nodmix 2026.5.25

package/skills/healthcheck/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: healthcheck
+description: "Audit/harden Nodmix hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security."
+---
+
+# Nodmix host healthcheck
+
+Goal: assess host risk, run read-only checks, then propose staged hardening without breaking access.
+
+## Rules
+
+- Ask before state-changing actions.
+- Do not change SSH/firewall/remote access until access path is confirmed.
+- Prefer reversible steps and rollback notes.
+- Never claim Nodmix manages OS firewall, SSH, or updates.
+- If identity/role unknown, recommend only.
+- User choices: numbered list.
+- Never print secrets.
+
+## Context to infer first
+
+- OS/version, container vs host.
+- Privilege level.
+- Access path: local, SSH, RDP, tailnet.
+- Network exposure: public IP, reverse proxy, tunnel, LAN only.
+- Nodmix gateway status, bind, auth.
+- Backup status.
+- Disk encryption.
+- Automatic security updates.
+- Usage mode: personal workstation, local assistant box, remote server, other.
+
+Ask only for missing facts. Simple phrasing preferred.
+
+## Read-only checks
+
+Ask once for permission to run read-only checks. Then run relevant commands.
+
+Common:
+
+```bash
+nodmix security audit --deep
+nodmix gateway status --deep
+nodmix doctor
+```
+
+macOS:
+
+```bash
+sw_vers
+lsof -nP -iTCP -sTCP:LISTEN
+/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
+pfctl -s info
+tmutil status
+fdesetup status
+softwareupdate --schedule
+```
+
+Linux:
+
+```bash
+cat /etc/os-release
+ss -ltnup || ss -ltnp
+ufw status || firewall-cmd --state || nft list ruleset
+systemctl status ssh sshd
+lsblk -f
+```
+
+Windows:
+
+```powershell
+systeminfo
+Get-NetFirewallProfile
+Get-BitLockerVolume
+```
+
+## Risk profile
+
+After context is known, ask desired posture:
+
+1. Convenience: local/private, minimal prompts.
+2. Balanced: secure defaults, low friction.
+3. Strict: remote/public/sensitive data, more lock-down.
+
+## Report shape
+
+- Current posture: one paragraph.
+- Findings: severity + evidence + why it matters.
+- Recommended plan: staged, reversible.
+- Commands: read-only first; write actions only after approval.
+- Gaps: what could not be checked.
+
+## Hardening menu
+
+Offer only relevant items:
+
+- Bind gateway to loopback/LAN/tailnet intentionally.
+- Require auth for remote access.
+- Close public ports or restrict by firewall.
+- Enable OS security updates.
+- Enable disk encryption.
+- Verify backups and restore path.
+- Disable password SSH or require keys/MFA where appropriate.
+- Add scheduled `nodmix security audit --deep`.
+
+Confirm exact action before applying.

package/skills/himalaya/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: himalaya
+description: "Himalaya CLI for IMAP/SMTP mail: list, read, search, compose, reply, forward, copy, move, delete."
+homepage: https://github.com/pimalaya/himalaya
+metadata:
+  {
+    "nodmix":
+      {
+        "emoji": "📧",
+        "requires": { "bins": ["himalaya"] },
+        "install":
+          [
+            {
+              "id": "brew",
+              "kind": "brew",
+              "formula": "himalaya",
+              "bins": ["himalaya"],
+              "label": "Install Himalaya (brew)",
+            },
+          ],
+      },
+  }
+---
+
+# Himalaya
+
+Use `himalaya` for IMAP/SMTP email from shell.
+
+## References
+
+- `references/configuration.md`: account config, auth, backend setup.
+- `references/message-composition.md`: MML compose syntax.
+
+## Setup
+
+```bash
+himalaya --version
+himalaya account configure
+```
+
+Config path: `~/.config/himalaya/config.toml`.
+
+Prefer password managers/keyrings for credentials; do not paste secrets into chat/logs.
+
+## Read/search
+
+```bash
+himalaya folder list
+himalaya envelope list
+himalaya message read <id>
+himalaya envelope list from alice@example.com subject invoice
+```
+
+## Write
+
+```bash
+himalaya message write
+himalaya template write
+himalaya template send < /tmp/message.txt
+himalaya message reply <id>
+himalaya message forward <id>
+```
+
+Use MML for attachments and rich messages; read `references/message-composition.md` first.
+
+## Organize
+
+```bash
+himalaya message copy <id> <folder>
+himalaya message move <id> <folder>
+himalaya message delete <id>
+himalaya flag add <id> --flag seen
+himalaya flag remove <id> --flag seen
+```
+
+## Safety
+
+- Confirm before sending, deleting, or moving many messages.
+- Use `--account` when multiple accounts exist.
+- Quote exact message IDs in summaries.

package/skills/himalaya/references/configuration.md

@@ -0,0 +1,184 @@
+# Himalaya Configuration Reference
+
+Configuration file location: `~/.config/himalaya/config.toml`
+
+## Minimal IMAP + SMTP Setup
+
+```toml
+[accounts.default]
+email = "user@example.com"
+display-name = "Your Name"
+default = true
+
+# IMAP backend for reading emails
+backend.type = "imap"
+backend.host = "imap.example.com"
+backend.port = 993
+backend.encryption.type = "tls"
+backend.login = "user@example.com"
+backend.auth.type = "password"
+backend.auth.raw = "your-password"
+
+# SMTP backend for sending emails
+message.send.backend.type = "smtp"
+message.send.backend.host = "smtp.example.com"
+message.send.backend.port = 587
+message.send.backend.encryption.type = "start-tls"
+message.send.backend.login = "user@example.com"
+message.send.backend.auth.type = "password"
+message.send.backend.auth.raw = "your-password"
+```
+
+## Password Options
+
+### Raw password (testing only, not recommended)
+
+```toml
+backend.auth.raw = "your-password"
+```
+
+### Password from command (recommended)
+
+```toml
+backend.auth.cmd = "pass show email/imap"
+# backend.auth.cmd = "security find-generic-password -a user@example.com -s imap -w"
+```
+
+### System keyring (requires keyring feature)
+
+```toml
+backend.auth.keyring = "imap-example"
+```
+
+Then run `himalaya account configure <account>` to store the password.
+
+## Gmail Configuration
+
+```toml
+[accounts.gmail]
+email = "you@gmail.com"
+display-name = "Your Name"
+default = true
+
+backend.type = "imap"
+backend.host = "imap.gmail.com"
+backend.port = 993
+backend.encryption.type = "tls"
+backend.login = "you@gmail.com"
+backend.auth.type = "password"
+backend.auth.cmd = "pass show google/app-password"
+
+message.send.backend.type = "smtp"
+message.send.backend.host = "smtp.gmail.com"
+message.send.backend.port = 587
+message.send.backend.encryption.type = "start-tls"
+message.send.backend.login = "you@gmail.com"
+message.send.backend.auth.type = "password"
+message.send.backend.auth.cmd = "pass show google/app-password"
+```
+
+**Note:** Gmail requires an App Password if 2FA is enabled.
+
+## iCloud Configuration
+
+```toml
+[accounts.icloud]
+email = "you@icloud.com"
+display-name = "Your Name"
+
+backend.type = "imap"
+backend.host = "imap.mail.me.com"
+backend.port = 993
+backend.encryption.type = "tls"
+backend.login = "you@icloud.com"
+backend.auth.type = "password"
+backend.auth.cmd = "pass show icloud/app-password"
+
+message.send.backend.type = "smtp"
+message.send.backend.host = "smtp.mail.me.com"
+message.send.backend.port = 587
+message.send.backend.encryption.type = "start-tls"
+message.send.backend.login = "you@icloud.com"
+message.send.backend.auth.type = "password"
+message.send.backend.auth.cmd = "pass show icloud/app-password"
+```
+
+**Note:** Generate an app-specific password at appleid.apple.com
+
+## Folder Aliases
+
+Map custom folder names:
+
+```toml
+[accounts.default.folder.alias]
+inbox = "INBOX"
+sent = "Sent"
+drafts = "Drafts"
+trash = "Trash"
+```
+
+## Multiple Accounts
+
+```toml
+[accounts.personal]
+email = "personal@example.com"
+default = true
+# ... backend config ...
+
+[accounts.work]
+email = "work@company.com"
+# ... backend config ...
+```
+
+Switch accounts with `--account`:
+
+```bash
+himalaya --account work envelope list
+```
+
+## Notmuch Backend (local mail)
+
+```toml
+[accounts.local]
+email = "user@example.com"
+
+backend.type = "notmuch"
+backend.db-path = "~/.mail/.notmuch"
+```
+
+## OAuth2 Authentication (for providers that support it)
+
+```toml
+backend.auth.type = "oauth2"
+backend.auth.client-id = "your-client-id"
+backend.auth.client-secret.cmd = "pass show oauth/client-secret"
+backend.auth.access-token.cmd = "pass show oauth/access-token"
+backend.auth.refresh-token.cmd = "pass show oauth/refresh-token"
+backend.auth.auth-url = "https://provider.com/oauth/authorize"
+backend.auth.token-url = "https://provider.com/oauth/token"
+```
+
+## Additional Options
+
+### Signature
+
+```toml
+[accounts.default]
+signature = "Best regards,\nYour Name"
+signature-delim = "-- \n"
+```
+
+### Downloads directory
+
+```toml
+[accounts.default]
+downloads-dir = "~/Downloads/himalaya"
+```
+
+### Editor for composing
+
+Set via environment variable:
+
+```bash
+export EDITOR="vim"
+```

package/skills/himalaya/references/message-composition.md

@@ -0,0 +1,199 @@
+# Message Composition with MML (MIME Meta Language)
+
+Himalaya uses MML for composing emails. MML is a simple XML-based syntax that compiles to MIME messages.
+
+## Basic Message Structure
+
+An email message is a list of **headers** followed by a **body**, separated by a blank line:
+
+```
+From: sender@example.com
+To: recipient@example.com
+Subject: Hello World
+
+This is the message body.
+```
+
+## Headers
+
+Common headers:
+
+- `From`: Sender address
+- `To`: Primary recipient(s)
+- `Cc`: Carbon copy recipients
+- `Bcc`: Blind carbon copy recipients
+- `Subject`: Message subject
+- `Reply-To`: Address for replies (if different from From)
+- `In-Reply-To`: Message ID being replied to
+
+### Address Formats
+
+```
+To: user@example.com
+To: John Doe <john@example.com>
+To: "John Doe" <john@example.com>
+To: user1@example.com, user2@example.com, "Jane" <jane@example.com>
+```
+
+## Plain Text Body
+
+Simple plain text email:
+
+```
+From: alice@localhost
+To: bob@localhost
+Subject: Plain Text Example
+
+Hello, this is a plain text email.
+No special formatting needed.
+
+Best,
+Alice
+```
+
+## MML for Rich Emails
+
+### Multipart Messages
+
+Alternative text/html parts:
+
+```
+From: alice@localhost
+To: bob@localhost
+Subject: Multipart Example
+
+<#multipart type=alternative>
+This is the plain text version.
+<#part type=text/html>
+<html><body><h1>This is the HTML version</h1></body></html>
+<#/multipart>
+```
+
+### Attachments
+
+Attach a file:
+
+```
+From: alice@localhost
+To: bob@localhost
+Subject: With Attachment
+
+Here is the document you requested.
+
+<#part filename=/path/to/document.pdf><#/part>
+```
+
+Attachment with custom name:
+
+```
+<#part filename=/path/to/file.pdf name=report.pdf><#/part>
+```
+
+Multiple attachments:
+
+```
+<#part filename=/path/to/doc1.pdf><#/part>
+<#part filename=/path/to/doc2.pdf><#/part>
+```
+
+### Inline Images
+
+Embed an image inline:
+
+```
+From: alice@localhost
+To: bob@localhost
+Subject: Inline Image
+
+<#multipart type=related>
+<#part type=text/html>
+<html><body>
+<p>Check out this image:</p>
+<img src="cid:image1">
+</body></html>
+<#part disposition=inline id=image1 filename=/path/to/image.png><#/part>
+<#/multipart>
+```
+
+### Mixed Content (Text + Attachments)
+
+```
+From: alice@localhost
+To: bob@localhost
+Subject: Mixed Content
+
+<#multipart type=mixed>
+<#part type=text/plain>
+Please find the attached files.
+
+Best,
+Alice
+<#part filename=/path/to/file1.pdf><#/part>
+<#part filename=/path/to/file2.zip><#/part>
+<#/multipart>
+```
+
+## MML Tag Reference
+
+### `<#multipart>`
+
+Groups multiple parts together.
+
+- `type=alternative`: Different representations of same content
+- `type=mixed`: Independent parts (text + attachments)
+- `type=related`: Parts that reference each other (HTML + images)
+
+### `<#part>`
+
+Defines a message part.
+
+- `type=<mime-type>`: Content type (e.g., `text/html`, `application/pdf`)
+- `filename=<path>`: File to attach
+- `name=<name>`: Display name for attachment
+- `disposition=inline`: Display inline instead of as attachment
+- `id=<cid>`: Content ID for referencing in HTML
+
+## Composing from CLI
+
+### Interactive compose
+
+Opens your `$EDITOR`:
+
+```bash
+himalaya message write
+```
+
+### Reply (opens editor with quoted message)
+
+```bash
+himalaya message reply 42
+himalaya message reply 42 --all  # reply-all
+```
+
+### Forward
+
+```bash
+himalaya message forward 42
+```
+
+### Send from stdin
+
+```bash
+cat message.txt | himalaya template send
+```
+
+### Prefill headers from CLI
+
+```bash
+himalaya message write \
+  -H "To:recipient@example.com" \
+  -H "Subject:Quick Message" \
+  "Message body here"
+```
+
+## Tips
+
+- The editor opens with a template; fill in headers and body.
+- Save and exit the editor to send; exit without saving to cancel.
+- MML parts are compiled to proper MIME when sending.
+- Use `himalaya message export --full` to inspect the raw MIME structure of received emails.

package/skills/imsg/SKILL.md

@@ -0,0 +1,122 @@
+---
+name: imsg
+description: "iMessage/SMS CLI for listing chats, history, and sending messages via Messages.app."
+homepage: https://imsg.to
+metadata:
+  {
+    "nodmix":
+      {
+        "emoji": "📨",
+        "os": ["darwin"],
+        "requires": { "bins": ["imsg"] },
+        "install":
+          [
+            {
+              "id": "brew",
+              "kind": "brew",
+              "formula": "steipete/tap/imsg",
+              "bins": ["imsg"],
+              "label": "Install imsg (brew)",
+            },
+          ],
+      },
+  }
+---
+
+# imsg
+
+Use `imsg` to read and send iMessage/SMS via macOS Messages.app.
+
+## When to Use
+
+Use when:
+
+- User explicitly asks to send iMessage or SMS
+- Reading iMessage conversation history
+- Checking recent Messages.app chats
+- Sending to phone numbers or Apple IDs
+
+## When NOT to Use
+
+Do not use when:
+
+- Telegram messages -> use `message` tool with `channel:telegram`
+- Signal messages -> use Signal channel if configured
+- WhatsApp messages -> use WhatsApp channel if configured
+- Discord messages -> use `message` tool with `channel:discord`
+- Slack messages -> use `slack` skill
+- Group chat management (adding/removing members) -> not supported
+- Bulk/mass messaging -> always confirm with user first
+- Replying in current conversation -> just reply normally (Nodmix routes automatically)
+
+## Requirements
+
+- macOS with Messages.app signed in
+- Full Disk Access for terminal
+- Automation permission for Messages.app (for sending)
+
+## Common Commands
+
+### List Chats
+
+```bash
+imsg chats --limit 10 --json
+```
+
+### View History
+
+```bash
+# By chat ID
+imsg history --chat-id 1 --limit 20 --json
+
+# With attachments info
+imsg history --chat-id 1 --limit 20 --attachments --json
+```
+
+### Watch for New Messages
+
+```bash
+imsg watch --chat-id 1 --attachments
+```
+
+### Send Messages
+
+```bash
+# Text only
+imsg send --to "+14155551212" --text "Hello!"
+
+# With attachment
+imsg send --to "+14155551212" --text "Check this out" --file /path/to/image.jpg
+
+# Specify service
+imsg send --to "+14155551212" --text "Hi" --service imessage
+imsg send --to "+14155551212" --text "Hi" --service sms
+```
+
+## Service Options
+
+- `--service imessage` - Force iMessage (requires recipient has iMessage)
+- `--service sms` - Force SMS (green bubble)
+- `--service auto` - Let Messages.app decide (default)
+
+## Safety Rules
+
+1. **Always confirm recipient and message content** before sending
+2. **Never send to unknown numbers** without explicit user approval
+3. **Be careful with attachments** - confirm file path exists
+4. **Rate limit yourself** - don't spam
+
+## Example Workflow
+
+User: "Text mom that I'll be late"
+
+```bash
+# 1. Find mom's chat
+imsg chats --limit 20 --json | jq '.[] | select(.displayName | contains("Mom"))'
+
+# 2. Confirm with user
+# "Found Mom at +1555123456. Send 'I'll be late' via iMessage?"
+
+# 3. Send after confirmation
+imsg send --to "+1555123456" --text "I'll be late"
+```