auto: 2026-06-02_18:00 changes

1 files changed, 241 insertions, 43 deletions

diff --git a/modules/ext/skill-pack-core.js b/modules/ext/skill-pack-core.js
index cc8ae88..f731594 100644
--- a/modules/ext/skill-pack-core.js
+++ b/modules/ext/skill-pack-core.js
@@ -20,37 +20,51 @@ class SkillPackCoreModule {
 
     getHelpInfo() {
         return {
-            'skill-pack-core': 'Seed and manage built-in core skills (navigation, memory, search, modules, backup, mindmap, etc.)',
+            'skill-pack-core': 'Seed and manage built-in core skills (navigation, memory, search, modules, backup, agents, webdav, security, etc.)',
         };
     }
     
     _buildSkills() {
         const s = (name, desc, tags, cat, steps) => ({
             name, description: desc, tags, category: cat,
-            content: `---\nname: ${name}\ndescription: ${desc}\ntags: [${tags.join(', ')}]\ncategory: ${cat}\n---\n## Steps\n${steps}`
+            content: '---\nname: ' + name + '\ndescription: ' + desc + '\ntags: [' + tags.join(', ') + ']\ncategory: ' + cat + '\n---\n## Steps\n' + steps
+        });
+
+        const sk = (name, desc, tags, cat, content) => ({
+            name, description: desc, tags, category: cat,
+            content: '---\nname: ' + name + '\ndescription: ' + desc + '\ntags: [' + tags.join(', ') + ']\ncategory: ' + cat + '\n---\n' + content
         });
 
         return [
             s('navigating-the-terminal', 'How to explore the WebX11 terminal, find commands, check status, and navigate the filesystem', ['terminal', 'navigation', 'help', 'filesystem'], 'system',
 `1. **Get an overview of available commands:**
-   - Call get_help() to get a full command list sorted by category
-   - Call get_status() to see filesystem state, loaded modules, Ollama status
-   - For a specific command, use help <command> or check the help map
+   - Type "help" for a full command list sorted by category
+   - Type "status" to see filesystem state, loaded modules, Ollama status
+   - For a specific command, use help <command>
+   - Type "commands" for a compact list with module source info
+   - Type "check" for system health including module requirements
 
 2. **Explore the filesystem:**
-   - Use list_files(path?) to browse directories (omit path for current dir)
-   - Use read_file(path) to view file contents
-   - Use get_current_dir to see your working directory
-   - Use run_command("ls") or run_command("tree") for visual output
+   - Use ls, ll, tree to browse directories
+   - Use cd <dir> to navigate, pwd to show current path
+   - Use cat or edit to view file contents
+   - Use find or grep to search files
+   - Use du to see disk usage
 
 3. **Understand system state:**
-   - run_command("mem") — memory usage
-   - run_command("status") — network, files, modules, Ollama
-   - run_command("modules") — module manager GUI
-   - get_module_status() — loaded modules, URLs, local edits
-
-4. **When user asks a vague question:**
-   - First call get_status() and get_help() to understand the current state
+   - mem — memory usage (auto-shown in header on boot)
+   - status — network, files, modules, Ollama
+   - modules — module manager GUI
+   - health-check — VFS size, modules, logs, trash, skills, tool failures
+   - checkpoint-list — VFS checkpoint snapshots
+
+4. **Agent / Orchestration state:**
+   - agent-list — registered agents (type, capabilities, status)
+   - orchestrate — list active orchestrated agents
+   - lease-list — show active leases with TTL
+
+5. **When user asks a vague question:**
+   - First run status and help to understand the current state
    - Then ask clarifying questions based on what you found`),
 
             s('memory-and-profile', 'How to use the user profile system, session memory, and pattern tracking for persistent context', ['memory', 'profile', 'session', 'persistence'], 'system',
@@ -67,26 +81,36 @@ class SkillPackCoreModule {
    - session_recent(count) — show last N session summaries
    - session_stats — aggregate totals across all sessions
    - Recent sessions auto-load into context on first message
+   - systemd-style journal: use logs and logrotate commands for persistent logging
 
 3. **Conversation Patterns:**
    - Pattern tracking runs automatically — frequent topics surface as hints
    - my-set, my-get, my-list store additional personal data
    - AI conversation context persists within a session (use ai-clear to reset)
+   - debug command toggles real-time debug panel with Copy/Export/VFS buttons
 
-4. **When to use:**
+4. **Checkpoints (VFS snapshots):**
+   - checkpoint [name] — snapshot current VFS state
+   - checkpoint-list — list all checkpoints
+   - rollback <name> — restore from checkpoint
+   - checkpoint-del <name> — delete a checkpoint
+
+5. **When to use:**
    - At start: call session_recent(3) to see what was worked on before
    - After identifying user preferences: call user_set to store them
-   - After complex tasks: call session_save with a brief summary`),
+   - After complex tasks: call session_save with a brief summary
+   - Before risky edits: call checkpoint to create a restore point`),
 
             s('web-search-and-fetch', 'How to search the web and fetch URL content using the WebX11 proxy API', ['search', 'fetch', 'web', 'proxy', 'api'], 'research',
 `1. **Search the web:**
-   - Call web_search(query) — uses /api/search which queries SearXNG + DDG fallback
+   - Use search <query> or web_search(query) — uses /api/search which queries SearXNG + DDG fallback
    - Results include: title, url, content snippet, source engine
    - Always available (same-origin, no CORS issues)
    - 5-minute server-side cache for repeated queries
+   - Alternative: use ddg or duck <query> for DuckDuckGo direct, or s <query> as alias
 
 2. **Fetch URL content:**
-   - Call web_fetch(url) — uses /api/extract which strips HTML, extracts clean text
+   - Use fetch <url> or web_fetch(url) — uses /api/extract which strips HTML, extracts clean text
    - Returns: title, content (up to 4000 chars), word_count, extraction method
    - SSRF protection blocks internal network addresses
    - 15-minute server-side cache
@@ -96,19 +120,21 @@ class SkillPackCoreModule {
    - search <query> --fetch — fetches content snippets for top 3 results
 
 4. **When to use:**
-   - User asks about current events, facts, research → call web_search
-   - User says "read this article" or provides a URL → call web_fetch
+   - User asks about current events, facts, research → use search <query>
+   - User says "read this article" or provides a URL → use fetch <url>
    - For in-depth analysis: search first, then fetch top results`),
 
             s('module-management', 'How to view, edit, test, reload modules and manage startup configuration', ['modules', 'editing', 'code', 'self-improvement'], 'dev',
 `1. **View module source:**
    - view_module(name) — fetches original source or reads from _mods/ if edited
    - Supports all loaded modules: SystemModule, FileSystemModule, SearXNGModule, etc.
+   - Or use modules command for GUI module manager
 
 2. **Edit a module:**
    - edit_module(name) — copies source to _mods/<name>.js and opens code editor
    - Editor shows the full source in a textarea
    - Click "Save & Test" to save and auto-load the edited version
+   - Checkpoint before editing: checkpoint mod-edit-<name>
 
 3. **Test and reload:**
    - test_module(name) — loads edited module from _mods/ for live testing
@@ -121,8 +147,15 @@ class SkillPackCoreModule {
 5. **Manage startup:**
    - startup-modules — opens the Startup Modules UI to select which modules load
    - load-local <path> — load a module from VFS or URL without editing
+   - loadmod <url> — alternative: load module from URL
+   - removemod <name> — remove a loaded module
 
-6. **When to use:**
+6. **Agent modules (Phase 2):**
+   - module-agent-registry.js — Agent registry with agent-list, agent-register, agent-unregister, agent-status
+   - module-leases.js — Time-bound contracts with 5s watchdog, auto-expiry
+   - module-orchestrator.js — Spawn, delegate, kill, purge with heartbeat monitoring
+
+7. **When to use:**
    - User reports a bug in a module → view_module, edit_module, test_module
    - User asks "can you add X feature?" → same workflow
    - Always save edits before testing. If test fails, the original module stays loaded.`),
@@ -142,42 +175,68 @@ class SkillPackCoreModule {
    - config-export — dump all config as JSON
    - config-reset — restore defaults (use before factory-reset if you want to save data)
 
-4. **Health checks (run automatically after complex tasks):**
+4. **Security level:**
+   - security-level <0-3> — set security level (0=Permissive, 1=Standard, 2=Paranoid, 3=Audit)
+   - security — show current security level, blocked count, and stats
+   - cmd-allow <cmd> — whitelist a command from security checks
+   - cmd-deny <cmd> — blacklist a command
+
+5. **Health checks (run automatically after complex tasks):**
    - Check module loading status: loaded vs total
    - Check for pending module edits
    - Check memory usage (high if >100MB)
    - Check skill count (0 skills after 2+ tool calls → suggest create_skill)
+   - health-check — full audit: VFS size, modules, logs, trash, skills, tool failures
 
-5. **Font size and display:**
+6. **Font size and display:**
    - font-size <8-32> — set terminal font size, persists across sessions
    - setfont — alias for font-size
 
-6. **When to use:**
-   - System is slow or modules fail to load → check check_updates, memory
+7. **Checkpoints:**
+   - checkpoint [name] — snapshot current VFS state
+   - checkpoint-list — list all checkpoints
+   - rollback <name> — restore from checkpoint
+
+8. **When to use:**
+   - System is slow or modules fail to load → check check_updates, mem
    - User says "reset everything" → factory-reset --confirm
-   - User says "clear my files but keep settings" → reset-vfs --confirm`),
+   - User says "clear my files but keep settings" → reset-vfs --confirm
+   - User reports security concerns → security-level or cmd-allow/cmd-deny`),
 
             s('backup-and-restore', 'How to backup, restore, and export WebX11 data', ['backup', 'restore', 'export', 'import', 'persistence'], 'system',
 `1. **Backup VFS:**
    - vfs-export — downloads the entire virtual filesystem as a dated JSON file
    - backup — creates a full backup including VFS, modules, config (saves to _backups/)
 
-2. **Export/Import personal data:**
+2. **WebDAV cloud backup:**
+   - webdav-backup — push VFS snapshot to WebDAV server (auto-archive)
+   - webdav-backup-list — list remote WebDAV backups
+   - webdav-restore <file> — restore VFS from remote WebDAV snapshot
+   - webdav-push <local> <remote> — push file to WebDAV space
+   - webdav-pull <remote> <local> — pull file from WebDAV space
+   - webdav-ls [path] — list remote WebDAV directory contents
+   - webdav-status — check WebDAV connection and space usage
+   - webdav-explorer — GUI file browser for WebDAV
+   - webdav-browser — simpler file listing for WebDAV
+   - webdav-config — configure WebDAV endpoint and credentials
+
+3. **Export/Import personal data:**
    - my-export — prints all my-set data as formatted JSON
    - my-import <json> — bulk-import personal data from JSON string
 
-3. **Export/Import modules:**
+4. **Export/Import modules:**
    - export-mods — exports module registry as JSON
    - import-mods <json> — imports modules from JSON backup
 
-4. **Restore:**
+5. **Restore:**
    - restore <json> — restores terminal state from a backup JSON
    - Session logs are saved to /memory/ automatically on page unload
 
-5. **When to use:**
+6. **When to use:**
    - Before factory-reset: call my-export, vfs-export, export-mods to save data
    - When switching browsers or devices: export all, then import
-   - User says "backup my data" or "save my files"`),
+   - User says "backup my data" or "save my files"
+   - For cloud backup: use webdav-backup (requires WebDAV server configured)`),
 
             s('mindmap-workflow', 'How to create, view, edit, and manage brainstorming mindmaps', ['mindmap', 'brainstorming', 'planning', 'organization'], 'productivity',
 `1. **Create a new mindmap:**
@@ -215,18 +274,19 @@ class SkillPackCoreModule {
 
             s('skills-system-guide', 'How to use the skills system: load, create, patch, list, and audit skills for persistent procedural memory', ['skills', 'system', 'meta'], 'system',
 `1. **Always load skills at task start:**
-   - At the START of every task, call load_skills(query) to check for stored procedures
-   - Example: load_skills("search the web") returns matching skill content
-   - Example: load_skills("edit module") returns the module editing workflow
+   - At the START of every task, type or call "skill-view <name>" or "skill-list"
+   - Example: skill-view "module-management" — returns matching skill content
+   - Example: skill-list system — browse skills by category
 
 2. **Create skills after complex tasks:**
-   - After any task with 3+ tool calls, call create_skill to save the approach
+   - After any task with 3+ tool calls, call "skill-create"
    - Required fields: name (kebab-case), description, content (markdown with YAML frontmatter)
    - Optional: tags (comma-separated), category (e.g. research, system, dev)
    - Skills persist in /skills/ as .md files with /skills/index.json for fast lookup
+   - Skill pack auto-seeds 8 core skills on first boot
 
 3. **Patch skills when they're outdated:**
-   - If a stored procedure has wrong steps, call patch_skill(name, newContent)
+   - If a stored procedure has wrong steps, call "skill-patch <name>"
    - This replaces the entire skill content and updates the index
    - Do NOT create a duplicate — always patch the existing skill
 
@@ -235,13 +295,139 @@ class SkillPackCoreModule {
    - Named tool-<name>-workaround (e.g. tool-write_file-workaround)
 
 5. **Audit and maintenance:**
-   - list_skills(category?) — browse available skills, optionally filter
+   - skill-list <category?> — browse available skills, optionally filter
+   - skill-export <name> — download a skill as markdown
+   - skill-import <json> — bulk import skills
+   - skill-sync — re-index skills from /skills/ directory
    - Skills are audited every 20 messages for staleness (empty content, >30 days old)
 
 6. **YAML frontmatter format:**
    - Each skill file must start with: ---\\nname: <name>\\ndescription: <text>\\ntags: [...]\\ncategory: <cat>\\n---\\n
    - Steps follow under ## Steps heading
    - Use numbered lists for sequential steps`),
+
+            sk('agent-orchestration', 'How to use the agent registry, leases, and orchestrator for multi-agent workflows', ['agents', 'orchestration', 'delegation', 'leases'], 'system',
+`## Steps
+1. **Agent Registry:**
+   - agent-list — list all registered agents (ID, type, capabilities, status)
+   - agent-register <type> <capabilities> — register a new agent (capabilities: comma-separated like "code,research")
+   - agent-unregister <id> — remove an agent
+   - agent-status <id> — detailed status including uptime, task history
+
+2. **Leases (time-bound contracts):**
+   - lease-create <agent-id> <ttl-seconds> — create a lease with watchdog timer
+   - lease-list — show active leases with remaining TTL
+   - lease-revoke <lease-id> — terminate a lease early
+   - lease-renew <lease-id> <ttl-seconds> — extend a lease
+
+3. **Orchestrator (spawn, delegate, kill):**
+   - orchestrator-spawn <type> <capabilities> — spawn a new agent automatically (registers + creates lease)
+   - orchestrator-kill <agent-id> — kill an agent (revokes lease + unregisters)
+   - orchestrate — list all active agents with their orchestrator state
+   - orchestrator-purge — kill all idle/expired agents
+   - orchestrator-status — full system status: active, idle, dead agents
+
+4. **AI tool integration:**
+   - AI tools list_agents, delegate_task, spawn_agent are available in the AI system prompt
+   - The AI can auto-spawn worker agents for sub-tasks
+   - Each agent gets its own VFS workspace at /agents/<agent-id>/
+
+5. **When to use:**
+   - User needs parallel task execution → orchestrator-spawn coder + researcher
+   - Time-bound automation → lease-create with short TTL
+   - System cleanup → orchestrator-purge to kill stale agents`),
+
+            sk('debug-panel-and-logs', 'How to use the debug panel, session logging, and terminal diagnostics', ['debug', 'logging', 'diagnostics', 'troubleshooting'], 'system',
+`## Steps
+1. **Toggle debug panel:**
+   - debug — opens real-time debug panel showing last AI tool call, response time, and context
+   - Debug panel includes Copy, Export, and Write to VFS buttons
+   - Export: saves tool call log as timestamped JSON to downloads
+   - Write to VFS: appends debug data to /debug.log (dedup by turn ID)
+
+2. **Session logging:**
+   - logs [n] [LEVEL] — view last n log entries (optionally filtered by INFO/WARN/ERROR)
+   - logrotate — rotate current.log to dated archive (auto-cleans old logs beyond 10)
+   - Logs stored in /logs/ directory: current.log + dated archives
+   - Health check runs automatically after complex tasks
+
+3. **Diagnostic commands:**
+   - health-check — full audit: VFS size, modules, logs, trash, skills
+   - check — quick system health including module requirement status
+   - mem — real-time memory usage (also in header)
+   - status — network, files, modules, Ollama connectivity
+
+4. **System journals:**
+   - debug.log — appended by debug panel VFS button (dedup by turn ID)
+   - current.log — system activity log with rotation
+   - Auto-save: terminal state auto-saves every 60s
+
+5. **When to use:**
+   - AI is behaving unexpectedly → debug to see tool calls
+   - User reports errors → logs 50 ERROR to see error entries
+   - Memory concerns → mem to check, health-check for full audit`),
+
+            sk('webdav-operations', 'How to use WebDAV cloud storage for backup, file sync, and remote file access', ['webdav', 'cloud', 'backup', 'sync', 'storage'], 'system',
+`## Steps
+1. **Configuration:**
+   - webdav-config — configure WebDAV endpoint URL and credentials
+   - Connection auto-tested on config; webdav-status shows connection health
+   - Uses per-user token stored in .token file on the server side
+
+2. **File operations:**
+   - webdav-ls [path] — list remote directory contents
+   - webdav-push <local-path> <remote-path> — upload file to WebDAV
+   - webdav-pull <remote-path> [local-path] — download file from WebDAV
+   - webdav-explorer — GUI file browser for WebDAV
+   - webdav-browser — CLI file browser for WebDAV
+
+3. **Backup & Restore:**
+   - webdav-backup — push full VFS snapshot to WebDAV (creates /backups/newos4-<date>.json)
+   - webdav-backup-list — list all remote backup snapshots
+   - webdav-restore <filename> — restore VFS from a remote backup snapshot
+
+4. **Status & Diagnostics:**
+   - webdav-status — connection status, last sync, space information
+   - If uploads fail: check webdav-config, ensure .token file is valid
+   - WebDAV runs on the same server (nginx with WebDAV module), no external dependency
+
+5. **When to use:**
+   - Before factory-reset: webdav-backup to store VFS remotely
+   - Cross-browser: webdav-push/pull to move files between instances
+   - User says "cloud backup" or "remote save" → webdav-backup`),
+
+            sk('security-and-safety', 'How to use WebX11 security levels, command blocking, and safety features', ['security', 'safety', 'blocking', 'permissions'], 'system',
+`## Steps
+1. **Security levels:**
+   - security-level <0-3> — set security level:
+     0 = Permissive (no blocks, no confirms — anything runs)
+     1 = Standard (unknown cmds → AI route, destructive → confirm, system → block)
+     2 = Paranoid (unknown cmds blocked entirely, destructive blocked)
+     3 = Audit (everything allowed, everything logged)
+   - Default: level 1
+   - security — show current level, blocked count, and stats
+
+2. **Command control:**
+   - cmd-allow <cmd> — whitelist a command from security checks
+   - cmd-deny <cmd> — blacklist/block a command entirely
+   - whitelist built-in: help, clear, ls, cat, pwd, whoami, df, free, top, ps, echo, date, env, history
+
+3. **What gets blocked at each level:**
+   - Unknown commands: Level 1 → AI routed, Level 2+ → blocked
+   - Destructive commands (delete, write, save, format, etc.): Level 1 → confirmation, Level 2+ → blocked
+   - System commands (reboot, shutdown, format, kill): Level 1+ → blocked
+   - Suspicious flags (--execute, --eval, --shell): Level 1+ → blocked
+
+4. **Safety checklist:**
+   - Check security: security shows your current level
+   - Before running risky commands: create a checkpoint first
+   - For temporary relax: security-level 0, then restore to 1
+   - For total lockdown before leaving: security-level 2
+
+5. **When to use:**
+   - User wants to lock down the terminal → security-level 2
+   - User wants to allow a blocked command → cmd-allow <cmd>
+   - Debugging strange behavior → verify security-level (user may have set it higher)`)
         ];
     }
     registerCommands() {
@@ -264,8 +450,9 @@ class SkillPackCoreModule {
         console.log('[SkillPackCore] existing index keys:', Object.keys(index));
         let seeded = 0;
         for (const skill of this._skills) {
-            if (!index[skill.name]) {
-                fs.writeFile(`/skills/${skill.name}.md`, skill.content);
+            const existing = index[skill.name];
+            if (!existing) {
+                fs.writeFile('/skills/' + skill.name + '.md', skill.content);
                 index[skill.name] = {
                     name: skill.name,
                     description: skill.description,
@@ -275,14 +462,25 @@ class SkillPackCoreModule {
                     updated: new Date().toISOString()
                 };
                 seeded++;
+            } else {
+                // Update existing skill content on fresh load (cache-bust version bump triggers this)
+                fs.writeFile('/skills/' + skill.name + '.md', skill.content);
+                index[skill.name] = {
+                    ...existing,
+                    description: skill.description,
+                    tags: skill.tags,
+                    category: skill.category,
+                    updated: new Date().toISOString()
+                };
             }
         }
         if (seeded > 0) {
-            fs.fsWriteJSON('/skills/index.json', index);
+            this.terminal.print('📚 Seeded ' + seeded + ' new skill(s)', 'success');
         }
+        fs.fsWriteJSON('/skills/index.json', index);
         this._seeded = true;
     }
 }
 if (typeof window.webx11 !== 'undefined' && window.webx11) {
     webx11.moduleManager.registerModule(new SkillPackCoreModule(), 'https://webx11.duckdns.org/spaces/newos4/modules/ext/skill-pack-core.js');
-}
+}
\ No newline at end of file