ServiceContainer.register(SERVICE_KEYS.notifier, new ChannelNotifierAdapter());
+        ServiceContainer.register(SERVICE_KEYS.taskEnqueuer, new SQLiteTaskEnqueuerAdapter());
+        ServiceContainer.register(SERVICE_KEYS.chatHistory, new SQLiteChatHistoryAdapter());
+        ServiceContainer.register(SERVICE_KEYS.providerFactory, new LangChainProviderAdapter());
+        ServiceContainer.register(SERVICE_KEYS.auditEmitter, new AuditRepositoryAdapter());
+        // ─────────────────────────────────────────────────────────────────────────
         display.log(chalk.green(`Morpheus Agent (${config.agent.name}) starting...`));
         display.log(chalk.gray(`PID: ${process.pid}`));
         if (options.ui) {
@@ -220,15 +229,6 @@ export const startCommand = new Command('start')
             await clearPid();
             process.exit(1);
         }
-        // ── Composition Root ─────────────────────────────────────────────────────
-        // Register port adapters in the ServiceContainer so consumers can
-        // depend on interfaces instead of concrete implementations.
-        ServiceContainer.register(SERVICE_KEYS.notifier, new ChannelNotifierAdapter());
-        ServiceContainer.register(SERVICE_KEYS.taskEnqueuer, new SQLiteTaskEnqueuerAdapter());
-        ServiceContainer.register(SERVICE_KEYS.chatHistory, new SQLiteChatHistoryAdapter());
-        ServiceContainer.register(SERVICE_KEYS.providerFactory, new LangChainProviderAdapter());
-        ServiceContainer.register(SERVICE_KEYS.auditEmitter, new AuditRepositoryAdapter());
-        // ─────────────────────────────────────────────────────────────────────────
         const adapters = [];
         let httpServer;
         const taskWorker = new TaskWorker();

package/dist/config/manager.js

@@ -343,6 +343,11 @@ export class ConfigManager {
                 max_active_jobs: resolveNumeric('MORPHEUS_CHRONOS_MAX_ACTIVE_JOBS', config.chronos.max_active_jobs, 100),
             };
         }
+        // Apply precedence to GWS config
+        const gwsConfig = {
+            service_account_json: resolveString('MORPHEUS_GWS_SERVICE_ACCOUNT_JSON', config.gws?.service_account_json, ''),
+            enabled: resolveBoolean('MORPHEUS_GWS_ENABLED', config.gws?.enabled, true),
+        };
         // Apply precedence to DevKit config
         // Migration: if devkit is absent but apoc.working_dir exists, migrate it
         const rawDevKit = config.devkit ?? {};
@@ -409,6 +414,22 @@ export class ConfigManager {
     async save(newConfig) {
         // Deep merge or overwrite? simpler to overwrite for now or merge top level
         let updated = { ...this.config, ...newConfig };
+        // If GWS credentials string is provided, save it to file
+        if (newConfig.gws?.service_account_json_content) {
+            const content = newConfig.gws.service_account_json_content;
+            try {
+                // Validate JSON
+                JSON.parse(content);
+                await fs.ensureDir(PATHS.gws);
+                await fs.writeFile(PATHS.gwsCredentials, content, 'utf8');
+                // Update the path in config and remove the raw content
+                newConfig.gws.service_account_json = PATHS.gwsCredentials;
+                delete newConfig.gws.service_account_json_content;
+            }
+            catch (err) {
+                throw new Error(`Invalid Google Service Account JSON: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
         // Encrypt API keys before saving if MORPHEUS_SECRET is set
         updated = this.encryptAgentApiKeys(updated);
         // Validate before saving
@@ -524,7 +545,7 @@ export class ConfigManager {
             sandbox_dir: process.cwd(),
             readonly_mode: false,
             allowed_shell_commands: [],
-            allowed_paths: [PATHS.docs, PATHS.skills],
+            allowed_paths: [PATHS.docs, PATHS.skills, PATHS.gws],
             enable_filesystem: true,
             enable_shell: true,
             enable_git: true,
@@ -535,12 +556,23 @@ export class ConfigManager {
             const merged = { ...defaults, ...this.config.devkit };
             // Ensure allowed_paths has default if empty or undefined
             if (!merged.allowed_paths?.length) {
-                merged.allowed_paths = [PATHS.docs, PATHS.skills];
+                merged.allowed_paths = [PATHS.docs, PATHS.skills, PATHS.gws];
+            }
+            else if (!merged.allowed_paths.includes(PATHS.gws)) {
+                // Force inclusion of GWS path if it's not there
+                merged.allowed_paths.push(PATHS.gws);
             }
             return merged;
         }
         return defaults;
     }
+    getGwsConfig() {
+        const defaults = { enabled: true };
+        if (this.config.gws) {
+            return { ...defaults, ...this.config.gws };
+        }
+        return defaults;
+    }
     /**
      * Returns encryption status for all agent API keys.
      */

package/dist/config/paths.js

@@ -16,6 +16,8 @@ export const PATHS = {
     mcps: path.join(MORPHEUS_ROOT, 'mcps.json'),
     skills: path.join(MORPHEUS_ROOT, 'skills'),
     docs: path.join(MORPHEUS_ROOT, 'docs'),
+    gws: path.join(MORPHEUS_ROOT, 'gws'),
+    gwsCredentials: path.join(MORPHEUS_ROOT, 'gws', 'credentials.json'),
     shortMemoryDb: path.join(MORPHEUS_ROOT, 'memory', 'short-memory.db'),
     trinityDb: path.join(MORPHEUS_ROOT, 'memory', 'trinity.db'),
     satiDb: path.join(MORPHEUS_ROOT, 'memory', 'sati-memory.db'),

package/dist/config/schemas.js

@@ -98,6 +98,11 @@ export const CurrencyConfigSchema = z.object({
     symbol: z.string().min(1).default('$'),
     rate: z.number().positive().default(1.0),
 });
+export const GwsConfigSchema = z.object({
+    service_account_json: z.string().optional(),
+    service_account_json_content: z.string().optional(),
+    enabled: z.boolean().default(true),
+});
 // Zod Schema matching MorpheusConfig interface
 export const ConfigSchema = z.object({
     agent: z.object({
@@ -123,6 +128,7 @@ export const ConfigSchema = z.object({
     chronos: ChronosConfigSchema.optional(),
     devkit: DevKitConfigSchema.optional(),
     smiths: SmithsConfigSchema.optional(),
+    gws: GwsConfigSchema.optional(),
     setup: SetupConfigSchema.optional(),
     currency: CurrencyConfigSchema.optional(),
     verbose_mode: z.boolean().default(true),

package/dist/http/webhooks-router.js

@@ -12,6 +12,7 @@ const CreateWebhookSchema = z.object({
         .regex(/^[a-z0-9-_]+$/, 'Name must be a slug: lowercase letters, numbers, hyphens, underscores only'),
     prompt: z.string().min(1).max(10_000),
     notification_channels: z.array(z.enum(['ui', 'telegram', 'discord'])).min(1).default(['ui']),
+    requires_api_key: z.boolean().default(true),
 });
 const UpdateWebhookSchema = z.object({
     name: z
@@ -23,6 +24,7 @@ const UpdateWebhookSchema = z.object({
     prompt: z.string().min(1).max(10_000).optional(),
     enabled: z.boolean().optional(),
     notification_channels: z.array(z.enum(['ui', 'telegram', 'discord'])).min(1).optional(),
+    requires_api_key: z.boolean().optional(),
 });
 const MarkReadSchema = z.object({
     ids: z.array(z.string().uuid()).min(1),
@@ -39,14 +41,18 @@ export function createWebhooksRouter() {
     router.post('/trigger/:webhook_name', async (req, res) => {
         const { webhook_name } = req.params;
         const apiKey = req.headers['x-api-key'];
-        if (!apiKey || typeof apiKey !== 'string') {
-            return res.status(401).json({ error: 'Missing x-api-key header' });
-        }
-        const webhook = repo.getAndValidateWebhook(webhook_name, apiKey);
-        if (!webhook) {
-            // Intentionally ambiguous — don't reveal whether the name exists or is disabled
+        // 1. First lookup by name to check if it requires an API key
+        const webhook = repo.getWebhookByName(webhook_name);
+        if (!webhook || !webhook.enabled) {
+            // Intentionally ambiguous
             return res.status(401).json({ error: 'Invalid webhook name or api key' });
         }
+        // 2. Validate API key if required
+        if (webhook.requires_api_key) {
+            if (!apiKey || typeof apiKey !== 'string' || apiKey !== webhook.api_key) {
+                return res.status(401).json({ error: 'Invalid webhook name or api key' });
+            }
+        }
         const payload = req.body ?? {};
         // Create pending notification immediately
         const notification = repo.createNotification({

package/dist/runtime/__tests__/gws-sync.test.js

@@ -0,0 +1,69 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import fs from 'fs-extra';
+import path from 'path';
+import { syncGwsSkills } from '../gws-sync.js';
+import { ConfigManager } from '../../config/manager.js';
+import { calculateMd5 } from '../hash-utils.js';
+import { tmpdir } from 'os';
+vi.mock('../../config/manager.js');
+vi.mock('../display.js', () => ({
+    DisplayManager: {
+        getInstance: () => ({
+            log: vi.fn(),
+        }),
+    },
+}));
+describe('GwsSync', () => {
+    let mockDestDir;
+    let mockHashesFile;
+    const mockSourceDir = path.join(process.cwd(), 'gws-skills', 'skills');
+    beforeEach(async () => {
+        vi.resetAllMocks();
+        // Create a truly temporary directory for this test run
+        mockDestDir = path.join(tmpdir(), `morpheus-test-skills-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+        mockHashesFile = path.join(mockDestDir, '.gws-hashes.json');
+        vi.mocked(ConfigManager.getInstance).mockReturnValue({
+            getGwsConfig: () => ({ enabled: true }),
+        });
+        await fs.ensureDir(mockDestDir);
+    });
+    afterEach(async () => {
+        await fs.remove(mockDestDir);
+    });
+    it('should copy new skills if destination does not exist', async () => {
+        if (!(await fs.pathExists(mockSourceDir))) {
+            console.warn('Skipping test: gws-skills/skills not found');
+            return;
+        }
+        await syncGwsSkills(mockDestDir);
+        const skills = await fs.readdir(mockSourceDir);
+        if (skills.length > 0) {
+            const firstSkill = skills[0];
+            expect(await fs.pathExists(path.join(mockDestDir, firstSkill, 'SKILL.md'))).toBe(true);
+            const metadata = await fs.readJson(mockHashesFile);
+            expect(metadata.skills[firstSkill]).toBeDefined();
+        }
+    });
+    it('should not overwrite customized skills', async () => {
+        if (!(await fs.pathExists(mockSourceDir)))
+            return;
+        const skills = await fs.readdir(mockSourceDir);
+        if (skills.length === 0)
+            return;
+        const skillName = skills[0];
+        const destPath = path.join(mockDestDir, skillName, 'SKILL.md');
+        // 1. Initial sync to set baseline
+        await syncGwsSkills(mockDestDir);
+        const originalMetadata = await fs.readJson(mockHashesFile);
+        const originalHash = originalMetadata.skills[skillName];
+        // 2. User modifies the file
+        await fs.writeFile(destPath, 'USER CUSTOMIZATION');
+        const customHash = calculateMd5('USER CUSTOMIZATION');
+        expect(customHash).not.toBe(originalHash);
+        // 3. Sync again
+        await syncGwsSkills(mockDestDir);
+        // 4. Verify file was preserved
+        const content = await fs.readFile(destPath, 'utf-8');
+        expect(content).toBe('USER CUSTOMIZATION');
+    });
+});