@openhands/extensions 0.1.0 → 0.2.0

package/skills/code-simplifier/references/efficiency-review.md

@@ -0,0 +1,81 @@
+# Efficiency Review
+
+A detailed reference for evaluating performance, resource usage, and algorithmic efficiency in recently modified code. Focus on real, measurable inefficiencies - not premature optimization or micro-benchmarks that do not matter at the project's scale.
+
+## Core Principles
+
+1. **Pragmatic Optimization**: Fix inefficiencies that affect real users or real workloads. Do not optimize code paths that execute once at startup or handle trivial data volumes.
+2. **Algorithmic Awareness**: Prefer better algorithms and data structures over micro-optimizations. An O(n²) loop over a growing dataset is a real problem; shaving nanoseconds off an O(n) loop is not.
+3. **Measure Before Prescribing**: When recommending a change, explain *why* it matters at the expected scale. Cite the data size, call frequency, or latency target that makes the optimization worthwhile.
+4. **Preserve Functionality**: Efficiency improvements must not change behavior. All outputs and side effects remain identical.
+
+## What to Look For
+
+### Algorithmic Complexity
+
+- Nested loops over collections that grow with input size (O(n²) or worse)
+- Linear search where a hash/set lookup would suffice
+- Repeated sorting or filtering of the same data
+- Recursive algorithms without memoization on overlapping subproblems
+- Using arrays for membership checks instead of sets or maps
+
+### Unnecessary Work
+
+- Recomputing values inside loops that could be computed once outside
+- Performing I/O (file reads, network calls, DB queries) inside tight loops
+- Loading entire datasets into memory when streaming or pagination is available
+- Eagerly computing expensive results that may never be used (missing lazy evaluation)
+- Serializing/deserializing data multiple times in the same pipeline
+
+### Resource Usage
+
+- Unbounded memory growth (appending to lists without limits, caching without eviction)
+- File handles, connections, or streams opened but not closed (missing `finally`/`with`/`using`/`defer`)
+- Large object allocations in hot paths that could reuse buffers
+- Spawning threads or processes without pooling or concurrency limits
+
+### Data Structure Choices
+
+- Using a list where a set or map provides O(1) lookups
+- Storing data in formats that require repeated parsing (e.g., stringified JSON accessed multiple times)
+- Using mutable shared state where an immutable snapshot or copy-on-write pattern is safer and no slower
+- Choosing a general-purpose collection when a specialized one (deque, priority queue, sorted set) better fits the access pattern
+
+### Database and I/O Patterns
+
+- N+1 query patterns (fetching related records one-by-one inside a loop)
+- Missing indices on frequently queried columns (when schema is visible)
+- Fetching columns or rows not needed by the caller
+- Synchronous blocking calls in async contexts
+
+## Review Checklist
+
+- [ ] Identify any loops with O(n²) or worse complexity on non-trivial input sizes
+- [ ] Check for repeated computation that could be hoisted or cached
+- [ ] Verify I/O operations are batched and not performed in tight loops
+- [ ] Confirm resources (connections, handles, streams) are properly closed
+- [ ] Review data structure choices for appropriate access-pattern fit
+- [ ] Look for N+1 query patterns or unnecessary full-table scans
+- [ ] Validate that any suggested optimization is justified by expected scale
+
+## Output Format
+
+For each efficiency finding, provide:
+
+```
+**[EFFICIENCY]** [file:line] - Brief description
+  Issue: [What is inefficient and at what scale it matters]
+  Suggestion: [Concrete fix with expected complexity improvement]
+  Impact: HIGH (user-facing latency/cost) | MEDIUM (noticeable at scale) | LOW (minor, worth noting)
+```
+
+Impact guide:
+- **HIGH**: Causes user-visible latency, excessive memory usage, or cost at current or near-term scale.
+- **MEDIUM**: Becomes a problem as data or traffic grows; worth fixing proactively.
+- **LOW**: Minor inefficiency; mention if the fix is trivial, otherwise skip.
+
+When no efficiency concerns exist, state explicitly:
+
+```
+**[EFFICIENCY]** No significant performance or resource issues detected in the changed code.
+```

package/skills/datadog/.plugin/plugin.json

@@ -0,0 +1,19 @@
+{
+  "name": "datadog",
+  "version": "1.0.0",
+  "description": "Query and analyze Datadog logs, metrics, APM traces, and monitors using the Datadog API. Use when debugging production issues, monitoring application performance, or investigating alerts.",
+  "author": {
+    "name": "OpenHands",
+    "email": "contact@all-hands.dev"
+  },
+  "homepage": "https://github.com/OpenHands/extensions",
+  "repository": "https://github.com/OpenHands/extensions",
+  "license": "MIT",
+  "keywords": [
+    "datadog",
+    "monitoring",
+    "logs",
+    "metrics",
+    "apm"
+  ]
+}

package/skills/datadog/README.md

@@ -0,0 +1,100 @@
+# Datadog
+
+Query and analyze Datadog logs, metrics, APM traces, and monitors using the Datadog API. Use when debugging production issues, monitoring application performance, or investigating alerts.
+
+## Triggers
+
+This skill is activated by the following keywords:
+
+- `datadog`
+
+## Details
+
+# Datadog
+
+<IMPORTANT>
+Before performing any Datadog operations, first check if the required environment variables are set:
+
+```bash
+[ -n "$DD_API_KEY" ] && echo "DD_API_KEY is set" || echo "DD_API_KEY is NOT set"
+[ -n "$DD_APP_KEY" ] && echo "DD_APP_KEY is set" || echo "DD_APP_KEY is NOT set"
+[ -n "$DD_SITE" ] && echo "DD_SITE is set" || echo "DD_SITE is NOT set"
+```
+
+If any of these variables are missing, ask the user to provide them before proceeding:
+- **DD_API_KEY**: Datadog API key
+- **DD_APP_KEY**: Datadog Application key
+- **DD_SITE**: Datadog site (e.g., `datadoghq.com`, `datadoghq.eu`, `us3.datadoghq.com`)
+</IMPORTANT>
+
+## Authentication Headers
+
+```bash
+-H "DD-API-KEY: ${DD_API_KEY}" \
+-H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \
+-H "Content-Type: application/json"
+```
+
+## Query Logs
+
+```bash
+curl -s -X POST "https://api.${DD_SITE}/api/v2/logs/events/search" \
+  -H "DD-API-KEY: ${DD_API_KEY}" \
+  -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "filter": {
+      "query": "service:my-service status:error",
+      "from": "now-1h",
+      "to": "now"
+    },
+    "sort": "-timestamp",
+    "page": {"limit": 50}
+  }' | jq .
+```
+
+## Query Metrics
+
+```bash
+curl -s -G "https://api.${DD_SITE}/api/v1/query" \
+  -H "DD-API-KEY: ${DD_API_KEY}" \
+  -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \
+  --data-urlencode "query=avg:system.cpu.user{*}" \
+  --data-urlencode "from=$(date -d '1 hour ago' +%s)" \
+  --data-urlencode "to=$(date +%s)" | jq .
+```
+
+## Query APM Traces
+
+```bash
+curl -s -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
+  -H "DD-API-KEY: ${DD_API_KEY}" \
+  -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "filter": {
+      "query": "service:my-service",
+      "from": "now-1h",
+      "to": "now"
+    },
+    "sort": "-timestamp",
+    "page": {"limit": 25}
+  }' | jq .
+```
+
+## List Monitors
+
+```bash
+curl -s -G "https://api.${DD_SITE}/api/v1/monitor" \
+  -H "DD-API-KEY: ${DD_API_KEY}" \
+  -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" | jq .
+```
+
+## Documentation
+
+- [Logs API](https://docs.datadoghq.com/api/latest/logs/)
+- [Metrics API](https://docs.datadoghq.com/api/latest/metrics/)
+- [APM/Tracing API](https://docs.datadoghq.com/api/latest/tracing/)
+- [Monitors API](https://docs.datadoghq.com/api/latest/monitors/)
+- [Events API](https://docs.datadoghq.com/api/latest/events/)
+- [Dashboards API](https://docs.datadoghq.com/api/latest/dashboards/)

package/skills/datadog/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: datadog
+description: Query and analyze Datadog logs, metrics, APM traces, and monitors using the Datadog API. Use when debugging production issues, monitoring application performance, or investigating alerts.
+triggers:
+- datadog
+---
+
+# Datadog
+
+<IMPORTANT>
+Before performing any Datadog operations, first check if the required environment variables are set:
+
+```bash
+[ -n "$DD_API_KEY" ] && echo "DD_API_KEY is set" || echo "DD_API_KEY is NOT set"
+[ -n "$DD_APP_KEY" ] && echo "DD_APP_KEY is set" || echo "DD_APP_KEY is NOT set"
+[ -n "$DD_SITE" ] && echo "DD_SITE is set" || echo "DD_SITE is NOT set"
+```
+
+If any of these variables are missing, ask the user to provide them before proceeding:
+- **DD_API_KEY**: Datadog API key
+- **DD_APP_KEY**: Datadog Application key
+- **DD_SITE**: Datadog site (e.g., `datadoghq.com`, `datadoghq.eu`, `us3.datadoghq.com`)
+</IMPORTANT>
+
+## Authentication Headers
+
+```bash
+-H "DD-API-KEY: ${DD_API_KEY}" \
+-H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \
+-H "Content-Type: application/json"
+```
+
+## Query Logs
+
+```bash
+curl -s -X POST "https://api.${DD_SITE}/api/v2/logs/events/search" \
+  -H "DD-API-KEY: ${DD_API_KEY}" \
+  -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "filter": {
+      "query": "service:my-service status:error",
+      "from": "now-1h",
+      "to": "now"
+    },
+    "sort": "-timestamp",
+    "page": {"limit": 50}
+  }' | jq .
+```
+
+## Query Metrics
+
+```bash
+curl -s -G "https://api.${DD_SITE}/api/v1/query" \
+  -H "DD-API-KEY: ${DD_API_KEY}" \
+  -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \
+  --data-urlencode "query=avg:system.cpu.user{*}" \
+  --data-urlencode "from=$(date -d '1 hour ago' +%s)" \
+  --data-urlencode "to=$(date +%s)" | jq .
+```
+
+## Query APM Traces
+
+```bash
+curl -s -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
+  -H "DD-API-KEY: ${DD_API_KEY}" \
+  -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "filter": {
+      "query": "service:my-service",
+      "from": "now-1h",
+      "to": "now"
+    },
+    "sort": "-timestamp",
+    "page": {"limit": 25}
+  }' | jq .
+```
+
+## List Monitors
+
+```bash
+curl -s -G "https://api.${DD_SITE}/api/v1/monitor" \
+  -H "DD-API-KEY: ${DD_API_KEY}" \
+  -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" | jq .
+```
+
+## Documentation
+
+- [Logs API](https://docs.datadoghq.com/api/latest/logs/)
+- [Metrics API](https://docs.datadoghq.com/api/latest/metrics/)
+- [APM/Tracing API](https://docs.datadoghq.com/api/latest/tracing/)
+- [Monitors API](https://docs.datadoghq.com/api/latest/monitors/)
+- [Events API](https://docs.datadoghq.com/api/latest/events/)
+- [Dashboards API](https://docs.datadoghq.com/api/latest/dashboards/)

package/skills/deno/.plugin/plugin.json

@@ -0,0 +1,18 @@
+{
+  "name": "deno",
+  "version": "1.0.0",
+  "description": "Common project operations using Deno (tasks, run/test/lint/fmt, and dependency management).",
+  "author": {
+    "name": "OpenHands",
+    "email": "contact@all-hands.dev"
+  },
+  "homepage": "https://github.com/OpenHands/extensions",
+  "repository": "https://github.com/OpenHands/extensions",
+  "license": "MIT",
+  "keywords": [
+    "deno",
+    "typescript",
+    "javascript",
+    "runtime"
+  ]
+}

package/skills/deno/README.md

@@ -0,0 +1,5 @@
+# deno
+
+This skill documents common project operations using **Deno** (tasks, run/test/lint/fmt, and dependency management).
+
+See: [SKILL.md](./SKILL.md)

package/skills/deno/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: deno
+description: If the project uses deno, use this skill. Use this skill to initialize and work with Deno projects, add/remove dependencies (JSR and npm), run tasks and scripts with appropriate permissions, and use built-in tooling (fmt/lint/test).
+triggers:
+- deno
+- deno.json
+- deno.jsonc
+- deno.lock
+---
+
+# Deno
+
+Use Deno as the default runtime/tooling when the repo contains `deno.json`/`deno.jsonc`, uses `deno.lock`, or scripts/documentation reference `deno task`, `deno run`, `deno test`, etc.
+
+## Quick decision rules
+
+- Prefer `deno task <name>` if the repo defines tasks.
+- Use `deno add` / `deno remove` to manage dependencies (writes to config).
+- Be explicit about permissions for `deno run` / `deno test`.
+
+## Common operations
+
+### Initialize a new project
+
+```bash
+deno init
+```
+
+### Add dependencies (JSR and npm)
+
+```bash
+# JSR (recommended for Deno-first packages)
+deno add jsr:@std/path
+
+# npm packages are supported too
+deno add npm:react
+
+# multiple at once
+deno add jsr:@std/assert npm:chalk
+```
+
+### Remove dependencies
+
+```bash
+deno remove jsr:@std/path
+```
+
+### Run a script
+
+```bash
+# Minimal permissions: only what the program needs
+# Examples:
+#   --allow-net=api.example.com
+#   --allow-read=./data
+#   --allow-env=FOO,BAR
+
+deno run --allow-net --allow-read main.ts
+```
+
+### Run tasks
+
+```bash
+# list tasks
+deno task
+
+# run a task defined in deno.json/deno.jsonc
+deno task dev
+```
+
+### Formatting, linting, testing
+
+```bash
+deno fmt
+deno lint
+deno test
+
+# common permissioned test run
+deno test --allow-net --allow-read
+```
+
+### Install / run CLIs
+
+```bash
+# Run a JSR or npm package's CLI without installing globally
+deno x jsr:@std/http/file-server -p 8080
+
+# Install globally (requires choosing permissions at install time)
+# Prefer the smallest set of permissions; avoid blanket flags unless necessary.
+deno install -g -N -R jsr:@std/http/file-server -- -p 8080
+```
+
+## Notes / pitfalls
+
+- Deno is secure-by-default: missing permissions cause runtime errors; add the smallest set of `--allow-*` flags needed.
+- Dependency specifiers:
+  - `jsr:` for JSR registry packages
+  - `npm:` for npm packages
+  - URL imports are also supported (and cached)
+- Lockfile: `deno.lock` helps ensure reproducible dependency resolution.

package/skills/deno/references/README.md

@@ -0,0 +1,6 @@
+# References (deno)
+
+- https://docs.deno.com/runtime/reference/cli/
+- https://docs.deno.com/runtime/reference/cli/add/
+- https://docs.deno.com/runtime/reference/cli/run/
+- https://docs.deno.com/runtime/reference/cli/task/

package/skills/discord/.plugin/plugin.json

@@ -0,0 +1,18 @@
+{
+  "name": "discord",
+  "version": "1.0.0",
+  "description": "Build and automate Discord integrations (bots, webhooks, slash commands, and REST API workflows). Use when the user mentions Discord, a Discord server/guild, channels, webhooks, bot tokens, slash c...",
+  "author": {
+    "name": "OpenHands",
+    "email": "contact@all-hands.dev"
+  },
+  "homepage": "https://github.com/OpenHands/extensions",
+  "repository": "https://github.com/OpenHands/extensions",
+  "license": "MIT",
+  "keywords": [
+    "discord",
+    "bot",
+    "webhook",
+    "automation"
+  ]
+}

package/skills/discord/README.md

@@ -0,0 +1,31 @@
+# Discord
+
+Build and automate Discord integrations (bots, webhooks, slash commands, and REST API workflows). Use when the user mentions Discord, a Discord server/guild, channels, webhooks, bot tokens, slash commands/application commands, discord.js, or discord.py.
+
+## Triggers
+
+This skill is activated by the following keywords:
+
+- `discord`
+- `discord api`
+- `discord bot`
+- `discord webhook`
+- `discord.js`
+- `discord.py`
+
+## Details
+
+This skill focuses on practical Discord automation patterns:
+
+- Prefer **incoming webhooks** for one-way notifications.
+- Use **bot tokens + REST API** for richer automation.
+- Handle **rate limits** (HTTP 429) by waiting `retry_after` before retrying.
+
+See also: `references/REFERENCE.md`.
+
+## Footguns / gotchas
+
+- Webhook URLs contain a secret token; don’t log or share them.
+- Set `allowed_mentions` strictly (e.g. `{ "parse": [] }`) to avoid accidental pings.
+- Handle HTTP 429 using `retry_after` / `Retry-After` and avoid infinite retries.
+

package/skills/discord/SKILL.md

@@ -0,0 +1,109 @@
+---
+name: discord
+description: Build and automate Discord integrations (bots, webhooks, slash commands, and REST API workflows). Use when the user mentions Discord, a Discord server/guild, channels, webhooks, bot tokens, slash commands/application commands, discord.js, or discord.py.
+triggers:
+  - discord
+  - discord api
+  - discord bot
+  - discord webhook
+  - discord.js
+  - discord.py
+---
+
+# Discord
+
+Use this skill when implementing or automating Discord integrations.
+
+## Pick the right approach
+
+1. **Incoming webhooks (best for one-way posting)**
+   - Good for CI notifications, alerts, build status, etc.
+   - No bot user needed.
+   - See: https://discord.com/developers/docs/resources/webhook#execute-webhook
+
+2. **Bot token + REST API (two-way / richer automation)**
+   - Use when you need to post as a bot, manage channels, read history, moderate, etc.
+   - REST API base: `https://discord.com/api/v10`
+   - Most REST calls use `Authorization: Bot <token>`.
+
+3. **Interactions / slash commands (user-invoked commands)**
+   - Use application commands and interaction webhooks.
+   - Typically requires running a web server to receive interactions and respond quickly.
+
+## Secrets & safety
+
+- **Never hard-code tokens**. Use environment variables:
+  - `DISCORD_WEBHOOK_URL` for incoming webhooks
+  - `DISCORD_BOT_TOKEN` for bot REST API calls
+- Treat webhook URLs as secrets (they include a token).
+- Do **not** automate normal user accounts (“self-bots”). Use official bot/OAuth flows.
+
+## Footguns / safety notes (read this)
+
+- **Webhook URLs are secrets** (the token is embedded in the URL). Don’t paste them into issues, logs, CI output, or chat.
+- **Mentions are dangerous by default**: always set `allowed_mentions` to something strict (these examples use `{"parse": []}`) to avoid accidentally pinging `@everyone` / roles.
+- **Watch for accidental secret logging**:
+  - If you build your own scripts, avoid including full webhook URLs in exception messages.
+  - The bundled scripts sanitize webhook URLs in error output, but you should still avoid printing the URL yourself.
+- **Rate limits**: handle HTTP 429 with `retry_after`/`Retry-After`, and don’t retry forever.
+
+## Quick recipes
+
+### Post a message via an incoming webhook (recommended)
+
+Discord requires at least one of `content`, `embeds`, `components`, `file`, or `poll`.
+
+```bash
+curl -sS -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{"content":"Hello from OpenHands","allowed_mentions":{"parse":[]}}' \
+  "$DISCORD_WEBHOOK_URL"
+```
+
+### Post a message to a channel with a bot token
+
+Endpoint: `POST /channels/{channel_id}/messages` (Create Message)
+
+```bash
+CHANNEL_ID="..."
+
+curl -sS -X POST "https://discord.com/api/v10/channels/${CHANNEL_ID}/messages" \
+  -H "Authorization: Bot $DISCORD_BOT_TOKEN" \
+  -H 'Content-Type: application/json' \
+  -d '{"content":"Hello from my bot","allowed_mentions":{"parse":[]}}'
+```
+
+Docs: https://discord.com/developers/docs/resources/channel#create-message
+
+## Automation scripts (bundled)
+
+These scripts are self-contained and only use the Python standard library.
+
+- Post to a webhook:
+  ```bash
+  python3 -m skills.discord.scripts.post_webhook --content "Build finished" --wait
+  ```
+
+- Post to a channel using a bot token:
+  ```bash
+  python3 -m skills.discord.scripts.send_message --channel-id "$CHANNEL_ID" --content "Hello"
+  ```
+
+## Rate limits
+
+- Don’t hard-code limits. Use Discord’s `Retry-After` / `retry_after` and rate-limit headers when present.
+- On HTTP **429**, wait for the provided delay (clamp to a sane maximum, add small jitter), then retry.
+
+Docs: https://discord.com/developers/docs/topics/rate-limits
+
+## Slash commands / application commands
+
+- Use **guild commands** for fast iteration (instant updates).
+- Use **global commands** when ready; propagation can take longer.
+
+Docs: https://discord.com/developers/docs/interactions/application-commands
+
+## Reference
+
+For more details (OAuth2 flows, command registration endpoints, troubleshooting), see:
+- [references/REFERENCE.md](references/REFERENCE.md)

package/skills/discord/references/REFERENCE.md

@@ -0,0 +1,78 @@
+# Discord reference
+
+## Official docs
+
+- Discord Developer Docs (home): https://discord.com/developers/docs/intro
+- REST API versioning: `https://discord.com/api/v10` (use v10 endpoints)
+- Create Message (REST): https://discord.com/developers/docs/resources/channel#create-message
+- Webhooks: https://discord.com/developers/docs/resources/webhook
+- OAuth2: https://discord.com/developers/docs/topics/oauth2
+- Application Commands (slash commands): https://discord.com/developers/docs/interactions/application-commands
+- Rate limits: https://discord.com/developers/docs/topics/rate-limits
+
+## Footguns / gotchas
+
+- Incoming webhook URLs contain a secret token; treat the entire URL like a password.
+- If you include request URLs in error logs, sanitize `/webhooks/{id}/{token}` (the token is secret).
+- Use `allowed_mentions` to prevent accidental mass pings.
+- Respect rate limits. Don’t spin in tight retry loops on 429.
+
+## Common workflows
+
+### 1) Simple notifications (incoming webhook)
+
+1. Create an incoming webhook in the Discord client (channel settings → Integrations → Webhooks).
+2. Store it in `DISCORD_WEBHOOK_URL`.
+3. POST JSON like `{ "content": "..." }`.
+
+Key points from Discord docs:
+- Execute webhook: `POST /webhooks/{webhook.id}/{webhook.token}`.
+- Must include at least one of `content`, `embeds`, `components`, `file`, or `poll`.
+- Content limit is 2000 characters.
+- Use `allowed_mentions` to prevent accidental pings.
+
+### 2) Bot token + REST API
+
+1. Create an app + bot user in the Discord Developer Portal.
+2. Invite the bot to a guild using an OAuth2 URL with the `bot` scope.
+3. Use `Authorization: Bot $DISCORD_BOT_TOKEN` for REST calls.
+
+For posting messages:
+- `POST /channels/{channel_id}/messages`
+
+Helpful debugging hints:
+- 401: invalid token / wrong auth header format
+- 403: missing permissions in channel (e.g., Send Messages)
+- 404: wrong ID or bot doesn’t have access to channel
+
+### 3) Slash commands / interactions
+
+- Command registration is done via HTTP endpoints.
+- Use guild commands during development for instant updates.
+- If you implement the HTTP interactions endpoint yourself, you must verify request signatures.
+
+### 4) OAuth2 notes
+
+Discord strongly recommends using the `state` parameter to prevent CSRF.
+
+OAuth2 endpoints require `application/x-www-form-urlencoded` content type; JSON is not permitted.
+
+### 5) Rate limits
+
+Don’t hard-code limits; parse headers like:
+
+- `X-RateLimit-Limit`
+- `X-RateLimit-Remaining`
+- `X-RateLimit-Reset-After`
+- `X-RateLimit-Bucket`
+
+On HTTP 429:
+- Read `Retry-After` / JSON `retry_after`, wait, then retry.
+
+## Suggested environment variables
+
+- `DISCORD_WEBHOOK_URL`
+- `DISCORD_BOT_TOKEN`
+- `DISCORD_CHANNEL_ID` (optional convenience)
+- `DISCORD_GUILD_ID` (optional, for command registration)
+- `DISCORD_APPLICATION_ID` (optional, for command registration)