unbrowse 3.1.0 → 3.2.0

package/runtime-src/vault/index.ts

@@ -1,196 +0,0 @@
-import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
-import { homedir } from "os";
-import { log } from "../logger.js";
-
-type KeytarClient = {
-  setPassword: (service: string, account: string, password: string) => Promise<unknown>;
-  getPassword: (service: string, account: string) => Promise<string | null>;
-  deletePassword: (service: string, account: string) => Promise<boolean>;
-};
-
-const KEYTAR_UNAVAILABLE = Symbol("KEYTAR_UNAVAILABLE");
-const KEYTAR_BINDING_ERROR_RE = /(keytar(?:\.node)?|native bindings?|bindings file|no native build was found|could not locate the bindings file|module did not self-register|err_dlopen_failed|dlopen\(|compiled against a different node\.js version|cannot find module .*keytar|wasm is not supported on this platform|(set|get|delete)password is not a function)/i;
-
-export function normalizeKeytarModule(mod: unknown): KeytarClient | null {
-  let candidate: unknown = mod;
-  for (let depth = 0; depth < 3; depth++) {
-    if (!candidate || typeof candidate !== "object" || !("default" in candidate)) break;
-    candidate = (candidate as { default?: unknown }).default;
-  }
-  if (!candidate) return null;
-  if (
-    typeof (candidate as Partial<KeytarClient>).setPassword === "function" &&
-    typeof (candidate as Partial<KeytarClient>).getPassword === "function" &&
-    typeof (candidate as Partial<KeytarClient>).deletePassword === "function"
-  ) {
-    return candidate as KeytarClient;
-  }
-  return null;
-}
-
-let keytar: KeytarClient | null = null;
-try {
-  keytar = normalizeKeytarModule(await import("keytar"));
-} catch {
-  // keytar unavailable -- use encrypted file fallback
-}
-const importedKeytar = keytar;
-let keytarFallbackLogged = false;
-
-function isKeytarBindingError(error: unknown): boolean {
-  const message = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
-  return KEYTAR_BINDING_ERROR_RE.test(message);
-}
-
-function disableKeytar(error: unknown): void {
-  keytar = null;
-  if (keytarFallbackLogged) return;
-  const summary = error instanceof Error ? error.message : String(error);
-  log("vault", `keytar runtime unavailable (${summary}); using encrypted file fallback`);
-  keytarFallbackLogged = true;
-}
-
-async function callKeytar<T>(op: (client: KeytarClient) => Promise<T>): Promise<T | typeof KEYTAR_UNAVAILABLE> {
-  if (!keytar) return KEYTAR_UNAVAILABLE;
-  try {
-    return await op(keytar);
-  } catch (error) {
-    if (!isKeytarBindingError(error)) throw error;
-    disableKeytar(error);
-    return KEYTAR_UNAVAILABLE;
-  }
-}
-
-export function setKeytarClientForTests(client: KeytarClient | null): void {
-  keytar = client;
-  keytarFallbackLogged = false;
-}
-
-export function resetKeytarClientForTests(): void {
-  keytar = importedKeytar;
-  keytarFallbackLogged = false;
-}
-
-export interface StoredCredential {
-  value: string;
-  stored_at: string;
-  expires_at?: string;
-  max_age_ms?: number;
-}
-
-const SERVICE = "unbrowse";
-// Use a fixed location so the vault works regardless of server CWD
-const VAULT_DIR = join(homedir(), ".unbrowse", "vault");
-const VAULT_FILE = join(VAULT_DIR, "credentials.enc");
-const KEY_FILE = join(VAULT_DIR, ".key");
-
-function getOrCreateKey(): Buffer {
-  if (!existsSync(VAULT_DIR)) mkdirSync(VAULT_DIR, { recursive: true, mode: 0o700 });
-  if (existsSync(KEY_FILE)) return readFileSync(KEY_FILE);
-  const key = randomBytes(32);
-  writeFileSync(KEY_FILE, key, { mode: 0o600 });
-  return key;
-}
-
-// Async mutex to prevent concurrent read-modify-write races
-let vaultLock: Promise<void> = Promise.resolve();
-function withVaultLock<T>(fn: () => T | Promise<T>): Promise<T> {
-  const prev = vaultLock;
-  let release: () => void;
-  vaultLock = new Promise<void>((r) => { release = r; });
-  return prev.then(fn).finally(() => release!());
-}
-
-function readVaultFile(): Record<string, string> {
-  if (!existsSync(VAULT_FILE)) return {};
-  try {
-    const key = getOrCreateKey();
-    const raw = readFileSync(VAULT_FILE);
-    const iv = raw.subarray(0, 16);
-    const enc = raw.subarray(16);
-    const decipher = createDecipheriv("aes-256-cbc", key, iv);
-    const dec = Buffer.concat([decipher.update(enc), decipher.final()]);
-    return JSON.parse(dec.toString("utf8")) as Record<string, string>;
-  } catch {
-    return {};
-  }
-}
-
-function writeVaultFile(data: Record<string, string>): void {
-  const key = getOrCreateKey();
-  const iv = randomBytes(16);
-  const cipher = createCipheriv("aes-256-cbc", key, iv);
-  const enc = Buffer.concat([cipher.update(JSON.stringify(data), "utf8"), cipher.final()]);
-  writeFileSync(VAULT_FILE, Buffer.concat([iv, enc]), { mode: 0o600 });
-}
-
-export async function storeCredential(
-  account: string,
-  value: string,
-  opts?: { expires_at?: string; max_age_ms?: number }
-): Promise<void> {
-  const wrapped: StoredCredential = {
-    value,
-    stored_at: new Date().toISOString(),
-    expires_at: opts?.expires_at,
-    max_age_ms: opts?.max_age_ms,
-  };
-  const serialized = JSON.stringify(wrapped);
-  const keytarResult = await callKeytar((client) => client.setPassword(SERVICE, account, serialized));
-  if (keytarResult !== KEYTAR_UNAVAILABLE) return;
-  await withVaultLock(() => {
-    const data = readVaultFile();
-    data[account] = serialized;
-    writeVaultFile(data);
-  });
-}
-
-function isExpired(cred: StoredCredential): boolean {
-  if (cred.expires_at) {
-    return new Date(cred.expires_at).getTime() <= Date.now();
-  }
-  if (cred.max_age_ms) {
-    return new Date(cred.stored_at).getTime() + cred.max_age_ms <= Date.now();
-  }
-  return false;
-}
-
-export async function getCredential(account: string): Promise<string | null> {
-  let raw: string | null;
-  const keytarResult = await callKeytar((client) => client.getPassword(SERVICE, account));
-  if (keytarResult !== KEYTAR_UNAVAILABLE) {
-    raw = keytarResult;
-  } else {
-    const data = readVaultFile();
-    raw = data[account] ?? null;
-  }
-  if (!raw) return null;
-
-  // Try to parse as StoredCredential; backward-compat: raw strings are legacy (no expiry)
-  try {
-    const parsed = JSON.parse(raw) as StoredCredential;
-    if (parsed.value && parsed.stored_at) {
-      // It's a wrapped credential — check expiry
-      if (isExpired(parsed)) {
-        await deleteCredential(account);
-        return null;
-      }
-      return parsed.value;
-    }
-  } catch {
-    // Not JSON — legacy raw string, return as-is
-  }
-  return raw;
-}
-
-export async function deleteCredential(account: string): Promise<void> {
-  const keytarResult = await callKeytar((client) => client.deletePassword(SERVICE, account));
-  if (keytarResult !== KEYTAR_UNAVAILABLE) return;
-  await withVaultLock(() => {
-    const data = readVaultFile();
-    delete data[account];
-    writeVaultFile(data);
-  });
-}

package/runtime-src/verification/auth-gate.ts

@@ -1,8 +0,0 @@
-import type { EndpointDescriptor, SkillManifest } from "../types/index.js";
-
-export function isAuthGatedEndpoint(
-  skill: SkillManifest,
-  endpoint: EndpointDescriptor,
-): boolean {
-  return Boolean(skill.auth_profile_ref || endpoint.semantic?.auth_required === true);
-}

package/runtime-src/verification/candidates.ts

@@ -1,27 +0,0 @@
-import type { EndpointDescriptor, SkillManifest } from "../types/index.js";
-
-const STALE_THRESHOLD_MS = 24 * 60 * 60 * 1000; // 24 hours
-
-export function selectVerificationCandidates(
-  skill: SkillManifest,
-  options?: {
-    staleOnly?: boolean;
-    limit?: number;
-    now?: number;
-  },
-): EndpointDescriptor[] {
-  const now = options?.now ?? Date.now();
-  const candidates = skill.endpoints.filter((endpoint) => {
-    if (endpoint.method !== "GET") return false;
-    if (!options?.staleOnly) return true;
-    const isDisabled = endpoint.verification_status === "disabled";
-    const isFailed = endpoint.verification_status === "failed";
-    const lowReliability = typeof endpoint.reliability_score === "number" && endpoint.reliability_score < 0.2;
-    const lastVerified = endpoint.last_verified_at
-      ? new Date(endpoint.last_verified_at).getTime()
-      : 0;
-    return isDisabled || isFailed || lowReliability || now - lastVerified > STALE_THRESHOLD_MS;
-  });
-  const limit = options?.limit && options.limit > 0 ? options.limit : candidates.length;
-  return candidates.slice(0, limit);
-}

package/runtime-src/verification/index.ts

@@ -1,120 +0,0 @@
-import { executeInBrowser } from "../capture/index.js";
-import { updateEndpointScore } from "../marketplace/index.js";
-import { listSkills, getSkill } from "../marketplace/index.js";
-import { detectSchemaDrift } from "../transform/drift.js";
-import { computeVerificationCoverage, INITIAL_MATRIX } from "./matrix.js";
-import { isAuthGatedEndpoint } from "./auth-gate.js";
-import type { VerificationMatrix } from "./matrix.js";
-import type { EndpointDescriptor, SkillManifest, VerificationStatus } from "../types/index.js";
-import { selectVerificationCandidates } from "./candidates.js";
-
-const VERIFICATION_INTERVAL_MS = 6 * 60 * 60 * 1000; // 6 hours
-const VERIFY_ENDPOINT_BATCH_SIZE = Math.max(1, Number(process.env.UNBROWSE_VERIFY_ENDPOINT_BATCH_SIZE ?? 3));
-
-/**
- * Verify a single endpoint by test-executing safe (GET) endpoints.
- * Returns the new verification status.
- */
-export async function verifyEndpoint(
-  skill: SkillManifest,
-  endpoint: EndpointDescriptor
-): Promise<VerificationStatus> {
-  // Only verify safe (GET) endpoints automatically
-  if (endpoint.method !== "GET") return endpoint.verification_status;
-
-  try {
-    const { status, data } = await executeInBrowser(
-      endpoint.url_template,
-      endpoint.method,
-      endpoint.headers_template ?? {},
-      undefined,
-      undefined,
-      undefined
-    );
-
-    if (status < 200 || status >= 300) {
-      await updateEndpointScore(skill.skill_id, endpoint.endpoint_id, endpoint.reliability_score, "failed");
-      return "failed";
-    }
-
-    // Check for schema drift if we have a response schema
-    let hasCriticalDrift = false;
-    if (endpoint.response_schema && data != null) {
-      const drift = detectSchemaDrift(endpoint.response_schema, data);
-      if (drift.drifted && (drift.removed_fields.length > 0 || drift.type_changes.length > 0)) {
-        hasCriticalDrift = true;
-      }
-    }
-
-    const newStatus: VerificationStatus = hasCriticalDrift ? "pending" : "verified";
-    // Reset score for recovered disabled endpoints so they become usable again
-    const newScore = endpoint.verification_status === "disabled" && newStatus === "verified"
-      ? 0.5
-      : endpoint.reliability_score;
-    await updateEndpointScore(skill.skill_id, endpoint.endpoint_id, newScore, newStatus);
-    // Update last_verified_at
-    const fullSkill = await getSkill(skill.skill_id);
-    if (fullSkill) {
-      const ep = fullSkill.endpoints.find((e) => e.endpoint_id === endpoint.endpoint_id);
-      if (ep) ep.last_verified_at = new Date().toISOString();
-    }
-    return newStatus;
-  } catch {
-    await updateEndpointScore(skill.skill_id, endpoint.endpoint_id, endpoint.reliability_score, "failed");
-    return "failed";
-  }
-}
-
-/**
- * Verify all safe endpoints in a skill.
- * Returns a map of endpoint_id -> verification status.
- */
-export async function verifySkill(
-  skill: SkillManifest,
-  options?: {
-    endpoints?: EndpointDescriptor[];
-    staleOnly?: boolean;
-    limit?: number;
-    now?: number;
-  },
-): Promise<Record<string, VerificationStatus>> {
-  const results: Record<string, VerificationStatus> = {};
-  const endpoints = options?.endpoints ?? selectVerificationCandidates(skill, options);
-  for (const endpoint of endpoints) {
-    results[endpoint.endpoint_id] = await verifyEndpoint(skill, endpoint);
-  }
-  return results;
-}
-
-/**
- * Verify all safe endpoints in a skill and compute verification coverage
- * from the integration matrix. Returns endpoint results plus a coverage ratio.
- */
-export async function verifySkillWithCoverage(
-  skill: SkillManifest,
-  matrix: VerificationMatrix = INITIAL_MATRIX,
-): Promise<{ results: Record<string, VerificationStatus>; coverage: number }> {
-  const results = await verifySkill(skill);
-  const coverage = computeVerificationCoverage(matrix);
-  return { results, coverage };
-}
-
-/**
- * Schedule periodic re-verification of stale endpoints.
- */
-export function schedulePeriodicVerification(): ReturnType<typeof setInterval> {
-  return setInterval(async () => {
-    const skills = await listSkills();
-    for (const skill of skills) {
-      if (skill.lifecycle !== "active") continue;
-      const endpoints = selectVerificationCandidates(skill, {
-        staleOnly: true,
-        limit: VERIFY_ENDPOINT_BATCH_SIZE,
-      });
-      for (const endpoint of endpoints) {
-        if (isAuthGatedEndpoint(skill, endpoint)) continue;
-        await verifyEndpoint(skill, endpoint).catch(() => {});
-      }
-    }
-  }, VERIFICATION_INTERVAL_MS);
-}

package/runtime-src/verification/matrix.ts

@@ -1,30 +0,0 @@
-export interface IntegrationCheck {
-  host: string;
-  capability: string;
-  status: "pass" | "fail" | "skip" | "untested";
-  last_verified?: string;
-}
-
-export type VerificationMatrix = IntegrationCheck[];
-
-export function computeVerificationCoverage(matrix: VerificationMatrix): number {
-  if (matrix.length === 0) return 0;
-  const tested = matrix.filter((c) => c.status !== "untested").length;
-  return tested / matrix.length;
-}
-
-export const INITIAL_MATRIX: VerificationMatrix = [
-  { host: "openclaw", capability: "capture", status: "pass", last_verified: "2026-03-31" },
-  { host: "openclaw", capability: "execute", status: "pass", last_verified: "2026-03-31" },
-  { host: "openclaw", capability: "search", status: "pass", last_verified: "2026-03-31" },
-  { host: "mcp", capability: "execute", status: "pass", last_verified: "2026-03-31" },
-  { host: "mcp", capability: "search", status: "pass", last_verified: "2026-03-31" },
-  { host: "cli", capability: "capture", status: "pass", last_verified: "2026-03-31" },
-  { host: "cli", capability: "execute", status: "pass", last_verified: "2026-03-31" },
-  { host: "cli", capability: "search", status: "pass", last_verified: "2026-03-31" },
-  { host: "cli", capability: "publish", status: "pass", last_verified: "2026-03-31" },
-  { host: "hermes", capability: "execute", status: "untested" },
-  { host: "elizaos", capability: "execute", status: "untested" },
-  { host: "langchain", capability: "execute", status: "untested" },
-  { host: "langchain", capability: "search", status: "untested" },
-];

package/runtime-src/version.ts

@@ -1,148 +0,0 @@
-import { createHash } from "crypto";
-import { existsSync, readFileSync, readdirSync } from "fs";
-import { dirname, join, parse } from "path";
-import { fileURLToPath } from "url";
-import {
-  BUILD_CODE_HASH,
-  BUILD_DEFAULT_BACKEND_URL,
-  BUILD_GIT_SHA,
-  BUILD_RELEASE_MANIFEST_BASE64,
-  BUILD_RELEASE_MANIFEST_SIGNATURE,
-  BUILD_RELEASE_VERSION,
-} from "./build-info.generated.js";
-
-// Deterministic version hash of all src/*.ts files.
-// Computed once at startup. Same code = same hash.
-// Used to stamp every trace so real user sessions become versioned evals.
-
-const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
-
-function collectTsFiles(dir: string): string[] {
-  const results: string[] = [];
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const full = join(dir, entry.name);
-    if (entry.isDirectory() && entry.name !== "node_modules") {
-      results.push(...collectTsFiles(full));
-    } else if (entry.name.endsWith(".ts")) {
-      results.push(full);
-    }
-  }
-  return results;
-}
-
-function hashFiles(srcDir: string, files: string[]): string {
-  const hash = createHash("sha256");
-  for (const file of files) {
-    hash.update(file.slice(srcDir.length));
-    hash.update(readFileSync(file, "utf-8"));
-  }
-  return hash.digest("hex").slice(0, 12);
-}
-
-export function resolveCodeHashSourceDir(moduleDir: string): string | null {
-  const candidates = [
-    moduleDir,
-    join(moduleDir, "runtime-src"),
-    join(moduleDir, "..", "runtime-src"),
-    join(moduleDir, "src"),
-    join(moduleDir, "..", "src"),
-  ];
-
-  for (const candidate of candidates) {
-    try {
-      if (!existsSync(candidate)) continue;
-      const files = collectTsFiles(candidate);
-      if (files.length > 0) return candidate;
-    } catch {
-      // ignore candidate
-    }
-  }
-
-  return null;
-}
-
-export function computeCodeHashForDir(srcDir: string): string {
-  const files = collectTsFiles(srcDir).sort();
-  if (files.length === 0) throw new Error(`No TypeScript sources found in ${srcDir}`);
-  return hashFiles(srcDir, files);
-}
-
-function computeCodeHash(): string {
-  try {
-    const srcDir = resolveCodeHashSourceDir(MODULE_DIR);
-    if (srcDir) return computeCodeHashForDir(srcDir);
-  } catch {
-    // fall through
-  }
-
-  const pkgVersion = getPackageVersion();
-  if (pkgVersion !== "unknown") {
-    return createHash("sha256").update(`package:${pkgVersion}`).digest("hex").slice(0, 12);
-  }
-
-  // Compiled binary: filesystem not available, use a static hash
-  return "compiled";
-}
-
-function getGitSha(): string {
-  return BUILD_GIT_SHA?.trim() || "unknown";
-}
-
-function decodeBase64UrlJson<T>(value: string): T | null {
-  try {
-    if (!value) return null;
-    return JSON.parse(Buffer.from(value, "base64url").toString("utf-8")) as T;
-  } catch {
-    return null;
-  }
-}
-
-export function getEmbeddedReleaseVersion(): string | null {
-  if (BUILD_RELEASE_VERSION?.trim()) return BUILD_RELEASE_VERSION.trim();
-  const manifest = decodeBase64UrlJson<{ release_version?: string }>(BUILD_RELEASE_MANIFEST_BASE64?.trim() || "");
-  return typeof manifest?.release_version === "string" && manifest.release_version.trim()
-    ? manifest.release_version.trim()
-    : null;
-}
-
-export function getPackageVersionForModuleDir(moduleDir: string): string {
-  let dir = moduleDir;
-  const root = parse(dir).root;
-
-  while (true) {
-    try {
-      const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf-8")) as { version?: string };
-      return typeof pkg.version === "string" ? pkg.version : "unknown";
-    } catch {
-      // keep walking
-    }
-
-    if (dir === root) return "unknown";
-    dir = dirname(dir);
-  }
-}
-
-function getPackageVersion(): string {
-  const packageVersion = getPackageVersionForModuleDir(MODULE_DIR);
-  if (packageVersion !== "unknown") return packageVersion;
-  return getEmbeddedReleaseVersion() ?? "unknown";
-}
-
-/** 12-char hex hash of all source file contents */
-export const CODE_HASH: string = BUILD_CODE_HASH?.trim() || computeCodeHash();
-
-/** Short git commit SHA */
-export const GIT_SHA: string = getGitSha();
-
-/** package.json version for CLI/runtime mismatch checks */
-export const PACKAGE_VERSION: string = getPackageVersion();
-
-/** Embedded default backend target; preview binaries override this at build time. */
-export const DEFAULT_BACKEND_URL: string = BUILD_DEFAULT_BACKEND_URL?.trim() || "https://beta-api.unbrowse.ai";
-
-/** Combined version: "{code_hash}@{git_sha}" — stamped on every trace */
-export const TRACE_VERSION: string = `${CODE_HASH}@${GIT_SHA}`;
-
-/** Signed release attestation; embedded in compiled binaries when available. */
-export const RELEASE_MANIFEST_BASE64: string = BUILD_RELEASE_MANIFEST_BASE64?.trim() || "";
-export const RELEASE_MANIFEST_SIGNATURE: string = BUILD_RELEASE_MANIFEST_SIGNATURE?.trim() || "";

package/runtime-src/workflow/artifact.ts

@@ -1,161 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-import { log } from "../logger.js";
-import type { WorkflowArtifact, WorkflowRecipe, WorkflowStepStrategy } from "../types/index.js";
-
-function sanitizeProfileName(value: string): string {
-  return value.trim().replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
-}
-
-function getConfigDir(): string {
-  if (process.env.UNBROWSE_CONFIG_DIR) return process.env.UNBROWSE_CONFIG_DIR;
-  const profile = sanitizeProfileName(process.env.UNBROWSE_PROFILE ?? "");
-  return profile
-    ? join(homedir(), ".unbrowse", "profiles", profile)
-    : join(homedir(), ".unbrowse");
-}
-
-function getWorkflowArtifactDir(): string {
-  return process.env.UNBROWSE_WORKFLOW_ARTIFACT_DIR
-    ?? join(getConfigDir(), "workflow-artifacts");
-}
-
-export function workflowArtifactPathForSkill(skillId: string): string {
-  return join(getWorkflowArtifactDir(), `${skillId}.json`);
-}
-
-export function readWorkflowArtifact(skillId: string): WorkflowArtifact | null {
-  const path = workflowArtifactPathForSkill(skillId);
-  if (!existsSync(path)) return null;
-  try {
-    return JSON.parse(readFileSync(path, "utf-8")) as WorkflowArtifact;
-  } catch {
-    return null;
-  }
-}
-
-export function writeWorkflowArtifact(artifact: WorkflowArtifact): string | undefined {
-  try {
-    const dir = getWorkflowArtifactDir();
-    mkdirSync(dir, { recursive: true });
-    const target = workflowArtifactPathForSkill(artifact.skill_id);
-    writeFileSync(target, JSON.stringify(artifact, null, 2), "utf-8");
-    if (process.env.UNBROWSE_DEBUG_WORKFLOW === "1") {
-      log("workflow", `wrote artifact ${artifact.skill_id} -> ${target} (${artifact.recipes.length} recipes)`);
-    }
-    return target;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    log("workflow", `artifact write failed for ${artifact.skill_id}: ${message}`);
-    return undefined;
-  }
-}
-
-function mergeRecipeState(
-  nextRecipe: WorkflowRecipe,
-  prevRecipe?: WorkflowRecipe,
-): WorkflowRecipe {
-  if (!prevRecipe) return nextRecipe;
-  const previousSteps = new Map(prevRecipe.steps.map((step) => [step.strategy, step]));
-  const mergedSteps = nextRecipe.steps.map((step) => {
-    const previous = previousSteps.get(step.strategy);
-    if (!previous) return step;
-    return {
-      ...step,
-      success_count: previous.success_count ?? step.success_count,
-      failure_count: previous.failure_count ?? step.failure_count,
-      last_status: previous.last_status ?? step.last_status,
-      last_error: previous.last_error ?? step.last_error,
-      last_used_at: previous.last_used_at ?? step.last_used_at,
-    };
-  });
-
-  if (prevRecipe.last_successful_strategy) {
-    mergedSteps.sort((lhs, rhs) => {
-      if (lhs.strategy === prevRecipe.last_successful_strategy) return -1;
-      if (rhs.strategy === prevRecipe.last_successful_strategy) return 1;
-      return 0;
-    });
-  }
-
-  return {
-    ...nextRecipe,
-    steps: mergedSteps,
-    preferred: prevRecipe.preferred || nextRecipe.preferred,
-    last_successful_strategy: prevRecipe.last_successful_strategy ?? nextRecipe.last_successful_strategy,
-    last_used_at: prevRecipe.last_used_at ?? nextRecipe.last_used_at,
-  };
-}
-
-export function mergeWorkflowArtifacts(
-  nextArtifact: WorkflowArtifact,
-  prevArtifact?: WorkflowArtifact | null,
-): WorkflowArtifact {
-  if (!prevArtifact || prevArtifact.skill_id !== nextArtifact.skill_id) return nextArtifact;
-  const previousRecipes = new Map(prevArtifact.recipes.map((recipe) => [recipe.endpoint_id, recipe]));
-  return {
-    ...nextArtifact,
-    recipes: nextArtifact.recipes.map((recipe) => mergeRecipeState(recipe, previousRecipes.get(recipe.endpoint_id))),
-  };
-}
-
-export function recordWorkflowRecipeOutcome(
-  artifact: WorkflowArtifact,
-  endpointId: string,
-  strategy: WorkflowStepStrategy,
-  outcome: {
-    success: boolean;
-    status?: number;
-    error?: string;
-    selectedBindings?: Array<{ target_name: string; source_kind: string; source_name: string }>;
-  },
-): WorkflowArtifact {
-  const now = new Date().toISOString();
-  return {
-    ...artifact,
-    recipes: artifact.recipes.map((recipe) => {
-      if (recipe.endpoint_id !== endpointId) return recipe;
-      return {
-        ...recipe,
-        preferred: outcome.success ? true : recipe.preferred,
-        last_successful_strategy: outcome.success ? strategy : recipe.last_successful_strategy,
-        last_used_at: now,
-        token_bindings: recipe.token_bindings.map((binding) => {
-          const selected = outcome.selectedBindings?.find((entry) => entry.target_name === binding.target_name);
-          if (!selected) return binding;
-          return {
-            ...binding,
-            selected_source_kind: selected.source_kind as typeof binding.selected_source_kind,
-            selected_source_name: selected.source_name,
-          };
-        }),
-        steps: recipe.steps
-          .map((step) => {
-            if (step.strategy !== strategy) return step;
-            return {
-              ...step,
-              success_count: (step.success_count ?? 0) + (outcome.success ? 1 : 0),
-              failure_count: (step.failure_count ?? 0) + (outcome.success ? 0 : 1),
-              last_status: outcome.status ?? step.last_status,
-              last_error: outcome.error,
-              last_used_at: now,
-            };
-          })
-          .sort((lhs, rhs) => {
-            if (outcome.success && lhs.strategy === strategy) return -1;
-            if (outcome.success && rhs.strategy === strategy) return 1;
-            return 0;
-          }),
-      };
-    }),
-  };
-}
-
-export function listWorkflowArtifacts(): string[] {
-  const dir = getWorkflowArtifactDir();
-  if (!existsSync(dir)) return [];
-  return readdirSync(dir)
-    .filter((entry) => entry.endsWith(".json"))
-    .map((entry) => join(dir, entry));
-}