pikiloom 0.4.26 → 0.4.28

package/dist/catalog/cli-tools.js

@@ -1,38 +1,4 @@
-/**
- * CLI tool catalog — single source of truth for what the Dashboard shows under
- * Extensions → CLI.
- *
- * ─── How this plugs into the rest of the stack ───────────────────────────────
- *
- *   Dashboard → GET /api/extensions/cli/catalog
- *     → dashboard/routes/cli.ts
- *       → agent/cli/catalog.ts    (merge + live detection)
- *         → agent/cli/registry.ts (types + re-exports this array)
- *           ← src/catalog/cli-tools.ts ← YOU ARE HERE
- *
- * The registry module defines the `RecommendedCli` type and other helpers; the
- * detector spawns `which <binary>` + the status command, and the auth runner
- * streams the login sub-process. This file owns only the *data*.
- *
- * ─── How to add a CLI ────────────────────────────────────────────────────────
- *
- *   1. Append an entry to `CLI_TOOLS`.
- *   2. Pick an `auth.type`:
- *        - 'oauth-web' if the CLI has a first-party `<cli> ... login --web`
- *          flavor (gh, wrangler, vercel, …). The runner spawns that command,
- *          streams stdout/stderr to the UI, and polls `statusArgv` until it
- *          reports authed.
- *        - 'token' if the user pastes an API key. Implement the write-path in
- *          `agent/cli/auth.ts` → `applyCliToken` for that id (keeps secret
- *          handling explicit per CLI).
- *        - 'none' for CLIs that don't need sign-in (docker, pnpm).
- *   3. Fill `install.{darwin,linux,win}` with canonical commands. The UI shows
- *      the current OS's list and always renders a "Copy" button. We deliberately
- *      do NOT auto-run installers — package managers often need sudo or
- *      interactive confirmation and we'd rather keep the user in charge.
- */
 export const CLI_TOOLS = [
-    // ── Dev: source control & platforms ────────────────────────────────────────
     {
         id: 'gh',
         binary: 'gh',
@@ -62,7 +28,6 @@ export const CLI_TOOLS = [
             loginHintZh: '将打开浏览器完成 GitHub OAuth 授权。',
         },
     },
-    // ── Cloud platforms ────────────────────────────────────────────────────────
     {
         id: 'wrangler',
         binary: 'wrangler',
@@ -111,8 +76,6 @@ export const CLI_TOOLS = [
             statusArgv: ['vercel', 'whoami'],
             loginArgv: ['vercel', 'login'],
             logoutArgv: ['vercel', 'logout'],
-            // `vercel login` opens an interactive picker (email / GitHub / GitLab /
-            // Bitbucket / SAML) that needs a real TTY. Surface the official command.
             manualLoginCommands: [
                 { label: 'Sign in to Vercel', cmd: 'vercel login' },
             ],
@@ -194,8 +157,6 @@ export const CLI_TOOLS = [
             statusArgv: ['heroku', 'whoami'],
             loginArgv: ['heroku', 'login'],
             logoutArgv: ['heroku', 'logout'],
-            // `heroku login` prompts "Press any key to open up the browser to login
-            // or q to exit" — a hard TTY dependency. Surface the official command.
             manualLoginCommands: [
                 { label: 'Sign in to Heroku', cmd: 'heroku login' },
             ],
@@ -203,7 +164,6 @@ export const CLI_TOOLS = [
             loginHintZh: '请在自己的终端里运行 `heroku login` —— 该命令会提示「Press any key」，必须在交互式终端里完成。登录后回到这里点击「重新检测状态」。',
         },
     },
-    // ── Commerce & payments ────────────────────────────────────────────────────
     {
         id: 'stripe',
         binary: 'stripe',
@@ -230,7 +190,6 @@ export const CLI_TOOLS = [
             loginHintZh: '打开浏览器完成授权，凭据写入 ~/.config/stripe/。',
         },
     },
-    // ── Cloud giants (token-based profile flows) ───────────────────────────────
     {
         id: 'aws',
         binary: 'aws',
@@ -279,15 +238,10 @@ export const CLI_TOOLS = [
         },
         auth: {
             type: 'oauth-web',
-            // `gcloud auth list ... --format=value(account)` exits 0 even when no
-            // account is signed in (just prints an empty line). Require non-empty
-            // output so an empty list isn't mistaken for ready.
             statusArgv: ['gcloud', 'auth', 'list', '--filter=status:ACTIVE', '--format=value(account)'],
             statusReadyPattern: '\\S',
             loginArgv: ['gcloud', 'auth', 'login'],
             logoutArgv: ['gcloud', 'auth', 'revoke'],
-            // `gcloud auth login` orchestrates a local callback server + interactive
-            // prompts — needs a real TTY. ADC for SDK code is a separate command.
             manualLoginCommands: [
                 { label: 'Sign in (user credentials)', cmd: 'gcloud auth login' },
                 { label: 'Optional: Application Default Credentials', cmd: 'gcloud auth application-default login' },
@@ -296,7 +250,6 @@ export const CLI_TOOLS = [
             loginHintZh: '请在自己的终端里运行 `gcloud auth login` —— 它依赖本地回调服务器与交互式提示，不能在此面板里完成。SDK 用的 Application Default 凭证是另一个命令。登录后回到这里点击「重新检测状态」。',
         },
     },
-    // ── Social & messaging ─────────────────────────────────────────────────────
     {
         id: 'lark-cli',
         binary: 'lark-cli',
@@ -319,10 +272,6 @@ export const CLI_TOOLS = [
             statusArgv: ['lark-cli', 'auth', 'status'],
             loginArgv: ['lark-cli', 'auth', 'login', '--recommend'],
             logoutArgv: ['lark-cli', 'auth', 'logout'],
-            // Lark CLI sign-in has two ordered steps and renders a terminal QR that
-            // doesn't fit a streamed-output panel. Both commands run in the user's
-            // own terminal; only after step 2 does `lark-cli auth status` exit 0,
-            // so re-check naturally rejects "only step 1 completed".
             manualLoginCommands: [
                 { label: 'Step 1 — Register a Feishu app (one-time setup)', cmd: 'lark-cli config init --new' },
                 { label: 'Step 2 — Sign in via Device Flow OAuth', cmd: 'lark-cli auth login --recommend' },
@@ -331,7 +280,6 @@ export const CLI_TOOLS = [
             loginHintZh: '飞书 CLI 登录分两步，请在自己的终端里依序运行：先用第 1 步注册飞书应用，再用第 2 步完成 OAuth 授权 —— 两步全部完成后才算授权成功。`lark-cli` 登录时打印的二维码 / Device Flow URL 不适合在此面板内展示。完成第 2 步后回到这里点击「重新检测状态」。建议同步安装配套 Skills：`npx skills add larksuite/cli -y -g`。',
         },
     },
-    // ── Content & creation ─────────────────────────────────────────────────────
     {
         id: 'mocli',
         binary: 'mocli',
@@ -360,7 +308,6 @@ export const CLI_TOOLS = [
             loginHintZh: '在墨问小程序里：右下角「我的」→「开发者」→「我的 API Key」，复制粘贴到这里。装完后建议再跑 `npx skills add mowenxd/cli -y -g` 安装配套 Skills。',
         },
     },
-    // ── No-auth utilities (detect only) ────────────────────────────────────────
     {
         id: 'opencli',
         binary: 'opencli',

package/dist/catalog/index.js

@@ -1,21 +1,3 @@
-/**
- * src/catalog — data-only manifests of everything the Extensions page offers.
- *
- * This directory is the *single* place you edit to add/remove items from the
- * Dashboard. Each file is a plain TypeScript array; no logic lives here.
- *
- *   mcp-servers.ts  — Extensions → MCP tab
- *   cli-tools.ts    — Extensions → CLI tab
- *   skill-repos.ts  — Extensions → Skills tab
- *
- * The loading / auth / install logic lives in:
- *   - src/agent/mcp/{registry,extensions,oauth}.ts   (MCP)
- *   - src/agent/cli/{registry,detector,auth}.ts      (CLI)
- *   - src/agent/{skills,skill-installer}.ts          (Skills)
- *
- * Those modules own the types and execute the runtime flows; this directory
- * exists purely so "what to show" stays editable in one spot.
- */
 export { MCP_SERVERS } from './mcp-servers.js';
 export { CLI_TOOLS } from './cli-tools.js';
 export { SKILL_REPOS } from './skill-repos.js';

package/dist/catalog/local-models.js

@@ -1,20 +1,4 @@
-/**
- * Local model catalog — curated set of coding-friendly open models that
- * pikiloom recommends for self-hosted backends (Ollama / mlx-lm).
- *
- * Per-backend identifier rules:
- *   - `ollamaTag`  — entry exists in Ollama's library
- *   - `mlxModel`   — HuggingFace repo under `mlx-community/` (Apple Silicon)
- *   Either field is optional; the dashboard filters by backend before display.
- *
- * Sizing rules of thumb (Q4 quants on disk):
- *   weights_gb   ≈ params_b × 0.6
- *   min_ram_gb   ≈ weights_gb × 1.5 + 4   // KV cache + OS headroom
- *
- * `minRamGb` is conservative on purpose.
- */
 export const LOCAL_MODELS = [
-    // ── Tier A: 16 GB Macs ─────────────────────────────────────────────────────
     {
         id: 'qwen2.5-coder-7b',
         name: 'Qwen2.5-Coder 7B',
@@ -52,7 +36,6 @@ export const LOCAL_MODELS = [
         ollamaTag: 'gemma3:4b',
         homepage: 'https://ai.google.dev/gemma',
     },
-    // ── Tier B: 24-32 GB sweet spot ────────────────────────────────────────────
     {
         id: 'deepseek-coder-v2-lite',
         name: 'DeepSeek-Coder V2 Lite',
@@ -77,7 +60,6 @@ export const LOCAL_MODELS = [
         ollamaTag: 'phi4:14b',
         homepage: 'https://huggingface.co/microsoft/phi-4',
     },
-    // ── Tier S: 36+ GB unified memory ──────────────────────────────────────────
     {
         id: 'qwen2.5-coder-32b',
         name: 'Qwen2.5-Coder 32B',

package/dist/catalog/mcp-servers.js

@@ -1,34 +1,4 @@
-/**
- * MCP server catalog — single source of truth for what the Dashboard shows
- * under Extensions → MCP.
- *
- * ─── How this plugs into the rest of the stack ───────────────────────────────
- *
- *   Dashboard → GET /api/extensions/mcp/catalog
- *     → dashboard/routes/extensions.ts
- *       → agent/mcp/extensions.ts      (merge + state computation)
- *         → agent/mcp/registry.ts      (types + re-exports this array)
- *           ← src/catalog/mcp-servers.ts ← YOU ARE HERE
- *
- * The registry module owns types and helper functions (install / OAuth / health).
- * This file owns only the *data*. To add a new MCP server, append an entry here
- * and the whole pipeline picks it up. To hide an entry, remove/comment it out —
- * users who already installed it keep their setup; we only stop recommending.
- *
- * ─── recommendedScope ────────────────────────────────────────────────────────
- *
- *   'global'    — account-level SaaS (GitHub, Atlassian, …). Shown in the
- *                 Extensions tab; hidden from the Workspace modal.
- *   'workspace' — tools that depend on project context (Filesystem, SQLite,
- *                 Postgres). Shown in the Workspace modal; hidden globally.
- *   'both'      — useful in either place (rarely needed; avoid unless obvious).
- *
- * Generic protocol-demo servers (time / fetch / memory from @modelcontextprotocol)
- * were intentionally removed — they don't carry a product identity and added
- * clutter rather than value.
- */
 export const MCP_SERVERS = [
-    // ── Built-in (pikiloom-managed) ────────────────────────────────────────────
     {
         id: 'pikiloom-browser',
         name: 'Browser Automation',
@@ -56,7 +26,6 @@ export const MCP_SERVERS = [
         homepage: 'https://peekaboo.sh/',
         isBuiltin: true,
     },
-    // ── Local filesystems / databases (workspace scope) ────────────────────────
     {
         id: 'filesystem',
         name: 'Filesystem',
@@ -99,7 +68,6 @@ export const MCP_SERVERS = [
         },
         iconSlug: 'postgres',
     },
-    // ── Global-scope SaaS with MCP-OAuth ───────────────────────────────────────
     {
         id: 'github',
         name: 'GitHub',
@@ -160,7 +128,6 @@ export const MCP_SERVERS = [
         iconSlug: 'sentry',
         homepage: 'https://docs.sentry.io/product/sentry-mcp/',
     },
-    // ── Cloudflare trio (control plane / observability / docs) ─────────────────
     {
         id: 'cloudflare-bindings',
         name: 'Cloudflare',
@@ -197,7 +164,6 @@ export const MCP_SERVERS = [
         iconSlug: 'cloudflare',
         homepage: 'https://developers.cloudflare.com/agents/model-context-protocol/',
     },
-    // ── More SaaS integrations ─────────────────────────────────────────────────
     {
         id: 'gamma',
         name: 'Gamma',
@@ -246,7 +212,6 @@ export const MCP_SERVERS = [
         iconSlug: 'lark',
         homepage: 'https://open.feishu.cn/document/mcp',
     },
-    // ── Remote + API key ───────────────────────────────────────────────────────
     {
         id: 'stripe',
         name: 'Stripe',

package/dist/catalog/skill-repos.js

@@ -1,33 +1,4 @@
-/**
- * Skill repository catalog — single source of truth for what the Dashboard
- * shows under Extensions → Skills.
- *
- * ─── How this plugs into the rest of the stack ───────────────────────────────
- *
- *   Dashboard → GET /api/extensions/skills/catalog
- *     → dashboard/routes/extensions.ts
- *       → agent/mcp/registry.ts              (types + re-exports this array)
- *       → agent/skills.ts                    (locally-installed discovery)
- *       → agent/skill-installer.ts           (`npx skills add …` runner)
- *         ← src/catalog/skill-repos.ts       ← YOU ARE HERE
- *
- * ─── Curation policy ─────────────────────────────────────────────────────────
- *
- * Every entry below is a real, public GitHub repo. Authority signal is GitHub
- * stars — the dashboard fetches `stars` / `pushedAt` at load time and sorts the
- * cards by star count, so "more popular = appears higher". Don't add fictional
- * placeholder entries; if a repo isn't real and starred, users hit a 404 the
- * moment they click Install.
- *
- * ─── How to add a skill pack ─────────────────────────────────────────────────
- *
- *   Append a `RecommendedSkillRepo` entry with `source` set to an `owner/repo`
- *   GitHub slug (or full URL). The install flow runs `npx skills add <source>`
- *   and drops the skill into `~/.pikiloom/skills/` for global installs, or
- *   `<workdir>/.pikiloom/skills/` for project installs.
- */
 export const SKILL_REPOS = [
-    // ── Official / first-party ────────────────────────────────────────────────
     {
         id: 'pikiloom-skills',
         name: 'Pikiloom Skills',
@@ -37,7 +8,6 @@ export const SKILL_REPOS = [
         category: 'productivity',
         recommendedScope: 'both',
         homepage: 'https://github.com/xiaotonng/pikiloom-skills',
-        // First-party pack: keep it at the top even before it accrues stars.
         pinned: true,
     },
     {
@@ -60,7 +30,6 @@ export const SKILL_REPOS = [
         recommendedScope: 'both',
         homepage: 'https://github.com/vercel-labs/agent-skills',
     },
-    // ── High-signal community collections (awesome-lists / megapacks) ─────────
     {
         id: 'obra-superpowers',
         name: 'Obra Superpowers',
@@ -111,7 +80,6 @@ export const SKILL_REPOS = [
         recommendedScope: 'global',
         homepage: 'https://github.com/alirezarezvani/claude-skills',
     },
-    // ── Domain-specific high-quality skills ───────────────────────────────────
     {
         id: 'planning-with-files',
         name: 'Planning with Files',

package/dist/channels/base.js

@@ -1,10 +1,3 @@
-/**
- * Channel base — minimal abstract for all IM platforms.
- *
- * Only defines: lifecycle + outgoing primitives.
- * Hooks (onCommand, onMessage, onCallback, ...) are platform-specific
- * and belong in each subclass — different IMs expose different interaction models.
- */
 export const DEFAULT_CHANNEL_CAPABILITIES = Object.freeze({
     editMessages: false,
     typingIndicators: false,
@@ -15,24 +8,12 @@ export const DEFAULT_CHANNEL_CAPABILITIES = Object.freeze({
 export class Channel {
     bot = null;
     capabilities = DEFAULT_CHANNEL_CAPABILITIES;
-    /**
-     * Send an image given in-memory bytes. Default implementation throws — only
-     * channels whose `capabilities.sendImage` is true must override. The bot
-     * uses `supportsChannelCapability(ch, 'sendImage')` to gate dispatch.
-     *
-     * `mime` is the explicit MIME type (e.g. `image/png`) so subclasses can pick
-     * the right native upload primitive (Telegram sendPhoto vs sendDocument;
-     * Feishu uploadImage `image_type=message`; WeChat image message vs file).
-     */
     async sendImage(_chatId, _bytes, _opts) {
         throw new Error(`${this.constructor.name} does not implement sendImage`);
     }
     async setMenu(_commands) { }
     async clearMenu() { }
 }
-// ---------------------------------------------------------------------------
-// Shared helpers
-// ---------------------------------------------------------------------------
 export function supportsChannelCapability(channel, capability) {
     return channel?.capabilities?.[capability] ?? false;
 }

package/dist/channels/dingtalk/bot.js

@@ -1,6 +1,3 @@
-/**
- * DingTalk bot orchestration.
- */
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/channels/dingtalk/channel.js

@@ -1,18 +1,3 @@
-/**
- * DingTalk channel transport — Stream Mode (no public IP needed).
- *
- * Uses dingtalk-stream@2.x SDK. Auth: clientId (AppKey) + clientSecret
- * (AppSecret) of a self-built robot/app subscribed to the bot message topic.
- *
- * Receive: DWClient subscribes to TOPIC_ROBOT and yields RobotTextMessage
- * payloads via registerCallbackListener.
- *
- * Send: each inbound message carries a `sessionWebhook` URL valid for ~2 hours,
- * which we POST to for replies. We cache the latest sessionWebhook per chat
- * so a long-running task that produces a result message can still reach the
- * user even after the original webhook would have expired (mid-conversation
- * activity refreshes it). DingTalk plain-text messages cannot be edited.
- */
 import { DWClient, TOPIC_ROBOT, EventAck } from 'dingtalk-stream';
 import { Channel, DEFAULT_CHANNEL_CAPABILITIES, splitText, sleep, } from '../base.js';
 import { DINGTALK_LIMITS } from '../../core/constants.js';
@@ -29,8 +14,6 @@ function previewText(value, max = 200) {
 export class DingtalkChannel extends Channel {
     capabilities = {
         ...DEFAULT_CHANNEL_CAPABILITIES,
-        // DingTalk Stream Mode plain-text messages cannot be edited; AI Cards
-        // can be updated but are out of scope for this minimal channel.
     };
     knownChats = new Set();
     clientId;
@@ -42,7 +25,6 @@ export class DingtalkChannel extends Channel {
     chatMeta = new Map();
     messageHandlers = new Set();
     errorHandlers = new Set();
-    /** Dedup: stream may redeliver after timeouts. */
     seenMsgIds = new Set();
     seenMsgIdQueue = [];
     static SEEN_CAP = 256;
@@ -54,9 +36,6 @@ export class DingtalkChannel extends Channel {
     }
     onMessage(handler) { this.messageHandlers.add(handler); return this; }
     onError(handler) { this.errorHandlers.add(handler); return this; }
-    // ========================================================================
-    // Lifecycle
-    // ========================================================================
     async connect() {
         this.dwClient = new DWClient({
             clientId: this.clientId,
@@ -133,9 +112,6 @@ export class DingtalkChannel extends Channel {
         this.listenResolve?.();
         this.listenResolve = null;
     }
-    // ========================================================================
-    // Outgoing primitives
-    // ========================================================================
     async send(chatId, text, _opts = {}) {
         const chat = String(chatId);
         const meta = this.chatMeta.get(chat);
@@ -169,26 +145,17 @@ export class DingtalkChannel extends Channel {
             catch (err) {
                 if (err instanceof Error && err.message.startsWith('DingTalk reply errcode='))
                     throw err;
-                // Non-JSON body or no errcode is treated as success.
             }
             lastId = `dt:${Date.now().toString(36)}:${i}`;
         }
         return lastId;
     }
     async editMessage(_chatId, _msgId, _text, _opts) {
-        // Plain-text messages on DingTalk are not editable. AI Cards have an
-        // update API but require pre-registering a card template — out of scope
-        // for this transport. Callers that fall back here just no-op.
     }
     async deleteMessage(_chatId, _msgId) {
-        // No public delete API for bot-sent messages.
     }
     async sendTyping(_chatId, _opts) {
-        // No typing indicator API.
     }
-    // ========================================================================
-    // Internal dispatch
-    // ========================================================================
     async dispatchRobotMessage(msg) {
         try {
             this.dwClient?.socketCallBackResponse(msg.headers.messageId, { status: EventAck.SUCCESS });

package/dist/channels/discord/bot.js

@@ -1,10 +1,3 @@
-/**
- * Discord bot orchestration.
- *
- * Mirrors the Slack/Weixin command surface (/help, /status, /agent, /models, …)
- * over Discord channels. Bot replies as a regular message reply so the thread
- * UI keeps the conversation grouped under the trigger message.
- */
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/channels/discord/channel.js

@@ -1,16 +1,3 @@
-/**
- * Discord channel transport — Gateway WebSocket (no public IP needed).
- *
- * Uses discord.js v14 with the bare minimum gateway intents:
- *   - Guilds, GuildMessages, MessageContent, DirectMessages
- *
- * IMPORTANT: For the bot to read message content in shared channels you must
- * enable the "Message Content Intent" toggle in the Discord developer portal
- * Bot page. Without it the gateway will silently emit empty `content`.
- *
- * Receives DMs and messages where the bot is mentioned. Self-authored
- * messages are filtered out before dispatch.
- */
 import { Client, Events, GatewayIntentBits, Partials, } from 'discord.js';
 import { Channel, DEFAULT_CHANNEL_CAPABILITIES, splitText, sleep, } from '../base.js';
 import { DISCORD_LIMITS } from '../../core/constants.js';
@@ -42,9 +29,6 @@ export class DiscordChannel extends Channel {
     }
     onMessage(handler) { this.messageHandlers.add(handler); return this; }
     onError(handler) { this.errorHandlers.add(handler); return this; }
-    // ========================================================================
-    // Lifecycle
-    // ========================================================================
     async connect() {
         this.client = new Client({
             intents: [
@@ -122,9 +106,6 @@ export class DiscordChannel extends Channel {
         this.listenResolve?.();
         this.listenResolve = null;
     }
-    // ========================================================================
-    // Outgoing primitives
-    // ========================================================================
     async send(chatId, text, opts = {}) {
         const channelId = String(chatId);
         const channel = await this.fetchTextChannel(channelId);
@@ -174,9 +155,6 @@ export class DiscordChannel extends Channel {
         }
         catch { }
     }
-    // ========================================================================
-    // Internal dispatch
-    // ========================================================================
     async dispatchMessage(msg) {
         if (msg.author?.bot)
             return;