volute 0.33.0 → 0.34.0

package/dist/{chunk-A2A4KLFE.js → chunk-CVL5IGIR.js}

@@ -1,4 +1,10 @@
 #!/usr/bin/env node
+import {
+  hashSkillDir,
+  importSkillFromDir,
+  removeSharedSkill,
+  sharedSkillsDir
+} from "./chunk-N3DNFPVA.js";
 import {
   getAllSites,
   getPublishedPages,
@@ -9,27 +15,26 @@ import {
 import {
   getUser,
   getUserByUsername
-} from "./chunk-JYVGHWEJ.js";
+} from "./chunk-BM474GX6.js";
 import {
   publish
-} from "./chunk-KVK2DLWI.js";
-import {
-  hashSkillDir,
-  importSkillFromDir,
-  sharedSkillsDir
-} from "./chunk-C7I35G4R.js";
+} from "./chunk-XWXBJQBE.js";
 import {
   logger_default
 } from "./chunk-YUIHSKR6.js";
+import {
+  readGlobalConfig,
+  writeGlobalConfig
+} from "./chunk-6OWJXUAR.js";
 import {
   mindDir,
   voluteHome,
   voluteSystemDir
-} from "./chunk-LRCG2JLP.js";
+} from "./chunk-N7BLAHNE.js";
 
 // src/lib/extensions.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
-import { dirname, resolve as resolve6 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname, resolve as resolve7 } from "path";
 
 // packages/extensions/notes/src/index.ts
 import { resolve } from "path";
@@ -745,7 +750,7 @@ Warning: remote publish failed: ${err.message}`;
         const allFlag = args.includes("--all");
         const port = process.env.VOLUTE_DAEMON_PORT || "1618";
         if (allFlag) {
-          const { getAllSites: getAllSites2 } = await import("./db-RA45JBFG.js");
+          const { getAllSites: getAllSites2 } = await import("./db-PLEDCBHZ.js");
           const sites = getAllSites2(db);
           const lines2 = [];
           for (const site of sites) {
@@ -942,7 +947,7 @@ function createRoutes2(ctx) {
 var _voluteHome = null;
 async function getVoluteHome() {
   if (_voluteHome) return _voluteHome();
-  const mod = await import("./registry-PJ4S5PHQ.js");
+  const mod = await import("./registry-UYV5S6QT.js");
   _voluteHome = mod.voluteHome;
   return _voluteHome();
 }
@@ -1021,12 +1026,438 @@ var src_default2 = createExtension({
   }
 });
 
+// packages/extensions/plan/src/index.ts
+import { resolve as resolve5 } from "path";
+
+// packages/extensions/plan/src/plans.ts
+async function startPlan(db, getUser2, userId, title, description) {
+  db.prepare(
+    "UPDATE plans SET status = 'archived', completed_at = datetime('now') WHERE status = 'active'"
+  ).run();
+  const row = db.prepare(
+    `INSERT INTO plans (title, description, set_by)
+       VALUES (?, ?, ?)
+       RETURNING *`
+  ).get(title, description, userId);
+  const user = await getUser2(userId);
+  return {
+    ...row,
+    set_by_username: user?.username ?? "unknown",
+    set_by_display_name: user?.display_name ?? null
+  };
+}
+async function getActivePlan(db, getUser2) {
+  const row = db.prepare("SELECT * FROM plans WHERE status = 'active' LIMIT 1").get();
+  if (!row) return null;
+  const user = await getUser2(row.set_by);
+  const logs = db.prepare("SELECT * FROM plan_logs WHERE plan_id = ? ORDER BY created_at DESC LIMIT 20").all(row.id);
+  const messages = db.prepare("SELECT * FROM plan_messages WHERE plan_id = ? ORDER BY id DESC LIMIT 10").all(row.id);
+  const latestMessage = messages.length > 0 ? messages[0].content : null;
+  return {
+    ...row,
+    set_by_username: user?.username ?? "unknown",
+    set_by_display_name: user?.display_name ?? null,
+    logs,
+    messages,
+    latestMessage
+  };
+}
+function logProgress(db, planId, mindName, content) {
+  return db.prepare(
+    `INSERT INTO plan_logs (plan_id, mind_name, content)
+       VALUES (?, ?, ?)
+       RETURNING *`
+  ).get(planId, mindName, content);
+}
+function addPlanMessage(db, planId, content) {
+  return db.prepare(
+    `INSERT INTO plan_messages (plan_id, content)
+       VALUES (?, ?)
+       RETURNING *`
+  ).get(planId, content);
+}
+function finishPlan(db, planId, message) {
+  const result = db.prepare(
+    "UPDATE plans SET status = 'completed', completed_at = datetime('now'), finish_message = ? WHERE id = ? AND status = 'active'"
+  ).run(message ?? null, planId);
+  return result.changes > 0;
+}
+async function listPlans(db, getUser2, opts) {
+  const limit = opts?.limit ?? 20;
+  const offset = opts?.offset ?? 0;
+  const rows = opts?.status ? db.prepare("SELECT * FROM plans WHERE status = ? ORDER BY created_at DESC LIMIT ? OFFSET ?").all(opts.status, limit, offset) : db.prepare("SELECT * FROM plans ORDER BY created_at DESC LIMIT ? OFFSET ?").all(limit, offset);
+  const userCache = /* @__PURE__ */ new Map();
+  const result = [];
+  for (const row of rows) {
+    if (!userCache.has(row.set_by)) {
+      const u = await getUser2(row.set_by);
+      userCache.set(row.set_by, {
+        username: u?.username ?? "unknown",
+        display_name: u?.display_name ?? null
+      });
+    }
+    const userInfo = userCache.get(row.set_by);
+    result.push({
+      ...row,
+      set_by_username: userInfo.username,
+      set_by_display_name: userInfo.display_name
+    });
+  }
+  return result;
+}
+
+// packages/extensions/plan/src/commands.ts
+function getFlag2(args, flag) {
+  const idx = args.indexOf(flag);
+  if (idx !== -1 && args[idx + 1]) return args[idx + 1];
+  return void 0;
+}
+var _announce = null;
+async function announceToSystem(text) {
+  if (!_announce) {
+    try {
+      const mod = await import("./system-channel-DXD2JBOU.js");
+      _announce = mod.announceToSystem;
+    } catch {
+      return false;
+    }
+  }
+  try {
+    await _announce(text);
+    return true;
+  } catch (err) {
+    console.error("[plan] Failed to announce to system channel:", err);
+    return false;
+  }
+}
+function createCommands3() {
+  return {
+    start: {
+      description: "Start a new system plan",
+      usage: 'volute plan start "title" "description"  (description can be piped via stdin)',
+      handler: async (args, ctx) => {
+        if (!ctx.db) return { error: "Plan extension requires a database" };
+        const mindName = ctx.mindName;
+        if (!mindName) return { error: "No mind specified (use --mind or VOLUTE_MIND)" };
+        const user = await ctx.getUserByUsername(mindName);
+        if (!user) return { error: `Unknown mind: ${mindName}` };
+        const title = args[0];
+        const description = args[1] ?? ctx.stdin ?? "";
+        if (!title) return { error: 'Usage: volute plan start "title" "description"' };
+        const plan = await startPlan(ctx.db, ctx.getUser, user.id, title, description);
+        ctx.publishActivity({
+          type: "plan_started",
+          mind: user.username,
+          summary: `${user.username} started plan: "${title}"`,
+          metadata: { planId: plan.id, title }
+        });
+        return { output: `Plan started: ${plan.title}` };
+      }
+    },
+    message: {
+      description: "Post a message about the current plan (sent to #system)",
+      usage: `volute plan message "today's focus: ..."  (content can be piped via stdin)`,
+      handler: async (args, ctx) => {
+        if (!ctx.db) return { error: "Plan extension requires a database" };
+        const mindName = ctx.mindName;
+        if (!mindName) return { error: "No mind specified (use --mind or VOLUTE_MIND)" };
+        const content = args[0] ?? ctx.stdin;
+        if (!content) return { error: 'Usage: volute plan message "your message"' };
+        const plan = await getActivePlan(ctx.db, ctx.getUser);
+        if (!plan) return { error: "No active plan" };
+        const msg = addPlanMessage(ctx.db, plan.id, content);
+        ctx.publishActivity({
+          type: "plan_message",
+          mind: mindName,
+          summary: `Plan message: "${content.slice(0, 100)}"`,
+          metadata: { planId: plan.id, messageId: msg.id }
+        });
+        const announced = await announceToSystem(`[Plan: ${plan.title}] ${content}`);
+        return {
+          output: announced ? "Message posted to #system." : "Message logged (system channel unavailable)."
+        };
+      }
+    },
+    log: {
+      description: "Log progress on the current plan",
+      usage: 'volute plan log "progress update"  (content can be piped via stdin)',
+      handler: async (args, ctx) => {
+        if (!ctx.db) return { error: "Plan extension requires a database" };
+        const mindName = ctx.mindName;
+        if (!mindName) return { error: "No mind specified (use --mind or VOLUTE_MIND)" };
+        const content = args[0] ?? ctx.stdin;
+        if (!content) return { error: 'Usage: volute plan log "progress update"' };
+        const plan = await getActivePlan(ctx.db, ctx.getUser);
+        if (!plan) return { error: "No active plan" };
+        const log = logProgress(ctx.db, plan.id, mindName, content);
+        ctx.publishActivity({
+          type: "plan_progress",
+          mind: mindName,
+          summary: `${mindName} logged progress: "${content.slice(0, 100)}"`,
+          metadata: { planId: plan.id, logId: log.id }
+        });
+        return { output: "Progress logged." };
+      }
+    },
+    current: {
+      description: "Show the current active plan",
+      usage: "volute plan current",
+      handler: async (_args, ctx) => {
+        if (!ctx.db) return { error: "Plan extension requires a database" };
+        const plan = await getActivePlan(ctx.db, ctx.getUser);
+        if (!plan) return { output: "No active plan." };
+        const lines = [
+          `# ${plan.title}`,
+          "",
+          `Set by ${plan.set_by_username} \u2014 ${new Date(plan.created_at).toLocaleString()}`
+        ];
+        if (plan.description) {
+          lines.push("", plan.description);
+        }
+        if (plan.latestMessage) {
+          lines.push("", `## Latest message`, "", plan.latestMessage);
+        }
+        if (plan.logs.length > 0) {
+          lines.push("", "## Progress");
+          for (const log of plan.logs) {
+            const date = new Date(log.created_at).toLocaleString();
+            lines.push(`  ${log.mind_name} (${date}): ${log.content}`);
+          }
+        }
+        return { output: lines.join("\n") };
+      }
+    },
+    history: {
+      description: "List past plans",
+      usage: "volute plan history [--limit N]",
+      handler: async (args, ctx) => {
+        if (!ctx.db) return { error: "Plan extension requires a database" };
+        const limit = parseInt(getFlag2(args, "--limit") ?? "10", 10);
+        const plans = await listPlans(ctx.db, ctx.getUser, { limit });
+        if (plans.length === 0) return { output: "No plans found." };
+        const lines = plans.map((p) => {
+          const date = new Date(p.created_at).toLocaleDateString();
+          const status = p.status === "active" ? " [active]" : "";
+          return `  ${p.title}  (${date}, by ${p.set_by_username})${status}`;
+        });
+        return { output: lines.join("\n") };
+      }
+    },
+    finish: {
+      description: "Finish the current plan with a closing message",
+      usage: 'volute plan finish "closing message"  (message can be piped via stdin)',
+      handler: async (args, ctx) => {
+        if (!ctx.db) return { error: "Plan extension requires a database" };
+        const mindName = ctx.mindName;
+        if (!mindName) return { error: "No mind specified (use --mind or VOLUTE_MIND)" };
+        const plan = await getActivePlan(ctx.db, ctx.getUser);
+        if (!plan) return { error: "No active plan" };
+        const message = args[0] ?? ctx.stdin ?? "";
+        finishPlan(ctx.db, plan.id, message);
+        ctx.publishActivity({
+          type: "plan_finished",
+          mind: mindName,
+          summary: `${mindName} finished plan: "${plan.title}"`,
+          metadata: { planId: plan.id }
+        });
+        const announcement = message ? `[Plan finished: ${plan.title}] ${message}` : `[Plan finished: ${plan.title}]`;
+        const announced = await announceToSystem(announcement);
+        const suffix = announced ? "" : " (system channel unavailable)";
+        return { output: `Finished: ${plan.title}${suffix}` };
+      }
+    }
+  };
+}
+
+// packages/extensions/plan/src/db.ts
+function initDb3(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS plans (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      title TEXT NOT NULL,
+      description TEXT NOT NULL DEFAULT '',
+      status TEXT NOT NULL DEFAULT 'active',
+      set_by INTEGER NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      completed_at TEXT,
+      finish_message TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_plans_status ON plans(status);
+    CREATE INDEX IF NOT EXISTS idx_plans_created_at ON plans(created_at);
+
+    CREATE TABLE IF NOT EXISTS plan_logs (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      plan_id INTEGER NOT NULL REFERENCES plans(id) ON DELETE CASCADE,
+      mind_name TEXT NOT NULL,
+      content TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+    CREATE INDEX IF NOT EXISTS idx_plan_logs_plan_id ON plan_logs(plan_id);
+
+    CREATE TABLE IF NOT EXISTS plan_messages (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      plan_id INTEGER NOT NULL REFERENCES plans(id) ON DELETE CASCADE,
+      content TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+    CREATE INDEX IF NOT EXISTS idx_plan_messages_plan_id ON plan_messages(plan_id);
+  `);
+}
+
+// packages/extensions/plan/src/routes.ts
+import { Hono as Hono3 } from "hono";
+function resolveUserId2(c) {
+  const user = c.get("user");
+  if (!user || user.id === 0) return null;
+  return user;
+}
+async function parseJson2(c) {
+  try {
+    return await c.req.json();
+  } catch {
+    return null;
+  }
+}
+function createRoutes3(ctx) {
+  if (!ctx.db) throw new Error("Plan extension requires a database");
+  const db = ctx.db;
+  const { getUser: getUser2 } = ctx;
+  const app = new Hono3().get("/current", async (c) => {
+    const plan = await getActivePlan(db, getUser2);
+    if (!plan) return c.json(null);
+    return c.json(plan);
+  }).get("/", async (c) => {
+    const status = c.req.query("status");
+    const rawLimit = c.req.query("limit");
+    const rawOffset = c.req.query("offset");
+    const limit = rawLimit ? parseInt(rawLimit, 10) : void 0;
+    const offset = rawOffset ? parseInt(rawOffset, 10) : void 0;
+    if (limit !== void 0 && Number.isNaN(limit) || offset !== void 0 && Number.isNaN(offset)) {
+      return c.json({ error: "Invalid limit or offset parameter" }, 400);
+    }
+    const plans = await listPlans(db, getUser2, { status: status ?? void 0, limit, offset });
+    return c.json(plans);
+  }).post("/", async (c) => {
+    const actor = resolveUserId2(c);
+    if (!actor) return c.json({ error: "Unauthorized" }, 401);
+    if (actor.role !== "admin" && actor.user_type !== "mind") {
+      return c.json({ error: "Only spirit or admin can start plans" }, 403);
+    }
+    const body = await parseJson2(c);
+    if (!body) return c.json({ error: "Invalid JSON body" }, 400);
+    if (!body.title) return c.json({ error: "title is required" }, 400);
+    const plan = await startPlan(db, getUser2, actor.id, body.title, body.description ?? "");
+    ctx.publishActivity({
+      type: "plan_started",
+      mind: actor.username,
+      summary: `${actor.username} started plan: "${body.title}"`,
+      metadata: { planId: plan.id, title: body.title }
+    });
+    return c.json(plan, 201);
+  }).post("/:id{[0-9]+}/message", async (c) => {
+    const actor = resolveUserId2(c);
+    if (!actor) return c.json({ error: "Unauthorized" }, 401);
+    const planId = parseInt(c.req.param("id"), 10);
+    if (Number.isNaN(planId)) return c.json({ error: "Invalid plan ID" }, 400);
+    const plan = db.prepare("SELECT id FROM plans WHERE id = ? AND status = 'active'").get(planId);
+    if (!plan) return c.json({ error: "Active plan not found" }, 404);
+    const body = await parseJson2(c);
+    if (!body) return c.json({ error: "Invalid JSON body" }, 400);
+    if (!body.content) return c.json({ error: "content is required" }, 400);
+    const msg = addPlanMessage(db, planId, body.content);
+    ctx.publishActivity({
+      type: "plan_message",
+      mind: actor.username,
+      summary: `Plan message: "${body.content.slice(0, 100)}"`,
+      metadata: { planId, messageId: msg.id }
+    });
+    return c.json(msg, 201);
+  }).post("/:id{[0-9]+}/log", async (c) => {
+    const actor = resolveUserId2(c);
+    if (!actor) return c.json({ error: "Unauthorized" }, 401);
+    const planId = parseInt(c.req.param("id"), 10);
+    if (Number.isNaN(planId)) return c.json({ error: "Invalid plan ID" }, 400);
+    const plan = db.prepare("SELECT id FROM plans WHERE id = ? AND status = 'active'").get(planId);
+    if (!plan) return c.json({ error: "Active plan not found" }, 404);
+    const body = await parseJson2(c);
+    if (!body) return c.json({ error: "Invalid JSON body" }, 400);
+    if (!body.content) return c.json({ error: "content is required" }, 400);
+    const log = logProgress(db, planId, actor.username, body.content);
+    ctx.publishActivity({
+      type: "plan_progress",
+      mind: actor.username,
+      summary: `${actor.username} logged progress: "${body.content.slice(0, 100)}"`,
+      metadata: { planId, logId: log.id }
+    });
+    return c.json(log, 201);
+  }).patch("/:id{[0-9]+}/finish", async (c) => {
+    const actor = resolveUserId2(c);
+    if (!actor) return c.json({ error: "Unauthorized" }, 401);
+    if (actor.role !== "admin" && actor.user_type !== "mind") {
+      return c.json({ error: "Only spirit or admin can finish plans" }, 403);
+    }
+    const planId = parseInt(c.req.param("id"), 10);
+    if (Number.isNaN(planId)) return c.json({ error: "Invalid plan ID" }, 400);
+    const body = await parseJson2(c);
+    const message = body?.message;
+    const ok = finishPlan(db, planId, message);
+    if (!ok) return c.json({ error: "Plan not found" }, 404);
+    ctx.publishActivity({
+      type: "plan_finished",
+      mind: actor.username,
+      summary: `${actor.username} finished a plan`,
+      metadata: { planId }
+    });
+    return c.json({ ok: true });
+  }).get("/feed", async (c) => {
+    const rawLimit = c.req.query("limit");
+    const limit = rawLimit ? parseInt(rawLimit, 10) : 5;
+    if (Number.isNaN(limit)) return c.json({ error: "Invalid limit parameter" }, 400);
+    const plans = await listPlans(db, getUser2, { limit });
+    return c.json(
+      plans.map((p) => ({
+        id: `plan-${p.id}`,
+        title: p.title,
+        url: `/plan`,
+        date: p.created_at,
+        author: p.set_by_username,
+        bodyHtml: p.description || `<em>${p.status}</em>`,
+        icon: '<svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><circle cx="8" cy="8" r="6"/><path d="M8 4v4l2.5 2.5"/></svg>',
+        color: "blue"
+      }))
+    );
+  });
+  return app;
+}
+
+// packages/extensions/plan/src/index.ts
+var assetsDir3 = resolve5(import.meta.dirname, "../dist/ui");
+var skillsDir3 = resolve5(import.meta.dirname, "../skills");
+var src_default3 = createExtension({
+  id: "plan",
+  name: "Plan",
+  version: "0.1.0",
+  description: "System-wide plans for coordinated mind activity",
+  icon: '<svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><circle cx="8" cy="8" r="6"/><path d="M8 4v4l2.5 2.5"/></svg>',
+  color: "blue",
+  routes: (ctx) => createRoutes3(ctx),
+  commands: createCommands3(),
+  initDb: initDb3,
+  skillsDir: skillsDir3,
+  standardSkill: true,
+  ui: {
+    assetsDir: assetsDir3,
+    systemSection: { id: "plan", label: "Plan", urlPatterns: ["/plan"] },
+    feedSource: { endpoint: "/api/ext/plan/feed" }
+  }
+});
+
 // src/lib/systems-config.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "fs";
-import { resolve as resolve5 } from "path";
+import { resolve as resolve6 } from "path";
 var DEFAULT_API_URL = "https://volute.systems";
 function configPath() {
-  return resolve5(voluteSystemDir(), "systems.json");
+  return resolve6(voluteSystemDir(), "systems.json");
 }
 function readSystemsConfig() {
   const path = configPath();
@@ -1066,14 +1497,15 @@ function deleteSystemsConfig() {
 // src/lib/extensions.ts
 var VALID_EXTENSION_ID2 = /^[a-z0-9][a-z0-9_-]*$/;
 var loaded = [];
+var discovered = [];
 function extensionsBaseDir() {
-  return resolve6(voluteHome(), "extensions");
+  return resolve7(voluteHome(), "extensions");
 }
 function extensionDataDir(id) {
-  return resolve6(voluteSystemDir(), "extension-data", id);
+  return resolve7(voluteSystemDir(), "extension-data", id);
 }
 function extensionsConfigPath() {
-  return resolve6(voluteHome(), "system", "extensions.json");
+  return resolve7(voluteHome(), "system", "extensions.json");
 }
 function readExtensionsConfig() {
   const configPath2 = extensionsConfigPath();
@@ -1097,7 +1529,7 @@ async function getLibsqlDatabase() {
   return _LibsqlDatabase;
 }
 async function openExtensionDb(_id, dataDir) {
-  const dbPath = resolve6(dataDir, "data.db");
+  const dbPath = resolve7(dataDir, "data.db");
   const Database = await getLibsqlDatabase();
   return new Database(dbPath);
 }
@@ -1223,7 +1655,7 @@ async function loadExtension(manifest, app, authMw) {
   if (resolvedAssetsDir && !existsSync3(resolvedAssetsDir)) {
     let searchDir = dirname(new URL(import.meta.url).pathname);
     for (let i = 0; i < 5; i++) {
-      const candidate = resolve6(searchDir, "packages", "extensions", manifest.id, "dist", "ui");
+      const candidate = resolve7(searchDir, "packages", "extensions", manifest.id, "dist", "ui");
       if (existsSync3(candidate)) {
         resolvedAssetsDir = candidate;
         break;
@@ -1232,7 +1664,7 @@ async function loadExtension(manifest, app, authMw) {
     }
   }
   if (resolvedAssetsDir && existsSync3(resolvedAssetsDir)) {
-    const assetsDir3 = resolvedAssetsDir;
+    const assetsDir4 = resolvedAssetsDir;
     const { readFile: readFile2, stat: fsStat } = await import("fs/promises");
     const { extname: ext } = await import("path");
     const mimeTypes = {
@@ -1248,12 +1680,12 @@ async function loadExtension(manifest, app, authMw) {
       ".woff2": "font/woff2"
     };
     const prefix = `/ext/${manifest.id}`;
-    const indexPath = resolve6(assetsDir3, "index.html");
+    const indexPath = resolve7(assetsDir4, "index.html");
     const serveExtAssets = async (c) => {
       const urlPath = new URL(c.req.url).pathname;
       const relativePath = urlPath.slice(prefix.length).replace(/^\//, "") || "index.html";
-      const filePath = resolve6(assetsDir3, relativePath);
-      if (filePath !== assetsDir3 && !filePath.startsWith(assetsDir3 + "/"))
+      const filePath = resolve7(assetsDir4, relativePath);
+      if (filePath !== assetsDir4 && !filePath.startsWith(assetsDir4 + "/"))
         return c.text("Forbidden", 403);
       const s = await fsStat(filePath).catch(() => null);
       if (s?.isFile()) {
@@ -1270,11 +1702,11 @@ async function loadExtension(manifest, app, authMw) {
     app.get(`${prefix}/*`, serveExtAssets);
     app.get(prefix, serveExtAssets);
   }
-  const skillsDir3 = resolveSkillsDir(manifest);
-  if (skillsDir3) {
+  const skillsDir4 = resolveSkillsDir(manifest);
+  if (skillsDir4) {
     let entries;
     try {
-      entries = readdirSync2(skillsDir3, { withFileTypes: true });
+      entries = readdirSync2(skillsDir4, { withFileTypes: true });
     } catch (err) {
       logger_default.error(`failed to read skills dir for extension ${manifest.id}`, logger_default.errorData(err));
       entries = [];
@@ -1282,9 +1714,9 @@ async function loadExtension(manifest, app, authMw) {
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       try {
-        const skillPath = resolve6(skillsDir3, entry.name);
+        const skillPath = resolve7(skillsDir4, entry.name);
         const sourceHash = hashSkillDir(skillPath);
-        const destDir = resolve6(sharedSkillsDir(), entry.name);
+        const destDir = resolve7(sharedSkillsDir(), entry.name);
         if (existsSync3(destDir)) {
           const destHash = hashSkillDir(destDir);
           if (sourceHash === destHash) continue;
@@ -1309,7 +1741,7 @@ function resolveSkillsDir(manifest) {
   if (!manifest.skillsDir) return null;
   let searchDir = dirname(new URL(import.meta.url).pathname);
   for (let i = 0; i < 5; i++) {
-    const candidate = resolve6(searchDir, "packages", "extensions", manifest.id, "skills");
+    const candidate = resolve7(searchDir, "packages", "extensions", manifest.id, "skills");
     if (existsSync3(candidate)) return candidate;
     searchDir = dirname(searchDir);
   }
@@ -1318,30 +1750,30 @@ function resolveSkillsDir(manifest) {
   return null;
 }
 function discoverBuiltinExtensions() {
-  return [src_default, src_default2];
+  return [src_default, src_default2, src_default3];
 }
 async function discoverInstalledExtensions() {
-  const manifests = [];
+  const results = [];
   const packages = readExtensionsConfig();
-  const npmDir = resolve6(voluteHome(), "extensions", "_npm");
+  const npmDir = resolve7(voluteHome(), "extensions", "_npm");
   const { createRequire } = await import("module");
   for (const pkg of packages) {
     try {
       let resolved = pkg;
-      const npmPkgDir = resolve6(npmDir, "node_modules", pkg);
+      const npmPkgDir = resolve7(npmDir, "node_modules", pkg);
       if (existsSync3(npmPkgDir)) {
-        const require2 = createRequire(resolve6(npmDir, "noop.js"));
+        const require2 = createRequire(resolve7(npmDir, "noop.js"));
         resolved = require2.resolve(pkg);
       }
       const mod = await import(resolved);
       const manifest = mod.default ?? mod.extension ?? mod;
       if (!validateManifest(manifest, `package ${pkg}`)) continue;
-      manifests.push(manifest);
+      results.push({ manifest, package: pkg });
     } catch (err) {
       logger_default.error(`failed to load extension package: ${pkg}`, logger_default.errorData(err));
     }
   }
-  return manifests;
+  return results;
 }
 function validateManifest(manifest, source) {
   if (!manifest || typeof manifest !== "object") {
@@ -1383,8 +1815,8 @@ async function discoverLocalExtensions() {
     return [];
   }
   for (const dir of entries) {
-    const extDir = resolve6(baseDir, dir);
-    const candidates = [resolve6(extDir, "src", "index.js"), resolve6(extDir, "index.js")];
+    const extDir = resolve7(baseDir, dir);
+    const candidates = [resolve7(extDir, "src", "index.js"), resolve7(extDir, "index.js")];
     const entryPoint = candidates.find((p) => existsSync3(p));
     if (!entryPoint) continue;
     try {
@@ -1403,14 +1835,25 @@ async function loadAllExtensions(app, authMw) {
   const builtins = discoverBuiltinExtensions();
   const installed = await discoverInstalledExtensions();
   const local = await discoverLocalExtensions();
-  const all = [...builtins, ...installed, ...local];
+  const disabledIds = new Set(readGlobalConfig().disabledExtensions ?? []);
+  const all = [
+    ...builtins.map((m) => ({ manifest: m, source: "builtin" })),
+    ...installed.map((i) => ({ manifest: i.manifest, source: "npm", package: i.package })),
+    ...local.map((m) => ({ manifest: m, source: "local" }))
+  ];
   const seen = /* @__PURE__ */ new Set();
-  for (const manifest of all) {
+  for (const entry of all) {
+    const { manifest } = entry;
     if (seen.has(manifest.id)) {
       logger_default.warn(`duplicate extension ID: ${manifest.id}, skipping`);
       continue;
     }
     seen.add(manifest.id);
+    discovered.push(entry);
+    if (disabledIds.has(manifest.id)) {
+      logger_default.info(`extension disabled, skipping: ${manifest.id}`);
+      continue;
+    }
     try {
       await loadExtension(manifest, app, authMw);
     } catch (err) {
@@ -1455,6 +1898,114 @@ function getLoadedExtensions() {
     };
   });
 }
+function getAllDiscoveredExtensions() {
+  const disabledIds = new Set(readGlobalConfig().disabledExtensions ?? []);
+  return discovered.map((d) => ({
+    id: d.manifest.id,
+    name: d.manifest.name,
+    version: d.manifest.version,
+    description: d.manifest.description,
+    icon: d.manifest.icon,
+    source: d.source,
+    enabled: !disabledIds.has(d.manifest.id),
+    package: d.package
+  }));
+}
+function setExtensionEnabled(id, enabled) {
+  if (!discovered.find((d) => d.manifest.id === id)) {
+    throw new Error(`Extension "${id}" not found`);
+  }
+  const config = readGlobalConfig();
+  const disabled = new Set(config.disabledExtensions ?? []);
+  if (enabled) {
+    disabled.delete(id);
+  } else {
+    disabled.add(id);
+  }
+  config.disabledExtensions = disabled.size > 0 ? [...disabled] : void 0;
+  writeGlobalConfig(config);
+}
+function extensionsNpmDir() {
+  return resolve7(voluteHome(), "extensions", "_npm");
+}
+function ensureExtensionsNpmDir() {
+  const dir = extensionsNpmDir();
+  mkdirSync2(dir, { recursive: true });
+  const pkgPath = resolve7(dir, "package.json");
+  if (!existsSync3(pkgPath)) {
+    writeFileSync2(pkgPath, '{"private":true,"dependencies":{}}\n');
+  }
+  return dir;
+}
+function writeExtensionsConfig(packages) {
+  const configPath2 = extensionsConfigPath();
+  mkdirSync2(resolve7(configPath2, ".."), { recursive: true });
+  writeFileSync2(configPath2, `${JSON.stringify(packages, null, 2)}
+`);
+}
+var VALID_NPM_PACKAGE = /^(@[a-z0-9-~][a-z0-9._-~]*\/)?[a-z0-9-~][a-z0-9._-~]*(@[^\s]+)?$/;
+async function installNpmExtension(pkg) {
+  if (!VALID_NPM_PACKAGE.test(pkg)) {
+    throw new Error(`Invalid package name: "${pkg}"`);
+  }
+  const packages = readExtensionsConfig();
+  if (packages.includes(pkg)) {
+    throw new Error(`Extension "${pkg}" is already installed`);
+  }
+  const dir = ensureExtensionsNpmDir();
+  const { exec } = await import("./exec-DVLXKRIO.js");
+  try {
+    await exec("npm", ["install", pkg], { cwd: dir });
+  } catch (err) {
+    logger_default.error(`npm install failed for "${pkg}"`, logger_default.errorData(err));
+    throw new Error(`Failed to install "${pkg}". Check daemon logs for details.`);
+  }
+  packages.push(pkg);
+  writeExtensionsConfig(packages);
+  logger_default.info(`installed extension package: ${pkg}`);
+}
+async function uninstallNpmExtension(pkg) {
+  const packages = readExtensionsConfig();
+  const idx = packages.indexOf(pkg);
+  if (idx === -1) {
+    throw new Error(`Extension "${pkg}" is not installed`);
+  }
+  await cleanupExtensionSkills(pkg);
+  packages.splice(idx, 1);
+  writeExtensionsConfig(packages);
+  try {
+    const { exec } = await import("./exec-DVLXKRIO.js");
+    await exec("npm", ["uninstall", pkg], { cwd: extensionsNpmDir() });
+  } catch (err) {
+    logger_default.warn(
+      `npm uninstall failed for "${pkg}" (may have been manually removed)`,
+      logger_default.errorData(err)
+    );
+  }
+  logger_default.info(`uninstalled extension package: ${pkg}`);
+}
+async function cleanupExtensionSkills(pkg) {
+  try {
+    const pkgDir = resolve7(extensionsNpmDir(), "node_modules", pkg);
+    if (!existsSync3(pkgDir)) return;
+    const { createRequire } = await import("module");
+    const require2 = createRequire(resolve7(extensionsNpmDir(), "noop.js"));
+    const mod = require2(pkg);
+    const manifest = mod.default ?? mod.extension ?? mod;
+    if (!manifest?.skillsDir || !existsSync3(manifest.skillsDir)) return;
+    const skillDirs = readdirSync2(manifest.skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    for (const skillId of skillDirs) {
+      try {
+        await removeSharedSkill(skillId);
+        logger_default.info(`removed skill "${skillId}" from extension ${pkg}`);
+      } catch (err) {
+        logger_default.warn(`failed to remove skill "${skillId}" for extension ${pkg}`, logger_default.errorData(err));
+      }
+    }
+  } catch (err) {
+    logger_default.warn(`could not clean up skills for "${pkg}"`, logger_default.errorData(err));
+  }
+}
 function getExtensionStandardSkills() {
   const skills = [];
   for (const { manifest } of loaded) {
@@ -1494,6 +2045,7 @@ function notifyExtensionsDaemonStop() {
     }
   }
   loaded.length = 0;
+  discovered.length = 0;
 }
 function notifyExtensionsMindStart(mindName) {
   for (const { manifest } of loaded) {
@@ -1520,6 +2072,10 @@ export {
   deleteSystemsConfig,
   loadAllExtensions,
   getLoadedExtensions,
+  getAllDiscoveredExtensions,
+  setExtensionEnabled,
+  installNpmExtension,
+  uninstallNpmExtension,
   getExtensionStandardSkills,
   notifyExtensionsDaemonStart,
   notifyExtensionsDaemonStop,