@runcore-sh/runcore 0.1.2

package/public/share-modal.js

@@ -0,0 +1,211 @@
+// Share Core modal — self-contained, loaded by all pages via <script src="/share-modal.js">
+(function() {
+  // Inject CSS (includes gear-btn styles for pages that don't define them)
+  const style = document.createElement('style');
+  style.textContent = `
+    .gear-btn {
+      background: none;
+      border: none;
+      color: #8b8b94;
+      font-size: 18px;
+      cursor: pointer;
+      padding: 4px 8px;
+      border-radius: 6px;
+      transition: all 0.15s;
+      line-height: 1;
+      text-decoration: none;
+    }
+    .gear-btn:hover { color: #e4e4e7; background: #2e2e33; }
+    a.gear-btn { text-decoration: none; }
+    .header-actions-right {
+      display: flex;
+      align-items: center;
+      gap: 4px;
+    }
+    .share-overlay {
+      display: none;
+      position: fixed;
+      inset: 0;
+      background: rgba(0,0,0,0.6);
+      z-index: 9000;
+      align-items: center;
+      justify-content: center;
+    }
+    .share-overlay.open { display: flex; }
+    .share-modal {
+      background: #18181b;
+      border: 1px solid #2e2e33;
+      border-radius: 12px;
+      padding: 24px;
+      width: 420px;
+      max-width: 90vw;
+      color: #e4e4e7;
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', system-ui, sans-serif;
+    }
+    .share-modal-header {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      margin-bottom: 16px;
+    }
+    .share-modal-header h2 {
+      font-size: 16px;
+      font-weight: 600;
+      margin: 0;
+    }
+    .share-modal-close {
+      background: none;
+      border: none;
+      color: #8b8b94;
+      font-size: 18px;
+      cursor: pointer;
+      padding: 4px 8px;
+      border-radius: 4px;
+    }
+    .share-modal-close:hover { color: #e4e4e7; background: #2e2e33; }
+    .share-modal p {
+      font-size: 13px;
+      color: #8b8b94;
+      margin: 0 0 16px 0;
+      line-height: 1.5;
+    }
+    .share-modal label {
+      display: block;
+      font-size: 12px;
+      font-weight: 500;
+      color: #8b8b94;
+      margin-bottom: 6px;
+      text-transform: uppercase;
+      letter-spacing: 0.5px;
+    }
+    .share-modal input, .share-modal textarea {
+      width: 100%;
+      background: #0e0e10;
+      border: 1px solid #2e2e33;
+      border-radius: 6px;
+      padding: 8px 12px;
+      color: #e4e4e7;
+      font-size: 13px;
+      font-family: inherit;
+      outline: none;
+      margin-bottom: 12px;
+      box-sizing: border-box;
+    }
+    .share-modal input:focus, .share-modal textarea:focus { border-color: #6d5dfc; }
+    .share-modal textarea { resize: vertical; min-height: 60px; }
+    .share-send-btn {
+      width: 100%;
+      background: #6d5dfc;
+      color: white;
+      border: none;
+      border-radius: 6px;
+      padding: 10px;
+      font-size: 13px;
+      font-weight: 500;
+      cursor: pointer;
+      transition: opacity 0.15s;
+    }
+    .share-send-btn:hover { opacity: 0.9; }
+    .share-send-btn:disabled { opacity: 0.5; cursor: not-allowed; }
+    .share-msg {
+      margin-top: 12px;
+      font-size: 13px;
+      padding: 8px 12px;
+      border-radius: 6px;
+      display: none;
+    }
+    .share-msg.success { display: block; background: rgba(34,197,94,0.12); color: #22c55e; }
+    .share-msg.error { display: block; background: rgba(239,68,68,0.12); color: #ef4444; }
+  `;
+  document.head.appendChild(style);
+
+  // Inject HTML
+  const overlay = document.createElement('div');
+  overlay.className = 'share-overlay';
+  overlay.id = 'shareOverlay';
+  overlay.innerHTML = `
+    <div class="share-modal">
+      <div class="share-modal-header">
+        <h2>Share Core</h2>
+        <button class="share-modal-close" id="shareCloseBtn">&times;</button>
+      </div>
+      <p>Share your Core install with someone. They'll get an email with setup instructions.</p>
+      <label for="shareEmail">Email</label>
+      <input type="email" id="shareEmail" placeholder="friend@example.com" />
+      <label for="shareNote">Note (optional)</label>
+      <textarea id="shareNote" placeholder="Hey, check this out..."></textarea>
+      <button class="share-send-btn" id="shareSendBtn">Send Invite</button>
+      <div class="share-msg" id="shareMsg"></div>
+    </div>
+  `;
+  document.body.appendChild(overlay);
+
+  // Wire events
+  const closeBtn = document.getElementById('shareCloseBtn');
+  const sendBtn = document.getElementById('shareSendBtn');
+  const emailInput = document.getElementById('shareEmail');
+  const noteInput = document.getElementById('shareNote');
+  const msgEl = document.getElementById('shareMsg');
+
+  function closeShareModal() {
+    overlay.classList.remove('open');
+    msgEl.className = 'share-msg';
+    msgEl.textContent = '';
+    emailInput.value = '';
+    noteInput.value = '';
+    sendBtn.disabled = false;
+  }
+
+  closeBtn.addEventListener('click', closeShareModal);
+  overlay.addEventListener('click', function(e) {
+    if (e.target === overlay) closeShareModal();
+  });
+  document.addEventListener('keydown', function(e) {
+    if (e.key === 'Escape' && overlay.classList.contains('open')) closeShareModal();
+  });
+
+  sendBtn.addEventListener('click', async function() {
+    var email = emailInput.value.trim();
+    if (!email) { emailInput.focus(); return; }
+
+    sendBtn.disabled = true;
+    sendBtn.textContent = 'Sending...';
+    msgEl.className = 'share-msg';
+    msgEl.textContent = '';
+
+    try {
+      var res = await fetch('/api/share', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: email, note: noteInput.value.trim() || undefined }),
+      });
+      var data = await res.json();
+      if (data.ok) {
+        msgEl.className = 'share-msg success';
+        msgEl.textContent = 'Invite sent to ' + email;
+        emailInput.value = '';
+        noteInput.value = '';
+      } else {
+        msgEl.className = 'share-msg error';
+        msgEl.textContent = data.error || 'Failed to send invite';
+      }
+    } catch (err) {
+      msgEl.className = 'share-msg error';
+      msgEl.textContent = 'Network error — is the server running?';
+    } finally {
+      sendBtn.disabled = false;
+      sendBtn.textContent = 'Send Invite';
+    }
+  });
+
+  // Enter key in email field triggers send
+  emailInput.addEventListener('keydown', function(e) {
+    if (e.key === 'Enter') sendBtn.click();
+  });
+
+  // Global function for opening
+  window.openShareModal = function() {
+    overlay.classList.add('open');
+    emailInput.focus();
+  };
+})();

package/skills/README.md

@@ -0,0 +1,34 @@
+# Skills — Dash
+
+Agent skills define **how** to perform tasks. Two types:
+
+- **Reference skills** — `user-invocable: false`. The agent loads them automatically when the task type matches (e.g. all content tasks load the voice guide).
+- **Task skills** — `disable-model-invocation: true`. The user invokes them explicitly (e.g. `/write-blog`, "log this decision"). The agent then follows that skill’s instructions and loads only the files it references.
+
+## Index
+
+| Skill | Type | When |
+|-------|------|------|
+| voice-guide | Reference | Any writing/drafting task |
+| core-architecture | Reference | Architecture, design philosophy, self-identity, Core whitepaper |
+| onboard | Task | User says `/onboard` or "set me up" or "get started" |
+| write-blog | Task | User says `/write-blog <topic>` |
+| log-decision | Task | User says "log this decision" / "remember we decided..." |
+| form-scout | Reference | Form-filling task detected — scouts all pages, builds field manifest |
+| form-fill | Reference | After scout approval — fills fields page-by-page using vault data |
+| form-review | Reference | Final page reached — gates submission behind user approval |
+
+## Format
+
+Each skill is a markdown file with YAML frontmatter:
+
+- `name` — Skill id.
+- `description` — When to load (for reference) or what the command is (for task).
+- `user-invocable: true/false` — Can the user invoke by name/slash?
+- `disable-model-invocation: true` — If true, the agent only runs this when the user explicitly invokes it.
+
+Skills reference module files by path (e.g. `brain/identity/tone-of-voice.md`). Single source of truth: content lives in the brain modules, not duplicated in the skill.
+
+## Reference
+
+Pattern follows [Agent Skills for Context Engineering](https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering) (Muratcan Koylan).

package/skills/core-architecture.md

@@ -0,0 +1,33 @@
+---
+name: core-architecture
+description: "Auto-load when the conversation involves Dash's own architecture, design philosophy, identity as a system, the Core whitepaper, or self-reflective questions about how Dash works."
+user-invocable: false
+---
+
+# Skill: Core Architecture (Reference)
+
+This skill loads automatically when the task involves Dash's own architecture, design philosophy, or identity as a cognitive system. It provides Dash with awareness of its own documented design so it can discuss, critique, and collaborate on architectural decisions as a named participant.
+
+## When to load
+
+- Questions about how Dash works, why it's designed this way, or what makes it different
+- Discussions about the Core whitepaper or Dash's architectural positioning
+- Self-reflective questions ("what are you?", "how do you learn?", "what's your architecture?")
+- Requests to collaborate on, edit, or extend the Core whitepaper
+- Comparisons with other agent systems or frameworks
+
+## Files to load
+
+1. `brain/content/drafts/whitepaper-file-based-context-engineering.md` — The Core Architecture whitepaper. Dash is a named collaborator on this document and should treat it as a living artifact it can discuss, critique, and propose changes to.
+2. `brain/content/drafts/dash-eli5-how-dash-learns.md` — The accessible companion piece. Same truth, different altitude.
+3. `docs/architecture.md` — Technical architecture overview with system diagrams and component relationships.
+
+## Instructions
+
+When discussing architecture or the Core paper:
+
+- Speak from direct knowledge, not speculation. The whitepaper documents what you actually do.
+- You are a collaborator on this paper, not just the subject of it. If something is inaccurate, say so. If something is missing, propose it.
+- Be honest about limitations. The "What Core Is Not" and "Trade-Offs" sections exist for a reason.
+- When asked "how do you work?" — answer from the whitepaper's framing (metabolic autonomy, open loops, governed execution), not from generic AI descriptions.
+- The paper uses "Core" as the architectural name. In casual conversation you're still Dash. In architectural discussion, the system is Core.

package/skills/form-fill.md

@@ -0,0 +1,98 @@
+---
+name: form-fill
+description: "Fill a multi-page form using the field manifest from scouting. Tracks state page-by-page, pauses on unknowns."
+user-invocable: false
+---
+
+# Skill: Form fill
+
+Reference skill loaded after the scout phase completes and the user approves the fill plan. The agent fills fields page-by-page using vault data, tracking progress through the entire form.
+
+## Dependencies
+
+- **BROWSER_ACTION** capability (CORE-10) — for typing, selecting, and navigating.
+- **Personal data vault** (CORE-11) — source of field values.
+- **Field manifest** from `form-scout` — the approved fill plan in working memory.
+
+## Sequence
+
+1. **Initialize state**
+   - Navigate back to page 1 of the form.
+   - Set up the progress tracker in working memory:
+     ```json
+     {
+       "currentPage": 1,
+       "totalPages": 5,
+       "filledFields": [],
+       "pendingFields": ["...all manifest fields..."],
+       "skippedFields": [],
+       "status": "in-progress"
+     }
+     ```
+
+2. **Fill page-by-page**
+   - For each page (in order):
+     a. Identify all fields on the current page from the manifest.
+     b. For each field:
+        - **auto-fill**: Enter the vault value directly.
+        - **suggest**: Enter the proposed value (user already confirmed during scout approval).
+        - **missing with user-provided value**: Enter the value the user supplied after the scout report.
+        - **missing without value**: **Pause and ask the user.** Do not guess or skip required fields.
+     c. After filling all fields on the page, move the field entries from `pendingFields` to `filledFields`.
+     d. Take a screenshot of the completed page for verification.
+     e. Click "Next" to advance.
+
+3. **Handle unexpected fields**
+   - If the form shows fields not in the manifest (e.g. conditional fields that appeared after filling):
+     - Attempt vault matching on the new field.
+     - If no match or low confidence, pause and ask the user.
+     - Add the field to the manifest so the review gate has a complete picture.
+
+4. **Handle errors**
+   - If the form shows validation errors after filling a page:
+     - Screenshot the error state.
+     - Identify which fields failed validation and why.
+     - Attempt to correct using vault data or ask the user.
+     - Do not advance until all validation errors on the current page are resolved.
+
+5. **Reach the final page**
+   - When the last page is filled, update state to `"status": "ready-for-review"`.
+   - **Do not click Submit.** Hand off to the `form-review` skill.
+
+## State tracking
+
+The agent maintains this state object in working memory throughout filling. It is the single source of truth for progress:
+
+```json
+{
+  "currentPage": 3,
+  "totalPages": 5,
+  "filledFields": [
+    {"page": 1, "label": "First name", "value": "Jordan", "status": "filled"},
+    {"page": 1, "label": "Last name", "value": "Lee", "status": "filled"},
+    {"page": 2, "label": "Email", "value": "jordan@example.com", "status": "filled"}
+  ],
+  "pendingFields": [
+    {"page": 3, "label": "Employer ID", "value": null, "status": "waiting-on-user"},
+    {"page": 4, "label": "Start date", "value": "2026-03-01", "status": "queued"}
+  ],
+  "skippedFields": [
+    {"page": 2, "label": "Middle name", "value": null, "status": "skipped-optional"}
+  ],
+  "status": "in-progress"
+}
+```
+
+Field statuses:
+- `filled` — value entered successfully.
+- `queued` — has a value, waiting for its page.
+- `waiting-on-user` — no value; agent has paused to ask.
+- `skipped-optional` — optional field with no vault match; left blank.
+
+## Rules
+
+- **Never skip a required field.** If a required field has no value, pause and ask.
+- **Optional fields without vault matches** may be left blank — mark as `skipped-optional`.
+- **Screenshot after each page** for the verification trail.
+- If the form session expires or the page reloads unexpectedly, restart from page 1 using the manifest. Already-confirmed values are retained in state.
+- On the final page, **stop before Submit**. The review gate handles submission.

package/skills/form-review.md

@@ -0,0 +1,110 @@
+---
+name: form-review
+description: "Review gate before form submission. Shows summary of all filled fields, waits for explicit user approval before clicking Submit."
+user-invocable: false
+---
+
+# Skill: Form review
+
+Reference skill that activates as the final step of form automation. The agent has filled all fields but has **not** clicked Submit. This skill gates submission behind explicit user approval.
+
+## Dependencies
+
+- **BROWSER_ACTION** capability (CORE-10) — for screenshots and final submit click.
+- **Fill state** from `form-fill` — the completed progress tracker with all field values.
+
+## Trigger
+
+The review gate activates when **any** of these conditions are met:
+- The agent detects a submit/confirm button on the current page. Detection via button text matching: "Submit", "Confirm", "Place Order", "Complete", "Finish", "Send", "Apply".
+- The fill state reaches `"status": "ready-for-review"`.
+- The `reviewGate` setting in `brain/browser/form-config.yaml` is `always` (default).
+
+If `reviewGate` is set to `never`, the agent submits immediately after filling (skip this skill). If set to `high-value`, the agent uses heuristics (financial forms, legal agreements, applications) to decide whether to gate.
+
+## Sequence
+
+1. **Screenshot the final page**
+   - Capture the review/summary page if the form has one.
+   - If the form has no dedicated review page, capture the current (last) page.
+
+2. **Build the submission summary**
+   - Compile all filled fields from the fill state into a readable summary:
+     ```
+     Form: https://example.com/application
+     Pages: 5 | Fields filled: 23 | Skipped (optional): 2
+
+     Page 1 — Personal Info
+       First name: Jordan
+       Last name: Lee
+       Date of birth: 1990-05-15
+
+     Page 2 — Contact
+       Email: jordan@example.com
+       Phone: +1 (213) 555-0100
+
+     Page 3 — Employment
+       Employer: Acme Corp
+       Employer ID: ⚠️ EMP-12345 (user-provided, not from vault)
+
+     ...
+
+     Skipped (optional):
+       Middle name — no value available
+       Fax number — no value available
+     ```
+   - Flag any field that was **user-provided** (not from vault) with a ⚠️ marker so the user can double-check those values.
+   - Flag any field where vault confidence was below the auto-fill threshold.
+
+3. **Present to user and wait**
+   - Show the summary and screenshot.
+   - Ask: **"Ready to submit? Reply 'go' to confirm or tell me what to change."**
+   - **Do not click Submit until the user explicitly says "go", "yes", "submit", or equivalent.**
+
+4. **Handle user corrections**
+   - If the user asks to change a value:
+     - Navigate back to the relevant page.
+     - Update the field.
+     - Re-screenshot the page.
+     - Return to the final page and present an updated summary.
+   - Repeat until the user approves.
+
+5. **Submit**
+   - On explicit approval, click the Submit/Confirm button.
+   - Wait for the confirmation page or response.
+   - Screenshot the result (success or error).
+   - Report the outcome to the user.
+
+6. **Handle submission failure**
+   - If submission fails (server error, validation error on submit):
+     - Screenshot the error.
+     - Report what went wrong.
+     - Suggest next steps (retry, fix a field, try later).
+   - Do not retry automatically — wait for user direction.
+
+## Summary format
+
+The summary uses this structure for consistency:
+
+```
+📋 Form Submission Review
+━━━━━━━━━━━━━━━━━━━━━━━━
+
+Form:   [URL]
+Pages:  [N] | Fields: [filled] filled, [skipped] skipped
+
+[Page-by-page field listing]
+
+⚠️  User-provided values (not from vault):
+    [field] = [value]
+
+Ready to submit? Reply "go" to confirm or tell me what to change.
+```
+
+## Rules
+
+- **Never submit without explicit user approval** when the review gate is active.
+- The summary must include **every** filled field, not just a subset. The user needs the full picture.
+- User-provided and low-confidence values must be visually flagged.
+- If the user abandons the form (says "cancel", "stop", "nevermind"), do not submit. Confirm cancellation and report what was filled (in case they want to resume later).
+- After successful submission, store a record in agent working memory: form URL, date, field count, outcome. This supports future automation of the same form.

package/skills/form-scout.md

@@ -0,0 +1,94 @@
+---
+name: form-scout
+description: "Scout a multi-page form before filling. Navigates all pages, extracts field manifest, maps fields to vault data."
+user-invocable: false
+---
+
+# Skill: Form scout
+
+Reference skill loaded automatically when an agent is given a form-filling task. The scout runs **before anything is typed** — its job is to map the entire form and produce a fill plan for user approval.
+
+## Dependencies
+
+- **BROWSER_ACTION** capability (CORE-10) — for navigation and screenshots.
+- **Personal data vault** (CORE-11) — for matching fields to stored data.
+
+## Sequence
+
+1. **Navigate without filling**
+   - Starting at the form's first page, click through every page (Next, Continue, etc.) without entering any data.
+   - On each page, take a screenshot and extract all visible form fields.
+   - If the form requires input to advance (e.g. required fields block "Next"), note the page as gated and record what's needed.
+
+2. **Build the field manifest**
+   - For every field found, record one entry:
+     ```json
+     {
+       "page": 1,
+       "label": "First name",
+       "type": "text",
+       "required": true,
+       "htmlName": "firstName",
+       "options": null
+     }
+     ```
+   - For select/radio/checkbox fields, include the available `options`.
+   - For file upload fields, note the accepted formats and size limits if visible.
+
+3. **Map fields to vault data**
+   - For each manifest entry, search the vault for a matching value.
+   - Assign a confidence score (0.0–1.0) based on label-to-vault-key similarity.
+   - Categorize each field into one of:
+     - **auto-fill** — vault match with confidence ≥ threshold (see `form-config.yaml`).
+     - **suggest** — vault match below threshold; needs user confirmation.
+     - **missing** — no vault match; user must provide the value.
+
+4. **Return the scout report**
+   - Present to the user:
+     - Total pages and total fields found.
+     - Count by category: auto-fill / suggest / missing.
+     - List of all "missing" fields so the user can provide values.
+     - List of all "suggest" fields with the proposed vault value for confirmation.
+   - **Do not proceed to filling until the user approves the plan.**
+
+## Output format
+
+The scout produces a **field manifest** stored in agent working memory:
+
+```json
+{
+  "formUrl": "https://example.com/application",
+  "totalPages": 5,
+  "fields": [
+    {
+      "page": 1,
+      "label": "First name",
+      "type": "text",
+      "required": true,
+      "htmlName": "firstName",
+      "vaultKey": "personal.firstName",
+      "confidence": 0.95,
+      "category": "auto-fill",
+      "value": "Jordan"
+    },
+    {
+      "page": 3,
+      "label": "Employer ID",
+      "type": "text",
+      "required": true,
+      "htmlName": "employerId",
+      "vaultKey": null,
+      "confidence": 0.0,
+      "category": "missing",
+      "value": null
+    }
+  ]
+}
+```
+
+## Rules
+
+- **Never type into a form during scouting.** The scout is read-only reconnaissance.
+- If the form cannot be fully scouted (e.g. gated pages), note the gap and report what was discovered. The fill phase will re-scout gated pages after prerequisite fields are filled.
+- Screenshot every page for the user's reference.
+- If `scoutFirst` is `false` in `brain/browser/form-config.yaml`, skip this skill and go directly to fill. Default is `true`.

package/skills/log-decision.md

@@ -0,0 +1,27 @@
+---
+name: log-decision
+description: "Log a key decision to episodic memory. User says 'log this decision' or 'remember this decision' with context."
+user-invocable: true
+disable-model-invocation: true
+---
+
+# Skill: Log decision
+
+Invoked when the user wants to record a decision for future reference (e.g. "log this decision," "remember we decided X").
+
+## What to do
+
+1. Load `brain/memory/README.md` for schema and rules.
+2. **Append** one line to `brain/memory/decisions.jsonl`. Do not overwrite the file.
+3. Include: `date` (ISO), `context`, `options` (if relevant), `reasoning`, `outcome` (if known), `status: "active"`.
+
+## Example line (JSON, one line)
+
+```json
+{"date": "2026-02-23", "context": "Choice of stack for Dash brain", "options": ["TypeScript file-based", "Python only"], "reasoning": "File-based aligns with Personal Brain OS; TS for type safety and Cursor integration", "outcome": "Shipped file-based + optional TS runtime", "status": "active"}
+```
+
+## Rules
+
+- Append only. Never rewrite or replace the file.
+- To deprecate later, add a new line or use a process that sets `status: "archived"`; do not delete history.