openmausbot 0.1.85 → 0.1.87

package/dist-server/server/request-auth.js

@@ -2,6 +2,83 @@ import { timingSafeEqual } from "node:crypto";
 import { isIP } from "node:net";
 import { denyReason as companionDenial } from "../companion/src/routes.js";
 const LOOPBACK_SCOPES = ["admin", "client"];
+const SERVICE_SCOPES = ["client"];
+/** What a `service`-trust loopback caller may reach, and nothing else:
+ *
+ * - liveness and identity: health, who-am-I, edition and brand;
+ * - the cloud Slack worker (openmaus-cloud server/slack-worker.ts), which
+ *   shares the workspace's network namespace and reads the bot list, a
+ *   thread's messages and a bot's PNG picture, creates a thread, sends
+ *   through the guarded route, watches and stops its exact request,
+ *   withdraws a queued line, and declines a card (the handler refuses any
+ *   other answer from this caller);
+ * - the turn-scoped bot capability routes, whose own bearer token is the
+ *   authorization (checked in the handler), and the test-only capability
+ *   mint that exists only when its private key is set.
+ *
+ * Residual risk, not closed here: a bot's shell is a loopback caller too, so
+ * it can do everything the worker does. It can post into any bot's thread
+ * through the guarded route, including an existing Full-access thread
+ * (`expectedApprovalMode: "full"`), and while the operator's shared Full
+ * access is on it can open new Full-access threads; either way work runs with
+ * Full access and no card, whoever asked the bot. It can also stop a request
+ * and decline a card. It can no longer change settings, keys, instances, MCP
+ * servers, webhooks, sessions, people, budgets or fleet, loosen a bot's
+ * permissions, or approve anything. The planned fix is a relay token that only
+ * the Slack worker holds, so these routes stop answering session-less
+ * loopback at all. */
+export const SERVICE_ALLOW = [
+    { methods: ["GET"], path: /^\/api\/health$/ },
+    { methods: ["GET"], path: /^\/api\/auth\/session$/ },
+    { methods: ["GET"], path: /^\/api\/edition$/ },
+    { methods: ["GET"], path: /^\/api\/brand$/ },
+    { methods: ["GET"], path: /^\/api\/bots$/ },
+    { methods: ["GET"], path: /^\/api\/threads\/[\w-]+\/messages$/ },
+    { methods: ["GET"], path: /^\/api\/attachments\/[\w.-]+$/ },
+    { methods: ["POST"], path: /^\/api\/bots\/[\w-]+\/tasks$/ },
+    { methods: ["POST"], path: /^\/api\/bots\/[\w-]+\/messages\/guarded$/ },
+    { methods: ["GET"], path: /^\/api\/bots\/[\w-]+\/requests\/[\w-]+$/ },
+    { methods: ["POST"], path: /^\/api\/bots\/[\w-]+\/requests\/[\w-]+\/interrupt$/ },
+    { methods: ["DELETE"], path: /^\/api\/bots\/[\w-]+\/queue\/[\w-]+$/ },
+    { methods: ["POST"], path: /^\/api\/threads\/[\w-]+\/respond$/ }, // decline only: see the handler
+    { methods: ["GET", "POST", "PUT", "PATCH", "DELETE"], path: /^\/api\/internal\// }, // capability bearer checked in the handler
+    { methods: ["POST"], path: /^\/api\/testing\/internal-capability$/ }, // exists only with its private key
+];
+export function serviceAllowed(method, path) {
+    const upper = method.toUpperCase();
+    return SERVICE_ALLOW.some((rule) => rule.methods.includes(upper) && rule.path.test(path));
+}
+/** Pick the loopback trust for this process, and say why for the startup log.
+ *
+ * A packaged desktop keeps `owner`: its mutations already need Electron's
+ * per-launch capability, and only its owner uses the machine. Elsewhere the
+ * operator may set OMB_LOOPBACK_TRUST=owner|service. Without it a hosted
+ * workspace (any OMB_ADMIN_* setting, even an incomplete one) defaults to
+ * `service` — shared-workspace Full access is only honoured there, so it needs
+ * no rule of its own — and a headless self-hosted server keeps `owner`. A
+ * value that is neither fails closed. */
+export function resolveLoopbackTrust(input) {
+    const raw = (input.env ?? process.env).OMB_LOOPBACK_TRUST;
+    const requested = raw?.trim().toLowerCase();
+    if (input.desktopManaged) {
+        return { trust: "owner", reason: "desktop app", ...(raw !== undefined ? { warning: "OMB_LOOPBACK_TRUST is ignored in the desktop app" } : {}) };
+    }
+    if (requested === "owner" || requested === "service") {
+        return {
+            trust: requested,
+            reason: "OMB_LOOPBACK_TRUST",
+            ...(requested === "owner" && input.hostedWorkspace
+                ? { warning: "OMB_LOOPBACK_TRUST=owner on a shared workspace: every bot's shell can change settings and approve cards as the owner" }
+                : {}),
+        };
+    }
+    if (raw !== undefined && requested !== "") {
+        return { trust: "service", reason: "OMB_LOOPBACK_TRUST", warning: `OMB_LOOPBACK_TRUST="${raw.replace(/[^\w.-]/g, "").slice(0, 40)}" is not owner or service; using service` };
+    }
+    if (input.hostedWorkspace)
+        return { trust: "service", reason: "hosted workspace" };
+    return { trust: "owner", reason: "self-hosted default" };
+}
 export function isLoopbackHost(host) {
     if (!host)
         return false;
@@ -170,6 +247,8 @@ export const CLIENT_ALLOW = [
     // reads: fleet, transcripts, search (no secrets in any of these)
     { methods: ["GET"], path: /^\/api\/bots$/ },
     { methods: ["GET"], path: /^\/api\/team-map$/ },
+    // a link into the organisation's Admin: identifiers only, and Admin authorizes its own visitor
+    { methods: ["GET"], path: /^\/api\/bots\/[\w-]+\/slack-management$/ },
     { methods: ["GET"], path: /^\/api\/search$/ },
     { methods: ["GET"], path: /^\/api\/threads\/[\w-]+\/messages$/ },
     { methods: ["GET"], path: /^\/api\/threads\/[\w-]+\/messages\/[\w-]+\/image$/ },
@@ -219,6 +298,7 @@ export const CLIENT_ALLOW = [
     { methods: ["PATCH", "DELETE"], path: /^\/api\/routines\/[\w-]+$/ },
     { methods: ["POST"], path: /^\/api\/routines\/[\w-]+\/run$/ },
     { methods: ["POST"], path: /^\/api\/routine-runs\/[\w-]+\/(?:cancel|seen)$/ },
+    { methods: ["POST"], path: /^\/api\/routine-runs\/seen-all$/ },
     // webhook list is secret-free; creating or rotating one is not
     { methods: ["GET"], path: /^\/api\/webhooks$/ },
     // configured-or-not booleans; the handler strips the few identifying fields for clients
@@ -255,6 +335,9 @@ export function clientGroupPatchViolation(body) {
             return key;
     return null;
 }
+const CLI_OWNER_HEADER = "x-openmausbot-cli-owner";
+/** The only routes the serving CLI's secret opens: its pairing code. */
+const CLI_OWNER_ROUTE = /^\/api\/auth\/pairing$/;
 const DESKTOP_OWNER_HEADER = "x-openmausbot-desktop-owner";
 function mutatingPublicRoute(method, path) {
     const upper = method.toUpperCase();
@@ -343,6 +426,19 @@ export function resolveRequestAuth(req, options) {
             !secureTokenMatch(headerValue(req.headers[DESKTOP_OWNER_HEADER]), options.loopbackMutationToken)) {
             return deny(403, "forbidden: this change must come from the desktop app or a paired device");
         }
+        if (options.loopbackMutationToken === undefined && options.loopbackTrust === "service") {
+            // The CLI that started this server may still print a pairing code.
+            if (options.cliOwnerToken && CLI_OWNER_ROUTE.test(path) && ["GET", "POST"].includes(method.toUpperCase()) &&
+                secureTokenMatch(headerValue(req.headers[CLI_OWNER_HEADER]), options.cliOwnerToken)) {
+                return { auth: { kind: "loopback", scopes: LOOPBACK_SCOPES }, status: 401, error: "" };
+            }
+            // On a shared server "local" includes every bot's shell. Default deny:
+            // only the service routes, never an admin change, without a session.
+            if (!serviceAllowed(method, path)) {
+                return deny(403, "forbidden: on this shared server a local request without a session may only use the service routes; sign in to change settings, people or access");
+            }
+            return { auth: { kind: "loopback", scopes: SERVICE_SCOPES, trust: "service" }, status: 401, error: "" };
+        }
         return { auth: { kind: "loopback", scopes: LOOPBACK_SCOPES }, status: 401, error: "" };
     }
     if (proxied) {

package/dist-server/server/room-handoffs.js

@@ -6,6 +6,7 @@ const nodeSchema = z.object({
     id: z.string(), rootId: z.string(), parentId: z.string().optional(),
     groupId: z.string().optional(), threadId: z.string(), botId: z.string(),
     key: z.string(), text: z.string(), createdAt: z.number(),
+    requestBatchKey: z.string().optional(),
     status: z.enum(["source", "queued", "running", "waiting", "resume", "completed", "failed", "cancelled"]),
     result: z.string().default(""), reported: z.boolean().default(false),
     executions: z.number().int().nonnegative().default(0), startedAt: z.number().optional(),
@@ -159,7 +160,7 @@ export class RoomHandoffs {
         const root = this.root(n);
         return `Room handoff hard cap exhausted: node was ${n.status} after ${duration(this.now() - root.createdAt)} of the ${duration(this.limits.hardCapMs)} wall-clock cap`;
     }
-    enqueue(source, generation, parentId, target, key, text, approvalGranted = false, rework = false, sourceText = "") {
+    enqueue(source, generation, parentId, target, key, text, approvalGranted = false, rework = false, sourceText = "", requestBatchKey) {
         if (this.loadError)
             throw new Error(this.loadError);
         let parent = parentId ? this.nodes.get(parentId) : this.nodes.get(generation);
@@ -178,10 +179,17 @@ export class RoomHandoffs {
         const existing = this.children(parent.id).find(n => n.key === key);
         if (existing) {
             if (existing.groupId !== target.groupId || existing.botId !== target.botId || existing.text !== text ||
-                existing.kind !== kind)
+                existing.kind !== kind || existing.requestBatchKey !== requestBatchKey)
                 throw new Error("request_key was already used for different work");
             return { node: existing, duplicate: true };
         }
+        if (requestBatchKey && target.groupId) {
+            const batch = this.children(parent.id).filter(n => n.requestBatchKey === requestBatchKey && n.groupId === target.groupId);
+            if (batch.some(n => n.text !== text || n.threadId !== target.threadId))
+                throw new Error("request_key was already used for different room work");
+            if (batch.some(n => n.startedAt !== undefined))
+                throw new Error("This shared room request has already started; use a new request_key for additional recipients");
+        }
         if (!rework && this.children(parent.id).some(n => n.kind === kind &&
             n.groupId === target.groupId && n.botId === target.botId && n.status === "completed")) {
             throw new Error("This agent already completed your assignment. Do not send acknowledgements or approvals as new work. Finish with your decision; results return automatically. Only use rework=true for concrete additional work.");
@@ -221,7 +229,7 @@ export class RoomHandoffs {
         }
         const node = { ...target, id: randomUUID(), rootId: parent.rootId, parentId: parent.id,
             key, text, createdAt: this.now(), status: "queued", result: "", reported: false, executions: 0, approvalGranted,
-            kind };
+            kind, ...(target.groupId && requestBatchKey ? { requestBatchKey } : {}) };
         const problem = this.hooks.validate(node, parent);
         if (problem)
             throw new Error(problem);
@@ -239,16 +247,25 @@ export class RoomHandoffs {
         }
         return { node, duplicate: false };
     }
+    /** A room brief is displayed once; each recipient keeps its own execution and result. */
+    sharedRequest(node) {
+        const batch = node.groupId && node.requestBatchKey && node.parentId
+            ? this.children(node.parentId).filter(n => n.requestBatchKey === node.requestBatchKey &&
+                n.groupId === node.groupId && n.threadId === node.threadId && n.text === node.text)
+            : [node];
+        return { id: batch[0]?.id ?? node.id, botIds: batch.map(n => n.botId) };
+    }
     sourceSettled(generation, ok) {
         const node = this.nodes.get(generation);
         if (!node || node.status !== "source")
             return;
+        // An accepted assignment belongs to the queue, not the provider that
+        // submitted it. A failed/expired source turn must not erase that work.
+        // Explicit Stop, deletion and revoked routes still cancel separately.
         if (!ok)
-            this.cancelTree(node, "The originating room turn did not finish", "failed");
-        else {
-            node.status = "waiting";
-            this.publish(node);
-        }
+            node.result = "The originating turn ended before its teammates returned.";
+        node.status = "waiting";
+        this.publish(node);
     }
     cancelTree(node, reason, status = "cancelled") {
         for (const child of this.children(node.id))
@@ -347,8 +364,10 @@ export class RoomHandoffs {
             }
             if (n.status !== "queued" && n.status !== "resume")
                 continue;
-            // A newly queued child starts only after its author has settled.
-            if (parent && (parent.status === "source" || parent.status === "running"))
+            // Independent conversations can start as soon as work is accepted.
+            // Same-room speakers still serialize; never overlap their shared chat.
+            if (parent && (parent.status === "source" || parent.status === "running") &&
+                (parent.threadId === n.threadId || (n.groupId && n.groupId === parent.groupId)))
                 continue;
             // A stopped source stops waiting; only work that never started is
             // dropped with it. A teammate mid-turn keeps its process and reports.
@@ -381,10 +400,10 @@ export class RoomHandoffs {
                 if (terminal(n))
                     return;
                 n.result = result.text.slice(0, 12_000);
-                if (!result.ok)
-                    this.cancelTree(n, n.result || "Room agent failed", "failed");
-                else if (this.children(n.id).length > childCount)
+                if (this.children(n.id).length > childCount)
                     n.status = "waiting";
+                else if (!result.ok)
+                    this.cancelTree(n, n.result || "Room agent failed", "failed");
                 else
                     n.status = "completed";
                 // Close the paused span with the settlement itself: work enqueued
@@ -392,7 +411,18 @@ export class RoomHandoffs {
                 // budget, not the still-open pause's overstated runway.
                 this.trackExecutionPauses();
                 this.publish(n);
-            }).catch(e => { this.cancelTree(n, String(e).slice(0, 1000), "failed"); })
+            }).catch(e => {
+                if (terminal(n))
+                    return;
+                n.result = String(e).slice(0, 1000);
+                if (this.children(n.id).length > childCount) {
+                    n.status = "waiting";
+                    this.trackExecutionPauses();
+                    this.publish(n);
+                }
+                else
+                    this.cancelTree(n, n.result, "failed");
+            })
                 .finally(() => this.controllers.delete(n.id));
         }
     }

package/dist-server/server/routes/bot-presets.js

@@ -0,0 +1,25 @@
+// Preset bots for New bot (server/presets.ts has the store and the rules).
+// GET lists what New bot offers: the organization's presets first, then
+// imported files', never one from a withdrawn release. DELETE removes an
+// imported preset (the person's own click; no confirm step). Organization
+// presets are Admin's to remove. Both are admin-scoped by default in
+// server/request-auth.ts, like the New bot defaults: a preset adds skills
+// and starter notes to the bot made from it.
+import { listBotPresets, ORG_PRESET_REMOVE_MESSAGE, PRESET_UNAVAILABLE_MESSAGE } from "../presets.js";
+import { PASS } from "./table.js";
+export function createBotPresetRoutes(deps) {
+    return async ({ res, path, method, json }) => {
+        if (path === "/api/bot-presets" && method === "GET") {
+            return json(res, 200, { presets: listBotPresets(deps.presets, deps.orgStatuses()) });
+        }
+        const m = path.match(/^\/api\/bot-presets\/([\w-]+)$/);
+        if (!m || method !== "DELETE")
+            return PASS;
+        const removed = deps.presets.removeFilePreset(m[1]);
+        if (removed === "not_found")
+            return json(res, 404, { error: PRESET_UNAVAILABLE_MESSAGE });
+        if (removed === "organization")
+            return json(res, 409, { error: ORG_PRESET_REMOVE_MESSAGE });
+        return json(res, 200, { ok: true });
+    };
+}

package/dist-server/server/routes/hosted-slack.js

@@ -0,0 +1,20 @@
+// GET /api/bots/:id/slack-management: where, in the organisation's Admin, this
+// bot's Slack app is managed. A deep link only: this server holds no Slack
+// logic, contacts nobody, and the link carries identifiers, never a credential.
+// Client-scoped in server/request-auth.ts, so a member reading Bot Settings
+// gets the same link; Admin authorizes whoever opens it.
+import { hostedSlackManagement } from "../hosted-slack.js";
+import { PASS } from "./table.js";
+export function createHostedSlackRoutes(deps) {
+    return async ({ res, path, method, json }) => {
+        const m = path.match(/^\/api\/bots\/([\w-]+)\/slack-management$/);
+        if (!m || method !== "GET")
+            return PASS;
+        const bot = deps.bot(m[1]);
+        if (!bot || bot.hidden)
+            return json(res, 404, { error: "no such bot" });
+        res.setHeader("cache-control", "no-store");
+        // The id in the link is the stored bot's, not the text from the request.
+        return json(res, 200, hostedSlackManagement(bot.id, deps.hostedReady(), deps.env));
+    };
+}

package/dist-server/server/routes/table.js

@@ -0,0 +1,14 @@
+/** "Not my route": the next handler, then index.ts's inline routes, get a turn. */
+export const PASS = Symbol("route.pass");
+export const ROUTES = [];
+/** Runs handlers in order until one answers; true means stop routing. A
+ * handler that wrote a response but returned PASS by mistake still counts as
+ * answered, so the request can never reach a second handler. */
+export async function dispatchRoutes(routes, ctx) {
+    for (const route of routes) {
+        const out = await route(ctx);
+        if (out !== PASS || ctx.res.headersSent || ctx.res.writableEnded)
+            return true;
+    }
+    return false;
+}

package/dist-server/server/routine-requests.js

@@ -923,7 +923,7 @@ export class RoutineRequestService {
             if (refusal)
                 throw new RoutineRequestError(refusal, 403);
         }
-        await this.requireCloudReadiness(operation);
+        await this.requireCloudReadiness(operation, botId);
         // The readiness probe is asynchronous. Another request can edit or
         // delete the routine while it is in flight, so re-check the captured
         // revision before rendering and persisting the confirmation snapshot.
@@ -1006,7 +1006,7 @@ export class RoutineRequestService {
         }
         throw new RoutineRequestError(result.state === "invalid" ? result.error : "The routine change could not be applied", result.state === "invalid" ? result.status : 409);
     }
-    async requireCloudReadiness(operation) {
+    async requireCloudReadiness(operation, proposerBotId) {
         if (!this.cloudReady || operation.action === "pause" || operation.action === "delete")
             return;
         const definition = effectiveDefinition(operation, this.routines);
@@ -1014,7 +1014,10 @@ export class RoutineRequestService {
             return;
         let readiness;
         try {
-            readiness = await this.cloudReady();
+            const targetBotId = operation.action === "create"
+                ? operation.forBot?.botId ?? proposerBotId
+                : this.routines.listRoutines().find(routine => routine.id === operation.routineId)?.botId ?? proposerBotId;
+            readiness = await this.cloudReady(targetBotId);
         }
         catch (error) {
             const detail = error instanceof Error ? error.message : String(error);

package/dist-server/server/routines.js

@@ -6,7 +6,25 @@ import { DATA_DIR } from "./config.js";
 import { writeFileAtomic } from "./atomic.js";
 import { redactSecretsInText } from "./redact.js";
 import { normalizeCronSchedule, nextCronRuns } from "../shared/routine-schedule.js";
+import { isRoutineProblemRun } from "../shared/routines.js";
+import { ROUTINE_PARTS } from "./package-parts.js";
 const persistedSourceThreadId = z.string().trim().min(1).optional().catch(undefined);
+const HASH = /^[a-f0-9]{64}$/;
+function loadInstalledPackage(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const stamp = value;
+    if (typeof stamp.installId !== "string" || !/^[a-f0-9]{32}$/.test(stamp.installId) || typeof stamp.key !== "string" || !stamp.key || stamp.key.length > 80)
+        return undefined;
+    const parts = stamp.parts;
+    if (!parts || typeof parts !== "object" || !ROUTINE_PARTS.every((part) => HASH.test(String(parts[part]?.r)) && HASH.test(String(parts[part]?.w))))
+        return undefined;
+    return {
+        installId: stamp.installId,
+        key: stamp.key,
+        parts: Object.fromEntries(ROUTINE_PARTS.map((part) => [part, { r: parts[part].r, w: parts[part].w }])),
+    };
+}
 const webhookRunReceiptSchema = z.object({
     webhookId: z.string().min(1).max(200),
     deliveryId: z.string().min(1).max(200),
@@ -489,9 +507,12 @@ export class RoutineManager {
                         overlap: routine.overlap === "queue" ? "queue" : undefined,
                         skippedRuns: Number.isSafeInteger(routine.skippedRuns) && routine.skippedRuns > 0 ? routine.skippedRuns : undefined,
                         lastSkippedAt: Number.isSafeInteger(routine.lastSkippedAt) && routine.lastSkippedAt >= 0 && routine.lastSkippedAt <= MAX_DATE_MS ? routine.lastSkippedAt : undefined,
+                        installedPackage: loadInstalledPackage(routine.installedPackage),
                     };
                     if (loaded.timeoutMinutes === undefined)
                         delete loaded.timeoutMinutes;
+                    if (loaded.installedPackage === undefined)
+                        delete loaded.installedPackage;
                     delete loaded.failureStreak;
                     return [loaded];
                 })
@@ -581,7 +602,27 @@ export class RoutineManager {
             .sort((a, b) => (b.finishedAt ?? b.createdAt) - (a.finishedAt ?? a.createdAt) || b.createdAt - a.createdAt);
         const success = outcomes.findIndex(run => run.status === "completed");
         const failures = success < 0 ? outcomes.length : success;
-        return { ...cloneRoutine(routine), ...(failures ? { failureStreak: failures } : {}) };
+        const { installedPackage: _installedPackage, ...visible } = cloneRoutine(routine);
+        return { ...visible, ...(failures ? { failureStreak: failures } : {}) };
+    }
+    /** Routines added from the organization's library, with their stamps. */
+    packageStamps() {
+        return this.routines.flatMap((routine) => routine.installedPackage
+            ? [{ routineId: routine.id, botId: routine.botId, enabled: routine.enabled, stamp: structuredClone(routine.installedPackage) }]
+            : []);
+    }
+    /** Record which organization install a just-created routine belongs to. */
+    stampInstalledPackage(id, stamp) {
+        const clean = loadInstalledPackage(stamp);
+        if (!clean)
+            throw new Error("Invalid routine package stamp");
+        if (!this.routines.some((routine) => routine.id === id))
+            return false;
+        this.commitMutation(() => {
+            const routine = this.routines.find((candidate) => candidate.id === id);
+            routine.installedPackage = clean;
+        });
+        return true;
     }
     /** Whether this computer should stay awake for routines: a run is in
      * flight, or an enabled routine is due within the horizon. The schedule
@@ -1063,6 +1104,27 @@ export class RoutineManager {
         }
         return cloneRun(run);
     }
+    /** Clear every failure indicator at once: stamp seenAt on each unseen
+     * failed/missed run in one committed save, then emit the updated runs so
+     * connected clients drop their dots immediately. A failed save rolls the
+     * stamps back so a retry still finds the unseen runs. */
+    markAllSeen() {
+        if (!this.runs.some((run) => !run.seenAt && isRoutineProblemRun(run)))
+            return [];
+        const stampAt = this.now();
+        const updated = [];
+        this.commitMutation(() => {
+            for (const run of this.runs) {
+                if (run.seenAt || !isRoutineProblemRun(run))
+                    continue;
+                run.seenAt = stampAt;
+                updated.push(run);
+            }
+        });
+        for (const run of updated)
+            this.emitRun(run);
+        return updated.map(cloneRun);
+    }
     get isTicking() { return this.ticking; }
     start() {
         if (this.timer)

package/dist-server/server/section-context.js

@@ -9,6 +9,7 @@ import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.js";
 import { DATA_DIR } from "./config.js";
+import { renamePublishedTeam } from "./published-teams.js";
 export const SECTION_CONTEXT_MAX_BYTES = 24_000;
 export const SECTION_CONTEXTS_FILE = join(DATA_DIR, "section-contexts.json");
 const sectionContextRecordSchema = z.object({ text: z.string(), updatedAt: z.number().finite() });
@@ -94,6 +95,15 @@ export function changeEmptySection(name, nextName) {
     if (nextName !== null && context)
         data.contexts[nextName] = context;
     saveFile(data);
+    // Every team rename and removal funnels through here, so the team's
+    // published package id and keys follow it (published-teams.ts). The team
+    // itself is already renamed; a failure here costs only key stability.
+    try {
+        renamePublishedTeam(name, nextName);
+    }
+    catch (error) {
+        console.warn(`[teams] Could not move the shared-package record for this team: ${error.message}`);
+    }
 }
 export function readSectionContext(section) {
     const record = loadFile().contexts[sectionContextKey(section)];

package/dist-server/server/skills.js

@@ -34,14 +34,11 @@ import { DATA_DIR } from "./config.js";
 import { redactSecretsInText } from "./redact.js";
 import { LEARN_SOURCE_PREFIX } from "./skill-learn.js";
 import { workspaceDir } from "./workspace.js";
-/** Spec rule: lowercase alphanumerics with single hyphens, 1-64 chars,
- * folder name must equal it. The regex IS the traversal gate — no dots, no
- * slashes, no way to name a skill "..". */
-const SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-export const SKILL_NAME_MAX = 64;
-export const DESCRIPTION_MAX = 1024;
-/** One SKILL.md may be at most this large; the spec recommends <5k tokens. */
-export const SKILL_FILE_MAX_BYTES = 256 * 1024;
+import { isSkillName, parseSkillMd, scanSkillText, SKILL_FILE_MAX_BYTES } from "../shared/skill-md.js";
+// SKILL.md parsing and the static scan live in shared/ so the package
+// format (Admin and the renderer included) validates skills with the exact
+// same rules; re-exported here under their historical path.
+export { DESCRIPTION_MAX, isSkillName, parseSkillMd, scanSkillText, SKILL_FILE_MAX_BYTES, SKILL_NAME_MAX, } from "../shared/skill-md.js";
 /** Index budget: name+description lines only, ~100 tokens per skill. */
 export const INDEX_MAX_SKILLS = 30;
 export const INDEX_MAX_BYTES = 4_000;
@@ -51,58 +48,6 @@ export const STAGED_GIST_MAX = 240;
 /** Learned skills are duplicated onto their durable review card. Keep that
  * exact review payload bounded while leaving fetched skill imports unchanged. */
 export const STAGED_SKILL_FILE_MAX_BYTES = 32 * 1024;
-export function isSkillName(name) {
-    return name.length >= 1 && name.length <= SKILL_NAME_MAX && SKILL_NAME.test(name);
-}
-/** Minimal frontmatter reader for the two required keys plus the two we
- * display. Deliberately not a YAML engine: values are single-line strings in
- * every skill the spec's own examples show, and a parser that cannot
- * evaluate anchors or tags cannot be surprised by them. */
-export function parseSkillMd(raw) {
-    const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
-    if (!match)
-        return { error: "SKILL.md has no YAML frontmatter (--- block) at the top" };
-    const fields = {};
-    for (const line of match[1].split(/\r?\n/)) {
-        const kv = line.match(/^([A-Za-z][\w-]*):\s*(.*)$/);
-        if (!kv)
-            continue;
-        fields[kv[1].toLowerCase()] = kv[2].replace(/^["']|["']$/g, "").trim();
-    }
-    const name = fields.name ?? "";
-    const description = fields.description ?? "";
-    if (!isSkillName(name)) {
-        return { error: `frontmatter name ${JSON.stringify(name)} is not a valid skill name (lowercase, hyphens, max ${SKILL_NAME_MAX})` };
-    }
-    if (!description || description.length > DESCRIPTION_MAX) {
-        return { error: `frontmatter description is required and must be at most ${DESCRIPTION_MAX} characters` };
-    }
-    return {
-        name,
-        description,
-        license: fields.license || undefined,
-        compatibility: fields.compatibility || undefined,
-        body: match[2] ?? "",
-    };
-}
-/** Static red flags before a human review. Presence is a warning shown in
- * the review screen, never a silent rejection — the reviewer decides. These
- * are the three patterns the public registry audits actually caught. */
-export function scanSkillText(raw) {
-    const warnings = [];
-    if (/[A-Za-z0-9+/]{120,}={0,2}/.test(raw)) {
-        warnings.push("contains a long base64-looking blob — a common wrapper for hidden instructions or payloads");
-    }
-    if (/\b(curl|wget)\b[^\n]{0,200}\|\s*(ba|z|da)?sh\b/.test(raw)) {
-        warnings.push("pipes a download straight into a shell (curl|sh) — never enable without understanding why");
-    }
-    // zero-width and bidi-control characters hide text from the reviewer while
-    // the model still reads it — the invisible-instruction trick
-    if (/[\u200B-\u200F\u202A-\u202E\u2060-\u2064\uFEFF]/.test(raw)) {
-        warnings.push("contains invisible Unicode characters (zero-width or bidi controls) — text you cannot see");
-    }
-    return warnings;
-}
 const skillManifestEntrySchema = z.object({
     description: z.string(),
     enabled: z.boolean(),
@@ -115,6 +60,13 @@ const skillManifestEntrySchema = z.object({
     skippedFiles: z.array(z.string()),
     appliedStageId: z.string().optional(),
     storageRevision: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+    package: z.object({
+        installId: z.string().regex(/^[a-f0-9]{32}$/),
+        key: z.string().min(1).max(64),
+        release: z.string().min(1).max(40),
+        r: z.string().regex(/^[a-f0-9]{64}$/),
+        w: z.string().regex(/^[a-f0-9]{64}$/),
+    }).optional(),
 });
 const skillManifestSchema = z.record(z.string(), skillManifestEntrySchema);
 const managedLinksSchema = z.array(z.string());
@@ -498,7 +450,7 @@ function skillContentMatches(botId, name, entry) {
     }
 }
 function skillListing(botId, name, entry) {
-    const { appliedStageId, storageRevision: _storageRevision, ...visible } = entry;
+    const { appliedStageId, storageRevision: _storageRevision, package: _package, ...visible } = entry;
     const intact = skillContentMatches(botId, name, entry);
     return {
         name,
@@ -563,6 +515,26 @@ export function installSkill(botId, source, files) {
         return prepared;
     return installPreparedSkill(botId, source, prepared, { enabled: false });
 }
+/** The organization library's path: a skill the organization's Admin
+ * published arrives switched ON (the Admin is the review), with the install
+ * stamp that lets the library find it again. `source` is chosen by the
+ * caller (`org:<ref>@<release>`), never read from the package. */
+export function installOrgSkill(botId, source, skillMd, stamp) {
+    if (!source.startsWith("org:"))
+        return { error: "organization skills need an org: source" };
+    const prepared = preparedSkillFiles([{ path: "SKILL.md", content: skillMd }]);
+    if ("error" in prepared)
+        return prepared;
+    if (prepared.parsed.name !== stamp.key)
+        return { error: `the skill is named "${prepared.parsed.name}", not "${stamp.key}"` };
+    return installPreparedSkill(botId, source, prepared, { enabled: true, package: { ...stamp } });
+}
+/** A bot's skills that an organization install added, with their stamps. */
+export function skillPackageStamps(botId) {
+    return Object.entries(readManifest(botId)).flatMap(([name, entry]) => entry.package
+        ? [{ name, enabled: entry.enabled, stamp: { ...entry.package } }]
+        : []);
+}
 export function setSkillEnabled(botId, name, enabled) {
     if (!isSkillName(name))
         return { error: "invalid skill name" };
@@ -936,6 +908,7 @@ function installPreparedSkill(botId, source, prepared, options) {
         warnings: prepared.warnings,
         skippedFiles: prepared.skippedFiles,
         appliedStageId: options.appliedStageId,
+        ...(options.package ? { package: options.package } : {}),
     };
     const root = ensureSkillsRoot(botId);
     if (!root)