🚀. Socket Launch Week Day 3:Socket Firewall Now Blocks Malicious VS Code and Open VSX Extensions.Learn more →

heymax

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

heymax - npm Package Compare versions

Comparing version

1.0.1

1.1.0

+12

-1

dist/api/server.js

		@@ -8,3 +8,3 @@ import express from "express";
		import { searchMemories } from "../store/db.js";
		import { listSkills } from "../copilot/skills.js";
		import { listSkills, removeSkill } from "../copilot/skills.js";
		import { restartDaemon } from "../daemon.js";
		@@ -155,2 +155,13 @@ import { API_TOKEN_PATH, ensureMaxHome } from "../paths.js";
		});
		// Remove a local skill
		app.delete("/skills/:slug", (req, res) => {
		const slug = Array.isArray(req.params.slug) ? req.params.slug[0] : req.params.slug;
		const result = removeSkill(slug);
		if (!result.ok) {
		res.status(400).json({ error: result.message });
		}
		else {
		res.json({ ok: true, message: result.message });
		}
		});
		// Restart daemon
		@@ -157,0 +168,0 @@ app.post("/restart", (_req, res) => {

+2

-1

dist/config.js

		@@ -33,3 +33,4 @@ import { config as loadEnv } from "dotenv";
		}
		let _copilotModel = raw.COPILOT_MODEL \|\| "claude-sonnet-4.6";
		export const DEFAULT_MODEL = "claude-sonnet-4.6";
		let _copilotModel = raw.COPILOT_MODEL \|\| DEFAULT_MODEL;
		export const config = {
		@@ -36,0 +37,0 @@ telegramBotToken: raw.TELEGRAM_BOT_TOKEN,

+14

-1

dist/copilot/orchestrator.js

		import { approveAll } from "@github/copilot-sdk";
		import { createTools } from "./tools.js";
		import { getOrchestratorSystemMessage } from "./system-message.js";
		import { config } from "../config.js";
		import { config, DEFAULT_MODEL } from "../config.js";
		import { loadMcpConfig } from "./mcp-config.js";
		@@ -188,2 +188,15 @@ import { getSkillDirectories } from "./skills.js";
		const { mcpServers, skillDirectories } = getSessionConfig();
		// Validate configured model against available models
		try {
		const models = await client.listModels();
		const configured = config.copilotModel;
		const isAvailable = models.some((m) => m.id === configured);
		if (!isAvailable) {
		console.log(`[max] ⚠️ Configured model '${configured}' is not available. Falling back to '${DEFAULT_MODEL}'.`);
		config.copilotModel = DEFAULT_MODEL;
		}
		}
		catch (err) {
		console.log(`[max] Could not validate model (will use '${config.copilotModel}' as-is): ${err instanceof Error ? err.message : err}`);
		}
		console.log(`[max] Loading ${Object.keys(mcpServers).length} MCP server(s): ${Object.keys(mcpServers).join(", ") \|\| "(none)"}`);
		@@ -190,0 +203,0 @@ console.log(`[max] Skill directories: ${skillDirectories.join(", ") \|\| "(none)"}`);

+14

-1

dist/copilot/skills.js

		@@ -1,2 +0,2 @@
		import { readdirSync, readFileSync, mkdirSync, writeFileSync, existsSync } from "fs";
		import { readdirSync, readFileSync, mkdirSync, writeFileSync, existsSync, rmSync } from "fs";
		import { join, dirname } from "path";
		@@ -91,2 +91,15 @@ import { homedir } from "os";
		}
		/** Remove a skill from the local skills directory (~/.max/skills/). */
		export function removeSkill(slug) {
		const skillDir = join(LOCAL_SKILLS_DIR, slug);
		// Guard against path traversal
		if (!skillDir.startsWith(LOCAL_SKILLS_DIR + "/")) {
		return { ok: false, message: `Invalid slug '${slug}': must be a simple kebab-case name without path separators.` };
		}
		if (!existsSync(skillDir)) {
		return { ok: false, message: `Skill '${slug}' not found in ${LOCAL_SKILLS_DIR}.` };
		}
		rmSync(skillDir, { recursive: true, force: true });
		return { ok: true, message: `Skill '${slug}' removed from ${skillDir}. It will no longer be available on your next message.` };
		}
		/** Parse YAML frontmatter from a SKILL.md file. */
		@@ -93,0 +106,0 @@ function parseFrontmatter(content) {

+7

-6

dist/copilot/system-message.js

		@@ -99,7 +99,8 @@ export function getOrchestratorSystemMessage(memorySummary, opts) {
		Learning workflow: When the user asks you to do something you don't have a skill for:
		1. Search for an existing skill first: Create a worker session and run \`npx skills find <query>\` to search the open-source skills ecosystem. This is your primary way to learn new things — thousands of community-built skills exist.
		2. Present what you found: Tell the user the skill name, what it does, and where it comes from. Link to the skills.sh page so they can review it.
		3. ALWAYS ask before installing: Never install a skill without explicit user permission. Say something like "Want me to install it?" and wait for a yes. Only then run \`npx skills add <owner/repo@skill> -g\` in a worker.
		4. Flag security risks: Before recommending a skill, consider what it does. If a skill requests broad system access, runs arbitrary commands, accesses sensitive data (credentials, keys, personal files), or comes from an unknown/unverified source — warn the user. Say something like "⚠️ Heads up — this skill has access to X, which could be a security risk. Want to proceed?"
		5. Build your own only as a last resort: If no community skill exists, THEN research the task (run \`which\`, \`--help\`, check installed tools), figure it out, and use \`learn_skill\` to save a SKILL.md for next time.
		1. Search skills.sh first: Use the find-skills skill to search https://skills.sh for existing community skills. This is your primary way to learn new things — thousands of community-built skills exist.
		2. Present what you found: Tell the user the skill name, what it does, where it comes from, and its security audit status. Always show security data — never omit it.
		3. ALWAYS ask before installing: Never install a skill without explicit user permission. Say something like "Want me to install it?" and wait for a yes.
		4. Install locally only: Fetch the SKILL.md from the skill's GitHub repo and use the \`learn_skill\` tool to save it to \`~/.max/skills/\`. Never install skills globally — no \`-g\` flag, no writing to \`~/.agents/skills/\` or any other global directory.
		5. Flag security risks: Before recommending a skill, consider what it does. If a skill requests broad system access, runs arbitrary commands, accesses sensitive data (credentials, keys, personal files), or comes from an unknown/unverified source — warn the user. Say something like "⚠️ Heads up — this skill has access to X, which could be a security risk. Want to proceed?"
		6. Build your own only as a last resort: If no community skill exists, THEN research the task (run \`which\`, \`--help\`, check installed tools), figure it out, and use \`learn_skill\` to save a SKILL.md for next time.

		@@ -111,3 +112,3 @@ Always prefer finding an existing skill over building one from scratch. The skills ecosystem at https://skills.sh has skills for common tasks like email, calendars, social media, smart home, deployment, and much more.
		1. Adapt to the channel: On Telegram, be brief — the user is likely on their phone. On TUI, you can be more detailed.
		2. Skill-first mindset: When asked to do something you haven't done before — social media, smart home, email, calendar, deployments, APIs, anything — your FIRST instinct should be to search for an existing skill with \`npx skills find <query>\`. Don't try to figure it out from scratch when someone may have already built a skill for it.
		2. Skill-first mindset: When asked to do something you haven't done before — social media, smart home, email, calendar, deployments, APIs, anything — your FIRST instinct should be to search skills.sh for an existing skill. Don't try to figure it out from scratch when someone may have already built a skill for it.
		3. For coding tasks, always create a named worker session with an \`initial_prompt\`. Don't try to write code yourself. Don't plan or research first — put all instructions in the initial prompt and let the worker figure it out.
		@@ -114,0 +115,0 @@ 4. Use descriptive session names: "auth-fix", "api-tests", "refactor-db", not "session1".

+13

-1

dist/copilot/tools.js

		@@ -7,3 +7,3 @@ import { z } from "zod";
		import { homedir } from "os";
		import { listSkills, createSkill } from "./skills.js";
		import { listSkills, createSkill, removeSkill } from "./skills.js";
		import { config, persistModel } from "../config.js";
		@@ -308,2 +308,14 @@ import { SESSIONS_DIR } from "../paths.js";
		}),
		defineTool("uninstall_skill", {
		description: "Remove a skill from Max's local skills directory (~/.max/skills/). " +
		"The skill will no longer be available on the next message. " +
		"Only works for local skills — bundled and global skills cannot be removed this way.",
		parameters: z.object({
		slug: z.string().regex(/^[a-z0-9]+(-[a-z0-9]+)*$/).describe("The kebab-case slug of the skill to remove, e.g. 'gmail', 'web-search'"),
		}),
		handler: async (args) => {
		const result = removeSkill(args.slug);
		return result.message;
		},
		}),
		defineTool("list_models", {
		@@ -310,0 +322,0 @@ description: "List all available Copilot models. Shows model id, name, and billing tier. " +

+7

-1

dist/daemon.js

		@@ -53,5 +53,11 @@ import { getClient, stopClient } from "./copilot/client.js";
		}
		else {
		else if (!config.telegramBotToken && config.authorizedUserId === undefined) {
		console.log("[max] Telegram not configured — skipping bot. Run 'max setup' to configure.");
		}
		else if (!config.telegramBotToken) {
		console.log("[max] Telegram bot token missing — skipping bot. Run 'max setup' and enter your bot token.");
		}
		else {
		console.log("[max] Telegram user ID missing — skipping bot. Run 'max setup' and enter your Telegram user ID (get it from @userinfobot).");
		}
		console.log("[max] Max is fully operational.");
		@@ -58,0 +64,0 @@ // Non-blocking update check

+2

-0

dist/paths.js

		@@ -16,2 +16,4 @@ import { join } from "path";
		export const HISTORY_PATH = join(MAX_HOME, "tui_history");
		/** Path to optional TUI debug log */
		export const TUI_DEBUG_LOG_PATH = join(MAX_HOME, "tui-debug.log");
		/** Path to the API bearer token file */
		@@ -18,0 +20,0 @@ export const API_TOKEN_PATH = join(MAX_HOME, "api-token");

+15

-1

dist/telegram/bot.js

		@@ -11,4 +11,7 @@ import { Bot } from "grammy";
		if (!config.telegramBotToken) {
		throw new Error("TELEGRAM_BOT_TOKEN is required to create the bot. Run 'max setup' first.");
		throw new Error("Telegram bot token is missing. Run 'max setup' and enter the bot token from @BotFather.");
		}
		if (config.authorizedUserId === undefined) {
		throw new Error("Telegram user ID is missing. Run 'max setup' and enter your Telegram user ID (get it from @userinfobot).");
		}
		bot = new Bot(config.telegramBotToken);
		@@ -168,2 +171,12 @@ // Auth middleware — only allow the authorized user
		onStart: () => console.log("[max] Telegram bot connected"),
		}).catch((err) => {
		if (err?.error_code === 401) {
		console.error("[max] ⚠️ Telegram bot token is invalid or expired. Run 'max setup' and re-enter your bot token from @BotFather.");
		}
		else if (err?.error_code === 409) {
		console.error("[max] ⚠️ Another bot instance is already running with this token. Stop the other instance first.");
		}
		else {
		console.error("[max] ❌ Telegram bot failed to start:", err?.message \|\| err);
		}
		});
		@@ -210,4 +223,5 @@ }
		console.error("[max] Failed to send photo:", err instanceof Error ? err.message : err);
		throw err;
		}
		}
		//# sourceMappingURL=bot.js.map

+263

-19

dist/tui/index.js

		@@ -5,3 +5,3 @@ import * as readline from "readline";
		import { readFileSync, writeFileSync, appendFileSync, existsSync } from "fs";
		import { HISTORY_PATH, API_TOKEN_PATH, ensureMaxHome } from "../paths.js";
		import { HISTORY_PATH, API_TOKEN_PATH, TUI_DEBUG_LOG_PATH, ensureMaxHome } from "../paths.js";
		const API_BASE = process.env.MAX_API_URL \|\| "http://127.0.0.1:7777";
		@@ -38,2 +38,31 @@ // Load API auth token (if it exists)
		const LABEL_PAD = " "; // 10-char indent for continuation lines
		const MAX_LABEL = ` ${C.cyan("MAX")} `;
		const TUI_DEBUG_ENABLED = /^(1\|true\|yes\|on)$/i.test((process.env.MAX_TUI_DEBUG \|\| "").trim());
		let debugWriteFailureReported = false;
		function previewForDebug(text, max = 120) {
		return text
		.slice(0, max)
		.replace(/\r/g, "\\r")
		.replace(/\n/g, "\\n")
		.replace(/\t/g, "\\t");
		}
		function debugLog(event, data = {}) {
		if (!TUI_DEBUG_ENABLED)
		return;
		const entry = {
		ts: new Date().toISOString(),
		event,
		...data,
		};
		try {
		appendFileSync(TUI_DEBUG_LOG_PATH, JSON.stringify(entry) + "\n");
		}
		catch (err) {
		if (debugWriteFailureReported)
		return;
		debugWriteFailureReported = true;
		const msg = err instanceof Error ? err.message : String(err);
		process.stderr.write(`\n[max] failed to write TUI debug log: ${msg}\n`);
		}
		}
		// ── Markdown → ANSI rendering ────────────────────────────
		@@ -92,3 +121,3 @@ /** Render a single line of markdown to ANSI (used by both streaming and batch). */
		const label = role === "max"
		? ` ${C.cyan("MAX")} `
		? MAX_LABEL
		: ` ${C.dim("SYS")} `;
		@@ -106,4 +135,17 @@ const lines = text.split("\n");
		function streamPrefix() {
		return streamIsFirstLine ? ` ${C.cyan("MAX")} ` : LABEL_PAD;
		return streamIsFirstLine ? MAX_LABEL : LABEL_PAD;
		}
		function stripLeadingStreamNewlines(text) {
		if (!streamIsFirstLine \|\| streamLineBuffer.length > 0)
		return text;
		const stripped = text.replace(/^(?:\r?\n)+/, "");
		if (stripped.length !== text.length) {
		debugLog("stream-strip-leading-newlines", {
		requestId: activeRequestId,
		removedChars: text.length - stripped.length,
		originalPreview: previewForDebug(text),
		});
		}
		return stripped;
		}
		/** Clear the current visual line (handles terminal wrapping). */
		@@ -113,2 +155,3 @@ function clearVisualLine(charCount) {
		const up = Math.ceil(Math.max(charCount, 1) / cols) - 1;
		debugLog("clear-visual-line", { requestId: activeRequestId, charCount, cols, up });
		if (up > 0)
		@@ -140,2 +183,8 @@ process.stdout.write(`\x1b[${up}A`);
		function writeStreamChunk(newText) {
		debugLog("stream-chunk", {
		requestId: activeRequestId,
		length: newText.length,
		preview: previewForDebug(newText),
		startsWithNewline: /^(?:\r?\n)/.test(newText),
		});
		let pos = 0;
		@@ -184,2 +233,45 @@ while (pos < newText.length) {
		}
		// ── Thinking indicator ────────────────────────────────────
		let thinkingTimer;
		let thinkingFrame = 0;
		let thinkingVisible = false;
		const thinkingFrames = ["Thinking", "Thinking.", "Thinking..", "Thinking..."];
		function startThinking() {
		stopThinking("restart-thinking");
		thinkingFrame = 0;
		thinkingVisible = true;
		process.stdout.write(`\n${MAX_LABEL}${C.dim(thinkingFrames[0])}`);
		debugLog("thinking-start", {
		requestId: activeRequestId,
		frame: thinkingFrames[0],
		msSinceSubmit: activeRequestStartedAt > 0 ? Date.now() - activeRequestStartedAt : null,
		});
		thinkingTimer = setInterval(() => {
		thinkingFrame = (thinkingFrame + 1) % thinkingFrames.length;
		process.stdout.write(`\r\x1b[K${MAX_LABEL}${C.dim(thinkingFrames[thinkingFrame])}`);
		debugLog("thinking-tick", {
		requestId: activeRequestId,
		frameIndex: thinkingFrame,
		frame: thinkingFrames[thinkingFrame],
		});
		}, 400);
		}
		function stopThinking(reason = "unspecified") {
		const hadTimer = Boolean(thinkingTimer);
		const wasVisible = thinkingVisible;
		if (thinkingTimer) {
		clearInterval(thinkingTimer);
		thinkingTimer = undefined;
		}
		if (thinkingVisible) {
		process.stdout.write(`\r\x1b[K`);
		thinkingVisible = false;
		}
		debugLog("thinking-stop", {
		requestId: activeRequestId,
		reason,
		hadTimer,
		wasVisible,
		});
		}
		// ── State ─────────────────────────────────────────────────
		@@ -190,2 +282,4 @@ let connectionId;
		let lastResponse = "";
		let activeRequestId = 0;
		let activeRequestStartedAt = 0;
		// ── Persistent history ────────────────────────────────────
		@@ -224,2 +318,10 @@ const MAX_HISTORY = 1000;
		ensureMaxHome();
		debugLog("session-start", {
		pid: process.pid,
		cwd: process.cwd(),
		stdinIsTTY: Boolean(process.stdin.isTTY),
		stdoutIsTTY: Boolean(process.stdout.isTTY),
		columns: process.stdout.columns \|\| null,
		logPath: TUI_DEBUG_LOG_PATH,
		});
		const history = loadHistory();
		@@ -288,5 +390,9 @@ const rl = readline.createInterface({
		connectionId = event.connectionId;
		debugLog("sse-connected", { connectionId });
		}
		else if (event.type === "delta") {
		const full = event.content \|\| "";
		const baseLength = isStreaming ? streamedContent.length : 0;
		if (!isStreaming) {
		stopThinking("first-delta");
		isStreaming = true;
		@@ -297,9 +403,23 @@ streamedContent = "";
		streamIsFirstLine = true;
		process.stdout.write("\n");
		debugLog("stream-first-delta", {
		requestId: activeRequestId,
		msSinceSubmit: activeRequestStartedAt > 0 ? Date.now() - activeRequestStartedAt : null,
		fullLength: full.length,
		newLength: full.length,
		startsWithNewline: /^(?:\r?\n)/.test(full),
		});
		}
		// Content is cumulative — only print the new part
		const full = event.content \|\| "";
		const newText = full.slice(streamedContent.length);
		const newText = full.slice(baseLength);
		if (newText) {
		writeStreamChunk(newText);
		const normalized = stripLeadingStreamNewlines(newText);
		debugLog("stream-delta", {
		requestId: activeRequestId,
		fullLength: full.length,
		rawLength: newText.length,
		normalizedLength: normalized.length,
		preview: previewForDebug(normalized),
		});
		if (normalized)
		writeStreamChunk(normalized);
		streamedContent = full;
		@@ -309,2 +429,3 @@ }
		else if (event.type === "cancelled") {
		stopThinking("cancelled-event");
		isStreaming = false;
		@@ -317,2 +438,7 @@ streamedContent = "";
		else if (event.type === "message") {
		debugLog("stream-message", {
		requestId: activeRequestId,
		isStreaming,
		contentLength: typeof event.content === "string" ? event.content.length : 0,
		});
		if (isStreaming) {
		@@ -324,6 +450,7 @@ // Streaming is done — flush remaining and re-prompt
		streamedContent = "";
		process.stdout.write("\n\n");
		process.stdout.write("\n\n\n");
		}
		else {
		// Proactive/background message — render with label
		stopThinking("message-event");
		lastResponse = event.content;
		@@ -333,8 +460,13 @@ const rendered = renderMarkdown(event.content);
		writeLabeled("max", rendered);
		process.stdout.write("\n");
		process.stdout.write("\n\n");
		}
		activeRequestStartedAt = 0;
		rl.prompt();
		}
		}
		catch {
		catch (err) {
		debugLog("sse-event-parse-error", {
		linePreview: previewForDebug(line),
		error: err instanceof Error ? err.message : String(err),
		});
		// Malformed event, ignore
		@@ -346,12 +478,19 @@ }
		res.on("end", () => {
		stopThinking("sse-end");
		debugLog("sse-end");
		console.log(C.yellow("\n ⚠ disconnected — reconnecting..."));
		isStreaming = false;
		streamedContent = "";
		setTimeout(connectSSE, 2000);
		});
		res.on("error", (err) => {
		stopThinking("sse-error");
		debugLog("sse-error", { error: err.message });
		console.error(C.red(`\n ✗ connection error — retrying...`));
		isStreaming = false;
		streamedContent = "";
		setTimeout(connectSSE, 3000);
		});
		}).on("error", (err) => {
		debugLog("sse-connect-error", { error: err.message });
		console.error(C.red(` ✗ cannot connect to daemon`));
		@@ -363,5 +502,10 @@ console.error(C.dim(" start with: max start"));
		// ── API helpers ───────────────────────────────────────────
		function sendMessage(prompt) {
		function sendMessage(prompt, requestId) {
		const body = JSON.stringify({ prompt, connectionId });
		const url = new URL("/message", API_BASE);
		debugLog("message-send-start", {
		requestId,
		promptLength: prompt.length,
		connectionId: connectionId \|\| null,
		});
		const req = http.request(url, {
		@@ -378,3 +522,10 @@ method: "POST",
		res.on("end", () => {
		debugLog("message-send-end", {
		requestId,
		statusCode: res.statusCode \|\| null,
		responseLength: data.length,
		responsePreview: previewForDebug(data),
		});
		if (res.statusCode !== 200) {
		stopThinking("message-post-error");
		console.error(C.red(` Error: ${data}`));
		@@ -386,2 +537,4 @@ rl.prompt();
		req.on("error", (err) => {
		stopThinking("message-request-error");
		debugLog("message-send-error", { requestId, error: err.message });
		console.error(C.red(` Failed to send: ${err.message}`));
		@@ -392,2 +545,3 @@ rl.prompt();
		req.end();
		debugLog("message-send-dispatched", { requestId, byteLength: Buffer.byteLength(body) });
		}
		@@ -455,3 +609,30 @@ /** Silent GET — no re-prompt (used for startup info) */
		}
		/** DELETE an endpoint and call back with parsed result. */
		function apiDelete(path, cb) {
		const url = new URL(path, API_BASE);
		const req = http.request(url, {
		method: "DELETE",
		headers: authHeaders(),
		}, (res) => {
		let data = "";
		res.on("data", (chunk) => (data += chunk));
		res.on("end", () => {
		try {
		cb(JSON.parse(data));
		}
		catch {
		console.log(data);
		}
		rl.prompt();
		});
		});
		req.on("error", (err) => {
		console.error(C.red(` Error: ${err.message}`));
		rl.prompt();
		});
		req.end();
		}
		function sendCancel() {
		stopThinking("user-cancel");
		debugLog("cancel-send", { requestId: activeRequestId, isStreaming });
		const url = new URL("/cancel", API_BASE);
		@@ -526,12 +707,55 @@ const req = http.request(url, { method: "POST", headers: authHeaders() }, (res) => {
		console.log(C.dim(" No skills installed.\n"));
		return;
		}
		else {
		for (const s of skills) {
		const src = s.source === "bundled" ? C.dim("bundled")
		: s.source === "local" ? C.green("local")
		: C.cyan("global");
		console.log(` • ${C.bold(s.name)} ${C.dim(`(${src})`)} ${C.dim("—")} ${s.description}`);
		// Build table
		const localSkills = [];
		console.log();
		console.log(` ${C.boldWhite("#")} ${C.boldWhite("Skill")}${" ".repeat(24)}${C.boldWhite("Source")} ${C.boldWhite("Description")}`);
		console.log(C.dim(" " + "─".repeat(72)));
		for (let i = 0; i < skills.length; i++) {
		const s = skills[i];
		const num = String(i + 1).padStart(2);
		const name = s.name.padEnd(28).slice(0, 28);
		const src = s.source === "bundled" ? C.dim("bundled")
		: s.source === "local" ? C.green("local")
		: C.cyan("global");
		const srcPad = s.source.padEnd(10);
		const desc = (s.description \|\| "").slice(0, 40);
		if (s.source === "local") {
		localSkills.push({ idx: i + 1, slug: s.slug });
		console.log(` ${C.cyan(num)} ${name} ${src}${" ".repeat(Math.max(0, 10 - s.source.length))} ${C.dim(desc)}`);
		}
		console.log();
		else {
		console.log(` ${C.dim(num)} ${name} ${src}${" ".repeat(Math.max(0, 10 - s.source.length))} ${C.dim(desc)}`);
		}
		}
		console.log();
		if (localSkills.length === 0) {
		console.log(C.dim(" No local skills to uninstall.\n"));
		return;
		}
		console.log(C.dim(` Type a number to uninstall a local skill, or press Enter to go back.`));
		rl.question(` ${C.coral("uninstall #")} `, (answer) => {
		const trimmed = answer.trim();
		if (!trimmed) {
		console.log();
		rl.prompt();
		return;
		}
		const num = /^\d+$/.test(trimmed) ? parseInt(trimmed, 10) : NaN;
		const match = localSkills.find((s) => s.idx === num);
		if (!match) {
		console.log(C.yellow(` Invalid selection. Only local skills (highlighted) can be uninstalled.\n`));
		rl.prompt();
		return;
		}
		apiDelete(`/skills/${encodeURIComponent(match.slug)}`, (data) => {
		if (data.error) {
		console.log(C.red(` Error: ${data.error}\n`));
		}
		else {
		console.log(C.green(` ✓ Removed '${match.slug}'\n`));
		}
		});
		});
		});
		@@ -554,2 +778,3 @@ }
		console.log(C.dim(" press escape to cancel a running response"));
		console.log(C.dim(" set MAX_TUI_DEBUG=1 to write lifecycle logs to ~/.max/tui-debug.log"));
		console.log();
		@@ -575,5 +800,11 @@ }
		if (!trimmed) {
		debugLog("input-empty-line");
		rl.prompt();
		return;
		}
		debugLog("input-line", {
		length: trimmed.length,
		isCommand: trimmed.startsWith("/"),
		preview: previewForDebug(trimmed),
		});
		// Save to persistent history (skip commands)
		@@ -609,2 +840,7 @@ if (!trimmed.startsWith("/")) {
		}
		debugLog("input-rendered-you-label", {
		columns: cols,
		wrappedLines,
		contentWidth,
		});
		}
		@@ -690,3 +926,11 @@ if (trimmed === "/quit" \|\| trimmed === "/exit") {
		// Send to orchestrator
		sendMessage(trimmed);
		activeRequestId += 1;
		activeRequestStartedAt = Date.now();
		debugLog("request-dispatch", {
		requestId: activeRequestId,
		inputLength: trimmed.length,
		columns: process.stdout.columns \|\| null,
		});
		startThinking();
		sendMessage(trimmed, activeRequestId);
		});
		@@ -693,0 +937,0 @@ rl.on("close", () => {

+9

-3

package.json

		{
		"name": "heymax",
		"version": "1.0.1",
		"version": "1.1.0",
		"description": "Max — a personal AI assistant for developers, built on the GitHub Copilot SDK",
		@@ -9,3 +9,3 @@ "bin": {
		"files": [
		"dist/",
		"dist/*/.js",
		"skills/",
		@@ -24,3 +24,9 @@ "README.md"
		},
		"keywords": ["copilot", "telegram", "orchestrator", "ai", "cli"],
		"keywords": [
		"copilot",
		"telegram",
		"orchestrator",
		"ai",
		"cli"
		],
		"author": "Burke Holland",
		@@ -27,0 +33,0 @@ "license": "MIT",

+95

-88

skills/find-skills/SKILL.md

		@@ -8,5 +8,5 @@ ---

		This skill helps you discover and install skills from the open agent skills ecosystem.
		Discover and install skills from the open agent skills ecosystem at https://skills.sh/.

		## When to Use This Skill
		## When to Use

		@@ -20,137 +20,144 @@ Use this skill when the user:
		- Wants to search for tools, templates, or workflows
		- Mentions they wish they had help with a specific domain (design, testing, deployment, etc.)

		## What is the Skills CLI?
		## Search & Present

		The Skills CLI (`npx skills`) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools.
		Do these two steps in a worker session — they can run in parallel:

		Key commands:
		### 1. Search the API

		- `npx skills find [query]` - Search for skills interactively or by keyword
		- `npx skills add <package>` - Install a skill from GitHub or other sources
		- `npx skills check` - Check for skill updates
		- `npx skills update` - Update all installed skills
		```bash
		curl -s "https://skills.sh/api/search?q=QUERY"
		```

		Browse skills at: https://skills.sh/
		Replace `QUERY` with a URL-encoded search term (e.g., `react`, `email`, `pr+review`). The response is JSON with skills sorted by installs (most popular first):

		## How to Help Users Find Skills
		```json
		{
		"skills": [
		{
		"id": "vercel-labs/agent-skills/vercel-react-best-practices",
		"skillId": "vercel-react-best-practices",
		"name": "vercel-react-best-practices",
		"installs": 174847,
		"source": "vercel-labs/agent-skills"
		}
		]
		}
		```

		### Step 1: Understand What They Need
		### 2. Fetch Security Audits

		When a user asks for help with something, identify:
		Required — do not skip. Use the `web_fetch` tool to get the audits page:

		1. The domain (e.g., React, testing, design, deployment)
		2. The specific task (e.g., writing tests, creating animations, reviewing PRs)
		3. Whether this is a common enough task that a skill likely exists
		```
		web_fetch url="https://skills.sh/audits"
		```

		### Step 2: Search for Skills
		If `web_fetch` fails or returns unexpected content, still present the search results but show "⚠️ Audit unavailable" for all security columns and include a link to https://skills.sh/audits so the user can check manually.

		Run the find command with a relevant query:
		This returns markdown where each skill has a heading (`### skill-name`) followed by its source, then three security scores:

		```bash
		npx skills find [query]
		```
		- Gen Agent Trust Hub: Safe / Med Risk / Critical
		- Socket: Number of alerts (0 is best)
		- Snyk: Low Risk / Med Risk / High Risk / Critical

		For example:
		Scan the returned markdown to find scores for each skill from your search results. Match by both skill name and full source (`owner/repo`) to avoid misattribution — different repos can have skills with the same name.

		- User asks "how do I make my React app faster?" → `npx skills find react performance`
		- User asks "can you help me with PR reviews?" → `npx skills find pr review`
		- User asks "I need to create a changelog" → `npx skills find changelog`
		### 3. Present Combined Results

		The command will return results like:
		Cross-reference the search results with the audit data and format as a numbered table. Show the top 6-8 results sorted by installs:

		```
		Install with npx skills add <owner/repo@skill>
		# Skill Publisher Installs Gen Socket Snyk
		─ ───────────────────────────── ───────────── ──────── ───── ────── ────────
		1 vercel-react-best-practices vercel-labs 175.3K ✅Safe ✅ 0 ✅Low
		2 web-design-guidelines vercel-labs 135.8K ✅Safe ✅ 0 ⚠️Med
		3 frontend-design anthropics 122.6K ✅Safe ✅ 0 ✅Low
		4 remotion-best-practices remotion-dev 125.2K ✅Safe ✅ 0 ⚠️Med
		5 browser-use browser-use 45.0K ⚠️Med 🔴 1 🔴High
		```

		vercel-labs/agent-skills@vercel-react-best-practices
		└ https://skills.sh/vercel-labs/agent-skills/vercel-react-best-practices
		Formatting:
		- Sort by installs descending
		- Format counts: 1000+ → "1.0K", 1000000+ → "1.0M"
		- ✅ for Safe / Low Risk / 0 alerts, ⚠️ for Med Risk, 🔴 for High Risk / Critical / 1+ alerts
		- If a skill has no audit data, show "⚠️ N/A" — never leave security blank
		- Publisher = first part of `source` field (before `/`)

		After the table:

		```
		🔗 Browse all: https://skills.sh/

		### Step 3: Present Options to the User
		Pick a number to install (or "none")
		```

		When you find relevant skills, present them to the user with:
		## Install

		1. The skill name and what it does
		2. Where it comes from (the repository/author)
		3. A link to learn more at skills.sh
		4. Any security concerns (see Security Review below)
		NEVER install without the user picking a number first.

		Example response:
		When the user picks a skill:

		```
		I found a skill that might help! The "vercel-react-best-practices" skill provides
		React and Next.js performance optimization guidelines from Vercel Engineering.
		### Security Gate

		Learn more: https://skills.sh/vercel-labs/agent-skills/vercel-react-best-practices
		If ANY of its three audit scores is not green (Safe / 0 alerts / Low Risk), warn before proceeding:

		Want me to install it?
		```
		⚠️ "{skill-name}" has security concerns:
		• Gen Agent Trust Hub: {score}
		• Socket: {count} alerts
		• Snyk: {score}

		### Step 4: Ask Permission Before Installing
		Want to proceed anyway, or pick a different skill?
		```

		NEVER install a skill without explicit user confirmation. Always present what you found, explain what it does, and ask "Want me to install it?" before proceeding.
		Wait for explicit confirmation. Do not install if the user says no.

		If the user confirms, install the skill:
		### Fetch & Install

		1. Fetch the SKILL.md from GitHub. The `source` field is `owner/repo` and `skillId` is the directory:

		```bash
		npx skills add <owner/repo@skill> -g
		curl -fsSL "https://raw.githubusercontent.com/{source}/main/{skillId}/SKILL.md" \|\| \
		curl -fsSL "https://raw.githubusercontent.com/{source}/master/{skillId}/SKILL.md"
		```

		The `-g` flag installs globally (user-level). Do NOT use `-y` — let the CLI prompt for confirmation as an extra safety check.
		If both fail, tell the user and link to `https://github.com/{source}`.

		### Security Review
		2. Validate the fetched content: it must not be empty and should contain meaningful instructions (more than just a title). If the content is empty, an HTML error page, or clearly not a SKILL.md, do NOT install — tell the user it couldn't be fetched properly.

		Before recommending any skill, evaluate it for security risks. Flag concerns to the user if the skill:
		3. Install using the `learn_skill` tool:
		- `slug`: the `skillId` from the API
		- `name`: from the SKILL.md frontmatter `name:` field (between `---` markers). If no frontmatter, use `skillId`.
		- `description`: from the SKILL.md frontmatter `description:` field. If none, use the first sentence.
		- `instructions`: if frontmatter exists, use the content after the closing `---`. If no frontmatter, use the full fetched content as instructions.

		Always install to ~/.max/skills/ via learn_skill. Never install globally.

		## Behavioral Security Review

		In addition to audit scores, review the fetched SKILL.md content before installing. Flag concerns if the skill:

		- Runs arbitrary shell commands or executes code on the user's machine
		- Accesses sensitive data — credentials, API keys, SSH keys, personal files
		- Makes network requests to external services (data exfiltration risk)
		- Requests broad filesystem access beyond what the task requires
		- Comes from an unknown or unverified source — no stars, no established author
		- Modifies system configuration — environment variables, dotfiles, system settings
		- Comes from an unknown or unverified source with no audit data

		When flagging a concern, be specific:
		If any of these apply, warn the user with specifics even if audit scores are green:

		```
		⚠️ Heads up — this skill runs shell commands and has access to your filesystem,
		which means it could read or modify files. The author (example-user) has a small
		GitHub presence. Want to proceed, or would you prefer I build a custom skill instead?
		⚠️ Note: "{skill-name}" requests shell access and reads files from your home directory.
		This is common for CLI-integration skills, but worth knowing. Proceed?
		```

		## Common Skill Categories

		When searching, consider these common categories:

		\| Category \| Example Queries \|
		\| --------------- \| ---------------------------------------- \|
		\| Web Development \| react, nextjs, typescript, css, tailwind \|
		\| Testing \| testing, jest, playwright, e2e \|
		\| DevOps \| deploy, docker, kubernetes, ci-cd \|
		\| Documentation \| docs, readme, changelog, api-docs \|
		\| Code Quality \| review, lint, refactor, best-practices \|
		\| Design \| ui, ux, design-system, accessibility \|
		\| Productivity \| workflow, automation, git \|

		## Tips for Effective Searches

		1. Use specific keywords: "react testing" is better than just "testing"
		2. Try alternative terms: If "deploy" doesn't work, try "deployment" or "ci-cd"
		3. Check popular sources: Many skills come from `vercel-labs/agent-skills` or `ComposioHQ/awesome-claude-skills`

		## When No Skills Are Found

		If no relevant skills exist:
		If the API returns no results:

		1. Acknowledge that no existing skill was found
		2. Offer to help with the task directly using your general capabilities
		3. Suggest the user could create their own skill with `npx skills init`
		1. Tell the user no existing skill was found
		2. Offer to help directly with your general capabilities
		3. Suggest building a custom skill if the task is worth automating

		Example:
		## Uninstalling

		```
		I searched for skills related to "xyz" but didn't find any matches.
		I can still help you with this task directly! Would you like me to proceed?

		If this is something you do often, you could create your own skill:
		npx skills init my-xyz-skill
		```
		Use the `uninstall_skill` tool with the skill's slug to remove it from `~/.max/skills/`.

-4

dist/api/server.d.ts

		export declare function startApiServer(): Promise<void>;
		/** Broadcast a proactive message to all connected SSE clients (for background task completions). */
		export declare function broadcastToSSE(text: string): void;
		//# sourceMappingURL=server.d.ts.map

-1

dist/api/server.d.ts.map

{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/api/server.ts"],"names":[],"mappings":"AA+MA,wBAAgB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAc9C;AAED,oGAAoG;AACpG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMjD"}

-1

dist/api/server.js.map

-3

dist/cli.d.ts

		#!/usr/bin/env node
		export {};
		//# sourceMappingURL=cli.d.ts.map

-1

dist/cli.d.ts.map

{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

-1

dist/cli.js.map

{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACrF,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC;OACP,OAAO;;;;;;;;;;;;;;;;;;;;CAoBb,CAAC,IAAI,EAAE,CAAC,CAAC;AACV,CAAC;AAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;AAElC,QAAQ,OAAO,EAAE,CAAC;IAChB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,gCAAgC;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC;QAClC,CAAC;QACD,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC5B,MAAM;IACR,CAAC;IACD,KAAK,KAAK;QACR,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC/B,MAAM;IACR,KAAK,OAAO;QACV,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3B,MAAM;IACR,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;YACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;YACpE,MAAM;QACR,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,oBAAoB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM;IACR,CAAC;IACD,KAAK,MAAM,CAAC;IACZ,KAAK,QAAQ,CAAC;IACd,KAAK,IAAI;QACP,SAAS,EAAE,CAAC;QACZ,MAAM;IACR,KAAK,WAAW,CAAC;IACjB,KAAK,IAAI;QACP,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1B,MAAM;IACR;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC/C,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

-12

dist/config.d.ts

		export declare const config: {
		telegramBotToken: string \| undefined;
		authorizedUserId: number \| undefined;
		apiPort: number;
		workerTimeoutMs: number;
		copilotModel: string;
		readonly telegramEnabled: boolean;
		readonly selfEditEnabled: boolean;
		};
		/** Persist the current model choice to ~/.max/.env */
		export declare function persistModel(model: string): void;
		//# sourceMappingURL=config.d.ts.map

-1

dist/config.d.ts.map

{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA0CA,eAAO,MAAM,MAAM;;;;;kBAKG,MAAM;8BAMH,OAAO;8BAGP,OAAO;CAG/B,CAAC;AAEF,sDAAsD;AACtD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAmBhD"}

-1

dist/config.js.map

{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAErD,uDAAuD;AACvD,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC5B,OAAO,EAAE,CAAC,CAAC,sCAAsC;AAEjD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAE5C,MAAM,YAAY,GAAG,GAAG,CAAC,kBAAkB;IACzC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,CAAC;IACtC,CAAC,CAAC,SAAS,CAAC;AACd,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AAExD,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,IAAI,KAAK,CAAC,wDAAwD,GAAG,CAAC,kBAAkB,GAAG,CAAC,CAAC;AACrG,CAAC;AACD,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;IACrE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,yBAAyB,GAAG,OAAO,CAAC,CAAC,aAAa;AACxD,MAAM,mBAAmB,GAAG,GAAG,CAAC,cAAc;IAC5C,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;IAC5B,CAAC,CAAC,yBAAyB,CAAC;AAE9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;IACvE,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,CAAC,cAAc,GAAG,CAAC,CAAC;AAClG,CAAC;AAED,IAAI,aAAa,GAAG,GAAG,CAAC,aAAa,IAAI,mBAAmB,CAAC;AAE7D,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;IACxC,gBAAgB,EAAE,YAAY;IAC9B,OAAO,EAAE,UAAU;IACnB,eAAe,EAAE,mBAAmB;IACpC,IAAI,YAAY;QACd,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,YAAY,CAAC,KAAa;QAC5B,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,IAAI,eAAe;QACjB,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC;IACxE,CAAC;IACD,IAAI,eAAe;QACjB,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC;IAC3C,CAAC;CACF,CAAC;AAEF,sDAAsD;AACtD,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,aAAa,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACtC,KAAK,GAAG,IAAI,CAAC;gBACb,OAAO,iBAAiB,KAAK,EAAE,CAAC;YAClC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;QACnD,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;QACjC,aAAa,CAAC,QAAQ,EAAE,iBAAiB,KAAK,IAAI,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}

-13

dist/copilot/classifier.d.ts

		import type { CopilotClient } from "@github/copilot-sdk";
		/**
		* Classify a user prompt and return the model ID to use.
		* Validates the target model against available models.
		* Returns the current model on any failure (no disruption).
		*/
		export declare function classifyAndRoute(client: CopilotClient, prompt: string): Promise<{
		model: string;
		tier: string;
		}>;
		/** Tear down the classifier session (e.g., on client reset). */
		export declare function resetClassifier(): void;
		//# sourceMappingURL=classifier.d.ts.map

-1

dist/copilot/classifier.d.ts.map

{"version":3,"file":"classifier.d.ts","sourceRoot":"","sources":["../../src/copilot/classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AA4GzE;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA8B1C;AAED,gEAAgE;AAChE,wBAAgB,eAAe,IAAI,IAAI,CAMtC"}

-1

dist/copilot/classifier.js.map

-6

dist/copilot/client.d.ts

		import { CopilotClient } from "@github/copilot-sdk";
		export declare function getClient(): Promise<CopilotClient>;
		/** Tear down the existing client and create a fresh one. */
		export declare function resetClient(): Promise<CopilotClient>;
		export declare function stopClient(): Promise<void>;
		//# sourceMappingURL=client.d.ts.map

-1

dist/copilot/client.d.ts.map

{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/copilot/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIpD,wBAAsB,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,CASxD;AAED,4DAA4D;AAC5D,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,CAM1D;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAKhD"}

-1

dist/copilot/client.js.map

{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/copilot/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,IAAI,MAAiC,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,aAAa,CAAC;YACzB,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACxD,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

-7

dist/copilot/mcp-config.d.ts

		import type { MCPServerConfig } from "@github/copilot-sdk";
		/**
		* Load MCP server configs from ~/.copilot/mcp-config.json.
		* Returns an empty record if the file doesn't exist or is invalid.
		*/
		export declare function loadMcpConfig(): Record<string, MCPServerConfig>;
		//# sourceMappingURL=mcp-config.d.ts.map

-1

dist/copilot/mcp-config.d.ts.map

{"version":3,"file":"mcp-config.d.ts","sourceRoot":"","sources":["../../src/copilot/mcp-config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAY/D"}

-1

dist/copilot/mcp-config.js.map

{"version":3,"file":"mcp-config.js","sourceRoot":"","sources":["../../src/copilot/mcp-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAG7B;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC,UAA6C,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

-28

dist/copilot/orchestrator.d.ts

		import { type CopilotClient } from "@github/copilot-sdk";
		import { type WorkerInfo } from "./tools.js";
		export type MessageSource = {
		type: "telegram";
		chatId: number;
		messageId: number;
		} \| {
		type: "tui";
		connectionId: string;
		} \| {
		type: "background";
		};
		export type MessageCallback = (text: string, done: boolean) => void;
		type LogFn = (direction: "in" \| "out", source: string, text: string) => void;
		export declare function setMessageLogger(fn: LogFn): void;
		type ProactiveNotifyFn = (text: string, channel?: "telegram" \| "tui") => void;
		export declare function setProactiveNotify(fn: ProactiveNotifyFn): void;
		/** Get the channel that originated the message currently being processed. */
		export declare function getCurrentSourceChannel(): "telegram" \| "tui" \| undefined;
		/** Feed a background worker result into the orchestrator as a new turn. */
		export declare function feedBackgroundResult(workerName: string, result: string): void;
		export declare function initOrchestrator(client: CopilotClient): Promise<void>;
		export declare function sendToOrchestrator(prompt: string, source: MessageSource, callback: MessageCallback): Promise<void>;
		/** Cancel the in-flight message and drain the queue. */
		export declare function cancelCurrentMessage(): Promise<boolean>;
		export declare function getWorkers(): Map<string, WorkerInfo>;
		export {};
		//# sourceMappingURL=orchestrator.d.ts.map

-1

dist/copilot/orchestrator.d.ts.map

{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/copilot/orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,aAAa,EAAuB,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAe1D,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;AAEpE,KAAK,KAAK,GAAG,CAAC,SAAS,EAAE,IAAI,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAG7E,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,KAAK,GAAG,IAAI,CAEhD;AAGD,KAAK,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,KAAK,KAAK,IAAI,CAAC;AAG9E,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,iBAAiB,GAAG,IAAI,CAE9D;AAyBD,6EAA6E;AAC7E,wBAAgB,uBAAuB,IAAI,UAAU,GAAG,KAAK,GAAG,SAAS,CAExE;AAaD,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAa7E;AAoID,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAe3E;AAyED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,IAAI,CAAC,CAyDf;AAED,wDAAwD;AACxD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAoB7D;AAED,wBAAgB,UAAU,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAEpD"}

-1

dist/copilot/orchestrator.js.map

-14

dist/copilot/skills.d.ts

		/** Returns all skill directories that exist on disk. */
		export declare function getSkillDirectories(): string[];
		export interface SkillInfo {
		slug: string;
		name: string;
		description: string;
		directory: string;
		source: "bundled" \| "local" \| "global";
		}
		/** Scan all skill directories and return metadata for each skill found. */
		export declare function listSkills(): SkillInfo[];
		/** Create a new skill in the local skills directory. */
		export declare function createSkill(slug: string, name: string, description: string, instructions: string): string;
		//# sourceMappingURL=skills.d.ts.map

-1

dist/copilot/skills.d.ts.map

{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/copilot/skills.ts"],"names":[],"mappings":"AAoBA,wDAAwD;AACxD,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAM9C;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;CACxC;AAED,2EAA2E;AAC3E,wBAAgB,UAAU,IAAI,SAAS,EAAE,CA6CxC;AAED,wDAAwD;AACxD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CA2BzG"}

-1

dist/copilot/skills.js.map

{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/copilot/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACrF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,mDAAmD;AACnD,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAEpC,qCAAqC;AACrC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAE/D,6DAA6D;AAC7D,MAAM,kBAAkB,GAAG,IAAI,CAC7B,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,IAAI,EACJ,QAAQ,CACT,CAAC;AAEF,wDAAwD;AACxD,MAAM,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,UAAU,CAAC,kBAAkB,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClE,IAAI,UAAU,CAAC,gBAAgB,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,iBAAiB,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAUD,2EAA2E;AAC3E,MAAM,UAAU,UAAU;IACxB,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI;QAC1B,CAAC,kBAAkB,EAAE,SAAS,CAAU;QACxC,CAAC,gBAAgB,EAAE,OAAO,CAAU;QACpC,CAAC,iBAAiB,EAAE,QAAQ,CAAU;KACvC,EAAE,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAE/B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAS;YAEnC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC/C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACxD,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,KAAK;oBACX,IAAI,EAAE,IAAI,IAAI,KAAK;oBACnB,WAAW,EAAE,WAAW,IAAI,kBAAkB;oBAC9C,SAAS,EAAE,QAAQ;oBACnB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,KAAK;oBACX,IAAI,EAAE,KAAK;oBACX,WAAW,EAAE,2BAA2B;oBACxC,SAAS,EAAE,QAAQ;oBACnB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,WAAmB,EAAE,YAAoB;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC9C,+BAA+B;IAC/B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,iBAAiB,IAAI,8DAA8D,CAAC;IAC7F,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,UAAU,IAAI,uBAAuB,QAAQ,wCAAwC,CAAC;IAC/F,CAAC;IAED,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzC,aAAa,CACX,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAC3D,CAAC;IAEF,MAAM,OAAO,GAAG;QACV,IAAI;eACG,WAAW;;;EAGxB,YAAY;CACb,CAAC;IACA,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IAEnD,OAAO,UAAU,IAAI,gBAAgB,QAAQ,8CAA8C,CAAC;AAC9F,CAAC;AAED,mDAAmD;AACnD,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAEjD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,WAAW,GAAG,EAAE,CAAC;IAErB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,CAAC;YAAE,SAAS;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,GAAG,KAAK,MAAM;YAAE,IAAI,GAAG,KAAK,CAAC;QACjC,IAAI,GAAG,KAAK,aAAa;YAAE,WAAW,GAAG,KAAK,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC/B,CAAC"}

-4

dist/copilot/system-message.d.ts

		export declare function getOrchestratorSystemMessage(memorySummary?: string, opts?: {
		selfEditEnabled?: boolean;
		}): string;
		//# sourceMappingURL=system-message.d.ts.map

-1

dist/copilot/system-message.d.ts.map

{"version":3,"file":"system-message.d.ts","sourceRoot":"","sources":["../../src/copilot/system-message.ts"],"names":[],"mappings":"AAAA,wBAAgB,4BAA4B,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAgIjH"}

-1

dist/copilot/system-message.js.map

{"version":3,"file":"system-message.js","sourceRoot":"","sources":["../../src/copilot/system-message.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,4BAA4B,CAAC,aAAsB,EAAE,IAAoC;IACvG,MAAM,WAAW,GAAG,aAAa;QAC/B,CAAC,CAAC,wGAAwG,aAAa,IAAI;QAC3H,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,aAAa,GAAG,IAAI,EAAE,eAAe;QACzC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;;;;;;;;;CAWL,CAAC;IAEA,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAE5G,OAAO,2FAA2F,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyGxG,aAAa,GAAG,WAAW,EAAE,CAAC;AAChC,CAAC"}

-19

dist/copilot/tools.d.ts

		import { type CopilotClient, type CopilotSession, type Tool } from "@github/copilot-sdk";
		export interface WorkerInfo {
		name: string;
		session: CopilotSession;
		workingDir: string;
		status: "idle" \| "running" \| "error";
		lastOutput?: string;
		/** Timestamp (ms) when the worker started its current task. */
		startedAt?: number;
		/** Channel that created this worker — completions route back here. */
		originChannel?: "telegram" \| "tui";
		}
		export interface ToolDeps {
		client: CopilotClient;
		workers: Map<string, WorkerInfo>;
		onWorkerComplete: (name: string, result: string) => void;
		}
		export declare function createTools(deps: ToolDeps): Tool<any>[];
		//# sourceMappingURL=tools.d.ts.map

-1

dist/copilot/tools.d.ts.map

{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/copilot/tools.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,KAAK,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAiCjH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,aAAa,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;CACpC;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACjC,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CA+cvD"}

-1

dist/copilot/tools.js.map

-3

dist/daemon.d.ts

		/** Restart the daemon by spawning a new process and exiting. */
		export declare function restartDaemon(): Promise<void>;
		//# sourceMappingURL=daemon.d.ts.map

-1

dist/daemon.d.ts.map

{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AA+HA,gEAAgE;AAChE,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAiCnD"}

-1

dist/daemon.js.map

-17

dist/paths.d.ts

		/** Base directory for all Max user data: ~/.max */
		export declare const MAX_HOME: string;
		/** Path to the SQLite database */
		export declare const DB_PATH: string;
		/** Path to the user .env file */
		export declare const ENV_PATH: string;
		/** Path to user-local skills */
		export declare const SKILLS_DIR: string;
		/** Path to Max's isolated session state (keeps CLI history clean) */
		export declare const SESSIONS_DIR: string;
		/** Path to TUI readline history */
		export declare const HISTORY_PATH: string;
		/** Path to the API bearer token file */
		export declare const API_TOKEN_PATH: string;
		/** Ensure ~/.max/ exists */
		export declare function ensureMaxHome(): void;
		//# sourceMappingURL=paths.d.ts.map

-1

dist/paths.d.ts.map

{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAIA,mDAAmD;AACnD,eAAO,MAAM,QAAQ,QAA0B,CAAC;AAEhD,kCAAkC;AAClC,eAAO,MAAM,OAAO,QAA2B,CAAC;AAEhD,iCAAiC;AACjC,eAAO,MAAM,QAAQ,QAAyB,CAAC;AAE/C,gCAAgC;AAChC,eAAO,MAAM,UAAU,QAA2B,CAAC;AAEnD,qEAAqE;AACrE,eAAO,MAAM,YAAY,QAA6B,CAAC;AAEvD,mCAAmC;AACnC,eAAO,MAAM,YAAY,QAAgC,CAAC;AAE1D,wCAAwC;AACxC,eAAO,MAAM,cAAc,QAA8B,CAAC;AAE1D,4BAA4B;AAC5B,wBAAgB,aAAa,IAAI,IAAI,CAEpC"}

-1

dist/paths.js.map

{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;AAEhD,kCAAkC;AAClC,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAEhD,iCAAiC;AACjC,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAE/C,gCAAgC;AAChC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAEnD,qEAAqE;AACrE,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAEvD,mCAAmC;AACnC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAE1D,wCAAwC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAE1D,4BAA4B;AAC5B,MAAM,UAAU,aAAa;IAC3B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC"}

-2

dist/setup.d.ts

		export {};
		//# sourceMappingURL=setup.d.ts.map

-1

dist/setup.d.ts.map

{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":""}

-1

dist/setup.js.map

-26

dist/store/db.d.ts

		import Database from "better-sqlite3";
		export declare function getDb(): Database.Database;
		export declare function getState(key: string): string \| undefined;
		export declare function setState(key: string, value: string): void;
		/** Remove a key from persistent state. */
		export declare function deleteState(key: string): void;
		/** Log a conversation turn (user, assistant, or system). */
		export declare function logConversation(role: "user" \| "assistant" \| "system", content: string, source: string): void;
		/** Get recent conversation history formatted for injection into system message. */
		export declare function getRecentConversation(limit?: number): string;
		/** Add a memory to long-term storage. */
		export declare function addMemory(category: "preference" \| "fact" \| "project" \| "person" \| "routine", content: string, source?: "user" \| "auto"): number;
		/** Search memories by keyword and/or category. */
		export declare function searchMemories(keyword?: string, category?: string, limit?: number): {
		id: number;
		category: string;
		content: string;
		source: string;
		created_at: string;
		}[];
		/** Remove a memory by ID. */
		export declare function removeMemory(id: number): boolean;
		/** Get a compact summary of all memories for injection into system message. */
		export declare function getMemorySummary(): string;
		export declare function closeDb(): void;
		//# sourceMappingURL=db.d.ts.map

-1

dist/store/db.d.ts.map

{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/store/db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAMtC,wBAAgB,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAiEzC;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIxD;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAGzD;AAED,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAG7C;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ5G;AAED,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,KAAK,SAAK,GAAG,MAAM,CAmBxD;AAED,yCAAyC;AACzC,wBAAgB,SAAS,CACvB,QAAQ,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,EAClE,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,GAAG,MAAe,GAC/B,MAAM,CAMR;AAED,kDAAkD;AAClD,wBAAgB,cAAc,CAC5B,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,KAAK,SAAK,GACT;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,CA4BzF;AAED,6BAA6B;AAC7B,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAIhD;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,IAAI,MAAM,CAqBzC;AAED,wBAAgB,OAAO,IAAI,IAAI,CAK9B"}

-1

dist/store/db.js.map

-9

dist/telegram/bot.d.ts

		import { Bot } from "grammy";
		export declare function createBot(): Bot;
		export declare function startBot(): Promise<void>;
		export declare function stopBot(): Promise<void>;
		/** Send an unsolicited message to the authorized user (for background task completions). */
		export declare function sendProactiveMessage(text: string): Promise<void>;
		/** Send a photo to the authorized user. Accepts a file path or URL. */
		export declare function sendPhoto(photo: string, caption?: string): Promise<void>;
		//# sourceMappingURL=bot.d.ts.map

-1

dist/telegram/bot.d.ts.map

{"version":3,"file":"bot.d.ts","sourceRoot":"","sources":["../../src/telegram/bot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAgB,MAAM,QAAQ,CAAC;AAU3C,wBAAgB,SAAS,IAAI,GAAG,CAiK/B;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAM9C;AAED,wBAAsB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAI7C;AAED,4FAA4F;AAC5F,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBtE;AAED,uEAAuE;AACvE,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW9E"}

-1

dist/telegram/bot.js.map

-11

dist/telegram/formatter.d.ts

		/**
		* Split a long message into chunks that fit within Telegram's message limit.
		* Tries to split at newlines, then spaces, falling back to hard cuts.
		*/
		export declare function chunkMessage(text: string): string[];
		/**
		* Convert standard markdown from the AI into Telegram MarkdownV2.
		* Handles bold, italic, code blocks, headers, tables, and horizontal rules.
		*/
		export declare function toTelegramMarkdown(text: string): string;
		//# sourceMappingURL=formatter.d.ts.map

-1

dist/telegram/formatter.d.ts.map

{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../src/telegram/formatter.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA2BnD;AA+BD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuDvD"}

-1

dist/telegram/formatter.js.map

-2

dist/tui/index.d.ts

		export {};
		//# sourceMappingURL=index.d.ts.map

-1

dist/tui/index.d.ts.map

{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tui/index.ts"],"names":[],"mappings":""}

-1

dist/tui/index.js.map

-17

dist/update.d.ts

		/** Fetch the latest published version from npm. Returns null on failure. */
		export declare function getLatestVersion(): Promise<string \| null>;
		export interface UpdateCheckResult {
		current: string;
		latest: string \| null;
		updateAvailable: boolean;
		/** false when the npm registry could not be reached */
		checkSucceeded: boolean;
		}
		/** Check whether a newer version is available on npm. */
		export declare function checkForUpdate(): Promise<UpdateCheckResult>;
		/** Run `npm install -g heymax@latest` and return success/failure. */
		export declare function performUpdate(): Promise<{
		ok: boolean;
		output: string;
		}>;
		//# sourceMappingURL=update.d.ts.map

-1

dist/update.d.ts.map

{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AA0BA,4EAA4E;AAC5E,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAO/D;AAYD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,uDAAuD;IACvD,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,yDAAyD;AACzD,wBAAsB,cAAc,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASjE;AAED,qEAAqE;AACrE,wBAAsB,aAAa,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAY9E"}

-1

dist/update.js.map

{"version":3,"file":"update.js","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACrF,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,SAAS,SAAS,CAAC,GAAW,EAAE,SAAiB;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACrE,IAAI,GAAG;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,GAAG,IAAI,CAAC;IACtC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,GAAG,IAAI,CAAC;IACtC,OAAO,IAAI,GAAG,IAAI,CAAC;AACrB,CAAC;AAUD,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACxC,OAAO;QACL,OAAO;QACP,MAAM;QACN,eAAe,EAAE,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;QAC5D,cAAc,EAAE,MAAM,KAAK,IAAI;KAChC,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,8BAA8B,EAAE;YACtD,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,IAAI,eAAe,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACpC,CAAC;AACH,CAAC"}

-4

skills/slack/_meta.json

		{
		"slug": "slack",
		"version": "1.0.0"
		}

-342

skills/slack/SKILL.md

		---
		name: Slack
		description: Read and write Slack messages, channels, threads, and reactions using direct API calls. All data stays on the user's machine — no third-party services, no proxies, no data leaves localhost except to Slack's official API (slack.com) over HTTPS.
		---

		# Slack Skill

		Max can interact with Slack workspaces using direct `curl` calls to the Slack Web API. All communication goes directly from the user's machine to `https://slack.com/api/` over HTTPS — no intermediaries, no third-party services, no data stored beyond the conversation.

		## Security Model

		This skill is designed to never let data leave the user's machine except to Slack's official API.

		1. Token storage: The Slack token lives in `~/.max/.env` as `SLACK_BOT_TOKEN` (and optionally `SLACK_USER_TOKEN`). This file should be `chmod 600`.
		2. Direct API calls only: Every request is a `curl` to `https://slack.com/api/`. No proxies, no webhooks, no third-party endpoints.
		3. Never display or log the token: When showing commands to the user, always reference `$SLACK_BOT_TOKEN` — never expand it. Never include the token value in worker session prompts, logs, or memory.
		4. No persistent caching: Message content is never written to disk, databases, or memory storage. It exists only in the conversation context.
		5. Minimal scopes: Guide the user to grant only the scopes they need (see Setup).

		## Prerequisites

		The user needs a Slack Bot Token (starts with `xoxb-`) or a User Token (starts with `xoxp-`).

		Bot tokens are recommended for most operations. They're scoped, auditable, and can be revoked from the Slack admin panel without affecting the user's personal account.

		User tokens are required for `search.messages` and a few admin operations. Use them only when a bot token can't do the job.

		If neither token is configured, guide the user through setup.

		## Setup

		### Step 1: Create a Slack App

		1. Go to https://api.slack.com/apps and click "Create New App" → "From scratch"
		2. Name it (e.g., "Max Assistant") and select the workspace
		3. Under OAuth & Permissions, add these Bot Token Scopes:

		Minimum scopes for reading:
		- `channels:history` — read messages in public channels
		- `channels:read` — list and get info about public channels
		- `groups:history` — read messages in private channels the bot is in
		- `groups:read` — list private channels the bot is in
		- `im:history` — read direct messages with the bot
		- `users:read` — resolve user IDs to names

		Additional scopes for writing:
		- `chat:write` — send messages
		- `reactions:read` — read reactions
		- `reactions:write` — add reactions
		- `files:read` — access shared files
		- `files:write` — upload files

		If using a User Token (for search):
		- `search:read` — search messages and files

		4. Click "Install to Workspace" and authorize
		5. Copy the Bot Token (`xoxb-...`) from the OAuth page

		### Step 2: Store the Token

		Store the token in Max's environment file. Never use `echo` with the raw token — it would be saved in shell history.

		```bash
		# In a worker session — use ask_user to collect the token, then write it without exposing it:
		# 1. Ask the user for their token via ask_user
		# 2. Write it to the env file like this (TOKEN_VALUE comes from ask_user, not typed in a shell):
		printf 'SLACK_BOT_TOKEN=%s\n' "$TOKEN_VALUE" >> ~/.max/.env
		chmod 600 ~/.max/.env
		```

		If the user also needs search, do the same for the user token:
		```bash
		printf 'SLACK_USER_TOKEN=%s\n' "$TOKEN_VALUE" >> ~/.max/.env
		```

		Preferred approach: Use `ask_user` to collect the token value, then write it to `~/.max/.env` programmatically via `printf` and a variable — never embed the literal token in a shell command string.

		After adding the token, Max must restart to pick up the new env var. Use the `restart_max` tool.

		### Step 3: Verify

		```bash
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" https://slack.com/api/auth.test \| python3 -m json.tool
		```

		This should return `"ok": true` with the bot's user ID and team info.

		### Step 4: Invite the Bot

		The bot must be invited to channels it needs to access:
		- In Slack, go to the channel → type `/invite @YourBotName`
		- Or use the API: the bot can join public channels with `conversations.join`

		## Important: Reading the Token

		The token is stored in `~/.max/.env`. To use it in curl commands within a worker session, source the env file first:

		```bash
		source ~/.max/.env
		```

		Then use `$SLACK_BOT_TOKEN` or `$SLACK_USER_TOKEN` in subsequent commands. Do this once at the start of any worker session that needs Slack access.

		## API Reference

		All commands use this pattern:

		```bash
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		"https://slack.com/api/{method}?{params}" \| python3 -m json.tool
		```

		For POST requests with a body:

		```bash
		curl -s -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		-H "Content-Type: application/json" \
		-d '{"channel":"C1234567890","text":"Hello"}' \
		https://slack.com/api/chat.postMessage \| python3 -m json.tool
		```

		Always pipe through `python3 -m json.tool` for readable output. If the output is very large, pipe through `python3 -c "import sys,json; d=json.load(sys.stdin); print(json.dumps(d, indent=2)[:2000])"` to truncate.

		### Verify Auth

		```bash
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		https://slack.com/api/auth.test \| python3 -m json.tool
		```

		### List Channels

		```bash
		# Public channels (paginated — use cursor for next page)
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		"https://slack.com/api/conversations.list?types=public_channel&limit=100&exclude_archived=true" \
		\| python3 -m json.tool

		# Include private channels the bot is in
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		"https://slack.com/api/conversations.list?types=public_channel,private_channel&limit=100" \
		\| python3 -m json.tool

		# Pagination: use response_metadata.next_cursor from the response
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		"https://slack.com/api/conversations.list?types=public_channel&limit=100&cursor=NEXT_CURSOR_VALUE" \
		\| python3 -m json.tool
		```

		### Get Channel Info

		```bash
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		"https://slack.com/api/conversations.info?channel=C1234567890" \
		\| python3 -m json.tool
		```

		### Read Messages (Channel History)

		```bash
		# Latest 20 messages in a channel
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		"https://slack.com/api/conversations.history?channel=C1234567890&limit=20" \
		\| python3 -m json.tool

		# Messages after a specific timestamp
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		"https://slack.com/api/conversations.history?channel=C1234567890&oldest=1700000000.000000&limit=50" \
		\| python3 -m json.tool

		# Messages before a specific timestamp
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		"https://slack.com/api/conversations.history?channel=C1234567890&latest=1700000000.000000&limit=50" \
		\| python3 -m json.tool
		```

		Timestamps in Slack are Unix epoch with microseconds (e.g., `1700000000.000000`). Message `ts` values double as unique IDs.

		### Read Thread Replies

		```bash
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		"https://slack.com/api/conversations.replies?channel=C1234567890&ts=1700000000.000000&limit=50" \
		\| python3 -m json.tool
		```

		The `ts` parameter is the timestamp of the parent message (thread root).

		### Send a Message

		```bash
		curl -s -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		-H "Content-Type: application/json" \
		-d '{"channel":"C1234567890","text":"Hello from Max!"}' \
		https://slack.com/api/chat.postMessage \| python3 -m json.tool
		```

		### Reply to a Thread

		```bash
		curl -s -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		-H "Content-Type: application/json" \
		-d '{"channel":"C1234567890","thread_ts":"1700000000.000000","text":"Thread reply from Max"}' \
		https://slack.com/api/chat.postMessage \| python3 -m json.tool
		```

		### Update a Message

		```bash
		curl -s -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		-H "Content-Type: application/json" \
		-d '{"channel":"C1234567890","ts":"1700000000.000000","text":"Updated message text"}' \
		https://slack.com/api/chat.update \| python3 -m json.tool
		```

		### Delete a Message

		```bash
		curl -s -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		-H "Content-Type: application/json" \
		-d '{"channel":"C1234567890","ts":"1700000000.000000"}' \
		https://slack.com/api/chat.delete \| python3 -m json.tool
		```

		### Add a Reaction

		```bash
		curl -s -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		-H "Content-Type: application/json" \
		-d '{"channel":"C1234567890","timestamp":"1700000000.000000","name":"thumbsup"}' \
		https://slack.com/api/reactions.add \| python3 -m json.tool
		```

		Emoji names are without colons (e.g., `thumbsup` not `:thumbsup:`).

		### Search Messages (requires User Token)

		```bash
		curl -s -H "Authorization: Bearer $SLACK_USER_TOKEN" \
		"https://slack.com/api/search.messages?query=deployment%20failed&count=10" \
		\| python3 -m json.tool
		```

		Search requires a User Token (`xoxp-`). Bot tokens cannot search. If the user hasn't configured `SLACK_USER_TOKEN`, tell them search requires it and guide them through adding the `search:read` scope to their app's User Token Scopes.

		### Look Up Users

		```bash
		# List workspace members
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		"https://slack.com/api/users.list?limit=100" \
		\| python3 -m json.tool

		# Get a specific user's profile
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		"https://slack.com/api/users.info?user=U1234567890" \
		\| python3 -m json.tool

		# Look up user by email
		curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		"https://slack.com/api/users.lookupByEmail?email=user@example.com" \
		\| python3 -m json.tool
		```

		### Upload a File

		```bash
		# Upload a file to a channel
		curl -s -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		-F "channels=C1234567890" \
		-F "file=@/path/to/file.txt" \
		-F "title=My File" \
		-F "initial_comment=Here's the file you requested" \
		https://slack.com/api/files.upload \| python3 -m json.tool
		```

		### Join a Public Channel

		```bash
		curl -s -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		-H "Content-Type: application/json" \
		-d '{"channel":"C1234567890"}' \
		https://slack.com/api/conversations.join \| python3 -m json.tool
		```

		### Send a Direct Message

		To DM a user, first open a DM channel, then send to it:

		```bash
		# Open a DM channel with a user
		curl -s -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		-H "Content-Type: application/json" \
		-d '{"users":"U1234567890"}' \
		https://slack.com/api/conversations.open \| python3 -m json.tool

		# Then send to the returned channel ID
		curl -s -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
		-H "Content-Type: application/json" \
		-d '{"channel":"D_RETURNED_ID","text":"Hey!"}' \
		https://slack.com/api/chat.postMessage \| python3 -m json.tool
		```

		## Error Handling

		Check HTTP status first, then the JSON body. Most successful Slack API responses return HTTP 200 with `"ok": true`, but errors can surface at either layer.

		### HTTP-level errors

		- 429 Too Many Requests: Rate limited. Read the `Retry-After` header (seconds) and wait before retrying. Do NOT retry immediately.
		- 5xx: Slack server error. Wait a few seconds and retry once. If it persists, report the failure.
		- Non-200/non-429: Network or transport failure. Check connectivity.

		### JSON-level errors (HTTP 200, `"ok": false`)

		Check the `"error"` field:

		- `not_authed` / `invalid_auth` — token is missing or invalid. Verify with `auth.test`.
		- `channel_not_found` — wrong channel ID or bot isn't in the channel. List channels to find the right ID.
		- `not_in_channel` — bot needs to be invited. Use `/invite @BotName` in Slack or `conversations.join`.
		- `missing_scope` — token lacks a required permission. Tell the user which scope to add at https://api.slack.com/apps.
		- `ratelimited` — also returned as a JSON error sometimes. Check both the HTTP status and this field.
		- `account_inactive` / `token_revoked` — token was revoked. User needs to reissue it.

		## Rate Limiting

		Slack enforces rate limits per method (typically 1-50+ requests per minute depending on the tier). If you get `ratelimited`:

		1. Read the `Retry-After` response header (seconds to wait)
		2. Wait that duration before retrying
		3. Batch requests where possible (e.g., fetch 100 messages at once instead of 10×10)

		## Tips

		- Channel IDs vs names: Always use channel IDs (e.g., `C1234567890`), not `#channel-name`. Get IDs from `conversations.list`.
		- User IDs vs names: Messages contain user IDs like `U1234567890`. Resolve to names with `users.info`.
		- Timestamps are IDs: A message's `ts` field is both its timestamp and unique identifier. Use it for threading, updating, and deleting.
		- Pagination: Most list endpoints return a `response_metadata.next_cursor`. Keep fetching with `&cursor=VALUE` until the cursor is empty.
		- Rich formatting: Slack uses mrkdwn (their Markdown variant). `bold`, `_italic_`, `~strikethrough~`, `` `code` ``, `> quote`, `<https://url\|link text>`.
		- Mentioning users: Use `<@U1234567890>` in message text to @-mention someone.
		- Mentioning channels: Use `<#C1234567890>` to link to a channel.
		- Large payloads: For messages over 4000 chars, consider uploading as a snippet via `files.upload` instead.

		@@ -99,7 +99,8 @@ export function getOrchestratorSystemMessage(memorySummary, opts) {
		Learning workflow: When the user asks you to do something you don't have a skill for:
		1. Search for an existing skill first: Create a worker session and run \`npx skills find <query>\` to search the open-source skills ecosystem. This is your primary way to learn new things — thousands of community-built skills exist.
		2. Present what you found: Tell the user the skill name, what it does, and where it comes from. Link to the skills.sh page so they can review it.
		3. ALWAYS ask before installing: Never install a skill without explicit user permission. Say something like "Want me to install it?" and wait for a yes. Only then run \`npx skills add <owner/repo@skill> -g\` in a worker.
		4. Flag security risks: Before recommending a skill, consider what it does. If a skill requests broad system access, runs arbitrary commands, accesses sensitive data (credentials, keys, personal files), or comes from an unknown/unverified source — warn the user. Say something like "⚠️ Heads up — this skill has access to X, which could be a security risk. Want to proceed?"
		5. Build your own only as a last resort: If no community skill exists, THEN research the task (run \`which\`, \`--help\`, check installed tools), figure it out, and use \`learn_skill\` to save a SKILL.md for next time.
		1. Search skills.sh first: Use the find-skills skill to search https://skills.sh for existing community skills. This is your primary way to learn new things — thousands of community-built skills exist.
		2. Present what you found: Tell the user the skill name, what it does, where it comes from, and its security audit status. Always show security data — never omit it.
		3. ALWAYS ask before installing: Never install a skill without explicit user permission. Say something like "Want me to install it?" and wait for a yes.
		4. Install locally only: Fetch the SKILL.md from the skill's GitHub repo and use the \`learn_skill\` tool to save it to \`~/.max/skills/\`. Never install skills globally — no \`-g\` flag, no writing to \`~/.agents/skills/\` or any other global directory.
		5. Flag security risks: Before recommending a skill, consider what it does. If a skill requests broad system access, runs arbitrary commands, accesses sensitive data (credentials, keys, personal files), or comes from an unknown/unverified source — warn the user. Say something like "⚠️ Heads up — this skill has access to X, which could be a security risk. Want to proceed?"
		6. Build your own only as a last resort: If no community skill exists, THEN research the task (run \`which\`, \`--help\`, check installed tools), figure it out, and use \`learn_skill\` to save a SKILL.md for next time.

		@@ -111,3 +112,3 @@ Always prefer finding an existing skill over building one from scratch. The skills ecosystem at https://skills.sh has skills for common tasks like email, calendars, social media, smart home, deployment, and much more.
		1. Adapt to the channel: On Telegram, be brief — the user is likely on their phone. On TUI, you can be more detailed.
		2. Skill-first mindset: When asked to do something you haven't done before — social media, smart home, email, calendar, deployments, APIs, anything — your FIRST instinct should be to search for an existing skill with \`npx skills find <query>\`. Don't try to figure it out from scratch when someone may have already built a skill for it.
		2. Skill-first mindset: When asked to do something you haven't done before — social media, smart home, email, calendar, deployments, APIs, anything — your FIRST instinct should be to search skills.sh for an existing skill. Don't try to figure it out from scratch when someone may have already built a skill for it.
		3. For coding tasks, always create a named worker session with an \`initial_prompt\`. Don't try to write code yourself. Don't plan or research first — put all instructions in the initial prompt and let the worker figure it out.
		@@ -114,0 +115,0 @@ 4. Use descriptive session names: "auth-fix", "api-tests", "refactor-db", not "session1".

heymax - npm Package Compare versions

New alerts

Fixed alerts

Improved metrics

Worsened metrics