om-memory-system 4.29.1 → 4.31.1

package/dist/services/skill-routes.js

@@ -0,0 +1,249 @@
+import { existsSync } from "node:fs";
+import { RECORDING_OFF_TEXT, runSkillOperation, } from "../core/skill-operations.js";
+import { log } from "./logger.js";
+import { undoProposal } from "./skill-learning/apply.js";
+import { skillOperationsDeps } from "./skill-learning/operations-deps.js";
+import { getProposal, listProposals, setSkillMode, } from "./skill-learning/proposal-store.js";
+import { SKILL_ORDERS, rankSkills } from "./skill-learning/ranking.js";
+import { skillTurnSettingsFor } from "./skill-learning/settings-for.js";
+import { getSkillIndex } from "./skill-learning/skill-index.js";
+import { SkillStore, SkillStoreError, skillsDbPath } from "./skill-learning/store.js";
+import { recentSkillTurns, skillTurnsByIds } from "./skill-learning/turn-summaries.js";
+const PROPOSAL_STATES = [
+    "pending",
+    "applied",
+    "stale",
+    "rejected",
+    "undone",
+];
+// Codes from the skill operations, apply, undo and drafting. A code not listed is a 500.
+const STATUS_BY_CODE = {
+    "invalid-args": 400,
+    "invalid-name": 400,
+    "not-watched": 400,
+    "not-skill-file": 400,
+    "outside-folder": 400,
+    "not-found": 404,
+    "recording-off": 409,
+    ambiguous: 409,
+    "not-pending": 409,
+    "not-applied": 409,
+    "no-version": 409,
+    stale: 409,
+    exists: 409,
+    changed: 409,
+    "read-only": 409,
+    "not-configured": 409,
+    busy: 409,
+    "import-error": 400,
+    timeout: 502,
+    "no-tool-call": 502,
+    "invalid-reply": 502,
+};
+function statusFor(code) {
+    if (code.startsWith("http-"))
+        return 502;
+    return STATUS_BY_CODE[code] ?? 500;
+}
+const ok = (code, data, status = 200) => ({
+    status,
+    body: { success: true, code, data },
+});
+const fail = (code, error, extra = {}) => ({
+    status: statusFor(code),
+    body: { success: false, code, error, ...extra },
+});
+function fromOperation(result) {
+    if (!result.success)
+        return fail(result.code, result.text);
+    return {
+        status: 200,
+        body: { success: true, code: result.code, message: result.text, data: result.data ?? {} },
+    };
+}
+function text(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function folderCounts(index, exists) {
+    return index.folders.map((folder) => ({
+        path: folder,
+        skills: index.entries.filter((e) => e.folder === folder).length,
+        exists: exists(folder),
+    }));
+}
+/**
+ * The Skills page routes under `/api/skills`. Returns undefined for any other
+ * path. The web server applies the origin, token and JSON checks before this.
+ * Reads never create `skills.db`; a write opens it with `init` first.
+ */
+export async function routeSkills(path, method, url, readBody, ctx) {
+    if (path !== "/api/skills" && !path.startsWith("/api/skills/"))
+        return undefined;
+    try {
+        return await dispatch(path, method, url, readBody, ctx);
+    }
+    catch (error) {
+        if (error instanceof SkillStoreError)
+            return fail("read-only", error.message);
+        log("skills route: error", {
+            path: path.replace(/\/[^/]{16,}$/, "/:id"),
+            method,
+            code: error?.code ?? "error",
+            name: error instanceof Error ? error.name : typeof error,
+        }, "error");
+        return fail("error", "Skills request failed");
+    }
+}
+async function dispatch(path, method, url, readBody, ctx) {
+    const settings = skillTurnSettingsFor(ctx.cwd);
+    const store = new SkillStore(skillsDbPath(settings.storagePath));
+    const now = Date.now();
+    const index = () => getSkillIndex(settings.folders, now);
+    if (method === "GET") {
+        if (path === "/api/skills") {
+            const order = (url.searchParams.get("order") ?? "uses");
+            if (!SKILL_ORDERS.includes(order)) {
+                return fail("invalid-args", `order must be one of: ${SKILL_ORDERS.join(", ")}`);
+            }
+            const current = index();
+            return ok("ok", {
+                recording: settings.enabled,
+                skills: await rankSkills(store, current, now, order),
+                folders: folderCounts(current, existsSync),
+            });
+        }
+        if (path === "/api/skills/folders") {
+            return ok("ok", { folders: folderCounts(index(), existsSync) });
+        }
+        if (path === "/api/skills/stats") {
+            return ok("ok", {
+                turns: await store.countTurns(),
+                fileSize: store.fileSize(),
+                recording: settings.enabled,
+                redact: settings.redact,
+            });
+        }
+        if (path === "/api/skills/skill")
+            return showSkill(url, store, index(), now);
+        if (path === "/api/skills/proposals")
+            return proposals(url, store);
+        const one = /^\/api\/skills\/proposals\/([^/]+)$/.exec(path);
+        if (one) {
+            const proposal = await getProposal(store, decodeURIComponent(one[1]));
+            if (!proposal)
+                return fail("not-found", "No such proposal");
+            return ok("ok", {
+                proposal,
+                evidence: await skillTurnsByIds(store, proposal.evidenceTurnIds),
+            });
+        }
+        return undefined;
+    }
+    if (method !== "POST")
+        return undefined;
+    const operation = (mode, args) => runSkillOperation(mode, args, skillOperationsDeps(ctx.cwd, "person")).then(fromOperation);
+    switch (path) {
+        case "/api/skills/draft": {
+            const body = await readBody();
+            const idea = body.idea && typeof body.idea === "object" ? body.idea : undefined;
+            return operation("draft", {
+                skill: text(body.skill),
+                ...(idea ? { idea: idea, folder: text(body.folder) } : {}),
+            });
+        }
+        case "/api/skills/ideas":
+            return operation("ideas", {});
+        case "/api/skills/apply":
+            return operation("apply", { id: text((await readBody()).id) });
+        case "/api/skills/reject":
+            return operation("reject", { id: text((await readBody()).id) });
+        case "/api/skills/undo":
+            return undo(text((await readBody()).id), store, settings.folders);
+        case "/api/skills/mode":
+            return setMode(await readBody(), store, index());
+        case "/api/skills/delete-turns":
+            return deleteTurns(await readBody(), store);
+        case "/api/skills/record-past":
+            return recordPast(settings.enabled, ctx);
+    }
+    return undefined;
+}
+async function showSkill(url, store, index, now) {
+    const path = text(url.searchParams.get("path"));
+    const name = text(url.searchParams.get("name"));
+    if (!path && !name)
+        return fail("invalid-args", "Give path or name");
+    const skill = (await rankSkills(store, index, now)).find((s) => path ? s.path === path : s.path === null && s.name === name);
+    if (!skill)
+        return fail("not-found", "No such skill");
+    return ok("ok", {
+        skill,
+        recentTurns: await recentSkillTurns(store, skill, index),
+        proposals: skill.path ? await listProposals(store, { skillPath: skill.path }) : [],
+    });
+}
+async function proposals(url, store) {
+    const state = text(url.searchParams.get("state"));
+    const skill = text(url.searchParams.get("skill"));
+    if (state && !PROPOSAL_STATES.includes(state)) {
+        return fail("invalid-args", `state must be one of: ${PROPOSAL_STATES.join(", ")}`);
+    }
+    const filter = {};
+    if (state)
+        filter.state = state;
+    // A path names one file; a bare name matches every skill with that name.
+    if (skill && /[/\\]/.test(skill))
+        filter.skillPath = skill;
+    else if (skill)
+        filter.skillName = skill;
+    return ok("ok", { proposals: await listProposals(store, filter) });
+}
+async function undo(id, store, folders) {
+    if (!id)
+        return fail("invalid-args", "Give the proposal id");
+    if (!(await store.existingDb()))
+        return fail("not-found", `No proposal ${id}`);
+    await store.init();
+    const result = await undoProposal(id, { store, folders });
+    if (!result.ok) {
+        // Undo refuses a file changed by hand and shows what it would have restored.
+        const extra = result.code === "changed" ? { savedContent: result.savedContent ?? null } : {};
+        return fail(result.code, result.message, extra);
+    }
+    return ok("undone", { proposal: result.proposal, path: result.path });
+}
+async function setMode(body, store, index) {
+    const skillPath = text(body.skillPath);
+    if (!skillPath || (body.mode !== "manual" && body.mode !== "automatic")) {
+        return fail("invalid-args", "Give skillPath and mode manual or automatic");
+    }
+    if (!index.entries.some((e) => e.path === skillPath)) {
+        return fail("not-found", "No watched skill has this path");
+    }
+    await store.init();
+    await setSkillMode(store, skillPath, body.mode);
+    return ok("ok", { skillPath, mode: body.mode });
+}
+async function deleteTurns(body, store) {
+    if (body.confirm !== true)
+        return fail("invalid-args", "Send confirm: true to delete every turn");
+    // No file means nothing to delete; init would create one.
+    if (!(await store.existingDb()))
+        return ok("ok", { deleted: 0 });
+    await store.init();
+    return ok("ok", { deleted: await store.deleteAllTurns() });
+}
+async function recordPast(enabled, ctx) {
+    if (!enabled)
+        return fail("recording-off", RECORDING_OFF_TEXT);
+    try {
+        const job = await ctx.startRecordPast(ctx.cwd);
+        return ok("started", { id: job.id, job }, 202);
+    }
+    catch (error) {
+        // Import errors carry their own status, like the import start route.
+        const status = error.status;
+        const message = error instanceof Error ? error.message : "Record past turns failed";
+        return fail(status === 409 ? "busy" : "import-error", message);
+    }
+}

package/dist/services/turso/connection-manager.js

@@ -8,12 +8,17 @@ import { TursoDb } from "./turso-db.js";
 function toFileUrl(dbPath) {
     return dbPath.startsWith("file:") ? dbPath : `file:${dbPath}`;
 }
-function assertPathInsideStorage(dbPath) {
-    const storageRoot = resolve(CONFIG.storagePath);
-    const resolvedPath = resolve(dbPath);
-    const relativePath = relative(storageRoot, resolvedPath);
+function insideRoot(root, dbPath) {
+    const relativePath = relative(resolve(root), resolve(dbPath));
     // Only treat path-segment traversal as escape (not filenames containing "..").
-    if (relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) {
+    return !(relativePath === ".." ||
+        relativePath.startsWith(`..${sep}`) ||
+        isAbsolute(relativePath));
+}
+function assertPathInsideStorage(dbPath) {
+    // skills.db stays in the global storage path when a project moves storagePath.
+    const roots = [CONFIG.storagePath, CONFIG.skillStoragePath].filter((root) => root !== undefined);
+    if (!roots.some((root) => insideRoot(root, dbPath))) {
         throw new Error(`Refusing to open database outside storagePath: ${dbPath}`);
     }
 }
@@ -64,8 +69,7 @@ export class TursoConnectionManager {
                 // lock (see cross-process-write-lock.ts); the default rollback
                 // journal is kept because file-level migration copies rely on the
                 // main database file being current after every commit.
-                await db.execute("PRAGMA busy_timeout = 5000");
-                await db.execute("PRAGMA foreign_keys = ON");
+                await db.setConnectionPragmas(["PRAGMA busy_timeout = 5000", "PRAGMA foreign_keys = ON"]);
                 this.connections.set(dbPath, db);
                 return db;
             }

package/dist/services/turso/table-lease.d.ts

@@ -0,0 +1,40 @@
+import type { TursoDb } from "./turso-db.js";
+/** One batch with its retry at the 120-second limit fits well inside this. */
+export declare const LEASE_EXPIRY_MS: number;
+export type BatchStart = "ok" | "superseded" | "aborted";
+export interface TableLeaseOptions {
+    /** A fixed table name from the code. It goes into the SQL as written. */
+    table: string;
+    /** The database that holds the table. */
+    connection: () => Promise<TursoDb>;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+}
+/**
+ * A run record in one single-row table, shared across processes. The newest
+ * run owns the record. A run sends a batch only while it owns the record and
+ * no other run is mid-batch, so no batch is sent twice. A record not
+ * refreshed for 10 minutes has expired.
+ */
+export declare class TableLease {
+    private readonly options;
+    private prepared;
+    private readonly table;
+    private readonly now;
+    private readonly sleep;
+    constructor(options: TableLeaseOptions);
+    private db;
+    /** Become the owner. The previous owner's mid-batch mark stays until its batch ends. */
+    take(owner: string): Promise<void>;
+    /** Wait until this run may send its next batch, or report that a newer run took over. */
+    beginBatch(owner: string, options?: {
+        signal?: AbortSignal;
+        onWait?: () => void;
+    }): Promise<BatchStart>;
+    /** Clear this run's mid-batch mark, also after a newer run took over. */
+    endBatch(owner: string): Promise<void>;
+    /** Remove the record only when this run still owns it. */
+    release(owner: string): Promise<void>;
+    /** True while an unexpired record exists; a live pass skips meanwhile. */
+    isActive(): Promise<boolean>;
+}

package/dist/services/turso/table-lease.js

@@ -0,0 +1,77 @@
+/** One batch with its retry at the 120-second limit fits well inside this. */
+export const LEASE_EXPIRY_MS = 10 * 60 * 1000;
+const WAIT_MS = 1000;
+/**
+ * A run record in one single-row table, shared across processes. The newest
+ * run owns the record. A run sends a batch only while it owns the record and
+ * no other run is mid-batch, so no batch is sent twice. A record not
+ * refreshed for 10 minutes has expired.
+ */
+export class TableLease {
+    options;
+    prepared = null;
+    table;
+    now;
+    sleep;
+    constructor(options) {
+        this.options = options;
+        this.table = options.table;
+        this.now = options.now ?? Date.now;
+        this.sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    }
+    db() {
+        this.prepared ??= (async () => {
+            const db = await this.options.connection();
+            await db.run(`CREATE TABLE IF NOT EXISTS ${this.table} (
+        id INTEGER PRIMARY KEY CHECK (id = 1),
+        owner TEXT NOT NULL, busy_owner TEXT, refreshed_at INTEGER NOT NULL
+      )`);
+            return db;
+        })();
+        return this.prepared;
+    }
+    /** Become the owner. The previous owner's mid-batch mark stays until its batch ends. */
+    async take(owner) {
+        const db = await this.db();
+        await db.run(`INSERT INTO ${this.table} (id, owner, busy_owner, refreshed_at)
+      VALUES (1, ?, NULL, ?)
+      ON CONFLICT(id) DO UPDATE SET owner = excluded.owner`, [owner, this.now()]);
+    }
+    /** Wait until this run may send its next batch, or report that a newer run took over. */
+    async beginBatch(owner, options = {}) {
+        const db = await this.db();
+        for (;;) {
+            if (options.signal?.aborted)
+                return "aborted";
+            const now = this.now();
+            const changed = await db.run(`UPDATE ${this.table} SET busy_owner = ?, refreshed_at = ?
+        WHERE id = 1 AND owner = ?
+          AND (busy_owner IS NULL OR busy_owner = ? OR refreshed_at < ?)`, [owner, now, owner, owner, now - LEASE_EXPIRY_MS]);
+            if (changed > 0)
+                return "ok";
+            const row = await db.get(`SELECT owner FROM ${this.table} WHERE id = 1`);
+            if (!row || String(row.owner) !== owner)
+                return "superseded";
+            options.onWait?.();
+            await this.sleep(WAIT_MS);
+        }
+    }
+    /** Clear this run's mid-batch mark, also after a newer run took over. */
+    async endBatch(owner) {
+        const db = await this.db();
+        await db.run(`UPDATE ${this.table} SET busy_owner = NULL, refreshed_at = ? WHERE busy_owner = ?`, [this.now(), owner]);
+    }
+    /** Remove the record only when this run still owns it. */
+    async release(owner) {
+        const db = await this.db();
+        await db.run(`DELETE FROM ${this.table} WHERE id = 1 AND owner = ?`, [owner]);
+    }
+    /** True while an unexpired record exists; a live pass skips meanwhile. */
+    async isActive() {
+        const db = await this.db();
+        const row = await db.get(`SELECT 1 FROM ${this.table} WHERE id = 1 AND refreshed_at >= ?`, [
+            this.now() - LEASE_EXPIRY_MS,
+        ]);
+        return Boolean(row);
+    }
+}

package/dist/services/turso/turso-db.d.ts

@@ -2,7 +2,11 @@ import type { Client, InArgs, ResultSet, Transaction } from "@libsql/client";
 type Row = Record<string, unknown>;
 export declare class TursoDb {
     private readonly client;
+    /** Per-connection pragmas, set again after each transaction (see `transaction`). */
+    private pragmas;
     constructor(client: Client);
+    /** Run each pragma now and again after every transaction. */
+    setConnectionPragmas(pragmas: string[]): Promise<void>;
     getClient(): Client;
     execute(sql: string, args?: InArgs): Promise<ResultSet>;
     batch(statements: Array<{

package/dist/services/turso/turso-db.js

@@ -1,8 +1,16 @@
 export class TursoDb {
     client;
+    /** Per-connection pragmas, set again after each transaction (see `transaction`). */
+    pragmas = [];
     constructor(client) {
         this.client = client;
     }
+    /** Run each pragma now and again after every transaction. */
+    async setConnectionPragmas(pragmas) {
+        this.pragmas = pragmas;
+        for (const pragma of pragmas)
+            await this.execute(pragma);
+    }
     getClient() {
         return this.client;
     }
@@ -45,6 +53,11 @@ export class TursoDb {
         }
         finally {
             tx.close();
+            // libSQL hands the transaction's handle away and opens a fresh one, which
+            // starts without pragmas. Without this, busy_timeout drops to 0 and a
+            // second process holding the write lock gives SQLITE_BUSY at once.
+            for (const pragma of this.pragmas)
+                await this.execute(pragma).catch(() => { });
         }
     }
     async close() {

package/dist/services/user-prompt/profile-catch-up-lease.d.ts

@@ -1,34 +1,15 @@
-/** One batch with its retry at the 120-second limit fits well inside this. */
-export declare const LEASE_EXPIRY_MS: number;
-export type BatchStart = "ok" | "superseded" | "aborted";
+import { TableLease } from "../turso/table-lease.js";
+export { LEASE_EXPIRY_MS, type BatchStart } from "../turso/table-lease.js";
 /**
  * The catch-up run record, shared by the web app and the terminal command
  * through `user-prompts.db`. The newest run owns the record. A run sends a
  * batch only while it owns the record and no other run is mid-batch, so no
  * batch is sent twice. A record not refreshed for 10 minutes has expired.
  */
-export declare class CatchUpLease {
-    private readonly options;
-    private prepared;
-    private readonly now;
-    private readonly sleep;
+export declare class CatchUpLease extends TableLease {
     constructor(options?: {
         path?: string;
         now?: () => number;
         sleep?: (ms: number) => Promise<void>;
     });
-    private db;
-    /** Become the owner. The previous owner's mid-batch mark stays until its batch ends. */
-    take(owner: string): Promise<void>;
-    /** Wait until this run may send its next batch, or report that a newer run took over. */
-    beginBatch(owner: string, options?: {
-        signal?: AbortSignal;
-        onWait?: () => void;
-    }): Promise<BatchStart>;
-    /** Clear this run's mid-batch mark, also after a newer run took over. */
-    endBatch(owner: string): Promise<void>;
-    /** Remove the record only when this run still owns it. */
-    release(owner: string): Promise<void>;
-    /** True while an unexpired record exists; a live pass skips meanwhile. */
-    isActive(): Promise<boolean>;
 }

package/dist/services/user-prompt/profile-catch-up-lease.js

@@ -1,77 +1,21 @@
 import { join } from "node:path";
 import { CONFIG } from "../../config.js";
 import { tursoConnectionManager } from "../turso/connection-manager.js";
-/** One batch with its retry at the 120-second limit fits well inside this. */
-export const LEASE_EXPIRY_MS = 10 * 60 * 1000;
-const WAIT_MS = 1000;
+import { TableLease } from "../turso/table-lease.js";
+export { LEASE_EXPIRY_MS } from "../turso/table-lease.js";
 /**
  * The catch-up run record, shared by the web app and the terminal command
  * through `user-prompts.db`. The newest run owns the record. A run sends a
  * batch only while it owns the record and no other run is mid-batch, so no
  * batch is sent twice. A record not refreshed for 10 minutes has expired.
  */
-export class CatchUpLease {
-    options;
-    prepared = null;
-    now;
-    sleep;
+export class CatchUpLease extends TableLease {
     constructor(options = {}) {
-        this.options = options;
-        this.now = options.now ?? Date.now;
-        this.sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-    }
-    db() {
-        this.prepared ??= (async () => {
-            const path = this.options.path ?? join(CONFIG.storagePath, "user-prompts.db");
-            const db = await tursoConnectionManager.getConnection(path);
-            await db.run(`CREATE TABLE IF NOT EXISTS profile_catch_up_lease (
-        id INTEGER PRIMARY KEY CHECK (id = 1),
-        owner TEXT NOT NULL, busy_owner TEXT, refreshed_at INTEGER NOT NULL
-      )`);
-            return db;
-        })();
-        return this.prepared;
-    }
-    /** Become the owner. The previous owner's mid-batch mark stays until its batch ends. */
-    async take(owner) {
-        const db = await this.db();
-        await db.run(`INSERT INTO profile_catch_up_lease (id, owner, busy_owner, refreshed_at)
-      VALUES (1, ?, NULL, ?)
-      ON CONFLICT(id) DO UPDATE SET owner = excluded.owner`, [owner, this.now()]);
-    }
-    /** Wait until this run may send its next batch, or report that a newer run took over. */
-    async beginBatch(owner, options = {}) {
-        const db = await this.db();
-        for (;;) {
-            if (options.signal?.aborted)
-                return "aborted";
-            const now = this.now();
-            const changed = await db.run(`UPDATE profile_catch_up_lease SET busy_owner = ?, refreshed_at = ?
-        WHERE id = 1 AND owner = ?
-          AND (busy_owner IS NULL OR busy_owner = ? OR refreshed_at < ?)`, [owner, now, owner, owner, now - LEASE_EXPIRY_MS]);
-            if (changed > 0)
-                return "ok";
-            const row = await db.get("SELECT owner FROM profile_catch_up_lease WHERE id = 1");
-            if (!row || String(row.owner) !== owner)
-                return "superseded";
-            options.onWait?.();
-            await this.sleep(WAIT_MS);
-        }
-    }
-    /** Clear this run's mid-batch mark, also after a newer run took over. */
-    async endBatch(owner) {
-        const db = await this.db();
-        await db.run("UPDATE profile_catch_up_lease SET busy_owner = NULL, refreshed_at = ? WHERE busy_owner = ?", [this.now(), owner]);
-    }
-    /** Remove the record only when this run still owns it. */
-    async release(owner) {
-        const db = await this.db();
-        await db.run("DELETE FROM profile_catch_up_lease WHERE id = 1 AND owner = ?", [owner]);
-    }
-    /** True while an unexpired record exists; a live pass skips meanwhile. */
-    async isActive() {
-        const db = await this.db();
-        const row = await db.get("SELECT 1 FROM profile_catch_up_lease WHERE id = 1 AND refreshed_at >= ?", [this.now() - LEASE_EXPIRY_MS]);
-        return Boolean(row);
+        super({
+            table: "profile_catch_up_lease",
+            connection: () => tursoConnectionManager.getConnection(options.path ?? join(CONFIG.storagePath, "user-prompts.db")),
+            now: options.now,
+            sleep: options.sleep,
+        });
     }
 }

package/dist/services/web-jobs.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Background jobs of the web app that owns the port. That process serves the
+ * Claude Code hooks, so web-server.ts also starts their capture retries next to
+ * this call (the importer import must stay in web-server.ts). Kept out of
+ * web-server.ts, which sits at its size ceiling.
+ */
+export declare function startWebJobs(): Promise<void>;

package/dist/services/web-jobs.js

@@ -0,0 +1,14 @@
+/**
+ * Background jobs of the web app that owns the port. That process serves the
+ * Claude Code hooks, so web-server.ts also starts their capture retries next to
+ * this call (the importer import must stay in web-server.ts). Kept out of
+ * web-server.ts, which sits at its size ceiling.
+ */
+export async function startWebJobs() {
+    const [config, { startWebSkillReview }] = await Promise.all([
+        import("../config.js"),
+        import("./skill-learning/web-review.js"),
+    ]);
+    // A config reload replaces CONFIG, so read the live module binding each tick.
+    startWebSkillReview(() => config.CONFIG);
+}

package/dist/services/web-route-modules.d.ts

@@ -1,8 +1,8 @@
-import type { ChatRuntimeConfig } from "./chat/chat-runtime.js";
 import { type RouteResult } from "./chat/chat-routes.js";
+import type { SkillRouteContext } from "./skill-routes.js";
 /**
  * Route modules that live outside web-server.ts, which sits at its size
  * ceiling. Each returns undefined for paths it does not own. The request body
  * is read once, and only by a route that needs it.
  */
-export declare function routeModules(path: string, method: string, url: URL, req: Request, config: ChatRuntimeConfig): Promise<RouteResult | undefined>;
+export declare function routeModules(path: string, method: string, url: URL, req: Request, ctx: SkillRouteContext): Promise<RouteResult | undefined>;

package/dist/services/web-route-modules.js

@@ -6,7 +6,8 @@ import { routeProfileCleanup } from "./profile-cleanup-routes.js";
  * ceiling. Each returns undefined for paths it does not own. The request body
  * is read once, and only by a route that needs it.
  */
-export async function routeModules(path, method, url, req, config) {
+export async function routeModules(path, method, url, req, ctx) {
+    const { CONFIG: config } = await import("../config.js");
     let body;
     const readBody = () => (body ??= req.json().catch(() => ({})));
     const cleanup = await routeProfileCleanup(path, method, url, readBody);
@@ -15,5 +16,9 @@ export async function routeModules(path, method, url, req, config) {
     const hosts = await routeMemoryHosts(path, method, url, readBody, config);
     if (hosts !== undefined)
         return hosts;
+    if (path === "/api/skills" || path.startsWith("/api/skills/")) {
+        const { routeSkills } = await import("./skill-routes.js");
+        return routeSkills(path, method, url, readBody, ctx);
+    }
     return routeChat(path, method, readBody, config);
 }